@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.d.ts

@@ -203,6 +203,13 @@ export declare class OAuthProviderControllerBackendService extends AbstractContr
      * this ships OFF by default while CIMD is the recommended path.
      */
     private handleDynamicRegistration;
+    /**
+     * The client configuration endpoint URL for one client — RFC 7592 §3's `registration_client_uri`.
+     *
+     * Built from the same issuer the discovery document advertises, so a client that resolved this
+     * server through discovery reaches the same origin here.
+     */
+    private registrationClientUri;
     /**
      * The SINGLE seam through which every OAuth authorization RESPONSE leaves this server.
      *
@@ -233,6 +240,113 @@ export declare class OAuthProviderControllerBackendService extends AbstractContr
      */
     private sendAuthorizationRedirect;
     /** RFC 7591 § 3.2.2 registration-error response: 400 + `error` / `error_description`. */
+    /**
+     * Authenticate a call to the client configuration endpoint, or answer and return null.
+     *
+     * Every RFC 7592 verb shares this, so the refusal ladder cannot drift between them — which is the
+     * whole reason it is a helper rather than three copies. The ladder, and why each rung is the code
+     * it is:
+     *
+     * - **404 when the application has not opted in.** Identical to `/oauth/register`: an application
+     *   without dynamic registration should be indistinguishable from one whose framework never had
+     *   the endpoint, so a 403 would advertise a capability one config flag away.
+     * - **401 with `WWW-Authenticate` when the Bearer token is absent or malformed.** "The client MUST
+     *   use its registration access token in all calls to this endpoint as an OAuth 2.0 Bearer Token."
+     *   spec-cite: RFC 7592 §2.
+     * - **401 when the client does not exist.** "If the client does not exist on this server, the
+     *   server MUST respond with HTTP 401 Unauthorized and the registration access token used to make
+     *   this request SHOULD be immediately revoked." spec-cite: RFC 7592 §2.1. The SHOULD is moot for
+     *   us: a token for a client that does not exist has no row to revoke, so there is nothing to do.
+     * - **403 when the client exists but was not dynamically registered.** "If the client does not have
+     *   permission to read its record, the server MUST return an HTTP 403 Forbidden." spec-cite: RFC
+     *   7592 §2.1. An operator- or organization-registered client is administered through the ordinary
+     *   authenticated resource surface; it holds no registration access token and must not be
+     *   reachable here even if one were somehow presented.
+     * - **401 when the presented token does not match.**
+     *
+     * Note the deliberate asymmetry: an unknown client is 401 and a known-but-ineligible one is 403,
+     * which is what the specification asks for even though it leaks that a client id exists. That
+     * disclosure is bounded — the caller already had to supply the id — and diverging from the
+     * specification here would break a conformant client's error handling.
+     */
+    private authenticateClientConfiguration;
+    /**
+     * Constant-time comparison of a presented registration access token against the stored digest.
+     *
+     * Both sides are SHA-256 hex, so they are always the same length and `timingSafeEqual` cannot
+     * throw — which is why the digests are compared rather than the raw values.
+     */
+    private registrationTokenMatches;
+    /**
+     * RFC 6750 §3 shape for every unauthenticated refusal at this endpoint.
+     *
+     * One description for a missing token and a wrong one, on purpose: distinguishing them tells an
+     * unauthenticated caller which half of its guess was right.
+     */
+    private sendClientConfigurationUnauthorized;
+    /**
+     * The client information response body — RFC 7592 §3, minus the two members §2.2 forbids a client
+     * to send back.
+     *
+     * `registration_access_token` is NOT echoed on read or update. It is returned once, at
+     * registration, and we do not rotate it: §5 permits rotation on a read or update ("MAY"), and
+     * taking that option means a client that loses the response has silently lost management access
+     * for good. The specification's own preference — "SHOULD NOT expire while a client is still
+     * actively registered" — points the same way.
+     */
+    private clientInformationResponse;
+    /**
+     * `GET /oauth/register/:clientId` — RFC 7592 §2.1 Client Read Request.
+     *
+     * "the authorization server responds with an HTTP 200 OK with content type of `application/json`".
+     * spec-cite: RFC 7592 §2.1.
+     */
+    private handleClientConfigurationRead;
+    /**
+     * `PUT /oauth/register/:clientId` — RFC 7592 §2.2 Client Update Request.
+     *
+     * **Full replacement, not a patch, and that is the specification's choice rather than ours:** "This
+     * request MUST include all client metadata fields as returned to the client from a previous
+     * registration, read, or update operation" and "Omitted fields MUST be treated as null or empty
+     * values by the server, indicating the client's request to delete them from the client's
+     * registration." spec-cite: RFC 7592 §2.2.
