fix(auth): harden OpenIddict client seeding with explicit client type and self-heal for invalid existing clients

Author: Diogo-Ferraz

src/TaskManagement.Auth/Features/Authorization/Services/OpenIddictClientSeeder.cs

@@ -28,9 +28,11 @@ public async Task StartAsync(CancellationToken cancellationToken)
 
             foreach (var clientSettings in _clientSettings.Clients)
             {
+                var resolvedClientType = ResolveClientType(clientSettings);
                 var applicationDescriptor = new OpenIddictApplicationDescriptor
                 {
                     ClientId = clientSettings.ClientId,
+                    ClientType = resolvedClientType,
                     ConsentType = ConsentTypes.Explicit,
                     DisplayName = clientSettings.DisplayName,
                     Permissions =
@@ -72,10 +74,34 @@ public async Task StartAsync(CancellationToken cancellationToken)
                     continue;
                 }
 
+                var existingClientType = await manager.GetClientTypeAsync(existingClient, cancellationToken);
+                if (string.IsNullOrWhiteSpace(existingClientType))
+                {
+                    await manager.DeleteAsync(existingClient, cancellationToken);
+                    await manager.CreateAsync(applicationDescriptor, cancellationToken);
+                    continue;
+                }
+
                 await manager.UpdateAsync(existingClient, applicationDescriptor, cancellationToken);
             }
         }
 
         public Task StopAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+
+        private static string ResolveClientType(ClientSettingsOptions clientSettings)
+        {
+            if (string.IsNullOrWhiteSpace(clientSettings.ClientType))
+            {
+                return ClientTypes.Public;
+            }
+
+            return clientSettings.ClientType.Trim().ToLowerInvariant() switch
+            {
+                "public" => ClientTypes.Public,
+                "confidential" => ClientTypes.Confidential,
+                _ => throw new InvalidOperationException(
+                    $"Unsupported OpenIddict client type '{clientSettings.ClientType}' for client '{clientSettings.ClientId}'.")
+            };
+        }
     }
 }

src/TaskManagement.Auth/Infrastructure/Common/Settings/ClientSettings.cs

@@ -8,6 +8,7 @@ public class ClientSettings
     public class ClientSettingsOptions
     {
         public string ClientId { get; set; } = string.Empty;
+        public string ClientType { get; set; } = string.Empty;
         public string DisplayName { get; set; } = string.Empty;
         public List<string> RedirectUris { get; set; } = [];
         public List<string> PostLogoutRedirectUris { get; set; } = [];