Ricardo Espinoza 0432bc926c feat(core): Support Client ID Metadata Documents on the MCP OAuth server ... Recognize an HTTPS-URL client_id as a Client ID Metadata Document (CIMD): the server fetches the client's OAuth metadata from that URL and uses it as the verifiable client identity, instead of requiring Dynamic Client Registration. DCR stays available and unchanged for clients that don't support CIMD. Backend: - New CimdMetadataHttpClient fetches the document. The client_id URL is attacker-influenced and fetched pre-auth, so the request is always routed through the SSRF filter regardless of N8N_SSRF_PROTECTION_ENABLED; the document is validated (HTTPS, redirect_uris present, client_id matches the URL) and cached. - The clients store resolves a URL client_id from its cached document, which stays the source of truth; a row is persisted only to satisfy the consent/token foreign keys, marked isCimd and excluded from the registered-client cap (which bounds anonymous DCR). - Per the CIMD trust model the requested redirect_uri is validated against the document's declared redirect_uris (by the SDK) rather than the instance redirect-URI allowlist. - Gated behind N8N_OAUTH_SERVER_CIMD_ENABLED (default on). Frontend: - CIMD clients get a dedicated trust card on the consent screen: the verifiable domain, where the authorization code is sent (green check for loopback, a neutral host line otherwise), and an honest caveat that the name/icon are self-reported and unreviewed, with a link to the raw metadata document. They skip the manual redirect-trust acknowledgement DCR clients still require. - The connected-clients settings show a "Verified" badge for CIMD clients. Adds an isCimd column to oauth_clients (migration) and exposes isCimd on the OAuth client and consent-details payloads.		2026-08-04 11:05:09 -04:00
..
postgres-schema	feat(core): Support Client ID Metadata Documents on the MCP OAuth server	2026-08-04 11:05:09 -04:00
sqlite-schema	feat(core): Support Client ID Metadata Documents on the MCP OAuth server	2026-08-04 11:05:09 -04:00