+     *
+     * So a client that sends only the field it wants to change DELETES everything else. That is
+     * surprising, it is what the specification requires, and it is why `redirect_uris` is re-validated
+     * on every update rather than assumed still present.
+     *
+     * Every confinement the registration endpoint applies is re-applied here, in the same order. A
+     * client that could widen its scopes, add a grant or change its auth method through an update
+     * would have found a way around the registration confinements by taking one extra step.
+     */
+    private handleClientConfigurationUpdate;
+    /**
+     * `DELETE /oauth/register/:clientId` — RFC 7592 §2.3 Client Delete Request.
+     *
+     * "If a client has been successfully deprovisioned, the authorization server MUST respond with an
+     * HTTP 204 No Content message." spec-cite: RFC 7592 §2.3.
+     *
+     * **Deprovisioned by STATUS, not by removing the row**, and the row is what makes that sound: every
+     * client-resolution path in this server refuses a non-`ACTIVE` client, so `INACTIVE` is
+     * indistinguishable from absent to any protocol caller — while the row survives for the audit
+     * trail, which is the thing an operator investigating a deleted client actually needs.
+     *
+     * The registration access token is invalidated by the same write, though not by being erased:
+     * `authenticateClientConfiguration` refuses a non-`ACTIVE` client before it ever compares a token,
+     * so the token authenticates nowhere from this moment. "If a client is deprovisioned from a server,
+     * any outstanding registration access token for that client MUST be invalidated at the same time."
+     * spec-cite: RFC 7592 §5. Keeping the digest on the row costs nothing and preserves the record of
+     * which token the client held, which an operator investigating a deleted client wants.
+     *
+     * **NOT DONE, and stated rather than implied:** "If possible, the authorization server SHOULD
+     * immediately invalidate all existing authorization grants and currently active access tokens, all
+     * refresh tokens, and all other tokens associated with this client." spec-cite: RFC 7592 §2.3.
+     * Already-issued access tokens keep working until they expire. Reaching them means driving the
+     * revocation machinery over every token minted for this client, which is a larger change than this
+     * endpoint; the client cannot obtain NEW tokens the moment this returns, because the token endpoint
+     * resolves the client and refuses it.
+     */
+    private handleClientConfigurationDelete;
     private sendRegistrationError;
     /**
      * Per-source-IP registration budget.

package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider-controller.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/controllers/oauth-provider-controller.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAGvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AAC7I,OAAO,EAAE,mCAAmC,EAAE,MAAM,8FAA8F,CAAC;AACnJ,OAAO,EAAE,4BAA4B,EAAoE,MAAM,uFAAuF,CAAC;AAIvM,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AAC7I,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AAGjG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AAC5I,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAInF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAczH;;;;;;;;;;;;;;GAcG;AACH,qBACa,qCAAsC,SAAQ,gCAAgC;IAKxC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;IACvB,OAAO,CAAC,QAAQ,CAAC,eAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAGjC,OAAO,CAAC,QAAQ,CAAC,eAAe;gBAdzC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACjB,YAAY,EAAE,gCAAgC,EAChD,gBAAgB,EAAE,uBAAuB,EACxC,UAAU,EAAE,iBAAiB,EACzB,eAAe,EAAE,mCAAmC,EAC7D,YAAY,EAAE,YAAY,EACtB,SAAS,EAAE,uBAAuB,EACpC,iBAAiB,EAAE,4BAA4B,EAC3C,WAAW,EAAE,gCAAgC,EAC5C,YAAY,EAAE,0BAA0B,EAG5C,eAAe,EAAE,6BAA6B;IAK7G,SAAS,CAAC,WAAW,IAAI,IAAI;IAkE7B;;;;;;;;;;;;OAYG;YACW,YAAY;IAoD1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;YACW,gBAAgB;IAqH9B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,uBAAuB;IAgCrC;;;;;OAKG;YACW,eAAe;IAwG7B;;;OAGG;YACW,UAAU;IAKxB;;;;OAIG;YACW,WAAW;IA+GzB;;;;;;;;;;;;;;OAcG;IACH,wEAAwE;IACxE,OAAO,CAAC,gCAAgC;IAQxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;YACW,yBAAyB;IA2KvC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,yBAAyB;IAWjC,yFAAyF;IACzF,OAAO,CAAC,qBAAqB;IAK7B;;;;;;;OAOG;YACW,6BAA6B;YAa7B,eAAe;IA+I7B;;;;;;;;;;;;;;;OAeG;YACW,qBAAqB;IA6HnC;;;;;OAKG;YACW,cAAc;IA2B5B;;;;OAIG;YACW,wBAAwB;IAYtC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAehC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,cAAc;CAQvB"}
