Function authenticate_oauth_client 

pub async fn authenticate_oauth_client(
    conn: &mut PgConnection,
    client_id: &str,
    provided_secret: Option<&SecretString>,
    token_hmac_key: &SecretString,
) -> Result<OAuthClient, ClientAuthError>

Looks up a client by client_id and, if it is confidential, verifies provided_secret against its stored digest with a constant-time comparison.

A public client is returned without any secret check: callers that must reject public clients outright (e.g. introspection) do so themselves once this returns.