863cfc1e78* feat: relax OIDC discovery policy and add Dynamic Client Registration middleware (RFC 7591) - Add LenientOidcDiscoveryMetadataPolicy for providers that omit code_challenge_methods_supported (e.g. FusionAuth, Microsoft Entra ID) - Keep StrictOidcDiscoveryMetadataPolicy RFC-aligned - Add ClientRegistrationMiddleware handling POST /register and enriching /.well-known/oauth-authorization-server with registration_endpoint - Update Microsoft example to use built-in LenientOidcDiscoveryMetadataPolicy * fix: move metadata policy note under server.php in Files section Address review comment: the LenientOidcDiscoveryMetadataPolicy bullet was a behavioral note, not a file entry. Inline it into the server.php description to keep the Files list consistent. * fix: address Copilot review comments on ClientRegistrationMiddleware - Decode JSON with assoc=true for registrar data so nested objects are associative arrays, not stdClass instances - Add Cache-Control: no-store to all error responses (400), not just the success response (201) - Rewind response body stream before returning unmodified response when metadata is not valid JSON, preventing empty body on read * fix: harden ClientRegistrationMiddleware and improve test coverage - Revert spurious .gitignore trailing newline - Use JSON_THROW_ON_ERROR consistently in enrichAuthServerMetadata() - Add comment clarifying the second json_decode in handleRegistration() - Assert Cache-Control: no-store on registrar exception error response - Add test for non-object JSON body in metadata enrichment path - Extract createPlainTextHandler helper for non-JSON response tests * fix: reject JSON array bodies in metadata enrichment Treat JSON list arrays (e.g. [] or ["..."]) as invalid metadata in enrichAuthServerMetadata() to prevent corrupting the response shape by adding registration_endpoint to a non-object. * fix: add RFC 7591 error codes, Content-Type validation, and docblock safety warning Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Christopher Hertel <mail@christopher-hertel.de> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
44 lines
1.6 KiB
PHP
44 lines
1.6 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of the official PHP MCP SDK.
|
|
*
|
|
* A collaboration between Symfony and the PHP Foundation.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace Mcp\Server\Transport\Http\OAuth;
|
|
|
|
use Mcp\Exception\ClientRegistrationException;
|
|
|
|
/**
|
|
* Interface for OAuth 2.0 Dynamic Client Registration (RFC 7591).
|
|
*
|
|
* Implementations are responsible for persisting client credentials and
|
|
* returning a registration response as defined in RFC 7591 Section 3.2.
|
|
*
|
|
* @see https://datatracker.ietf.org/doc/html/rfc7591
|
|
*/
|
|
interface ClientRegistrarInterface
|
|
{
|
|
/**
|
|
* Registers a new OAuth 2.0 client.
|
|
*
|
|
* The registration request contains metadata fields as defined in RFC 7591
|
|
* Section 2 (e.g. redirect_uris, client_name, token_endpoint_auth_method).
|
|
*
|
|
* The returned array MUST include at least "client_id" and should include
|
|
* "client_secret" when the token endpoint auth method requires one.
|
|
*
|
|
* @param array<string, mixed> $registrationRequest Client metadata from the registration request body
|
|
*
|
|
* @return array<string, mixed> Registration response including client_id and optional client_secret
|
|
*
|
|
* @throws ClientRegistrationException If registration fails (e.g. invalid metadata, storage error).
|
|
* The exception message is returned to the client as error_description —
|
|
* do not include internal details (database errors, stack traces, etc.).
|
|
*/
|
|
public function register(array $registrationRequest): array;
|
|
}
|