feat(gotrue): add OAuth 2.1 client admin endpoints

[grdsdev]

Summary

This PR adds OAuth 2.1 client administration endpoints to the gotrue package, porting the feature from supabase-js#1582.

The new admin.oauth namespace provides comprehensive OAuth client management capabilities for server-side use with service role keys.

Changes

New API Methods

• admin.oauth.listClients() - List all OAuth clients with optional pagination
• admin.oauth.createClient() - Register a new OAuth client
• admin.oauth.getClient() - Get client details by ID
• admin.oauth.deleteClient() - Remove an OAuth client
• admin.oauth.regenerateClientSecret() - Regenerate client secret

New Types

• OAuthClientGrantType - Grant types enum (authorization_code, refresh_token)
• OAuthClientResponseType - Response types enum (code)
• OAuthClientType - Client type enum (public, confidential)
• OAuthClientRegistrationType - Registration type enum (dynamic, manual)
• OAuthClient - OAuth client model
• CreateOAuthClientParams - Parameters for creating OAuth clients
• OAuthClientResponse - Response wrapper for single client operations
• OAuthClientListResponse - Response wrapper for list operations

Implementation Details

• Added GoTrueAdminOAuthApi class following the pattern of GoTrueAdminMFAApi
• All methods require service_role key and should only be called server-side
• Proper UUID validation for client IDs
• Comprehensive test coverage

Usage Example

// Create a new OAuth client
final params = CreateOAuthClientParams(
  clientName: 'My Application',
  redirectUris: ['https://myapp.com/callback'],
  clientUri: 'https://myapp.com',
  scope: 'openid profile email',
);

final response = await supabase.auth.admin.oauth.createClient(params);
final clientId = response.client?.clientId;
final clientSecret = response.client?.clientSecret;

// List all OAuth clients
final clients = await supabase.auth.admin.oauth.listClients();

// Get client by ID
final client = await supabase.auth.admin.oauth.getClient(clientId);

// Regenerate client secret
final updated = await supabase.auth.admin.oauth.regenerateClientSecret(clientId);

// Delete client
await supabase.auth.admin.oauth.deleteClient(clientId);

Notes

• Only relevant when the OAuth 2.1 server is enabled in Supabase Auth
• All methods must be called with service_role key
• Never expose service_role key in client-side code

Test Plan

• Added comprehensive unit tests for all OAuth admin methods
• Tests cover create, list, get, delete, and regenerate operations
• Input validation tests for UUID parameters
• Code passes dart analyze with no issues
• Code formatted with dart format

Related

Ported from: supabase/supabase-js#1582

🤖 Generated with Claude Code