fix(auth): require and seed client secrets for confidential OpenIddict clients

Author: Diogo-Ferraz

src/TaskManagement.Auth/Features/Authorization/Services/OpenIddictClientSeeder.cs

@@ -29,10 +29,12 @@ public async Task StartAsync(CancellationToken cancellationToken)
             foreach (var clientSettings in _clientSettings.Clients)
             {
                 var resolvedClientType = ResolveClientType(clientSettings);
+                var resolvedClientSecret = ResolveClientSecret(clientSettings, resolvedClientType);
                 var applicationDescriptor = new OpenIddictApplicationDescriptor
                 {
                     ClientId = clientSettings.ClientId,
                     ClientType = resolvedClientType,
+                    ClientSecret = resolvedClientSecret,
                     ConsentType = ConsentTypes.Explicit,
                     DisplayName = clientSettings.DisplayName,
                     Permissions =
@@ -103,5 +105,21 @@ private static string ResolveClientType(ClientSettingsOptions clientSettings)
                     $"Unsupported OpenIddict client type '{clientSettings.ClientType}' for client '{clientSettings.ClientId}'.")
             };
         }
+
+        private static string? ResolveClientSecret(ClientSettingsOptions clientSettings, string resolvedClientType)
+        {
+            if (resolvedClientType == ClientTypes.Public)
+            {
+                return null;
+            }
+
+            if (!string.IsNullOrWhiteSpace(clientSettings.ClientSecret))
+            {
+                return clientSettings.ClientSecret;
+            }
+
+            throw new InvalidOperationException(
+                $"Client '{clientSettings.ClientId}' is configured as confidential but has no client secret.");
+        }
     }
 }

src/TaskManagement.Auth/Infrastructure/Common/Settings/ClientSettings.cs

@@ -9,6 +9,7 @@ public class ClientSettingsOptions
     {
         public string ClientId { get; set; } = string.Empty;
         public string ClientType { get; set; } = string.Empty;
+        public string ClientSecret { get; set; } = string.Empty;
         public string DisplayName { get; set; } = string.Empty;
         public List<string> RedirectUris { get; set; } = [];
         public List<string> PostLogoutRedirectUris { get; set; } = [];