estuary-cdk: refactor the placement of client creds in OAuth requests

[nicolaslazo]

Description:

So far, each OAuth flavour in the CDK had a hardcoded place where OAuth client credentials were supposed to go -- either the headers, or the request body. However, in the process of developing the QuickBooks connector (#3468) we realised its rotating tokens system broke the assumed standard: client ids and secrets were to be concatenated and base64-encoded before being placed in the headers.

This PR adds a new class method to our OAuth models: with_client_credentials_placement, which allows for a builder pattern-like interface to override what we'd used as the standard so far. This means no pre-existing connector code needed to be updated.

Two smaller changes were effected too

• OAuth2RotatingTokenSpec got merged into OAuth2Spec and now the latter supports the additionalTokenExchangeBody field
• Redundancy in the way we construct headers and form dictionaries has been simplified

Workflow steps:

(How does one use this feature, and how has it changed)

Documentation links affected:

(list any documentation links that you created, or existing ones that you've identified as needing updates, along with a brief description)

Notes for reviewers:

Changes have been tested on the following connectors:

• HubSpot
• Salesforce
• Outreach
• Genesys
• QuickBooks

[Copilot]

Pull Request Overview

This PR refactors OAuth client credentials placement in the estuary-cdk to support flexible credential placement strategies (headers vs. form body) and simplifies the OAuth specification models.

• Introduces a builder pattern via with_client_credentials_placement() method to override default credential placement
• Merges OAuth2RotatingTokenSpec into OAuth2Spec by adding additionalTokenExchangeBody field with a default empty dict
• Simplifies token exchange logic by using grant_type and client_credentials_placement ClassVars to eliminate redundant match/case logic

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
estuary-cdk/estuary_cdk/flow.py	Adds RequestDataPlacement type, adds grant_type and client_credentials_placement ClassVars to OAuth credential classes, adds with_client_credentials_placement() method to credential classes, merges OAuth2RotatingTokenSpec into OAuth2Spec, and refactors for_provider() methods to use cls parameter
estuary-cdk/estuary_cdk/http.py	Refactors _fetch_oauth2_token() to use credential ClassVars (grant_type, client_credentials_placement) instead of match/case on credential types, updates to use merged OAuth2Spec, and includes formatting improvements
estuary-cdk/estuary_cdk/capture/common.py	Removes OAuth2RotatingTokenSpec import
estuary-cdk/estuary_cdk/capture/base_capture_connector.py	Formatting and import organization improvements
source-zendesk-support-native/source_zendesk_support_native/models.py	Updates OAuth2RotatingTokenSpec to OAuth2Spec
source-outreach/source_outreach/models.py	Updates OAuth2RotatingTokenSpec to OAuth2Spec and removes redundant additionalTokenExchangeBody=None parameter

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Alex-Bair]

Had a few small comments.

Additionally whenever I make changes that affect multiple connectors, I make sure that the associated tests are passing in the CI checks. That helps put me a little at ease & makes it easier to claim that my CDK level changes didn't break individual connectors. It looks like the source-zendesk-support-native tests are failing, so we should figure out why they're failing & get them passing before merging this PR.

[Copilot]

Pull Request Overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Alex-Bair]

Looking good! I had a few more comments, but this is getting really close to being ready to be merged.

[Alex-Bair]

LGTM % a couple comments.

If you're alright with it, let's wait and merge this next week when more folks are around to support after Thanksgiving.

[Alex-Bair]

LGTM! Thanks!