OpenAPI convert client to application

[SirNexus]

In an effort to standardize the terminology and abstraction layer of the interface we're trying to build, it makes sense to transition away from emitting the client concept in the API and instead use the application concept. Here is an overview of the new API:

As you can see, we've moved the creation of an application to applications/oauth2. By restricting the creation of applications to be a specific type, we get several benefits:

1. Extension points in the API to allow for creation of other kinds of applications
2. Lowering of implementation overhead and complexity.

Take, for instance, an alternative approach that I investigated:

This API allows hooks for the creation of the application, and then the subsequent registering of the application as an OAuth2 client. This separates the application creation process from the registering of the application as a particular kind of client. This has several drawbacks:

1. The API is more complex, requiring more endpoints be implemented.
2. We have now introduced a state in our application where it lives in our IDP Connect implementation but not the AWS Cognito database. This adds increased surface area for bugs and maintenance complexity.
   • What happens if you associate an API Product with an application before you register it as an OAuth client? We'll have to store state. What happens if you then register it as an OAuth application? We'd have to update that state to reflect what lives in our IDP Connect state.

Overall, we want to avoid having to have state in our application. The purpose of our SPI is to provide simply a bridge between the Portal Server's source of truth and and backing storage for credentials. This layer should be as minimal as possible, and this API accomplishes that.

Keep in mind also that this means for a single logical application in Portal, we will have to create independent applications of different types if, say, we eventually support a applications/api-keys endpoint. I think this tradeoff is well worth it for the implementation and cognitive complexity savings this approach allows for.