fix(auth)!: decode omitted OAuthClient fields and drop the unused scope

[spydon]

Aligns OAuthClient and the OAuth client options with what Auth actually returns and accepts.

• OAuthClient.tokenEndpointAuthenticationMethod and OAuthClient.registrationType are nullable. Auth marks token_endpoint_auth_method and registration_type as omitempty in OAuthServerClientResponse, but they were decoded as required, so a response without them would throw.
• OAuthClient.scope is removed. OAuthServerClientResponse has no scope field, so it was always null.
• CreateOAuthClientOptions.scope and UpdateOAuthClientOptions.scope are removed. Neither OAuthServerClientRegisterParams nor OAuthServerClientUpdateParams reads a scope key, so Auth ignored it. Scopes are requested per authorization through the scope query parameter on /oauth/authorize.

The OAuth integration tests passed scope: 'email' when creating clients and asserted that the authorization details echoed it back. That only held because the server's default scope is email. The test fixture now sends scope=email on the authorize request instead.

MIGRATION.md has a section for each break.

Linear: SDK-2160

Summary by CodeRabbit

• Documentation
  • Clarified that OAuth client authentication method and registration type may be absent.
  • Documented that scopes are set on authorization requests and returned with authorization details.
• Bug Fixes
  • OAuth client details now handle missing authentication method and registration type values.
• API Changes
  • Removed scope from OAuth client models and client creation and update options.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: supabase/supabase-flutter/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: f0d630cf-5d9c-48ef-9a70-1fdd7e5dfe9d

📥 Commits

Reviewing files that changed from the base of the PR and between 7d22a98 and 2578412.

📒 Files selected for processing: 6

• MIGRATION.md
• packages/supabase_auth/lib/src/types/types.dart
• packages/supabase_auth/test/src/auth_admin_oauth_api_test.dart
• packages/supabase_auth/test/src/auth_oauth_api_test.dart
• packages/supabase_auth/test/src/types/oauth_client_test.dart
• sdk-compliance.yaml

💤 Files with no reviewable changes: 2

• packages/supabase_auth/test/src/auth_admin_oauth_api_test.dart
• sdk-compliance.yaml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 2 remain after this review.

📝 Walkthrough

OAuth client models now treat authentication metadata as nullable and no longer include client-level scope. Tests, SDK compliance entries, and the migration guide reflect these changes. OAuth API tests place requested scope on the authorization request.

Changes: OAuth client contract

Layer / File(s)	Summary
Update OAuth client models packages/supabase_auth/lib/src/types/types.dart, packages/supabase_auth/test/src/types/oauth_client_test.dart, packages/supabase_auth/test/src/auth_admin_oauth_api_test.dart, sdk-compliance.yaml	OAuthClient.tokenEndpointAuthenticationMethod and registrationType are nullable. scope is removed from OAuth client models and create/update options, including JSON serialization. Tests and SDK compliance entries reflect the updated contract.
Place scope on authorization requests packages/supabase_auth/test/src/auth_oauth_api_test.dart, MIGRATION.md	OAuth API tests provide scope on the authorization request and check the returned authorization scope. The migration guide documents the nullable fields, scope removal, and authorization-scope locations.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Suggested reviewers: cmelchior, androidpoet

Merge Risk: ⚪ Minimal · up to 25784

OAuth client metadata can be omitted, and requested scopes are supplied on authorization requests. The breaking model changes are documented, and no material merge risk is apparent.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes both main changes: decoding omitted OAuthClient fields and removing the unused scope.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}