feat(gotrue): add OAuth 2.1 client admin endpoints

[grdsdev]

Summary

This PR adds OAuth 2.1 client administration endpoints to the gotrue package, porting the feature from supabase-js#1582 and supabase-py#1240.

The new admin.oauth namespace provides comprehensive OAuth client management capabilities for server-side use with service role keys.

Changes

New API Methods

• admin.oauth.listClients() - List all OAuth clients with optional pagination
• admin.oauth.createClient() - Register a new OAuth client
• admin.oauth.getClient() - Get client details by ID
• admin.oauth.deleteClient() - Remove an OAuth client
• admin.oauth.regenerateClientSecret() - Regenerate client secret

New Types

• OAuthClientGrantType - Grant types enum (authorization_code, refresh_token)
• OAuthClientResponseType - Response types enum (code)
• OAuthClientType - Client type enum (public, confidential)
• OAuthClientRegistrationType - Registration type enum (dynamic, manual)
• OAuthClient - OAuth client model
• CreateOAuthClientParams - Parameters for creating OAuth clients
• OAuthClientResponse - Response wrapper for single client operations
• OAuthClientListResponse - Response wrapper for list operations

Implementation Details

• Added GoTrueAdminOAuthApi class following the pattern of GoTrueAdminMFAApi
• All methods require service_role key and should only be called server-side
• Proper UUID validation for client IDs
• Handles optional fields (aud in list response)
• Handles empty response bodies (204 No Content for delete operations)
• Comprehensive test coverage matching Python implementation

Test Infrastructure Updates

• Updated GoTrue test image from v2.175.0 to v2.180.0
• Enabled OAuth 2.1 server in test environment:
  • GOTRUE_OAUTH_SERVER_ENABLED: 'true'
  • GOTRUE_OAUTH_SERVER_ALLOW_DYNAMIC_REGISTRATION: 'true'

Usage Example

// Create a new OAuth client
final params = CreateOAuthClientParams(
  clientName: 'My Application',
  redirectUris: ['https://myapp.com/callback'],
  clientUri: 'https://myapp.com',
  scope: 'openid profile email',
);

final response = await supabase.auth.admin.oauth.createClient(params);
final clientId = response.client?.clientId;
final clientSecret = response.client?.clientSecret;

// List all OAuth clients
final clients = await supabase.auth.admin.oauth.listClients();

// Get client by ID
final client = await supabase.auth.admin.oauth.getClient(clientId);

// Regenerate client secret
final updated = await supabase.auth.admin.oauth.regenerateClientSecret(clientId);

// Delete client
await supabase.auth.admin.oauth.deleteClient(clientId);

Notes

• Only relevant when the OAuth 2.1 server is enabled in Supabase Auth
• All methods must be called with service_role key
• Never expose service_role key in client-side code

Test Plan

• Added comprehensive unit tests for all OAuth admin methods
• Tests cover create, list, get, delete, and regenerate operations
• Input validation tests for UUID parameters
• All 8 tests passing with OAuth 2.1 enabled GoTrue instance
• Test behavior matches Python implementation from supabase-py#1240
• Code passes dart analyze with no issues
• Code formatted with dart format

Related

• Ported from: feat(auth): add OAuth 2.1 client admin endpoints supabase-js#1582
• Python implementation: feat(auth): add OAuth 2.1 client admin endpoints supabase-py#1240
• Tests match Python PR behavior with all edge cases covered

🤖 Generated with Claude Code

[coveralls]

Pull Request Test Coverage Report for Build 18289613337

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

• For more information on this, see Tracking coverage changes with pull request builds.
• To avoid this issue with future PRs, see these Recommended CI Configurations.
• For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

• 91 of 95 (95.79%) changed or added relevant lines in 4 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage increased (+0.4%) to 80.885%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
packages/gotrue/lib/src/gotrue_admin_oauth_api.dart	47	49	95.92%
packages/gotrue/lib/src/types/types.dart	36	38	94.74%

Totals
Change from base Build 18159276591:	0.4%
Covered Lines:	3237
Relevant Lines:	4002

---

💛 - Coveralls