-- Apply before the 1.7 schema/Worker cutover. These four existing apps use
-- ClientSecretPost. Only registration metadata changes; secrets stay intact.
-- Do not include tres: both its backends must use Basic for their shared client.
UPDATE oauth_clients
SET token_endpoint_auth_method = 'client_secret_post'
WHERE client_id IN (
  'JmdxvkWCtYPlJyYzEmsmrRKqVVkqaDTH', -- anvil
  'yjghWbdLExBTqCfMroCNFprsIsBWcpTZ', -- bland
  'SOkHjqnAkmcQkiNFgZobhpjIcTEFbtaL', -- flamemail admin
  'FfBngpAjBSDkXZuNSRqvlCEPKgVNFVxO'  -- git-on-cloudflare
)
  AND token_endpoint_auth_method = 'client_secret_basic'
  AND client_secret IS NOT NULL
  AND length(client_secret) > 0
RETURNING name, token_endpoint_auth_method;