feat(oauth): add dynamic client registration endpoint (RFC 7591)

[appleboy]

Summary

• Add POST /oauth/register endpoint implementing RFC 7591 Dynamic Client Registration
• Gated behind ENABLE_DYNAMIC_CLIENT_REGISTRATION=true env var (disabled by default for security)
• Registered clients start in pending status and require admin approval before use
• Supports grant_types: authorization_code, device_code (including URN form)
• Supports token_endpoint_auth_method: none (public), client_secret_basic, client_secret_post (confidential)
• Restricts scopes to user-safe set: email, profile, openid, offline_access
• Rate limited at 5 req/min (configurable via DYNAMIC_CLIENT_REGISTRATION_RATE_LIMIT)
• Returns RFC 7591 §3.2.1 compliant response with client_id, client_secret, grant_types, etc.

Configuration

# Enable dynamic client registration (default: false)
ENABLE_DYNAMIC_CLIENT_REGISTRATION=true

# Rate limit for /oauth/register (default: 5 requests/minute)
DYNAMIC_CLIENT_REGISTRATION_RATE_LIMIT=5

Example Usage

curl -X POST http://localhost:8080/oauth/register   -H "Content-Type: application/json"   -d '{
    "client_name": "My CLI Tool",
    "grant_types": ["device_code"],
    "scope": "email profile"
  }'

Test plan

• All existing tests pass (go test ./...)
• Linting passes (make lint — 0 issues)
• 13 handler tests: minimal registration, device code grant, confidential client, scopes, disabled endpoint, missing fields, unsupported grant types/auth methods/scopes, invalid redirect URIs, invalid JSON, multiple grant types
• Manual test with curl against running server

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 91.66667% with 14 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/handlers/registration.go	95.51%	5 Missing and 2 partials ⚠️
internal/bootstrap/handlers.go	0.00%	6 Missing ⚠️
internal/bootstrap/router.go	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Adds an OAuth 2.0 Dynamic Client Registration endpoint (POST /oauth/register) intended to follow RFC 7591, wiring it into routing, configuration, rate limiting, and adding handler-level tests.

Changes:

• Introduces RegistrationHandler with request validation and RFC 7591-style JSON responses.
• Wires /oauth/register into the router and rate-limiting middleware, plus new config knobs.
• Adds handler tests covering success and error cases; adds an audit log event constant.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
internal/models/audit_log.go	Adds a new audit event constant for dynamic registration.
internal/handlers/registration.go	Implements POST /oauth/register handler and response shaping.
internal/handlers/registration_test.go	Adds test coverage for registration handler behaviors.
internal/config/config.go	Adds env-backed config fields to enable registration and configure rate limit.
internal/bootstrap/router.go	Registers the new /oauth/register route with rate limiting.
internal/bootstrap/ratelimit.go	Adds a dedicated rate limiter middleware slot for registration.
internal/bootstrap/handlers.go	Instantiates and exposes the new registration handler.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.