chore: 🤖 tweak oidc attributes serialization

addons/api/addon/models/fragment-auth-method-attributes.js

@@ -9,10 +9,10 @@ export default class FragmentAuthMethodAttributesModel extends Fragment {
   @attr('string') issuer;
   @attr('string') client_id;
   @attr('string') client_secret;
-  @attr('string') client_secret_hmac;
+  @attr('string', { readOnly: true }) client_secret_hmac;
   @attr('number') max_age;
   @attr('string') api_url_prefix;
-  @attr('string') callback_url;
+  @attr('string', { readOnly: true }) callback_url;
   @attr('boolean') disable_discovered_config_validation;
   @attr('boolean') dry_run;
 

addons/api/addon/serializers/fragment-auth-method-attributes.js

@@ -0,0 +1,26 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentAuthMethodAttributesSerializer extends JSONSerializer {
+  /**
+   * If an attribute is annotated as readOnly in the model, don't serialize it.
+   * Otherwise delegate to default attribute serializer.
+   *
+   * @override
+   * @method serializeAttribute
+   * @param {Snapshot} snapshot
+   * @param {Object} json
+   * @param {String} key
+   * @param {Object} attribute
+   */
+  serializeAttribute(snapshot, json, key, attribute) {
+    const { type, options } = attribute;
+    let value = super.serializeAttribute(...arguments);
+    // Convert empty strings to null.
+    if (type === 'string' && json[key] === '') json[key] = null;
+    // Do not serialize read-only attributes.
+    if (options.readOnly) delete json[key];
+    // Client secret cannot be unset.  If it's falsy, it must be removed.
+    if (key === 'client_secret' && !json[key]) delete json[key];
+    return value;
+  }
+}