[codex] Fix OAuth client reference_id updates

[salasebas]

Summary

Reject attempts to update an OAuth client's reference_id through the update-client endpoint and stop persisting that field from update payloads.

Root Cause

UpdateClientBody.update accepted a full OAuthClient, including reference_id. The update path merged and persisted that value. Later, the client_credentials token flow copied the stored client reference_id into access token storage, allowing an authenticated client owner to spoof the tenant or organization reference used by downstream authorization.

Changes

• Return invalid_client_metadata when update-client receives reference_id.
• Keep reference_id out of the merge and update record paths.
• Add a regression test that proves the stored client and issued client-credentials token keep the original server-derived reference.

Validation

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo nextest run -p rustauth-oauth-provider --all-features
• cargo test -p rustauth-oauth-provider --features test-util update_client_rejects_reference_id_changes_and_preserves_token_reference -- --nocapture

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
rustauth-docs-site	Canceled		Jul 1, 2026 6:29am