Implement RFC 7591 Dynamic Client Registration for ChatGPT OAuth

[vitorhugo-java]

Summary

Adds support for RFC 7591 Dynamic Client Registration (DCR) to enable ChatGPT plugin OAuth integration. ChatGPT requires a DCR endpoint before it can complete the OAuth flow. This implementation provides a public /connect/register endpoint that allows clients to dynamically register without pre-configuration.

Key Changes

• New DCR Controller (DynamicClientRegistrationController):

  • Implements RFC 7591 compliant /connect/register POST endpoint
  • Generates public clients (no secret) with PKCE requirement and authorization_code grant only
  • Validates redirect URIs (HTTPS required, except http://localhost for testing)
  • Supports scope negotiation with configurable allowed scopes
  • Implements per-IP rate limiting (5 registrations/minute) to prevent abuse
  • Generates unique client IDs with "dcr-" prefix to prevent collision with static clients

• OIDC Discovery Updates (AuthorizationServerConfig):

  • Advertises registration_endpoint in .well-known/openid-configuration
  • Includes "none" in token_endpoint_auth_methods_supported for public client support
  • Implements userinfo mapper to return email and name from user repository for openid/profile scopes

• Security Configuration (SecurityConfig):

  • Permits public access to /connect/register endpoint
  • Maintains protection for other OAuth endpoints

• Comprehensive Integration Tests (DynamicClientRegistrationIT):

  • Validates OIDC discovery advertises DCR endpoint and "none" auth method
  • Tests successful registration with valid redirect URIs
  • Verifies scope negotiation (intersection of requested and allowed)
  • Confirms rejection of invalid URIs (non-HTTPS, missing, malformed)
  • Validates per-IP rate limiting enforcement
  • Tests default scope behavior when none requested

Implementation Details

• Registered clients are configured as public (ClientAuthenticationMethod.NONE) with PKCE required
• Rate limiting uses a thread-safe ConcurrentHashMap with sliding-window per IP
• Scope resolution falls back to default scopes when MCP is not configured
• Client names are sanitized (max 100 chars) to prevent injection
• Redirect URIs are validated and deduplicated
• Token TTL and refresh token settings are configurable via McpOAuthProperties

https://claude.ai/code/session_01X74fzJo874vACX3PM9mrWn

[github-actions]

Qodana for JVM

3 new problems were found

Inspection name	Severity	Problems
Nullability and data flow problems	🔶 Warning	1
Mismatched query and update of 'StringBuilder'	🔶 Warning	1
Simplifiable conditional expression	🔶 Warning	1

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

• Register at Qodana Cloud and configure the action
• Use GitHub Code Scanning with Qodana
• Host Qodana report at GitHub Pages
• Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2025.3.2
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions