Support OAuth client_credentials grant in OAuth client

## Motivation and Context

The MCP authorization specification and SEP-1046 allow confidential clients to
obtain tokens through the OAuth 2.1 `client_credentials` grant: a machine-to-machine flow
with no user, no browser redirect, and no authorization code. The Ruby SDK
previously supported only the interactive authorization-code flow, so it could not
authenticate against a server that requires `client_credentials`. This makes
the `auth/client-credentials-basic` conformance scenario pass and is removed from
the expected failures list.

Following the TypeScript SDK (`ClientCredentialsProvider`) and the Python SDK
(`ClientCredentialsOAuthProvider`), the grant gets its own provider class rather than
overloading the authorization-code provider. The change adds:

- `MCP::Client::OAuth::ClientCredentialsProvider`, a dedicated provider
  for the grant. `client_id` and `client_secret` are mandatory
  (the grant is for confidential clients), `token_endpoint_auth_method` is
  `client_secret_basic` (default) or `client_secret_post` -- `none` is
  rejected because an unauthenticated `client_credentials` request is
  meaningless. It has no redirect arguments, so a credentials-only
  client never supplies the redirect URI / handlers that grant has no use for.
- `MCP::Client::OAuth::StorageBackedProvider`, an internal module that
  shares the token / client-information persistence between the two provider classes
  so `Flow` can treat any provider uniformly.
- `Provider#authorization_flow` (`:authorization_code`) and
  `ClientCredentialsProvider#authorization_flow` (`:client_credentials`).
  `Flow#run!` dispatches on this rather than inspecting
  `client_metadata[:grant_types]`, which is protocol metadata for
  the authorization server, not an SDK control signal.
- `run_client_credentials!` shares the same PRM / AS metadata discovery
  and Communication Security checks as the interactive flow, then
  exchanges `grant_type=client_credentials` at the token endpoint via
  the existing `post_to_token_endpoint` (which already applies
  `client_secret_basic`). There is no PKCE, redirect, or `offline_access`
  augmentation, because the grant does not issue a refresh token
  (OAuth 2.1 Section 4.3.3).
- `conformance/client.rb` builds a `ClientCredentialsProvider` for
  the `auth/client-credentials-*` scenarios, reusing the harness-injected
  `client_id` / `client_secret`.

## How Has This Been Tested?

New `ClientCredentialsProvider` tests cover: credentials are stored as
client information; `authorization_flow` is `:client_credentials`;
`client_secret_post` is accepted; missing `client_id` / `client_secret`
and `token_endpoint_auth_method: "none"` are rejected; and the token helpers
delegate to storage.

New `Flow` tests cover: a `client_credentials` provider exchanges
`grant_type=client_credentials` with HTTP Basic auth, saves the token,
and never contacts the authorization or registration endpoint;
the requested scope is taken from PRM `scopes_supported`; and a standard
`Provider` runs the authorization-code grant regardless of what its
`client_metadata[:grant_types]` lists. A `Provider` test asserts
`authorization_flow` is `:authorization_code`.

Conformance: `auth/client-credentials-basic` now passes 7/7 with no failures.

## Breaking Changes

None. `ClientCredentialsProvider` is a new class; the existing `Provider` keeps
its required `redirect_uri` / `redirect_handler` / `callback_handler` arguments
and its behaviour is unchanged. Existing interactive clients are unaffected.

test/mcp/client/oauth/client_credentials_provider_test.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "test_helper"
+require "mcp/client/oauth"
+
+module MCP
+  class Client
+    module OAuth
+      class ClientCredentialsProviderTest < Minitest::Test
+        def test_initialize_stores_credentials_as_client_information
+          provider = ClientCredentialsProvider.new(client_id: "cc-client", client_secret: "cc-secret")
+
+          info = provider.client_information
+          assert_equal("cc-client", info["client_id"])
+          assert_equal("cc-secret", info["client_secret"])
+          assert_equal("client_secret_basic", info["token_endpoint_auth_method"])
+        end
+
+        def test_authorization_flow_is_client_credentials
+          provider = ClientCredentialsProvider.new(client_id: "cc-client", client_secret: "cc-secret")
+
+          assert_equal(:client_credentials, provider.authorization_flow)
+        end
+
+        def test_initialize_accepts_client_secret_post
+          provider = ClientCredentialsProvider.new(
+            client_id: "cc-client",
+            client_secret: "cc-secret",
+            token_endpoint_auth_method: "client_secret_post",
+          )
+
+          assert_equal("client_secret_post", provider.client_information["token_endpoint_auth_method"])
+        end
+
+        def test_initialize_rejects_missing_client_id
+          ["", "   ", nil].each do |value|
+            assert_raises(ClientCredentialsProvider::InvalidCredentialsError, "should reject #{value.inspect}") do
+              ClientCredentialsProvider.new(client_id: value, client_secret: "cc-secret")
+            end
+          end
+        end
+
+        def test_initialize_rejects_missing_client_secret
+          # The client_credentials grant is for confidential clients, so a credential is mandatory.
+          ["", "   ", nil].each do |value|
+            assert_raises(ClientCredentialsProvider::InvalidCredentialsError, "should reject #{value.inspect}") do
+              ClientCredentialsProvider.new(client_id: "cc-client", client_secret: value)
+            end
+          end
+        end
+
+        def test_initialize_rejects_none_auth_method
+          # An unauthenticated client_credentials request is meaningless.
+          assert_raises(ClientCredentialsProvider::InvalidCredentialsError) do
+            ClientCredentialsProvider.new(
+              client_id: "cc-client",
+              client_secret: "cc-secret",
+              token_endpoint_auth_method: "none",
+            )
+          end
+        end
+
+        def test_token_helpers_delegate_to_storage
+          provider = ClientCredentialsProvider.new(client_id: "cc-client", client_secret: "cc-secret")
+          provider.save_tokens("access_token" => "cc-token")
+
+          assert_equal("cc-token", provider.access_token)
+          provider.clear_tokens!
+          assert_nil(provider.tokens)
+        end
+      end
+    end
+  end
+end

