Dynamic client registration, the API scope catalogue tied to rights, and bearer tokens as scope-narrowed sessions for resource servers (ID5.2 / ID5.3)

已发运

2026年11月15日 12:55 UTC

作者

Kamo

承诺

cc87602

- /api/security/oidc/register (RFC 7591): 404 unless the org's dcrMode is APPROVAL / AUTO_PUBLIC; PENDING + one approval notification, except a public loopback/https app in AUTO_PUBLIC; per-IP and per-org limits; audited - Connected Apps settings dcrMode + registrationUrl; discovery registration_endpoint only while on, API scopes in scopes_supported - oauthserver/scopes/ApiScopes: <area>.read|write -> RoleRightTypes; public /api/security/oidc/scopes; allowedScopes accept them - a code / refresh carries only the API scopes whose rights the member holds now (the grant keeps what they agreed to) - internal resource-session: the token's member, live rights narrowed to its scopes, never god, marked apiScope so no rights push or refresh widens it, <=10 min, reused per token; internal issuer-by-host for the MCP gateway