+{"version":3,"file":"oauth-provider-controller.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/controllers/oauth-provider-controller.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAGvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AAC7I,OAAO,EAAE,mCAAmC,EAAE,MAAM,8FAA8F,CAAC;AACnJ,OAAO,EAAE,4BAA4B,EAAoE,MAAM,uFAAuF,CAAC;AAIvM,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AAC7I,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AAGjG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AAC5I,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAInF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAgBzH;;;;;;;;;;;;;;GAcG;AACH,qBACa,qCAAsC,SAAQ,gCAAgC;IAKxC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;IACvB,OAAO,CAAC,QAAQ,CAAC,eAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAGjC,OAAO,CAAC,QAAQ,CAAC,eAAe;gBAdzC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACjB,YAAY,EAAE,gCAAgC,EAChD,gBAAgB,EAAE,uBAAuB,EACxC,UAAU,EAAE,iBAAiB,EACzB,eAAe,EAAE,mCAAmC,EAC7D,YAAY,EAAE,YAAY,EACtB,SAAS,EAAE,uBAAuB,EACpC,iBAAiB,EAAE,4BAA4B,EAC3C,WAAW,EAAE,gCAAgC,EAC5C,YAAY,EAAE,0BAA0B,EAG5C,eAAe,EAAE,6BAA6B;IAK7G,SAAS,CAAC,WAAW,IAAI,IAAI;IA4E7B;;;;;;;;;;;;OAYG;YACW,YAAY;IAoD1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;YACW,gBAAgB;IAqH9B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,uBAAuB;IAgCrC;;;;;OAKG;YACW,eAAe;IAwG7B;;;OAGG;YACW,UAAU;IAKxB;;;;OAIG;YACW,WAAW;IA+GzB;;;;;;;;;;;;;;OAcG;IACH,wEAAwE;IACxE,OAAO,CAAC,gCAAgC;IAQxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;YACW,yBAAyB;IA6LvC;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAM7B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,yBAAyB;IAWjC,yFAAyF;IAKzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;YACW,+BAA+B;IAkE7C;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAOhC;;;;;OAKG;IACH,OAAO,CAAC,mCAAmC;IAM3C;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAcjC;;;;;OAKG;YACW,6BAA6B;IAQ3C;;;;;;;;;;;;;;;;OAgBG;YACW,+BAA+B;IA+H7C;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,+BAA+B;IAmB7C,OAAO,CAAC,qBAAqB;IAK7B;;;;;;;OAOG;YACW,6BAA6B;YAa7B,eAAe;IA+I7B;;;;;;;;;;;;;;;OAeG;YACW,qBAAqB;IA6HnC;;;;;OAKG;YACW,cAAc;IA2B5B;;;;OAIG;YACW,wBAAwB;IAYtC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAehC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,cAAc;CAQvB"}

package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.js

@@ -11,6 +11,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import 'reflect-metadata';
+import { timingSafeEqual } from 'node:crypto';
 import { inject, injectable } from 'inversify';
 import cors from 'cors';
 import { AbstractControllerBackendService } from '../../../base-classes/services/controllers/abstract-controller.backend.service.js';
@@ -23,7 +24,7 @@ import { OAuthProviderTokenBackendService } from '../../../security/authenticati
 import { OidcAuthorizationCodeBackendService } from '../../../security/authentications/services/oidc-authorization-code.backend.service.js';
 import { OidcUserClaimsBackendService, OIDC_SUPPORTED_IDENTITY_SCOPES, OIDC_SCOPE_GATED_IDENTITY_CLAIMS } from '../../../security/authentications/services/oidc-user-claims.backend.service.js';
 import { CimdTrustPolicy } from '../../../security/authentications/models/cimd.backend.schemas.js';
-import { generateOAuthClientSecretMaterial } from '../../../security/oauth-clients/oauth-client-generation.backend.utils.js';
+import { generateOAuthClientSecretMaterial, generateRegistrationAccessTokenMaterial, hashRegistrationAccessToken } from '../../../security/oauth-clients/oauth-client-generation.backend.utils.js';
 import { CimdClientMetadataBackendService } from '../../../security/authentications/services/cimd-client-metadata.backend.service.js';
 import { AppConfigurationService } from '../../../config/services/app-configuration.backend.service.js';
 import { JwtBackendService } from '../../../security/jwt/services/jwt.backend.service.js';
@@ -34,7 +35,7 @@ import { getClientIpFromRequest } from '../../../runtime/utils/request-client-ip
 import { assertMachineAuthAttemptWithinRate, recordMachineAuthFailure } from '../../../security/authentications/services/utils/machine-auth-rate-limit.backend.utils.js';
 import { isValidS256CodeChallenge } from '../../../security/authentications/services/utils/pkce.backend.utils.js';
 import { AuditLogsBackendService } from '../../../compliance/audit-trails/services/audit-logs.backend.service.js';
