From d9ac7d01a9be03d5669be9be85adb84744b80d57 Mon Sep 17 00:00:00 2001 From: Stefan Ernst <24554551+stefan-ernst@users.noreply.github.com> Date: Thu, 23 Jul 2026 12:23:38 +0200 Subject: [PATCH] fix(oauth): defer resource binding for dynamic clients --- internal/handlers/oauth_mcp.go | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/internal/handlers/oauth_mcp.go b/internal/handlers/oauth_mcp.go index 8acdfc97..46e2bfd5 100644 --- a/internal/handlers/oauth_mcp.go +++ b/internal/handlers/oauth_mcp.go @@ -90,8 +90,11 @@ type dynamicClientRegistrationResponse struct { } // RegisterDynamicClient implements a constrained RFC 7591 registration -// endpoint for MCP clients. It creates public clients only: authorization-code -// plus refresh-token grants, S256 PKCE, and HTTPS or loopback callbacks. +// endpoint for public OAuth clients. It creates public clients only: +// authorization-code plus refresh-token grants, S256 PKCE, and HTTPS or +// loopback callbacks. Registration does not select a protected-resource +// audience; clients that need one (such as MCP clients) bind it on the +// authorization request via RFC 8707's resource parameter. func (h *OAuthHandler) RegisterDynamicClient(w http.ResponseWriter, r *http.Request) { r.Body = http.MaxBytesReader(w, r.Body, oauthRegistrationMaxBytes) var req dynamicClientRegistrationRequest @@ -117,15 +120,15 @@ func (h *OAuthHandler) RegisterDynamicClient(w http.ResponseWriter, r *http.Requ } displayName := strings.TrimSpace(req.ClientName) if displayName == "" { - displayName = "MCP client" + displayName = "OAuth client" } - slug := "mcp-" + strings.TrimPrefix(clientID, "wsoc_")[:16] + slug := "oauth-" + strings.TrimPrefix(clientID, "wsoc_")[:16] redirectsJSON, _ := json.Marshal(req.RedirectURIs) allowedScopes := nonAdminOAuthScopes() scopesJSON, _ := json.Marshal(allowedScopes) err = repository.NewOAuthClientRepository(h.db).CreateDynamicPublicClient( - slug, displayName, clientID, string(redirectsJSON), string(scopesJSON), h.mcpResourceURI, + slug, displayName, clientID, string(redirectsJSON), string(scopesJSON), "", ) if err != nil { if errors.Is(err, repository.ErrDuplicateEntry) {