Added missing features

config/packages/rate_limiter.yaml

@@ -0,0 +1,10 @@
+framework:
+    rate_limiter:
+        # Guards the open RFC 7591 Dynamic Client Registration endpoint (App\Controller\OAuth\ClientRegistrationController)
+        # against abuse (mass client creation) - registration itself requires no authentication by design
+        # (any client may self-register; the real gate is the per-user consent screen at /authorize), so
+        # this is the only throttle standing between it and the internet.
+        oauth_client_registration:
+            policy: 'sliding_window'
+            limit: 20
+            interval: '1 hour'

config/packages/security.yaml

@@ -75,6 +75,12 @@ security:
         # authentication here (rather than relying on is_authenticated()) triggers Symfony's normal
         # redirect-to-login-then-back flow for anonymous requests, same as the user settings pages.
         - { path: ^/authorize, role: IS_AUTHENTICATED_FULLY }
+        # RFC 7591 Dynamic Client Registration (App\Controller\OAuth\ClientRegistrationController) is
+        # deliberately open/unauthenticated - see that class's docblock. Rate-limited, not access-controlled.
+        - { path: ^/oauth/register, role: PUBLIC_ACCESS }
+        # Note: RFC 8414/9728 discovery metadata under /.well-known/ needs no entry here - the "dev"
+        # firewall above already matches ^/\.well-known/ with security:false (fully public, no
+        # AccessListener at all), which is where those requests actually get handled.
         # Restrict access to API to users, which has the API access permission
         - { path: "^/api", allow_if: 'is_granted("@api.access_api") and is_authenticated()' }
         # Restrict access to KICAD to users, which has API access permission

config/packages/test/rate_limiter.yaml

@@ -0,0 +1,16 @@
+framework:
+    # The default "oauth_client_registration" limiter (config/packages/rate_limiter.yaml) stores its state
+    # in the "cache.rate_limiter" pool, which is filesystem-backed and therefore persists across separate
+    # phpunit invocations (unlike the DB, which DAMADoctrineTestBundle wraps in a rolled-back transaction
+    # per test). Tests hitting POST /oauth/register for real (tests/Controller/OAuth/ClientRegistrationControllerTest.php)
+    # all share the same client IP (127.0.0.1) as the limiter key, so without this override, repeated test
+    # runs within the same hour would eventually start getting real 429s instead of the responses the
+    # tests actually assert on. An array-adapter pool is fresh for every kernel boot, so it never persists
+    # between test runs.
+    cache:
+        pools:
+            test.rate_limiter.cache:
+                adapter: cache.adapter.array
+    rate_limiter:
+        oauth_client_registration:
+            cache_pool: test.rate_limiter.cache

config/permissions.yaml

@@ -297,6 +297,9 @@ perms: # Here comes a list with all Permission names (they have a perm_[name] co
       manage_oauth_tokens:
         label: "Manage OAuth tokens"
         apiTokenRole: ROLE_API_ADMIN
+      manage_oauth_clients:
+        label: "perm.system.manage_oauth_clients"
+        apiTokenRole: ROLE_API_ADMIN
       show_updates:
         label: "perm.system.show_available_updates"
         apiTokenRole: ROLE_API_ADMIN

config/routes/attributes.yaml

@@ -4,6 +4,9 @@ controllers:
         namespace: App\Controller
     type: attribute
     prefix: '{_locale}'
+    # OAuth2 protocol endpoints (client registration, discovery metadata) must live at fixed,
+    # spec-mandated paths with no locale prefix - see config/routes/oauth_server_controllers.yaml.
+    exclude: '../../src/Controller/OAuth/*'
 
     defaults:
         _locale: '%kernel.default_locale%'
@@ -11,6 +14,12 @@ controllers:
         # Match only locales like de_DE or de
         _locale: "^[a-z]{2}(_[A-Z]{2})?$"
 
+oauth_server_controllers:
+    resource:
+        path: ../../src/Controller/OAuth/
+        namespace: App\Controller\OAuth
+    type: attribute
+
 kernel:
     resource: ../../src/Kernel.php
     type: attribute