-import { ApiKeyScope, CoreResourceType, ExecutionContext_ExecutionType, MANUAL_CONTROLLER_ROUTES_URLS, ManualControllerRouteKey, OAuthClientRegistrationOrigin, OAuthGrantType, OAuthTokenEndpointAuthMethod, isSafeOAuthRedirectUri, isWildoBackendError, } from '@wildo-ai/saas-models';
+import { ApiKeyScope, CoreResourceType, ExecutionContext_ExecutionType, MANUAL_CONTROLLER_ROUTES_URLS, ManualControllerRouteKey, OAuthClientRegistrationOrigin, OAuthClientStatus, OAuthGrantType, OAuthTokenEndpointAuthMethod, isSafeOAuthRedirectUri, isWildoBackendError, } from '@wildo-ai/saas-models';
 /**
  * OAuth 2.0 Authorization Server endpoints (Wildo-AS-PROVIDER). A THIN transport wrapper
  * over {@link OAuthProviderTokenBackendService} — it parses the request per RFC 6749 and
@@ -127,6 +128,15 @@ let OAuthProviderControllerBackendService = class OAuthProviderControllerBackend
         const registerUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER];
         this.router.post(registerUrl, this.asyncHandler(this.handleDynamicRegistration.bind(this)));
         this.logRouteRegistration('POST', registerUrl, 'RFC 7591 dynamic client registration (404 unless opted in)');
+        // RFC 7592 §2: ONE client configuration endpoint, three methods. Registered unconditionally like
+        // `/oauth/register` above and gated by the same opt-in inside the handler.
+        const registerClientUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT];
+        this.router.get(registerClientUrl, this.asyncHandler(this.handleClientConfigurationRead.bind(this)));
+        this.router.put(registerClientUrl, this.asyncHandler(this.handleClientConfigurationUpdate.bind(this)));
+        this.router.delete(registerClientUrl, this.asyncHandler(this.handleClientConfigurationDelete.bind(this)));
+        this.logRouteRegistration('GET', registerClientUrl, 'RFC 7592 client read (404 unless opted in)');
+        this.logRouteRegistration('PUT', registerClientUrl, 'RFC 7592 client update (404 unless opted in)');
+        this.logRouteRegistration('DELETE', registerClientUrl, 'RFC 7592 client delete (404 unless opted in)');
     }
     /**
      * `POST /oauth/revoke` — RFC 7009 token revocation. Revokes the presented `token` (a user
@@ -815,6 +825,11 @@ let OAuthProviderControllerBackendService = class OAuthProviderControllerBackend
             return;
         }
         const secretMaterial = generateOAuthClientSecretMaterial(ApiKeyScope.APPLICATION);
+        // RFC 7592 §3: the registration response carries a `registration_access_token` the client uses at
+        // the client configuration endpoint, and a `registration_client_uri` naming that endpoint. Minted
+        // here and returned exactly once — there is no way to recover it afterwards, which is why §5 says
+        // it "SHOULD NOT expire while a client is still actively registered".
+        const registrationTokenMaterial = generateRegistrationAccessTokenMaterial();
         const created = await this.systemAccess.createAsSystem(CoreResourceType.OAUTH_CLIENTS_APPLICATION, {
             name: clientName,
             scope: ApiKeyScope.APPLICATION,
@@ -832,11 +847,20 @@ let OAuthProviderControllerBackendService = class OAuthProviderControllerBackend
             registrationOrigin: OAuthClientRegistrationOrigin.DYNAMIC,
             hashedSecret: secretMaterial.hashedSecret,
             secretPrefix: secretMaterial.secretPrefix,
+            registrationAccessTokenHash: registrationTokenMaterial.registrationAccessTokenHash,
+            registrationAccessTokenPrefix: registrationTokenMaterial.registrationAccessTokenPrefix,
         }, {
             // `registrationOrigin`, `hashedSecret` and `secretPrefix` all carry
             // `.excludeFromCreate()` — they are server-managed precisely so no caller can author them.
             // This endpoint IS the server-side door, so it re-attaches them explicitly.
-            preserveServerInjectedFields: ['registrationOrigin', 'hashedSecret', 'secretPrefix'],
+            preserveServerInjectedFields: [
+                'registrationOrigin', 'hashedSecret', 'secretPrefix',
+                // Same reason as the two above: server-managed, so `.excludeFromCreate()` strips them and
+                // this endpoint — the server-side door — re-attaches them explicitly. Omitting them here
+                // would persist a client with NO registration access token, and every management call would
+                // then fail 401 with nothing to diagnose.
