feat: support OAuth 2.1 / MCP login flow

[acoshift]

Summary

Turns this service into an OAuth 2.1 authorization server that an MCP CLI client can authenticate against, while keeping the existing confidential web-client flow working unchanged. Flows are discriminated by the client's token_endpoint_auth_method: existing rows default to client_secret_post (unchanged); registered MCP clients are public (none) and PKCE-gated.

What's added

• Discovery metadata (RFC 8414) at GET /.well-known/oauth-authorization-server
• PKCE (S256) on the authorize and token endpoints
• Public clients: /token accepts code_verifier instead of client_secret
• Dynamic Client Registration (RFC 7591) at POST /register
• Token introspection (RFC 7662) at POST /introspect for the (separate) resource server, guarded by INTROSPECTION_TOKEN
• Loopback redirect URIs (RFC 8252) for native/CLI clients
• Standard token response — access_token + expires_in; refresh_token retained for backward compatibility
• BASE_URL / INTROSPECTION_TOKEN env vars; periodic cleanup of expired oauth2_sessions / oauth2_codes

Database migration

Apply against the existing database before deploying:

-- oauth2_clients: allow public clients (no secret) and dynamic client registration.
alter table oauth2_clients alter column secret drop not null;
alter table oauth2_clients alter column redirect_uri set default '';
alter table oauth2_clients add column if not exists redirect_uris              string[] not null default array[]::string[];
alter table oauth2_clients add column if not exists token_endpoint_auth_method string not null default 'client_secret_post';
alter table oauth2_clients add column if not exists client_name                string not null default '';

-- oauth2_codes: PKCE, bound redirect_uri, resource indicator (RFC 8707).
alter table oauth2_codes add column if not exists code_challenge        string not null default '';
alter table oauth2_codes add column if not exists code_challenge_method string not null default '';
alter table oauth2_codes add column if not exists redirect_uri          string not null default '';
alter table oauth2_codes add column if not exists resource              string not null default '';

-- oauth2_sessions: carry PKCE + resource across the Google round-trip.
alter table oauth2_sessions add column if not exists code_challenge        string not null default '';
alter table oauth2_sessions add column if not exists code_challenge_method string not null default '';
alter table oauth2_sessions add column if not exists resource              string not null default '';

Tests

First tests in the repo. They run against a real CockroachDB (cockroach-go/v2 testserver per test, schema applied from the embedded schema/*.sql migrations) and stub Google's token endpoint via the googleTokenURL package var — covering both the old confidential flow (regression) and the new public/PKCE flow, DCR, and introspection. go test ./..., go vet ./..., gofmt -l all clean.

Review notes

• token_type case change — the legacy /token response used "token_type":"bearer"; it now returns "Bearer" (the RFC-registered value). refresh_token is preserved. If the existing web client compares token_type case-sensitively, this needs a revert to lowercase.
• resource (RFC 8707) is stored but not enforced — issued tokens are the existing opaque 7-day tokens, not audience-bound. Full audience restriction would need per-resource tokens (larger change).
• Resource-server side (out of scope here) — the MCP server must return 401 + WWW-Authenticate pointing at /.well-known/oauth-protected-resource, serve that metadata, and validate tokens via /introspect.

Test plan

• go build ./..., go vet ./..., gofmt -l clean
• Automated tests (go test ./...) cover old confidential + new PKCE flows, DCR, introspection
• Apply migration; curl $BASE_URL/.well-known/oauth-authorization-server
• End-to-end with a real client: claude mcp add --transport http …

🤖 Generated with Claude Code