Add OAuth device flow, token introspection, and dynamic client registration

Adds three OAuth surfaces to the OIDC provider so CLIs, terminal agents, and
MCP connectors can authenticate as real users instead of using static API keys.

Device Authorization Grant (RFC 8628):
- OidcDeviceCode model (HMAC device_code, short plaintext user_code, nullable
  user until approval, slow_down polling state), mirroring OidcAuthorizationCode
- POST /oauth/device_authorization issues the code pair + verification URIs
- device_code grant on /oauth/token returns authorization_pending / slow_down /
  access_denied / expired_token, then the standard token triple; single-use
- Authenticated /device approval page, gated by Application#user_allowed?

Token Introspection (RFC 7662):
- POST /oauth/introspect: confidential-caller-authenticated; returns active,
  scope, and the user's groups so resource servers can authorize on membership

Dynamic Client Registration (RFC 7591):
- POST /oauth/register creates public/confidential clients (PKCE required)
- Runtime toggle via a new Setting store + admin switch on the Applications page;
  off by default, env var CLINCH_DCR_ENABLED as bootstrap fallback
- New clients are default-deny (no allowed_groups) until an admin grants access
- RFC 8414 metadata alias at /.well-known/oauth-authorization-server;
  registration_endpoint advertised only while the window is open

Discovery advertises all three grants/endpoints. Seeds add a clinch-cli public
client and a c2a2-introspection confidential client. ADRs in docs/decisions
record the opaque-vs-JWT, device-flow, and DCR-security decisions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F7cwhwDJp3MJJDoNPVE6zq

test/controllers/oidc_registration_controller_test.rb

@@ -0,0 +1,137 @@
+require "test_helper"
+
+class OidcRegistrationControllerTest < ActionDispatch::IntegrationTest
+  JSON_HEADERS = {"Content-Type" => "application/json"}.freeze
+
+  def teardown
+    Setting.where(key: Application::DCR_SETTING_KEY).delete_all
+    Application.where("slug LIKE ?", "%-%").where(metadata: nil).delete_all
+    Application.where("metadata LIKE ?", "%dynamically_registered%").destroy_all
+  end
+
+  def enable_dcr
+    Setting.set(Application::DCR_SETTING_KEY, true)
+  end
+
+  def register(body)
+    post "/oauth/register", params: body.to_json, headers: JSON_HEADERS
+  end
+
+  test "registration is disabled by default" do
+    register(redirect_uris: ["https://client.example.com/cb"], token_endpoint_auth_method: "none")
+    assert_response :forbidden
+    assert_equal "access_denied", JSON.parse(@response.body)["error"]
+  end
+
+  test "registers a public client and returns no secret" do
+    enable_dcr
+    register(
+      redirect_uris: ["https://client.example.com/cb"],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      client_name: "My MCP Connector"
+    )
+
+    assert_response :created
+    body = JSON.parse(@response.body)
+    assert body["client_id"].present?
+    assert_not body.key?("client_secret")
+    assert_equal ["https://client.example.com/cb"], body["redirect_uris"]
+    assert_equal "none", body["token_endpoint_auth_method"]
+
+    app = Application.find_by(client_id: body["client_id"])
+    assert app.public_client?
+    assert app.require_pkce?
+    assert_empty app.allowed_groups, "a freshly registered client must be default-deny"
+  end
+
+  test "registers a confidential client and returns a secret once" do
+    enable_dcr
+    register(
+      redirect_uris: ["https://client.example.com/cb"],
+      token_endpoint_auth_method: "client_secret_basic"
+    )
+
+    assert_response :created
+    body = JSON.parse(@response.body)
+    assert body["client_secret"].present?
+    assert_equal 0, body["client_secret_expires_at"]
+
+    app = Application.find_by(client_id: body["client_id"])
+    assert app.confidential_client?
+    assert app.authenticate_client_secret(body["client_secret"])
+  end
+
+  test "requires at least one redirect_uri" do
+    enable_dcr
+    register(token_endpoint_auth_method: "none")
+    assert_response :bad_request
+    assert_equal "invalid_redirect_uri", JSON.parse(@response.body)["error"]
+  end
+
+  test "rejects non-loopback http redirect_uris" do
+    enable_dcr
+    register(redirect_uris: ["http://evil.example.com/cb"], token_endpoint_auth_method: "none")
+    assert_response :bad_request
+    assert_equal "invalid_redirect_uri", JSON.parse(@response.body)["error"]
+  end
+
+  test "allows http redirect_uris for loopback" do
+    enable_dcr
+    register(redirect_uris: ["http://localhost:8123/cb"], token_endpoint_auth_method: "none")
+    assert_response :created
+  end
+
+  test "rejects unsupported grant types" do
+    enable_dcr
+    register(redirect_uris: ["https://client.example.com/cb"], grant_types: ["client_credentials"])
+    assert_response :bad_request
+    assert_equal "invalid_client_metadata", JSON.parse(@response.body)["error"]
+  end
+
+  test "rejects a non-JSON body" do
+    enable_dcr
+    post "/oauth/register", params: "not json", headers: JSON_HEADERS
+    assert_response :bad_request
+    assert_equal "invalid_client_metadata", JSON.parse(@response.body)["error"]
+  end
+
+  # --- Discovery advertisement ----------------------------------------------
+
+  test "discovery advertises registration_endpoint only when enabled" do
+    get "/.well-known/openid-configuration"
+    assert_not JSON.parse(@response.body).key?("registration_endpoint")
+
+    enable_dcr
+    get "/.well-known/openid-configuration"
+    assert JSON.parse(@response.body)["registration_endpoint"].end_with?("/oauth/register")
+  end
+
+  test "RFC 8414 metadata alias mirrors OIDC discovery" do
+    get "/.well-known/oauth-authorization-server"
+    assert_response :success
+    config = JSON.parse(@response.body)
+    assert config["token_endpoint"].end_with?("/oauth/token")
+    assert config["authorization_endpoint"].end_with?("/oauth/authorize")
+  end
+
+  # --- Admin runtime toggle --------------------------------------------------
+
+  test "admin can toggle the registration window at runtime" do
+    sign_in_as(users(:alice)) # alice is in the admin group
+
+    patch "/admin/dynamic_client_registration", params: {enabled: "true"}
+    assert_redirected_to admin_applications_path
+    assert Application.dynamic_registration_enabled?
+
+    patch "/admin/dynamic_client_registration", params: {enabled: "false"}
+    assert_not Application.dynamic_registration_enabled?
+  end
+
+  test "non-admins cannot toggle registration" do
+    sign_in_as(users(:one)) # not an admin
+    patch "/admin/dynamic_client_registration", params: {enabled: "true"}
+    assert_redirected_to root_path
+    assert_not Application.dynamic_registration_enabled?
+  end
+end