feat(oauth): v0.4 step 3 — Dynamic Client Registration (RFC 7591)

POST /oauth/register lets MCP clients that have no prior relationship
with this server self-register. Anthropic's Claude.ai connector docs
explicitly mention DCR support — without this endpoint, the connector
couldn't complete the flow.

Behaviour:

- Public clients only (token_endpoint_auth_method=none). Confidential
  clients are rejected rather than silently downgraded, so DCR clients
  don't get a false sense of authentication on top of PKCE.
- redirect_uris: https:// only, plus http://localhost / 127.0.0.1 / [::1]
  for desktop clients. Fragments rejected per RFC 6749 §3.1.2.
- grant_types: authorization_code, refresh_token (the only ones our
  /oauth/token endpoint understands).
- response_types: code only (matches V64 discovery advertisement).
- client_id = "mcp-" + 16 random hex bytes. Returned to the caller plus
  a registration_access_token (issued but not used yet; step 4 can wire
  it up for client self-management).
- Accept-and-ignore the optional metadata fields Anthropic and others
  send (client_uri, logo_uri, tos_uri, policy_uri, software_id,
  software_version, scope) so registration doesn't fail on benign extras.

GET /oauth/authorize now refuses unknown client_ids and validates that
redirect_uri is in the registered client's allow-list. Without this,
an attacker who learned a client_id could supply their own redirect_uri
and capture the auth code. Constant-time comparison on the URI to
avoid leaking the registered set via timing.

Persistence: in-memory. Same posture as V53 + OAuthStore — single
user, restart = re-register. Step 4 adds a Settings UI for review
and revoke; persistent client storage can land later if the
single-user assumption breaks.

Author: mi4uu

server/src/api/oauth-flow.ts

@@ -1,6 +1,7 @@
 import { Elysia, t } from "elysia";
 import type { AuthStore } from "../auth/store";
 import type { OAuthStore } from "../auth/oauth-store";
+import type { OAuthClientStore, ClientRegistrationRequest } from "../auth/oauth-clients";
 
 // V63 step 2: /oauth/authorize + /oauth/token endpoints.
 //
@@ -134,10 +135,48 @@ function redirectWithError(redirectUri: string, state: string, error: string, de
 
 const SUPPORTED_SCOPES = new Set(["vault:read", "vault:write"]);
 
-export function oauthFlowRoutes(authStore: AuthStore, oauth: OAuthStore) {
+export function oauthFlowRoutes(
+  authStore: AuthStore,
+  oauth: OAuthStore,
+  clients: OAuthClientStore,
+) {
   return (
     new Elysia()
 
+      // ----- POST /oauth/register (RFC 7591 Dynamic Client Registration) -----
+      .post(
+        "/oauth/register",
+        ({ body, set }) => {
+          const req = body as ClientRegistrationRequest;
+          const r = clients.register(req);
+          if (!r.ok) {
+            set.status = 400;
+            return { error: r.error, error_description: r.error_description };
+          }
+          set.status = 201;
+          set.headers["cache-control"] = "no-store";
+          set.headers["pragma"] = "no-cache";
+          return r.client;
+        },
+        {
+          body: t.Object({
+            client_name: t.Optional(t.String()),
+            redirect_uris: t.Array(t.String()),
+            grant_types: t.Optional(t.Array(t.String())),
+            response_types: t.Optional(t.Array(t.String())),
+            token_endpoint_auth_method: t.Optional(t.String()),
+            // Anthropic-style metadata fields we accept but ignore.
+            scope: t.Optional(t.String()),
+            client_uri: t.Optional(t.String()),
+            logo_uri: t.Optional(t.String()),
+            tos_uri: t.Optional(t.String()),
+            policy_uri: t.Optional(t.String()),
+            software_id: t.Optional(t.String()),
+            software_version: t.Optional(t.String()),
+          }),
+        },
+      )
+
       // ----- GET /oauth/authorize (render consent) -----
       .get(
         "/oauth/authorize",
@@ -170,6 +209,25 @@ export function oauthFlowRoutes(authStore: AuthStore, oauth: OAuthStore) {
             set.status = 400;
             return { error: "invalid_request", error_description: redirOk.reason };
           }
+          // V63 step 3: client_id must match a registered client and the
+          // redirect_uri must be in that client's allow-list. Without this
+          // check, an attacker who learns a client_id can swap in their own
+          // redirect_uri and capture the auth code.
+          const knownClient = clients.get(clientId);
+          if (!knownClient) {
+            set.status = 400;
+            return {
+              error: "invalid_client",
+              error_description: "unknown client_id — register via POST /oauth/register first",
+            };
+          }
+          if (!clients.validateRedirectUri(clientId, redirectUri)) {
+            set.status = 400;
+            return {
+              error: "invalid_request",
+              error_description: "redirect_uri not registered for this client",
+            };
+          }
 
