feat: add OAuth 2.0 Dynamic Client Registration middleware (RFC 7591)

PSR-15 middleware that handles POST /register by delegating to a
ClientRegistrarInterface and enriches /.well-known/oauth-authorization-server
responses with the registration_endpoint.

Author: simonchrz

CHANGELOG.md

@@ -9,6 +9,8 @@ All notable changes to `mcp/sdk` will be documented in this file.
 * Add client component for building MCP clients
 * Add `Builder::setReferenceHandler()` to allow custom `ReferenceHandlerInterface` implementations (e.g. authorization decorators)
 * Add elicitation enum schema types per SEP-1330: `TitledEnumSchemaDefinition`, `MultiSelectEnumSchemaDefinition`, `TitledMultiSelectEnumSchemaDefinition`
+* Add `LenientOidcDiscoveryMetadataPolicy` for identity providers that omit `code_challenge_methods_supported` in OIDC discovery
+* Add OAuth 2.0 Dynamic Client Registration middleware (RFC 7591)
 
 0.4.0
 -----

src/Exception/ClientRegistrationException.php

@@ -0,0 +1,16 @@
+<?php
+
+/*
+ * This file is part of the official PHP MCP SDK.
+ *
+ * A collaboration between Symfony and the PHP Foundation.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Mcp\Exception;
+
+final class ClientRegistrationException extends \RuntimeException implements ExceptionInterface
+{
+}

src/Server/Transport/Http/Middleware/ClientRegistrationMiddleware.php

@@ -0,0 +1,139 @@
+<?php
+
+/*
+ * This file is part of the official PHP MCP SDK.
+ *
+ * A collaboration between Symfony and the PHP Foundation.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Mcp\Server\Transport\Http\Middleware;
+
+use Http\Discovery\Psr17FactoryDiscovery;
+use Mcp\Exception\ClientRegistrationException;
+use Mcp\Server\Transport\Http\OAuth\ClientRegistrarInterface;
+use Psr\Http\Message\ResponseFactoryInterface;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+use Psr\Http\Message\StreamFactoryInterface;
+use Psr\Http\Server\MiddlewareInterface;
+use Psr\Http\Server\RequestHandlerInterface;
+
+/**
+ * OAuth 2.0 Dynamic Client Registration (RFC 7591) middleware.
+ *
+ * Handles POST /register requests by delegating to a ClientRegistrarInterface
+ * and enriches /.well-known/oauth-authorization-server responses with the
+ * registration_endpoint.
+ */
+final class ClientRegistrationMiddleware implements MiddlewareInterface
+{
+    private const REGISTRATION_PATH = '/register';
+
+    private ResponseFactoryInterface $responseFactory;
+    private StreamFactoryInterface $streamFactory;
+
+    public function __construct(
+        private readonly ClientRegistrarInterface $registrar,
+        private readonly string $localBaseUrl,
+        ?ResponseFactoryInterface $responseFactory = null,
+        ?StreamFactoryInterface $streamFactory = null,
+    ) {
+        if ('' === trim($localBaseUrl)) {
+            throw new \InvalidArgumentException('The $localBaseUrl must not be empty.');
+        }
+
+        $this->responseFactory = $responseFactory ?? Psr17FactoryDiscovery::findResponseFactory();
+        $this->streamFactory = $streamFactory ?? Psr17FactoryDiscovery::findStreamFactory();
+    }
+
+    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
+    {
+        $path = $request->getUri()->getPath();
+
+        if ('POST' === $request->getMethod() && self::REGISTRATION_PATH === $path) {
+            return $this->handleRegistration($request);
+        }
+
+        $response = $handler->handle($request);
+
+        if ('GET' === $request->getMethod() && '/.well-known/oauth-authorization-server' === $path) {
+            return $this->enrichAuthServerMetadata($response);
+        }
+
+        return $response;
+    }
+
+    private function handleRegistration(ServerRequestInterface $request): ResponseInterface
+    {
+        $body = $request->getBody()->__toString();
+        $data = json_decode($body, true);
+
+        if (!\is_array($data)) {
+            return $this->jsonResponse(400, [
+                'error' => 'invalid_client_metadata',
+                'error_description' => 'Request body must be valid JSON.',
+            ]);
+        }
+
+        try {
+            $result = $this->registrar->register($data);
+        } catch (ClientRegistrationException $e) {
+            return $this->jsonResponse(400, [
+                'error' => 'invalid_client_metadata',
+                'error_description' => $e->getMessage(),
+            ]);
+        }
+
+        return $this->jsonResponse(201, $result);
+    }
+
+    private function enrichAuthServerMetadata(ResponseInterface $response): ResponseInterface
+    {
+        if (200 !== $response->getStatusCode()) {
+            return $response;
+        }
+
+        $stream = $response->getBody();
+
+        if ($stream->isSeekable()) {
+            $stream->rewind();
+        }
+
+        $metadata = json_decode($stream->__toString(), true);
+
+        if (!\is_array($metadata)) {
+            return $response;
+        }
+
+        $metadata['registration_endpoint'] = rtrim($this->localBaseUrl, '/').self::REGISTRATION_PATH;
+
+        return $this->jsonResponse(200, $metadata, [
+            'Cache-Control' => $response->getHeaderLine('Cache-Control'),
+        ]);
+    }
+
+    /**
+     * @param array<string, mixed>  $data
+     * @param array<string, string> $extraHeaders
+     */
+    private function jsonResponse(int $status, array $data, array $extraHeaders = []): ResponseInterface
+    {
+        $response = $this->responseFactory
+            ->createResponse($status)
+            ->withHeader('Content-Type', 'application/json')
+            ->withBody($this->streamFactory->createStream(
+                json_encode($data, \JSON_THROW_ON_ERROR | \JSON_UNESCAPED_SLASHES),
+            ));
+
+        foreach ($extraHeaders as $name => $value) {
+            if ('' !== $value) {
+                $response = $response->withHeader($name, $value);
+            }
+        }
+
+        return $response;
+    }
+}

src/Server/Transport/Http/OAuth/ClientRegistrarInterface.php

@@ -0,0 +1,29 @@
+<?php
+
+/*
+ * This file is part of the official PHP MCP SDK.
+ *
+ * A collaboration between Symfony and the PHP Foundation.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Mcp\Server\Transport\Http\OAuth;
+
+use Mcp\Exception\ClientRegistrationException;
+
+/**
+ * Interface for OAuth 2.0 Dynamic Client Registration (RFC 7591).
+ */
+interface ClientRegistrarInterface
+{
+    /**
+     * @param array<string, mixed> $registrationRequest
+     *
+     * @return array<string, mixed>
+     *
+     * @throws ClientRegistrationException
+     */
+    public function register(array $registrationRequest): array;
+}