client_type decides whether the token endpoint validates a client secret at
all, and the column accepted any text: nullable, no CHECK, no enum. No Go
path can write a bad value, and IsPublic fails closed on anything
unrecognized, so the read side is safe today. The point is what the schema
still permits: a future migration writing 'public' onto a row that holds a
secret turns off client authentication for that app with nothing to catch it,
no constraint, no log, no audit entry, no test.

Two columns also describe the same fact and could contradict each other.
token_endpoint_auth_method is the client's own declaration, registered
metadata under RFC 7591 §2 where "none" means the client is public and has no
secret; client_type is the derived value enforced on. Registration used to
persist the declaration verbatim while hardcoding client_type, so rows exist
declaring "none" on a client stored confidential that holds a real secret. A
client reading its own metadata concludes it is public, drops the secret, and
stops being able to exchange codes. The backfill aligns the declaration to
what is enforced; deriving enforcement from the declaration instead would
reclassify those clients as public and stop requiring the secret they were
issued.

SET NOT NULL changes the generated field from sql.NullString to string, so
the three write sites are updated to match. That is the whole application
change; no behavior depends on it.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…d backfill

Addresses CRF-1 on #27931. Neither migration had a dedicated test, and the
shared fixture cannot reach the case that matters: testdata/fixtures/
000182_oauth2_provider.up.sql inserts one app with no
token_endpoint_auth_method, so the backfill's IS NULL branch matches it while
the '= none' branch, the one repairing the actual bug, matches zero rows in
CI.

Follows the existing Stepper-to-prior-version, seed, migrate, assert pattern
of TestMigration000542ChatReasoningEffortBackfill,
TestMigration000562OAuth2PublicClientTokensBackfill and
TestMigration000563TemplateAgentsAllowedBackfill.

The backfill test seeds all six combinations that matter: a confidential
client declaring "none" (the known bug), one with no declaration at all, a
public client declaring a secret-based method, and the three already
consistent shapes. It asserts client_secret_post is not flattened to basic,
that client_type itself is never rewritten, and states the resulting
invariant directly by counting rows where the declaration contradicts the
enforced type.

The constraint test asserts a NULL client_type is backfilled to confidential
rather than blocking SET NOT NULL, that the column becomes NOT NULL, and that
the CHECK actually rejects "Public", "PUBLIC", "public ", "bogus", "" and
NULL while both canonical values remain insertable.

Both are mutation-checked. Removing the backfill's '= none' branch fails the
legacy case and the invariant count; removing the CHECK fails the rejection
assertions.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

… this tree

Addresses part of CRF-6 on #27931. The comment named IsPublic, which is
added in #27873 and greps to nothing here, so a reader during the window
between the two PRs goes looking for a function that does not exist. Ten
panel reviewers flagged it independently.

States the property directly instead, which is true at this commit and stays
true afterwards.

The finding's other four instances describe enforcement that arrives with
#27873 and are deliberately left: unlike a dangling symbol they are accurate
statements about where the column is headed, and each becomes true when that
PR lands.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…nt type migrations

Addresses CRF-4 and CRF-10 through CRF-16 on #27931.

CRF-11: the CHECK-violation assertion matched the constraint name as a raw
string, while this migration generates a typed constant for it. Now uses
database.IsCheckViolation with CheckOauth2ProviderAppsClientTypeCheck, the
established idiom, which matches the pq error code and constraint name rather
than error text, and which make gen keeps correct through a rename.

CRF-13: the stepper loop treated exhaustion as success, so a renumbered or
squashed 564 would silently apply 000565 and 000566 during setup and fail
later on a confusing "constraint already exists". Now t.Fatalf, matching every
other stepper loop in the file.

CRF-14: the NULL-insert probe asserted only that some error occurred, while
its siblings pin the constraint. Now pins the not-null violation.

CRF-15: the down migration opened with "Deliberately empty." and then ran
SELECT 1. Comment-only down migrations run fine (000506 is the precedent), so
the statement is gone and the first line is true.

CRF-12: the helper doc claimed it seeds every combination the two migrations
care about, but 000565's NULL client_type row is seeded in that test.
Narrowed to what it actually covers.

CRF-10: the declaration-versus-enforcement rationale was written four times
and 000565's twice. Kept the migration headers as the owning location and
removed the copies that restated an adjacent require message, map literal, or
header. Also folded in CRF-17's deploy-blocking consequence, which was the one
thing the 000565 header did not say.

CRF-16: "section 2" throughout, the majority form in the diff. CRF-4: the
local strPtr closure replaced with the shared ptr.Ref.

Re-verified after the assertion changes: dropping the CHECK still fails the
constraint test, and the full package passes at -parallel=1.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…lient_type

The subtest passed a zero-value InsertOAuth2ProviderAppParams. That was fine
while client_type was sql.NullString, where the zero value inserts NULL into
a nullable column. This branch makes the column NOT NULL with a CHECK for
'confidential' and 'public', and the generated insert always names the
column, so the DEFAULT never applies and the zero value now inserts '' and
fails the constraint:

  pq: new row for relation "oauth2_provider_apps" violates check constraint
      "oauth2_provider_apps_client_type_check"

Seeds 'confidential', the value every production call site already passes.
The subtest asserts RBAC, not column contents, so this does not change what
it verifies.

Fixes test-go-pg, test-go-pg-17 and test-go-race-pg on b254294, which all
failed on this one subtest.