Add Oauth server for MCP

.env

@@ -5,6 +5,23 @@
 # Share that value with nobody and keep it secret
 APP_SECRET=a03498528f5a5fc089273ec9ae5b2849
 
+# Used to encrypt OAuth2 authorization codes and refresh tokens (only relevant if you use OAuth2 client
+# auto-provisioning for API/MCP apps). Not set by default - generate your own with
+# "bin/console partdb:oauth:generate-secret" and put it in .env.local before enabling OAUTH_SERVER_ENABLED
+# below. Keep it secret, and do NOT change it once set, or all outstanding refresh tokens/in-flight
+# authorization codes become invalid.
+#OAUTH2_ENCRYPTION_KEY=
+
+# Enables the OAuth2 authorization server (client auto-provisioning for API/MCP apps: /oauth/authorize, /oauth/token,
+# the admin client overview at /tools/oauth_clients, and OAuth2-issued bearer token authentication).
+# Disabled by default - the login/consent screen and bearer token authentication are unreachable until
+# this is turned on.
+OAUTH_SERVER_ENABLED=0
+# Enables open/unauthenticated Dynamic Client Registration (RFC 7591, POST /oauth/register) on top of the
+# OAuth2 server above. Has no effect if OAUTH_SERVER_ENABLED is not also set to 1. Clients can still be
+# registered manually by an admin via /tools/oauth_clients regardless of this setting.
+OAUTH_DCR_ENABLED=0
+
 # Change this and uncomment the following line to set the trusted hosts for your Part-DB installation, aka under which
 # domain names it is reachable. This is makes things more secure, because it can prevent certain header attacks.
 # You have to escape dots in the domain name with a backslash
@@ -191,3 +208,4 @@ APP_SHARE_DIR=var/share
 ###> symfony/ai-open-router-platform ###
 OPENROUTER_API_KEY=
 ###< symfony/ai-open-router-platform ###
+

.env.test

@@ -12,4 +12,12 @@ DATABASE_URL="sqlite:///%kernel.project_dir%/var/app_test.db"
 # Disable update checks, as tests would fail, when github is not reachable
 CHECK_FOR_UPDATES=0
 
-INSTANCE_NAME="Part-DB"
+INSTANCE_NAME="Part-DB"
+
+# The OAuth2 authorization server (and its Dynamic Client Registration endpoint) are disabled by default
+# in production (see .env) - enabled here so the full test suite keeps exercising them.
+OAUTH_SERVER_ENABLED=1
+OAUTH_DCR_ENABLED=1
+# .env intentionally ships no default OAUTH2_ENCRYPTION_KEY (an installation must generate its own via
+# "bin/console partdb:oauth:generate-secret") - this fixed value is only for the test suite above.
+OAUTH2_ENCRYPTION_KEY=def00000c86928f692e06d964033821dc8a28cc741e2fa511d3af815930e693913e48106ab10f48d9874ce464604c702777f2144575ac70ff5c3d35f2d03d08334327bbd

.github/workflows/tests.yml

@@ -118,6 +118,11 @@ jobs:
         run: php bin/console --env test doctrine:database:create --if-not-exists -n
         if: matrix.db-type == 'mysql' || matrix.db-type == 'postgres'
 
+      # .env.test enables the OAuth2 server (OAUTH_SERVER_ENABLED=1), and its tests actually sign/verify
+      # JWTs, so - unlike a real deployment, which works fine without this - CI needs a real keypair.
+      - name: Generate OAuth2 keys
+        run: php bin/console --env test partdb:oauth:generate-keys -n
+
       - name: Do migrations
         run: php bin/console --env test doctrine:migrations:migrate -n
 

composer.json

@@ -2,6 +2,35 @@
     "name": "part-db/part-db-server",
     "type": "project",
     "license": "AGPL-3.0-or-later",
+    "repositories": [
+        {
+            "type": "package",
+            "package": {
+                "name": "maennchen/zipstream-php",
+                "version": "2.4.0.1",
+                "dist": {
+                    "type": "zip",
+                    "url": "https://api.github.com/repos/maennchen/ZipStream-PHP/zipball/3fa72e4c71a43f9e9118752a5c90e476a8dc9eb3"
+                },
+                "source": {
+                    "type": "git",
+                    "url": "https://github.com/maennchen/ZipStream-PHP.git",
+                    "reference": "3fa72e4c71a43f9e9118752a5c90e476a8dc9eb3"
+                },
+                "require": {
+                    "php": "^8.0",
+                    "ext-mbstring": "*",
+                    "psr/http-message": "^1.0 || ^2.0",
+                    "myclabs/php-enum": "^1.5"
+                },
+                "autoload": {
+                    "psr-4": {
+                        "ZipStream\\": "src/"
+                    }
+                }
+            }
+        }
+    ],
     "require": {
         "php": "^8.2",
         "ext-ctype": "*",
@@ -16,13 +45,14 @@
         "api-platform/doctrine-orm": "^4.1",
         "api-platform/json-api": "^4.0.0",
         "api-platform/mcp": "^v4.3.17",
-        "api-platform/symfony": "^4.0.0",
         "api-platform/metadata": "^v4.3.17",
+        "api-platform/symfony": "^4.0.0",
         "beberlei/doctrineextensions": "^1.2",
         "brick/math": "^0.17.0",
         "brick/schema": "^0.2.0",
         "composer/ca-bundle": "^1.5",
         "composer/package-versions-deprecated": "^1.11.99.5",
+        "defuse/php-encryption": "^2.4",
         "doctrine/data-fixtures": "^2.0.0",
         "doctrine/dbal": "^4.0.0",
         "doctrine/doctrine-bundle": "^2.0",
@@ -40,8 +70,10 @@
         "league/commonmark": "^2.7",
         "league/csv": "^9.8.0",
         "league/html-to-markdown": "^5.0.1",
+        "league/oauth2-server": "^9.2",
+        "league/oauth2-server-bundle": "^1.2.1",
         "liip/imagine-bundle": "^2.2",
-        "maennchen/zipstream-php": "2.1",
+        "maennchen/zipstream-php": "2.4.0.1",
         "mcp/sdk": "v0.7.0 as v0.6.0",
         "nbgrp/onelogin-saml-bundle": "^v2.0.2",
         "nelexa/zip": "^4.0",