test/mcp/client/oauth/flow_test.rb

@@ -68,6 +68,14 @@ module MCP
           WebMock.reset!
         end
 
+        def client_credentials_provider(token_endpoint_auth_method: "client_secret_basic")
+          ClientCredentialsProvider.new(
+            client_id: "cc-client",
+            client_secret: "cc-secret",
+            token_endpoint_auth_method: token_endpoint_auth_method,
+          )
+        end
+
         # Runs the full authorization flow and returns the `scope` query parameter
         # sent on the authorization request. The caller stubs the AS metadata;
         # this helper supplies a provider whose `grant_types` and optional pre-set
@@ -96,6 +104,102 @@ module MCP
           captured_scope
         end
 
+        def test_run_uses_client_credentials_grant_for_client_credentials_provider
+          provider = client_credentials_provider
+
+          result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
+
+          assert_equal(:authorized, result)
+          assert_equal("test-token-from-flow", provider.access_token)
+          # No authorization-code machinery: /authorize is never contacted
+          # (no stub exists for it, so a request would raise), and DCR is not
+          # run because credentials are pre-registered.
+          assert_not_requested(:post, "#{@auth_base}/register")
+          assert_requested(:post, "#{@auth_base}/token") do |req|
+            form = URI.decode_www_form(req.body).to_h
+            expected_basic = "Basic " + Base64.strict_encode64("cc-client:cc-secret")
+            form["grant_type"] == "client_credentials" &&
+              !form.key?("code") &&
+              !form.key?("code_verifier") &&
+              req.headers["Authorization"] == expected_basic
+          end
+        end
+
+        def test_run_client_credentials_with_client_secret_post_sends_credentials_in_body
+          # `client_secret_post` puts the credentials in the form body rather
+          # than an HTTP Basic header (RFC 6749 Section 2.3.1).
+          provider = client_credentials_provider(token_endpoint_auth_method: "client_secret_post")
+
+          Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
+
+          assert_requested(:post, "#{@auth_base}/token") do |req|
+            form = URI.decode_www_form(req.body).to_h
+            form["grant_type"] == "client_credentials" &&
+              form["client_id"] == "cc-client" &&
+              form["client_secret"] == "cc-secret" &&
+              req.headers["Authorization"].nil?
+          end
+        end
+
+        def test_run_client_credentials_raises_clean_error_when_client_information_missing
+          # The constructor always stores credentials, but if a custom storage loses them
+          # the grant must fail with a domain error rather than a `NoMethodError` from
+          # the authorization-code registration helper.
+          provider = client_credentials_provider
+          provider.storage.save_client_information(nil)
+
+          error = assert_raises(Flow::AuthorizationError) do
+            Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
+          end
+          assert_match(/client_credentials grant/, error.message)
+          assert_not_requested(:post, "#{@auth_base}/token")
+        end
+
+        def test_run_client_credentials_requests_scope_from_prm_scopes_supported
+          stub_request(:get, @prm_url).to_return(
+            status: 200,
+            headers: { "Content-Type" => "application/json" },
+            body: JSON.generate(
+              resource: "https://srv.example.com/mcp",
+              authorization_servers: [@auth_base],
+              scopes_supported: ["mcp:read", "mcp:write"],
+            ),
+          )
+
+          provider = client_credentials_provider
+
+          Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
+
+          assert_requested(:post, "#{@auth_base}/token") do |req|
+            URI.decode_www_form(req.body).to_h["scope"] == "mcp:read mcp:write"
+          end
+        end
+
+        def test_run_uses_authorization_code_grant_for_default_provider
+          # A standard `Provider` declares `authorization_flow == :authorization_code`,
+          # so `Flow` runs the interactive grant regardless of what `client_metadata[:grant_types]` happens to list.
+          state_holder = {}
+          provider = Provider.new(
+            client_metadata: {
+              redirect_uris: ["http://localhost:0/callback"],
+              grant_types: ["authorization_code", "client_credentials"],
+              response_types: ["code"],
+              token_endpoint_auth_method: "none",
+            },
+            redirect_uri: "http://localhost:0/callback",
+            redirect_handler: ->(url) {
+              state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
+            },
+            callback_handler: -> { ["test-auth-code", state_holder[:state]] },
+          )
+
+          Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
+
+          assert_requested(:post, "#{@auth_base}/token") do |req|
+            URI.decode_www_form(req.body).to_h["grant_type"] == "authorization_code"
+          end
+        end
+
         def test_run_completes_full_authorization_flow
           captured_authorization_url = nil
           state_value = nil

test/mcp/client/oauth/provider_test.rb

@@ -181,6 +181,12 @@ module MCP
             end
           end
         end
+
+        def test_authorization_flow_is_authorization_code
+          provider = Provider.new(**args_for("https://app.example.com/callback"))
+
+          assert_equal(:authorization_code, provider.authorization_flow)
+        end
       end
     end
   end