fix: retain existing RegistrationAccessTokenSignature when PATCHing an OAuth2 Client

[OMBradF]

Fixes #4093

patchOAuth2Client applies the JSON patch by marshaling the Client struct to JSON, applying patch operations, then unmarshaling back. The RegistrationAccessTokenSignature field is tagged json:"-", so it is excluded from both the marshal and unmarshal steps. The resulting struct has an empty signature, which is then persisted to the database via UpdateClient, permanently overwriting the stored signature with an empty string.

Related issue(s)

See #4093

Checklist

• I have read the contributing guidelines.
• [ ] I have referenced an issue containing the design document if my change
  introduces a new feature. N/A - updating existing feature
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  security@ory.com) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• [ ] I have added or changed the documentation. N/A

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where registration access tokens were invalidated when updating OAuth2 client configurations. Tokens now remain valid after administrative patches are applied.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: de0d2ed4-da0b-4b4c-a249-9cdda4dd2091

📥 Commits

Reviewing files that changed from the base of the PR and between 4174065 and e50d602.

📒 Files selected for processing (2)

• client/handler.go
• client/sdk_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• client/sdk_test.go
• client/handler.go

---

📝 Walkthrough

Walkthrough

The PR preserves RegistrationAccessTokenSignature during OAuth2 client PATCH operations. The handler restores the signature after JSON patching and secret normalization. A test verifies that the original registration access token remains valid after an administrative client_uri update.

Changes

OAuth2 client PATCH preservation

Layer / File(s)	Summary
Preserve registration access-token signature client/handler.go	patchOAuth2Client saves the existing signature before JSON patching and restores it before updating and returning the client.
Validate token preservation client/sdk_test.go	The test verifies authenticated public dynamic-client retrieval after an administrative client_uri patch.

Estimated code review effort: 2 (Simple) | ~12 minutes

Possibly related issues

• ory/hydra#4093 — The change preserves RegistrationAccessTokenSignature during OAuth2 client PATCH operations.

Suggested reviewers: aeneasr

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary fix: retaining the existing registration access token signature during OAuth2 client PATCH operations.
Description check	✅ Passed	The description explains the bug, references issue #4093, documents the fix, and confirms that tests and required checklist items are complete.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.