+                'registrationAccessTokenHash', 'registrationAccessTokenPrefix',
+            ],
         });
         // assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — an anonymous party created a
         // client identity in this application. Fire-and-forget; auditing must never fail the request it
@@ -864,8 +888,23 @@ let OAuthProviderControllerBackendService = class OAuthProviderControllerBackend
             response_types: ['code'],
             token_endpoint_auth_method: OAuthTokenEndpointAuthMethod.NONE,
             scope: (requestedScopes.length > 0 ? requestedScopes : [...OIDC_SUPPORTED_IDENTITY_SCOPES]).join(' '),
+            // RFC 7592 §3 — both REQUIRED in a registration response that supports management. The token
+            // appears here and NOWHERE else, ever.
+            registration_access_token: registrationTokenMaterial.plainToken,
+            registration_client_uri: this.registrationClientUri(created._id),
         }, 201);
     }
+    /**
+     * The client configuration endpoint URL for one client — RFC 7592 §3's `registration_client_uri`.
+     *
+     * Built from the same issuer the discovery document advertises, so a client that resolved this
+     * server through discovery reaches the same origin here.
+     */
+    registrationClientUri(clientId) {
+        const template = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT];
+        const issuer = this.appConfigService.resolveApiResourceAudience();
+        return `${issuer}${template.replace(':clientId', encodeURIComponent(clientId))}`;
+    }
     /**
      * The SINGLE seam through which every OAuth authorization RESPONSE leaves this server.
      *
@@ -905,6 +944,318 @@ let OAuthProviderControllerBackendService = class OAuthProviderControllerBackend
         this.jsonSuccess(res, { redirect_to: redirect.toString() }, 200);
     }
     /** RFC 7591 § 3.2.2 registration-error response: 400 + `error` / `error_description`. */
+    /* ───────────────────────────────────────────────────────────────────────────
+     * RFC 7592 — client configuration endpoint
+     * ──────────────────────────────────────────────────────────────────────── */
+    /**
+     * Authenticate a call to the client configuration endpoint, or answer and return null.
+     *
+     * Every RFC 7592 verb shares this, so the refusal ladder cannot drift between them — which is the
+     * whole reason it is a helper rather than three copies. The ladder, and why each rung is the code
+     * it is:
+     *
+     * - **404 when the application has not opted in.** Identical to `/oauth/register`: an application
+     *   without dynamic registration should be indistinguishable from one whose framework never had
+     *   the endpoint, so a 403 would advertise a capability one config flag away.
+     * - **401 with `WWW-Authenticate` when the Bearer token is absent or malformed.** "The client MUST
+     *   use its registration access token in all calls to this endpoint as an OAuth 2.0 Bearer Token."
+     *   spec-cite: RFC 7592 §2.
+     * - **401 when the client does not exist.** "If the client does not exist on this server, the
+     *   server MUST respond with HTTP 401 Unauthorized and the registration access token used to make
+     *   this request SHOULD be immediately revoked." spec-cite: RFC 7592 §2.1. The SHOULD is moot for
+     *   us: a token for a client that does not exist has no row to revoke, so there is nothing to do.
+     * - **403 when the client exists but was not dynamically registered.** "If the client does not have
+     *   permission to read its record, the server MUST return an HTTP 403 Forbidden." spec-cite: RFC
+     *   7592 §2.1. An operator- or organization-registered client is administered through the ordinary
+     *   authenticated resource surface; it holds no registration access token and must not be
+     *   reachable here even if one were somehow presented.
+     * - **401 when the presented token does not match.**
+     *
+     * Note the deliberate asymmetry: an unknown client is 401 and a known-but-ineligible one is 403,
+     * which is what the specification asks for even though it leaks that a client id exists. That
+     * disclosure is bounded — the caller already had to supply the id — and diverging from the
+     * specification here would break a conformant client's error handling.
+     */
+    async authenticateClientConfiguration(req, res) {
+        if (!this.dynamicRegistrationConfiguration().enabled) {
+            res.status(404).json({ error: 'not_found' });
+            return null;
+        }
+        const header = req.headers.authorization;
+        const presented = typeof header === 'string' && header.startsWith('Bearer ')
+            ? header.slice('Bearer '.length).trim()
+            : undefined;
+        if (!presented) {
+            this.sendClientConfigurationUnauthorized(res, 'a registration access token is required');
+            return null;
+        }
+        const clientId = String(req.params.clientId ?? '');
+        if (!clientId) {
+            this.sendClientConfigurationUnauthorized(res, 'unknown client');
+            return null;
+        }
+        const record = await this.systemAccess.readAsSystem(CoreResourceType.OAUTH_CLIENTS_APPLICATION, clientId).catch(() => null);
+        if (!record) {
+            this.sendClientConfigurationUnauthorized(res, 'unknown client');
+            return null;
+        }
+        if (record.registrationOrigin !== OAuthClientRegistrationOrigin.DYNAMIC) {
+            res.set('Cache-Control', 'no-store');
+            res.status(403).json({ error: 'access_denied', error_description: 'this client is not managed through dynamic registration' });
+            return null;
+        }
+        /*
+         * A DEPROVISIONED client is not manageable, and this rung is what makes its registration access
+         * token invalid.