           // From here on, errors redirect.
           if (responseType !== "code") {

server/src/app.ts

@@ -30,6 +30,7 @@ import { authMiddleware } from "./api/auth-middleware";
 import { oauthDiscoveryRoutes } from "./api/oauth-discovery";
 import { oauthFlowRoutes } from "./api/oauth-flow";
 import { OAuthStore } from "./auth/oauth-store";
+import { OAuthClientStore } from "./auth/oauth-clients";
 import { folderPermsRoutes } from "./api/folder-perms";
 import { AuthStore } from "./auth/store";
 import { TokenStore } from "./auth/tokens";
@@ -69,6 +70,7 @@ export function createApp(opts: AppOptions = {}) {
   const tokenStore = new TokenStore();
   const oauthStore = new OAuthStore();
   oauthStore.startSweeper();
+  const oauthClients = new OAuthClientStore();
 
   const app = new Elysia()
     .use(cors())
@@ -77,8 +79,8 @@ export function createApp(opts: AppOptions = {}) {
     // V64: OAuth discovery surface, served before everything else so it's
     // reachable even when auth.json gates the rest of the API.
     .use(oauthDiscoveryRoutes())
-    // V63 step 2: authorize + token endpoints (PKCE flow).
-    .use(oauthFlowRoutes(authStore, oauthStore))
+    // V63 step 2+3: authorize + token + register endpoints (PKCE + DCR).
+    .use(oauthFlowRoutes(authStore, oauthStore, oauthClients))
     .use(authRoutes(authStore, tokenStore))
     .use(treeRoutes(vault))
     .use(noteRoutes(vault, index))

