test(mcp): assert public clients get no client secret (open-metadata#28568) (open-metadata#28758)

Author: Vishnuujain

openmetadata-mcp/src/test/java/org/openmetadata/mcp/server/auth/handlers/RegistrationHandlerTest.java

@@ -91,6 +91,7 @@ void testValidRegistration_defaultsAuthMethod() {
     OAuthClientInformation result = handler.handle(metadata).join();
 
     assertThat(result.getTokenEndpointAuthMethod()).isEqualTo("client_secret_post");
+    assertThat(result.getClientSecret()).isNotNull().isNotEmpty();
   }
 
   @Test
@@ -256,6 +257,46 @@ void testNoneAuthMethod_accepted() {
     verify(clientRepository).register(any());
   }
 
+  /**
+   * Regression for PR #28552: a public client (token_endpoint_auth_method=none) MUST NOT be issued a
+   * client secret. Before the fix the secret was generated unconditionally, so the token endpoint
+   * then demanded a secret the public PKCE client (Cursor, ChatGPT) never had, failing with
+   * "Client secret required" (401). Public clients are secured by PKCE, not a secret.
+   */
+  @Test
+  void testPublicClient_none_issuesNoSecret() {
+    OAuthClientMetadata metadata = validMetadata();
+    metadata.setTokenEndpointAuthMethod("none");
+
+    OAuthClientInformation result = handler.handle(metadata).join();
+
+    assertThat(result.getClientSecret()).isNull();
+    assertThat(result.getClientSecretExpiresAt()).isNull();
+    verify(clientRepository).register(any());
+  }
+
+  @Test
+  void testConfidentialClient_clientSecretPost_issuesSecret() {
+    OAuthClientMetadata metadata = validMetadata();
+    metadata.setTokenEndpointAuthMethod("client_secret_post");
+
+    OAuthClientInformation result = handler.handle(metadata).join();
+
+    assertThat(result.getClientSecret()).isNotNull().isNotEmpty();
+    assertThat(result.getClientSecretExpiresAt()).isEqualTo(0L);
+  }
+
+  @Test
+  void testConfidentialClient_clientSecretBasic_issuesSecret() {
+    OAuthClientMetadata metadata = validMetadata();
+    metadata.setTokenEndpointAuthMethod("client_secret_basic");
+
+    OAuthClientInformation result = handler.handle(metadata).join();
+
+    assertThat(result.getClientSecret()).isNotNull().isNotEmpty();
+    assertThat(result.getClientSecretExpiresAt()).isEqualTo(0L);
+  }
+
   @Test
   void testUnsupportedAuthMethod_throwsRegistrationException() {
     OAuthClientMetadata metadata = validMetadata();