`use-pkce-with-authorization-code-grant` option hides 'client_secret' field for `clientCredentials` schemes

Q&A

• OS: Linux
• Browser: Firefox
• Version: 97.0.1
• Method of installation: SpringDoc-OpenAPI
• Swagger-UI version: 4.5.0
• Swagger/OpenAPI version: OpenAPI 3.0

Content & configuration

Example Swagger/OpenAPI definition:

{
  "openapi": "3.0.1",
  "servers": [
    {
      "url": "http://localhost:8080"
    }
  ],
  "paths": {
    "/api/portals/{portalId}/": {
      "get": {
        "operationId": "getPortal",
        "parameters": [
          {
            "name": "portalId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Portal"
                }
              }
            }
          }
        },
        "security": [
          {
            "admin": []
          }
        ]
      }
    },
    "/api/portals/current/": {
      "get": {
        "operationId": "getCurrentPortal",
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PortalSummary"
                }
              }
            }
          }
        },
        "security": [
          {
            "serviceAccount": []
          }
        ]
      }
    }
  },
  "components": {
    "schemas": {
      "Portal": {
        "required": [],
        "type": "object",
        "properties": {
          "enabledFeatures": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "privateData": {
            "type": "string"
          }
        }
      },
      "PortalSummary": {
        "type": "object",
        "properties": {
          "enabledFeatures": {
            "type": "array",
            "items": {
              "type": "string"
            }
          }
        }
      }
    },
    "securitySchemes": {
      "admin": {
        "type": "oauth2",
        "flows": {
          "authorizationCode": {
            "authorizationUrl": "http://localhost:8089/realms/master/protocol/openid-connect/auth",
            "tokenUrl": "http://localhost:8089/realms/master/protocol/openid-connect/token",
            "scopes": {
              "openid": ""
            }
          }
        }
      },
      "serviceAccount": {
        "type": "oauth2",
        "flows": {
          "clientCredentials": {
            "authorizationUrl": "http://localhost:8089/realms/master/protocol/openid-connect/auth",
            "tokenUrl": "http://localhost:8089/realms/master/protocol/openid-connect/token"
          }
        }
      }
    }
  }
}

Swagger-UI configuration options:

springdoc:
  swagger-ui:
    oauth:
      use-pkce-with-authorization-code-grant: true

Describe the bug you're encountering

I'm trying to describe an API with multiple endpoints. Some endpoints require an administrator user to login via Code+PKCE flow, while others are meant to be used by machine users, using client secrets. For this I have configured two security schemes, one with authorizationCode, the other clientCredentials.
When I enable the use-pkce-with-authorization-code-grant option, the client secret field disappears for both security schemes. I am then unable to authenticate with the client credentials scheme. When disabling the use-pkce-with-authorization-code-grant option, I am unable to login with the authorizationCode scheme, even when leaving the clientSecret field blank.

To reproduce...

Steps to reproduce the behavior:

1. Click on 'Authorize.'
2. Scroll down to 'serviceAccount (OAuth2, clientCredentials)'
3. Field 'client_secret' is missing

Expected behavior

Field 'client_secret' should be visible for the clientCredentials scheme

Screenshots

Additional context or thoughts

The use-pkce-with-authorization-code-grant option should really only affect authorizationCode schemes imo. It seems to be hiding the client_secret field more generally though. I guess it's not so common to combine both authorizationCode and clientCredentials schemes in one API...

Reproduce the issue in Swagger UI using the supplied OpenAPI definition and the use-pkce-with-authorization-code-grant configuration, then inspect the Authorize flow for the authorizationCode and clientCredentials schemes. Done means the client_secret field remains visible for clientCredentials while PKCE affects only authorizationCode.