Skip to content

feat: implement dynamic client registration#7096

Open
Zaimwa9 wants to merge 18 commits intofeat/setup-dot-and-as-metadatafrom
feat/implement-dynamic-client-registration
Open

feat: implement dynamic client registration#7096
Zaimwa9 wants to merge 18 commits intofeat/setup-dot-and-as-metadatafrom
feat/implement-dynamic-client-registration

Conversation

@Zaimwa9
Copy link
Copy Markdown
Contributor

@Zaimwa9 Zaimwa9 commented Apr 1, 2026

Thanks for submitting a PR! Please check the boxes below:

  • I have read the Contributing Guide.
  • I have added information to docs/ if required so people know about the feature.
  • I have filled in the "Changes" section below.
  • I have filled in the "How did you test this code" section below.

Changes

Closes #7033

Implements POST /o/register/ for DCR OAuth Dynamic Client Registration to enable MCP clients to self-register their application.

  • Added DCR endpoint that
    • accepts client_name and redirect_uris
    • creates a public DOT Application
    • returns a client_id
  • Redirect URI validation: HTTPS required (localhost/127.0.0.1 exception), no wildcards, no fragments, max 5 URIs
  • XSS on consent screen protection with client name sanitisation
  • Dedicated DCR_THROTTLE_RATE throttle scope at 10/min per IP
  • RFC 7591 compliant error responses (error + error_description format)
  • Daily recurring task to clean up stale applications (registered > 14 days ago, never used)

How did you test this code?

https://www.loom.com/share/8f821fda00cd48cbbc4673a509047364

  1. Start the dev server: make docker-up django-migrate && make serve
  2. Register a client:
curl -s -X POST http://localhost:8000/o/register/ \
  -H 'Content-Type: application/json' \
  -d '{"client_name": "OAuth Test Server", "redirect_uris": ["http://localhost:3000/oauth/callback"]}' \
  | python3 -m json.tool
  1. Update CLIENT_ID in api/oauth2_test_server.mjs with the returned client_id
  2. Run node api/oauth2_test_server.mjs and open http://localhost:3000
  3. Log in via the Django admin page, then authorise the application on the consent screen
  4. Verify the token response is returned (access_token, refresh_token, scope: mcp)

@Zaimwa9 Zaimwa9 requested a review from gagantrivedi April 1, 2026 14:56
@Zaimwa9 Zaimwa9 requested a review from a team as a code owner April 1, 2026 14:56
claude[bot]
claude bot reviewed Apr 1, 2026
View reviewed changes
Copy link
Copy Markdown

@claude claude bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, reopen this pull request to trigger a review.

@vercel
Copy link
Copy Markdown

vercel bot commented Apr 1, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments
Project Deployment Actions Updated (UTC)
docs Ignored Ignored Preview Apr 2, 2026 9:15am
flagsmith-frontend-preview Ignored Ignored Preview Apr 2, 2026 9:15am
flagsmith-frontend-staging Ignored Ignored Preview Apr 2, 2026 9:15am

Request Review

@github-actions github-actions bot added api Issue related to the REST API feature New feature or request labels Apr 1, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 1, 2026 •
edited
Loading

Docker builds report

Image Build Status Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-7096 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-api-test:pr-7096 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-7096 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith-api:pr-7096 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith:pr-7096 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-7096 Finished ✅ Results ✅

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 1, 2026 •
edited
Loading

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  43.8 seconds
commit  38ed2b9
info  🔄 Run: #15615 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  51.5 seconds
commit  2783d3e
info  🔄 Run: #15614 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  26.8 seconds
commit  2783d3e
info  🔄 Run: #15614 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  11.8 seconds
commit  38ed2b9
info  🔄 Run: #15615 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  1 minute, 10 seconds
commit  2783d3e
info  🔄 Run: #15614 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  53.9 seconds
commit  2783d3e
info  🔄 Run: #15614 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  10.5 seconds
commit  610acbd
info  🔄 Run: #15617 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  54.8 seconds
commit  610acbd
info  🔄 Run: #15617 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  55.5 seconds
commit  610acbd
info  🔄 Run: #15617 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  1 minute, 2 seconds
commit  610acbd
info  🔄 Run: #15617 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  40.8 seconds
commit  6806acb
info  🔄 Run: #15618 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  41.6 seconds
commit  6a98fa6
info  🔄 Run: #15619 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  9.6 seconds
commit  6806acb
info  🔄 Run: #15618 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  49.1 seconds
commit  6a98fa6
info  🔄 Run: #15619 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  16 passed

