fix: update auth_callback to include client_id in POST body for OIDC providers

backend/app/main.py

@@ -78,21 +78,22 @@ async def auth_callback(payload: AuthCallbackRequest):
         "code": payload.code,
         "code_verifier": payload.code_verifier,
         "redirect_uri": str(payload.redirect_uri),
-        "client_id": settings.oidc_client_id,
     }
 
     # Some OIDC providers expect client credentials via HTTP Basic auth
     auth = None
     if settings.oidc_client_secret:
         auth = (settings.oidc_client_id, settings.oidc_client_secret)
+    else:
+        data["client_id"] = settings.oidc_client_id
 
     async with httpx.AsyncClient(timeout=15.0) as client:
         response = await client.post(token_endpoint, data=data, headers={"Accept": "application/json"}, auth=auth)
 
         # Some providers only accept client authentication via POST body
         if response.status_code != 200 and auth is not None:
-            # try falling back to client_secret in the request body
             data_with_secret = dict(data)
+            data_with_secret["client_id"] = settings.oidc_client_id
             data_with_secret["client_secret"] = settings.oidc_client_secret
             response = await client.post(token_endpoint, data=data_with_secret, headers={"Accept": "application/json"})