server/src/auth/oauth-clients.ts

@@ -0,0 +1,152 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+
+// V63 step 3: Dynamic Client Registration store (RFC 7591).
+//
+// MCP clients that don't have a prior relationship with this server can
+// POST /oauth/register with a JSON body declaring their redirect_uris and
+// client_name; we mint a client_id (and skip client_secret — every MCP
+// client we care about is public, PKCE is the only credential).
+//
+// Persistence: in-memory, same as the rest of the auth surface. The
+// rationale matches V53 — single-user single-device, restart = fresh.
+// Step 4 may add Settings → Security → "Registered clients" with persist
+// + revoke, but the spec doesn't require persistence; clients re-register
+// after a restart, which costs them one extra round trip and nothing else.
+
+export interface RegisteredClient {
+  client_id: string;
+  client_name: string;
+  redirect_uris: string[];
+  grant_types: string[];
+  response_types: string[];
+  token_endpoint_auth_method: "none";
+  client_id_issued_at: number;
+  registration_access_token: string;
+}
+
+export interface ClientRegistrationRequest {
+  client_name?: string;
+  redirect_uris: string[];
+  grant_types?: string[];
+  response_types?: string[];
+  token_endpoint_auth_method?: string;
+}
+
+function isValidRedirect(uri: string): boolean {
+  let u: URL;
+  try {
+    u = new URL(uri);
+  } catch {
+    return false;
+  }
+  if (u.hash) return false;
+  if (u.protocol === "https:") return true;
+  if (u.protocol === "http:") {
+    return u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]";
+  }
+  return false;
+}
+
+function constantTimeEq(a: string, b: string): boolean {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  if (ab.length !== bb.length) return false;
+  return timingSafeEqual(ab, bb);
+}
+
+export class OAuthClientStore {
+  private readonly clients = new Map<string, RegisteredClient>();
+
+  register(req: ClientRegistrationRequest):
+    | { ok: true; client: RegisteredClient }
+    | { ok: false; error: string; error_description: string } {
+    if (!Array.isArray(req.redirect_uris) || req.redirect_uris.length === 0) {
+      return {
+        ok: false,
+        error: "invalid_redirect_uri",
+        error_description: "redirect_uris must be a non-empty array",
+      };
+    }
+    for (const uri of req.redirect_uris) {
+      if (typeof uri !== "string" || !isValidRedirect(uri)) {
+        return {
+          ok: false,
+          error: "invalid_redirect_uri",
+          error_description: `redirect_uri rejected: ${uri} (must be https:// or http://localhost)`,
+        };
+      }
+    }
+    const grantTypes = req.grant_types ?? ["authorization_code", "refresh_token"];
+    const allowedGrants = new Set(["authorization_code", "refresh_token"]);
+    for (const g of grantTypes) {
+      if (!allowedGrants.has(g)) {
+        return {
+          ok: false,
+          error: "invalid_client_metadata",
+          error_description: `grant_type not supported: ${g}`,
+        };
+      }
+    }
+    const responseTypes = req.response_types ?? ["code"];
+    for (const r of responseTypes) {
+      if (r !== "code") {
+        return {
+          ok: false,
+          error: "invalid_client_metadata",
+          error_description: `response_type not supported: ${r}`,
+        };
+      }
+    }
+    const auth = req.token_endpoint_auth_method ?? "none";
+    if (auth !== "none") {
+      // We're a public-client server (PKCE-only). Reject confidential
+      // client registrations rather than silently downgrading.
+      return {
+        ok: false,
+        error: "invalid_client_metadata",
+        error_description: "token_endpoint_auth_method must be 'none' (PKCE-only public clients)",
+      };
+    }
+
+    const client: RegisteredClient = {
+      client_id: `mcp-${randomBytes(16).toString("hex")}`,
+      client_name: typeof req.client_name === "string" && req.client_name.length > 0
+        ? req.client_name.slice(0, 200)
+        : "Unnamed MCP client",
+      redirect_uris: req.redirect_uris.slice(),
+      grant_types: grantTypes,
+      response_types: responseTypes,
+      token_endpoint_auth_method: "none",
+      client_id_issued_at: Math.floor(Date.now() / 1000),
+      registration_access_token: randomBytes(32).toString("base64url"),
+    };
+    this.clients.set(client.client_id, client);
+    return { ok: true, client };
+  }
+
+  get(clientId: string): RegisteredClient | undefined {
+    return this.clients.get(clientId);
+  }
+
+  // Returns true if (clientId, redirectUri) pair was registered. Used by
+  // the /authorize handler so unknown clients with arbitrary redirect_uris
+  // don't slip through. Constant-time comparison on the URI to avoid
+  // leaking which redirect_uris are registered.
+  validateRedirectUri(clientId: string, redirectUri: string): boolean {
+    const c = this.clients.get(clientId);
+    if (!c) return false;
+    return c.redirect_uris.some((r) => constantTimeEq(r, redirectUri));
+  }
+
+  list(): RegisteredClient[] {
+    return Array.from(this.clients.values());
+  }
+
+  revoke(clientId: string): boolean {
+    return this.clients.delete(clientId);
+  }
+
+  count(): number {
+    return this.clients.size;
+  }
+}