Details

stats  16 tests across 13 suites
duration  1 minute, 2 seconds
commit  6806acb
info  🔄 Run: #15618 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  53.1 seconds
commit  6806acb
info  🔄 Run: #15618 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  41 seconds
commit  910765b
info  🔄 Run: #15620 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  48.2 seconds
commit  910765b
info  🔄 Run: #15620 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  16 passed

Details

stats  16 tests across 13 suites
duration  57.3 seconds
commit  910765b
info  🔄 Run: #15620 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  52.1 seconds
commit  910765b
info  🔄 Run: #15620 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  25.4 seconds
commit  a1fea8e
info  🔄 Run: #15621 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  47.7 seconds
commit  779b0eb
info  🔄 Run: #15622 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  40.9 seconds
commit  779b0eb
info  🔄 Run: #15622 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  11.9 seconds
commit  a1fea8e
info  🔄 Run: #15621 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  16 passed

Details

stats  16 tests across 13 suites
duration  1 minute, 14 seconds
commit  a1fea8e
info  🔄 Run: #15621 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  45.8 seconds
commit  a1fea8e
info  🔄 Run: #15621 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  25.2 seconds
commit  0dcd6b7
info  🔄 Run: #15634 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  11 seconds
commit  0dcd6b7
info  🔄 Run: #15634 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  43.8 seconds
commit  0dcd6b7
info  🔄 Run: #15634 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  1 minute, 7 seconds
commit  0dcd6b7
info  🔄 Run: #15634 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  9.3 seconds
commit  a10dfd8
info  🔄 Run: #15635 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  52.3 seconds
commit  a10dfd8
info  🔄 Run: #15635 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  44 seconds
commit  a10dfd8
info  🔄 Run: #15635 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  1 minute, 12 seconds
commit  a10dfd8
info  🔄 Run: #15635 (attempt 1)

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 1, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.27%. Comparing base (ec0b067) to head (a10dfd8).

Additional details and impacted files 
@@                       Coverage Diff                        @@
##           feat/setup-dot-and-as-metadata    #7096    +/-   ##
================================================================
  Coverage                           98.27%   98.27%            
================================================================
  Files                                1344     1347     +3     
  Lines                               50126    50349   +223     
================================================================
+ Hits                                49259    49482   +223     
  Misses                                867      867

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 1, 2026
@github-actions github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 1, 2026
Zaimwa9 added 2 commits April 1, 2026 17:54
@Zaimwa9
feat: misc-cleanup
03717aa
@Zaimwa9
Merge branch 'feat/implement-dynamic-client-registration' of github.c…
910765b 
…om:Flagsmith/flagsmith into feat/implement-dynamic-client-registration
@github-actions github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 1, 2026
@github-actions github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 1, 2026
@github-actions github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 2, 2026
@github-actions github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 2, 2026
gagantrivedi
gagantrivedi requested changes Apr 3, 2026
View reviewed changes
api/app/settings/common.py


LOGIN_THROTTLE_RATE = env("LOGIN_THROTTLE_RATE", "20/min")
DCR_THROTTLE_RATE = env("DCR_THROTTLE_RATE", "10/min")
Copy link
Copy Markdown
Member

@gagantrivedi gagantrivedi Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the window of this shoulld be much bigger? something like 500/month?

api/tests/unit/oauth2_metadata/test_dcr.py
],
ids=["invalid-uri", "wildcard"],
)
def test_validate_redirect_uri__invalid_input__raises_validation_error(
Copy link
Copy Markdown
Member

@gagantrivedi gagantrivedi Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this live in a different test file? oauth2_metadata/test_service.py?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claude claude[bot] claude[bot] left review comments

@gagantrivedi gagantrivedi gagantrivedi requested changes

Assignees

@gagantrivedi gagantrivedi

Labels

api Issue related to the REST API feature New feature or request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Zaimwa9 @gagantrivedi