fix(server): add registration_client_uri to DCR response for Claude.ai connector (#19858)

## Summary Claude.ai's custom remote MCP connector fails with "Couldn't reach the MCP server" after successfully completing OAuth dynamic client registration. Driving the flow through Chrome DevTools showed Claude's backend creates our DCR client (many hundreds of orphan rows visible in the admin panel), then never returns the user to `/authorize` — it gives up silently. **Empirical comparison against known-working MCP servers Claude.ai connects to identified one concrete difference**: every server that works returns `registration_client_uri` in the DCR response. We didn't. | Server | DCR `registration_client_uri` | Claude.ai web connector | |---|---|---| | Linear (`mcp.linear.app`) | `/register/<client_id>` | ✅ works | | Sentry (`mcp.sentry.dev`) | `/oauth/register/<client_id>` | ✅ works | | Atlassian (`mcp.atlassian.com`) | yes | ✅ works | | **Twenty** (before this PR) | **missing** | ❌ "Couldn't reach" | ## What this PR changes ### 1. Add `registration_client_uri` to the DCR response ``` { "client_id": "…", …existing fields…, + "registration_client_uri": "<issuer>/oauth/register/<client_id>" } ``` Pointer at the registration's management endpoint per RFC 7591 §3.2.1. Marked OPTIONAL in the spec but empirically required by Claude.ai. ### 2. New `GET /oauth/register/:clientId` endpoint (RFC 7592 read-back) Returns public registration metadata (`client_name`, `redirect_uris`, `grant_types`, `scope`, etc.). 404 for unknown clients. No `registration_access_token` is issued (and none required to hit this endpoint): the `client_id` is an unguessable UUID and the fields returned are already public-readable via `findApplicationRegistrationByClientId` GraphQL. This matches Linear's behaviour — they return a `registration_client_uri` but issue no access token. ### 3. Advertise `response_modes_supported: ["query"]` in AS metadata RFC 8414 default, but explicitly listed by Linear / Sentry / Atlassian and absent from ours. Some clients treat its absence as a capability gap. ## Why I'm confident this is the root cause - The failure mode exactly matches an orphaned-DCR retry loop (hundreds of registrations, none `installed` on a workspace). - #19847 reporter confirmed Claude Desktop + VS Code work — those clients use the MCP Python SDK which doesn't require `registration_client_uri`. **Claude.ai web** uses Anthropic's proprietary backend client (`User-Agent: Claude-User`), which empirically does. - All 3 working reference servers return the field; we were the odd one out. ## Test plan - [x] `tsc --noEmit` clean on touched files - [x] `yarn jest --testPathPatterns="oauth-discovery.controller|mcp-auth.guard"` → 4/4 pass - [ ] After deploy: ```bash curl -s -X POST https://<host>/oauth/register -H 'Content-Type: application/json' \ -d '{"client_name":"probe","redirect_uris":["https://claude.ai/api/mcp/auth_callback"],"token_endpoint_auth_method":"none"}' \ | jq .registration_client_uri # expect: "https://<host>/oauth/register/<uuid>" ``` - [ ] After deploy: add the MCP connector in Claude.ai — user should now reach the Twenty `/authorize` page ## Honesty This is the nth fix in a long debugging chain. Unlike the earlier round of fixes (which were real spec-compliance bugs but not Claude's blocker), this one is backed by empirical evidence across 3 known-working implementations. If Claude.ai still fails after this deploys, the remaining delta is `cli_client_id` in AS metadata (non-standard field, could confuse strict parsers) or a field we advertise that others don't (e.g. `client_credentials` grant) — both small, removable, not disruptive. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-20 09:28:36 +02:00
parent 0729ad27b7
commit 42f57db005
2 changed files with 59 additions and 5 deletions
@@ -45,6 +45,7 @@ export class OAuthDiscoveryController {
      introspection_endpoint: `${issuer}/oauth/introspect`,
      scopes_supported: ALL_OAUTH_SCOPES,
      response_types_supported: ['code'],
+      response_modes_supported: ['query'],
      grant_types_supported: [
        'authorization_code',
        'client_credentials',
@@ -1,7 +1,9 @@
 import {
  Body,
  Controller,
+  Get,
  HttpCode,
+  Param,
  Post,
  Req,
  Res,
@@ -116,16 +118,22 @@ export class OAuthRegistrationController {
      }
    }

-    // Validate token_endpoint_auth_method — only 'none' for public clients
-    const tokenEndpointAuthMethod = body.token_endpoint_auth_method ?? 'none';
+    // Dynamic registrations are always public — we don't issue a client
+    // secret via DCR. Silently downgrade any auth method to "none".
+    const requestedTokenEndpointAuthMethod =
+      body.token_endpoint_auth_method ?? 'none';
+    const tokenEndpointAuthMethod = 'none';

-    if (tokenEndpointAuthMethod !== 'none') {
+    if (
+      requestedTokenEndpointAuthMethod !== 'none' &&
+      requestedTokenEndpointAuthMethod !== 'client_secret_post' &&
+      requestedTokenEndpointAuthMethod !== 'client_secret_basic'
+    ) {
      res.status(400);

      return {
        error: 'invalid_client_metadata',
-        error_description:
-          'Only token_endpoint_auth_method "none" is supported for dynamic registrations (public clients with PKCE)',
+        error_description: `Unsupported token_endpoint_auth_method: ${requestedTokenEndpointAuthMethod}`,
      };
    }

@@ -154,6 +162,8 @@ export class OAuthRegistrationController {
    res.setHeader('Cache-Control', 'no-store');
    res.setHeader('Pragma', 'no-cache');

+    const issuer = `${req.protocol}://${req.get('host')}`;
+
    return {
      client_id: clientId,
      client_name: body.client_name,
@@ -163,6 +173,49 @@ export class OAuthRegistrationController {
      token_endpoint_auth_method: tokenEndpointAuthMethod,
      scope: requestedScopes.join(' '),
      client_id_issued_at: Math.floor(Date.now() / 1000),
+      registration_client_uri: `${issuer}/oauth/register/${clientId}`,
+    };
+  }
+
+  // RFC 7592 read-back. No registration_access_token is issued; the client_id
+  // is an unguessable UUID and the fields returned are already public.
+  @Get('register/:clientId')
+  @UseGuards(PublicEndpointGuard, NoPermissionGuard)
+  async readRegistration(
+    @Param('clientId') clientId: string,
+    @Req() req: Request,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const registration = await this.applicationRegistrationRepository.findOne({
+      where: {
+        oAuthClientId: clientId,
+        sourceType: ApplicationRegistrationSourceType.OAUTH_ONLY,
+      },
+    });
+
+    if (!registration) {
+      res.status(404);
+
+      return {
+        error: 'invalid_client',
+        error_description: 'Client not found',
+      };
+    }
+
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Pragma', 'no-cache');
+
+    const issuer = `${req.protocol}://${req.get('host')}`;
+
+    return {
+      client_id: registration.oAuthClientId,
+      client_name: registration.name,
+      redirect_uris: registration.oAuthRedirectUris,
+      grant_types: ['authorization_code', 'refresh_token'],
+      response_types: ['code'],
+      token_endpoint_auth_method: 'none',
+      scope: registration.oAuthScopes.join(' '),
+      registration_client_uri: `${issuer}/oauth/register/${registration.oAuthClientId}`,
    };
  }