+         *
+         * "If a client is deprovisioned from a server, any outstanding registration access token for
+         * that client MUST be invalidated at the same time." spec-cite: RFC 7592 §5. A token that
+         * authenticates at no endpoint is invalidated in the only sense that matters — so `DELETE` marks
+         * the client `INACTIVE` and this refuses every later call, rather than clearing the stored hash
+         * and losing the record of which token the client held, which an operator investigating a
+         * deleted client wants.
+         */
+        if (record.status !== OAuthClientStatus.ACTIVE) {
+            this.sendClientConfigurationUnauthorized(res, 'invalid registration access token');
+            return null;
+        }
+        const storedHash = record.registrationAccessTokenHash;
+        // Compared through `timingSafeEqual` over the two DIGESTS: both are fixed-length hex, so the
+        // buffers can never differ in length and the comparison cannot leak a prefix match by timing.
+        if (!storedHash || !this.registrationTokenMatches(presented, storedHash)) {
+            this.sendClientConfigurationUnauthorized(res, 'invalid registration access token');
+            return null;
+        }
+        return { clientId, record };
+    }
+    /**
+     * Constant-time comparison of a presented registration access token against the stored digest.
+     *
+     * Both sides are SHA-256 hex, so they are always the same length and `timingSafeEqual` cannot
+     * throw — which is why the digests are compared rather than the raw values.
+     */
+    registrationTokenMatches(presented, storedHash) {
+        const presentedDigest = Buffer.from(hashRegistrationAccessToken(presented), 'hex');
+        const storedDigest = Buffer.from(storedHash, 'hex');
+        if (presentedDigest.length !== storedDigest.length || presentedDigest.length === 0)
+            return false;
+        return timingSafeEqual(presentedDigest, storedDigest);
+    }
+    /**
+     * RFC 6750 §3 shape for every unauthenticated refusal at this endpoint.
+     *
+     * One description for a missing token and a wrong one, on purpose: distinguishing them tells an
+     * unauthenticated caller which half of its guess was right.
+     */
+    sendClientConfigurationUnauthorized(res, description) {
+        res.set('Cache-Control', 'no-store');
+        res.set('WWW-Authenticate', 'Bearer error="invalid_token"');
+        res.status(401).json({ error: 'invalid_token', error_description: description });
+    }
+    /**
+     * The client information response body — RFC 7592 §3, minus the two members §2.2 forbids a client
+     * to send back.
+     *
+     * `registration_access_token` is NOT echoed on read or update. It is returned once, at
+     * registration, and we do not rotate it: §5 permits rotation on a read or update ("MAY"), and
+     * taking that option means a client that loses the response has silently lost management access
+     * for good. The specification's own preference — "SHOULD NOT expire while a client is still
+     * actively registered" — points the same way.
+     */
+    clientInformationResponse(clientId, record) {
+        return {
+            client_id: clientId,
+            client_name: record.name,
+            redirect_uris: record.redirectUris ?? [],
+            post_logout_redirect_uris: record.postLogoutRedirectUris ?? [],
+            grant_types: record.allowedGrants ?? [],
+            response_types: ['code'],
+            token_endpoint_auth_method: record.tokenEndpointAuthMethod,
+            scope: (record.allowedScopes ?? []).join(' '),
+            registration_client_uri: this.registrationClientUri(clientId),
+        };
+    }
+    /**
+     * `GET /oauth/register/:clientId` — RFC 7592 §2.1 Client Read Request.
+     *
+     * "the authorization server responds with an HTTP 200 OK with content type of `application/json`".
+     * spec-cite: RFC 7592 §2.1.
+     */
+    async handleClientConfigurationRead(req, res) {
+        const authenticated = await this.authenticateClientConfiguration(req, res);
+        if (!authenticated)
+            return;
+        res.set('Cache-Control', 'no-store');
+        this.jsonSuccess(res, this.clientInformationResponse(authenticated.clientId, authenticated.record), 200);
+    }
+    /**
+     * `PUT /oauth/register/:clientId` — RFC 7592 §2.2 Client Update Request.
+     *
+     * **Full replacement, not a patch, and that is the specification's choice rather than ours:** "This
+     * request MUST include all client metadata fields as returned to the client from a previous
+     * registration, read, or update operation" and "Omitted fields MUST be treated as null or empty
+     * values by the server, indicating the client's request to delete them from the client's
+     * registration." spec-cite: RFC 7592 §2.2.
+     *
+     * So a client that sends only the field it wants to change DELETES everything else. That is
+     * surprising, it is what the specification requires, and it is why `redirect_uris` is re-validated
+     * on every update rather than assumed still present.
