fix: add client_id and client_secret to form when type is request-body (via #4213)

src/core/plugins/auth/actions.js

@@ -84,21 +84,33 @@ export const authorizePassword = ( auth ) => ( { authActions } ) => {
   } else {
     Object.assign(form, {username}, {password})
 
-    if ( passwordType === "query") {
+    switch ( passwordType ) {
-      if ( clientId ) {
+      case "query":
-        query.client_id = clientId
+        setClientIdAndSecret(query, clientId, clientSecret)
-      }
+        break
-      if ( clientSecret ) {
+
-        query.client_secret = clientSecret
+      case "request-body":
-      }
+        setClientIdAndSecret(form, clientId, clientSecret)
-    } else {
+        break
-      headers.Authorization = "Basic " + btoa(clientId + ":" + clientSecret)
+
+      default:
+        headers.Authorization = "Basic " + btoa(clientId + ":" + clientSecret)
     }
   }
 
   return authActions.authorizeRequest({ body: buildFormData(form), url: schema.get("tokenUrl"), name, headers, query, auth})
 }
 
+function setClientIdAndSecret(target, clientId, clientSecret) {
+  if ( clientId ) {
+    Object.assign(target, {client_id: clientId})
+  }
+
+  if ( clientSecret ) {
+    Object.assign(target, {client_secret: clientSecret})
+  }
+}
+
 export const authorizeApplication = ( auth ) => ( { authActions } ) => {
   let { schema, scopes, name, clientId, clientSecret } = auth
   let headers = {