Added missing features

config/packages/rate_limiter.yaml

@@ -0,0 +1,10 @@
+framework:
+    rate_limiter:
+        # Guards the open RFC 7591 Dynamic Client Registration endpoint (App\Controller\OAuth\ClientRegistrationController)
+        # against abuse (mass client creation) - registration itself requires no authentication by design
+        # (any client may self-register; the real gate is the per-user consent screen at /authorize), so
+        # this is the only throttle standing between it and the internet.
+        oauth_client_registration:
+            policy: 'sliding_window'
+            limit: 20
+            interval: '1 hour'

config/packages/security.yaml

@@ -75,6 +75,12 @@ security:
         # authentication here (rather than relying on is_authenticated()) triggers Symfony's normal
         # redirect-to-login-then-back flow for anonymous requests, same as the user settings pages.
         - { path: ^/authorize, role: IS_AUTHENTICATED_FULLY }
+        # RFC 7591 Dynamic Client Registration (App\Controller\OAuth\ClientRegistrationController) is
+        # deliberately open/unauthenticated - see that class's docblock. Rate-limited, not access-controlled.
+        - { path: ^/oauth/register, role: PUBLIC_ACCESS }
+        # Note: RFC 8414/9728 discovery metadata under /.well-known/ needs no entry here - the "dev"
+        # firewall above already matches ^/\.well-known/ with security:false (fully public, no
+        # AccessListener at all), which is where those requests actually get handled.
         # Restrict access to API to users, which has the API access permission
         - { path: "^/api", allow_if: 'is_granted("@api.access_api") and is_authenticated()' }
         # Restrict access to KICAD to users, which has API access permission

config/packages/test/rate_limiter.yaml

@@ -0,0 +1,16 @@
+framework:
+    # The default "oauth_client_registration" limiter (config/packages/rate_limiter.yaml) stores its state
+    # in the "cache.rate_limiter" pool, which is filesystem-backed and therefore persists across separate
+    # phpunit invocations (unlike the DB, which DAMADoctrineTestBundle wraps in a rolled-back transaction
+    # per test). Tests hitting POST /oauth/register for real (tests/Controller/OAuth/ClientRegistrationControllerTest.php)
+    # all share the same client IP (127.0.0.1) as the limiter key, so without this override, repeated test
+    # runs within the same hour would eventually start getting real 429s instead of the responses the
+    # tests actually assert on. An array-adapter pool is fresh for every kernel boot, so it never persists
+    # between test runs.
+    cache:
+        pools:
+            test.rate_limiter.cache:
+                adapter: cache.adapter.array
+    rate_limiter:
+        oauth_client_registration:
+            cache_pool: test.rate_limiter.cache