+     *
+     * Every confinement the registration endpoint applies is re-applied here, in the same order. A
+     * client that could widen its scopes, add a grant or change its auth method through an update
+     * would have found a way around the registration confinements by taking one extra step.
+     */
+    async handleClientConfigurationUpdate(req, res) {
+        const authenticated = await this.authenticateClientConfiguration(req, res);
+        if (!authenticated)
+            return;
+        const { clientId, record } = authenticated;
+        const body = (req.body ?? {});
+        // "The client MUST include its `client_id` field in the request, and it MUST be the same as its
+        // currently issued client identifier." spec-cite: RFC 7592 §2.2. A mismatch is the client
+        // addressing one registration and describing another, which is a client bug worth naming.
+        if (body.client_id !== clientId) {
+            this.sendRegistrationError(res, 'invalid_client_metadata', 'client_id must be present and must match the client being updated');
+            return;
+        }
+        // "The updated client metadata fields request MUST NOT include the `registration_access_token`,
+        // `registration_client_uri`, `client_secret_expires_at`, or `client_id_issued_at` fields."
+        // spec-cite: RFC 7592 §2.2. Refused rather than ignored: a client sending one has misunderstood
+        // the contract, and silently dropping it would leave it believing it had rotated its own token.
+        const forbidden = ['registration_access_token', 'registration_client_uri', 'client_secret_expires_at', 'client_id_issued_at']
+            .find((field) => body[field] !== undefined);
+        if (forbidden) {
+            this.sendRegistrationError(res, 'invalid_client_metadata', `${forbidden} must not be included in an update request`);
+            return;
+        }
+        // "If the client includes the `client_secret` field in the request, the value of this field MUST
+        // match the currently issued client secret for that client. The client MUST NOT be allowed to
+        // overwrite its existing client secret with its own chosen value." spec-cite: RFC 7592 §2.2.
+        // A dynamically registered client is PUBLIC and never received a secret, so any value it sends
+        // cannot match one — refuse rather than compare against a secret it does not have.
+        if (body.client_secret !== undefined) {
+            this.sendRegistrationError(res, 'invalid_client_metadata', 'this client has no client secret to confirm');
+            return;
+        }
+        const redirectUris = body.redirect_uris;
+        if (!Array.isArray(redirectUris) || redirectUris.length === 0 || !redirectUris.every((uri) => typeof uri === 'string')) {
+            this.sendRegistrationError(res, 'invalid_redirect_uri', 'redirect_uris must be a non-empty array of strings');
+            return;
+        }
+        const unsafe = redirectUris.find((uri) => !isSafeOAuthRedirectUri(uri));
+        if (unsafe) {
+            this.sendRegistrationError(res, 'invalid_redirect_uri', `redirect_uri is not permitted: ${unsafe}`);
+            return;
+        }
+        // Omitted ⇒ emptied, per §2.2. That is the whole reason this reads as a replacement.
+        let postLogoutRedirectUris = [];
+        if (body.post_logout_redirect_uris !== undefined) {
+            if (!Array.isArray(body.post_logout_redirect_uris) || !body.post_logout_redirect_uris.every((uri) => typeof uri === 'string')) {
+                this.sendRegistrationError(res, 'invalid_client_metadata', 'post_logout_redirect_uris must be an array of strings');
+                return;
+            }
+            const unsafePostLogout = body.post_logout_redirect_uris.find((uri) => !isSafeOAuthRedirectUri(uri));
+            if (unsafePostLogout) {
+                this.sendRegistrationError(res, 'invalid_client_metadata', `post_logout_redirect_uri is not permitted: ${unsafePostLogout}`);
+                return;
+            }
+            postLogoutRedirectUris = body.post_logout_redirect_uris;
+        }
+        const clientName = typeof body.client_name === 'string' && body.client_name.trim().length > 0
+            ? body.client_name.trim().slice(0, 100)
+            : undefined;
+        if (!clientName) {
+            this.sendRegistrationError(res, 'invalid_client_metadata', 'client_name is required');
+            return;
+        }
+        // The registration confinements, re-applied. See `handleDynamicRegistration` for why each one
+        // refuses rather than downgrades; the reasoning is identical and is not repeated here.
