{"record":{"id":"4f537c3b56f133ba","repo":"siyuan-note/siyuan","slug":"register-oauth-client-w","errorCode":null,"errorMessage":"register OAuth client: %w","messagePattern":"register OAuth client: %w","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/mcp/client/oauth.go","lineNumber":307,"sourceCode":"\t\ttokenAuthMethod := preferredTokenAuthMethod(asm.TokenEndpointAuthMethodsSupported)\n\t\tif len(asm.TokenEndpointAuthMethodsSupported) > 0 && tokenAuthMethod == \"\" {\n\t\t\treturn fmt.Errorf(\"OAuth authorization server does not support a compatible token endpoint authentication method\")\n\t\t}\n\t\tgrantTypes := []string{\"authorization_code\"}\n\t\tif len(asm.GrantTypesSupported) == 0 || slices.Contains(asm.GrantTypesSupported, \"refresh_token\") {\n\t\t\tgrantTypes = append(grantTypes, \"refresh_token\")\n\t\t}\n\t\tregistration, registerErr := oauthex.RegisterClient(ctx, asm.RegistrationEndpoint, &oauthex.ClientRegistrationMetadata{\n\t\t\tRedirectURIs:            []string{callbackURL},\n\t\t\tTokenEndpointAuthMethod: tokenAuthMethod,\n\t\t\tGrantTypes:              grantTypes,\n\t\t\tResponseTypes:           []string{\"code\"},\n\t\t\tClientName:              \"SiYuan\",\n\t\t\tScope:                   strings.Join(scopes, \" \"),\n\t\t\tApplicationType:         \"native\",\n\t\t}, h.client)\n\t\tif registerErr != nil {\n\t\t\treturn fmt.Errorf(\"register OAuth client: %w\", registerErr)\n\t\t}\n\t\tregistrationCredential = oauthCredential{\n\t\t\tServerID:            h.server.ID,\n\t\t\tEndpoint:            h.server.URL,\n\t\t\tResource:            prm.Resource,\n\t\t\tIssuer:              asm.Issuer,\n\t\t\tResourceMetadataURL: prm.MetadataURL,\n\t\t\tRedirectURL:         callbackURL,\n\t\t\tClientID:            registration.ClientID,\n\t\t\tClientSecret:        registration.ClientSecret,\n\t\t\tClientSecretExpiry:  registration.ClientSecretExpiresAt,\n\t\t\tTokenEndpoint:       asm.TokenEndpoint,\n\t\t\tRevocationEndpoint:  asm.RevocationEndpoint,\n\t\t\tTokenAuthMethod:     registration.TokenEndpointAuthMethod,\n\t\t\tScopes:              scopes,\n\t\t}\n\t\tif registrationCredential.TokenAuthMethod == \"\" {\n\t\t\tif registration.ClientSecret == \"\" {","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/mcp/client/oauth.go#L289-L325","documentation":"Wrapped error returned at oauth.go:306-307 when oauthex.RegisterClient fails during RFC 7591 dynamic client registration. The underlying error comes from the registration_endpoint HTTP call — network failure, non-2xx response, or a malformed registration response that could not be parsed.","triggerScenarios":"POST to asm.RegistrationEndpoint with ClientRegistrationMetadata (redirect URIs, grant types, client name 'SiYuan') returns 4xx (e.g. invalid_redirect_uri, invalid_client_metadata) or 5xx, the connection fails, or the response body is not valid registration JSON.","commonSituations":"Redirect URI rejected (port differs from util.ServerPort, or AS requires HTTPS); requested scopes rejected by AS policy; registration endpoint behind a firewall/unreachable; AS DCR implementation returns a non-conformant body; client_secret_expires_at or other field rejected.","solutions":["Inspect the wrapped error text (the %w chain carries the HTTP status/body from RegisterClient) to identify the registration_endpoint's rejection reason.","Ensure the SiYuan kernel port (util.ServerPort) matches the callback and that the AS permits http://127.0.0.1:<port>/... redirect URIs.","Verify scopes requested (prm.ScopesSupported + asm.ScopesSupported + bearer challenge scope) are all permitted by the AS DCR policy.","Check network reachability to the registration_endpoint URL (proxy, TLS, firewall)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"registration, registerErr := oauthex.RegisterClient(ctx, asm.RegistrationEndpoint, meta, h.client)\nif registerErr != nil {\n    // Error 325 path — log the underlying HTTP detail and surface to runtime state.\n    logging.LogWarnf(\"mcp oauth: DCR failed against %s: %s\", asm.RegistrationEndpoint, registerErr)\n    setMCPRuntimeStateForContext(ctx, h.server.ID, \"authorization_required\", 0, registerErr.Error(), \"\")\n    return fmt.Errorf(\"register OAuth client: %w\", registerErr)\n}","preventionTips":["Ensure the AS permits the loopback http://127.0.0.1 redirect URI scheme.","Request only scopes the AS will grant to DCR clients.","Verify network reachability and TLS validity of the registration_endpoint."],"tags":["oauth","mcp","dynamic-client-registration","rfc7591","network","registration-endpoint"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}