[kdubb]

Public authorization-code + PKCE clients currently fail before authorization when discovery omits none, as Keycloak does. Allow public acquisition and rotating refresh with that metadata or an omitted authentication-method property, while preserving confidential-client method checks and rejecting malformed arrays.

Add regression coverage for explicit none, Keycloak metadata, omitted metadata, refresh rotation, ambient credential isolation, issuer and endpoint validation, unsupported confidential authentication, and canceled authorization-grant reuse. Document the fix in the changelog.

Validation: formatting, Ruff, mypy, all 250 tests (92.1% coverage), source/wheel builds, Twine checks, and wheel verification passed locally on Python 3.12.12. Discovery tests use HTTPX MockTransport; no live Keycloak instance was used.

Closes #6.

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Changes OAuth token endpoint authentication validation logic.

The PR appears safe to merge; public discovery compatibility improves while existing confidential-client checks remain intact.

What we checked:

• Confidential checks stay intact: Only authentication="none" skips the membership check. Clients with secrets still need their configured method in discovery.
• Cancellation test uses supported backend: anyio_backend always returns asyncio, matching the new test's asyncio calls.

Summary

Public OAuth PKCE acquisition and refresh now work when discovery omits none or the authentication-method property.

• Confidential clients still require their configured authentication method.
• Discovery rejects authentication-method arrays containing non-string entries.
• Added tests cover refresh rotation, ambient credential isolation, trust checks, and canceled grant reuse.
• No actionable issues found. Tests were inspected, not run.

_{Reviews (1) · Last reviewed commit: "Fix public PKCE discovery compatibility"}