+        if (body.roles !== undefined) {
+            this.sendRegistrationError(res, 'invalid_client_metadata', 'roles cannot be requested at dynamic registration');
+            return;
+        }
+        const requestedScopes = typeof body.scope === 'string' ? body.scope.split(/\s+/).filter(Boolean) : [];
+        const beyondIdentity = requestedScopes.filter((scope) => !OIDC_SUPPORTED_IDENTITY_SCOPES.includes(scope));
+        if (beyondIdentity.length > 0) {
+            this.sendRegistrationError(res, 'invalid_client_metadata', `scope(s) not available to a dynamically registered client: ${beyondIdentity.join(', ')}`);
+            return;
+        }
+        const requestedGrants = Array.isArray(body.grant_types) ? body.grant_types : [OAuthGrantType.AUTHORIZATION_CODE];
+        const forbiddenGrant = requestedGrants.find((grant) => grant !== OAuthGrantType.AUTHORIZATION_CODE && grant !== OAuthGrantType.REFRESH_TOKEN);
+        if (forbiddenGrant) {
+            this.sendRegistrationError(res, 'invalid_client_metadata', `grant_type not available to a dynamically registered client: ${String(forbiddenGrant)}`);
+            return;
+        }
+        const requestedAuthMethod = body.token_endpoint_auth_method;
+        if (requestedAuthMethod !== undefined && requestedAuthMethod !== OAuthTokenEndpointAuthMethod.NONE) {
+            this.sendRegistrationError(res, 'invalid_client_metadata', 'only token_endpoint_auth_method=none is available to a dynamically registered client');
+            return;
+        }
+        const updated = await this.systemAccess.updateAsSystem(CoreResourceType.OAUTH_CLIENTS_APPLICATION, clientId, {
+            name: clientName,
+            redirectUris,
+            postLogoutRedirectUris,
+            allowedScopes: requestedScopes.length > 0 ? requestedScopes : [...OIDC_SUPPORTED_IDENTITY_SCOPES],
+        });
+        if (!updated) {
+            this.sendClientConfigurationUnauthorized(res, 'unknown client');
+            return;
+        }
+        // assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a self-registered client changed
+        // its own registration. Same standing as the registration itself, so the same audit concern:
+        // `redirect_uris` is where a client's authorization responses are delivered, and an update is the
+        // one way that set moves after registration.
+        void this.auditLogs.logDynamicClientRegistered({
+            clientId,
+            clientName,
+            redirectUris,
+            postLogoutRedirectUris,
+            ipAddress: getClientIpFromRequest(req),
+        }).catch((auditError) => this.logger.warn('DYNAMIC_CLIENT_REGISTERED audit emit failed on update (non-fatal)', {
+            ...projectCaughtErrorLogFields(auditError),
+        }));
+        res.set('Cache-Control', 'no-store');
+        this.jsonSuccess(res, this.clientInformationResponse(clientId, { ...record, ...updated }), 200);
+    }
+    /**
+     * `DELETE /oauth/register/:clientId` — RFC 7592 §2.3 Client Delete Request.
+     *
+     * "If a client has been successfully deprovisioned, the authorization server MUST respond with an
+     * HTTP 204 No Content message." spec-cite: RFC 7592 §2.3.
+     *
+     * **Deprovisioned by STATUS, not by removing the row**, and the row is what makes that sound: every
+     * client-resolution path in this server refuses a non-`ACTIVE` client, so `INACTIVE` is
+     * indistinguishable from absent to any protocol caller — while the row survives for the audit
+     * trail, which is the thing an operator investigating a deleted client actually needs.
+     *
+     * The registration access token is invalidated by the same write, though not by being erased:
+     * `authenticateClientConfiguration` refuses a non-`ACTIVE` client before it ever compares a token,
+     * so the token authenticates nowhere from this moment. "If a client is deprovisioned from a server,
+     * any outstanding registration access token for that client MUST be invalidated at the same time."
+     * spec-cite: RFC 7592 §5. Keeping the digest on the row costs nothing and preserves the record of
+     * which token the client held, which an operator investigating a deleted client wants.
+     *
+     * **NOT DONE, and stated rather than implied:** "If possible, the authorization server SHOULD
+     * immediately invalidate all existing authorization grants and currently active access tokens, all
+     * refresh tokens, and all other tokens associated with this client." spec-cite: RFC 7592 §2.3.
+     * Already-issued access tokens keep working until they expire. Reaching them means driving the
+     * revocation machinery over every token minted for this client, which is a larger change than this
+     * endpoint; the client cannot obtain NEW tokens the moment this returns, because the token endpoint
+     * resolves the client and refuses it.
+     */
+    async handleClientConfigurationDelete(req, res) {
+        const authenticated = await this.authenticateClientConfiguration(req, res);
+        if (!authenticated)
+            return;
+        const { clientId } = authenticated;
+        const deprovisioned = await this.systemAccess.updateAsSystem(CoreResourceType.OAUTH_CLIENTS_APPLICATION, clientId, { status: OAuthClientStatus.INACTIVE });
+        if (!deprovisioned) {
+            this.sendClientConfigurationUnauthorized(res, 'unknown client');
+            return;
+        }
+        res.set('Cache-Control', 'no-store');
+        res.status(204).send();
+    }
     sendRegistrationError(res, error, description) {
         res.set('Cache-Control', 'no-store');
         res.status(400).json({ error, error_description: description });