feat(mcp): add direct MCP OAuth dynamic client registration

cmd/mecated/command.go

@@ -269,7 +269,7 @@ func resolveMCPSubcommand(args []string) commandResolution {
 }
 
 func writeMCPHelp(out io.Writer) {
-	_, _ = fmt.Fprintln(out, "Usage: mecated mcp login SERVER [--no-browser] [--permission-config PATH ...]\n\nAuthorize one operator-configured OAuth MCP server. --permission-config selects trusted operator settings only; it never supplies OAuth values.")
+	_, _ = fmt.Fprintln(out, "Usage: "+strings.TrimPrefix(mcpLoginUsage, "usage: ")+"\n\nAuthorize one operator-configured OAuth MCP server. --permission-config selects trusted operator settings only; it never supplies OAuth values. DCR recovery modifiers are mutually exclusive and perform an explicit registration operation before login.")
 }
 
 func mcpUsageError(argv []string) error {
@@ -278,9 +278,9 @@ func mcpUsageError(argv []string) error {
 		sub = argv[2]
 	}
 	if sub == "" {
-		return errors.New("mcp: missing subcommand\navailable subcommands:\n  mcp login SERVER [--no-browser] [--permission-config PATH ...]    authorize a configured OAuth server")
+		return errors.New("mcp: missing subcommand\navailable subcommands:\n  " + strings.TrimPrefix(mcpLoginUsage, "usage: mecated ") + "    authorize a configured OAuth server")
 	}
-	return fmt.Errorf("mcp: unknown subcommand %q\navailable subcommands:\n  mcp login SERVER [--no-browser] [--permission-config PATH ...]    authorize a configured OAuth server", sub)
+	return fmt.Errorf("mcp: unknown subcommand %q\navailable subcommands:\n  %s    authorize a configured OAuth server", sub, strings.TrimPrefix(mcpLoginUsage, "usage: mecated "))
 }
 
 // configUsageError builds the error message for a bare/unknown `config` invocation.

cmd/mecated/mcplogin.go

@@ -19,12 +19,15 @@ import (
 	"github.com/stacklok/mecatl/mcp/oauthlogin"
 )
 
-var errMCPLoginUsage = errors.New("usage: mecated mcp login SERVER [--no-browser] [--permission-config PATH ...]")
+const mcpLoginUsage = "usage: mecated mcp login SERVER [--no-browser] [--permission-config PATH ...] [--reset-dcr-registration | --retry-dcr-registration]"
+
+var errMCPLoginUsage = errors.New(mcpLoginUsage)
 
 type mcpLoginArgs struct {
 	server            string
 	noBrowser         bool
 	permissionConfigs []string
+	dcrAction         mcp.OAuthDCRLoginAction
 }
 
 func parseMCPLoginArgs(args []string, out io.Writer) (mcpLoginArgs, error) {
@@ -33,19 +36,33 @@ func parseMCPLoginArgs(args []string, out io.Writer) (mcpLoginArgs, error) {
 		arg := args[i]
 		switch arg {
 		case "-h", "--help":
-			_, _ = fmt.Fprintln(out, "Usage: mecated mcp login SERVER [--no-browser] [--permission-config PATH ...]\n\nAuthorize one operator-configured OAuth MCP server. --no-browser prints the terminal authorization URL. --permission-config selects trusted operator settings and is repeatable.")
+			_, _ = fmt.Fprintln(out, "Usage: "+strings.TrimPrefix(mcpLoginUsage, "usage: ")+"\n\nAuthorize one operator-configured OAuth MCP server. --no-browser prints the terminal authorization URL. --permission-config selects trusted operator settings and is repeatable. DCR registration recovery requires exactly one explicit --reset-dcr-registration or --retry-dcr-registration operation.")
 			return mcpLoginArgs{}, flag.ErrHelp
 		case "--no-browser":
 			if parsed.noBrowser {
 				return mcpLoginArgs{}, errMCPLoginUsage
 			}
 			parsed.noBrowser = true
+		case "--reset-dcr-registration":
+			if parsed.dcrAction != mcp.OAuthDCRLoginReuse {
+				return mcpLoginArgs{}, errMCPLoginUsage
+			}
+			parsed.dcrAction = mcp.OAuthDCRLoginResetRegistration
+		case "--retry-dcr-registration":
+			if parsed.dcrAction != mcp.OAuthDCRLoginReuse {
+				return mcpLoginArgs{}, errMCPLoginUsage
+			}
+			parsed.dcrAction = mcp.OAuthDCRLoginRetryRegistration
 		case "--permission-config":
-			i++
-			if i >= len(args) || args[i] == "" || strings.HasPrefix(args[i], "-") {
+			if i+1 >= len(args) {
 				return mcpLoginArgs{}, errMCPLoginUsage
 			}
-			parsed.permissionConfigs = append(parsed.permissionConfigs, args[i])
+			path := args[i+1] // #nosec G602 -- the immediately preceding bound check proves i+1 is valid.
+			if path == "" || strings.HasPrefix(path, "-") {
+				return mcpLoginArgs{}, errMCPLoginUsage
+			}
+			i++
+			parsed.permissionConfigs = append(parsed.permissionConfigs, path)
 		default:
 			if path, ok := strings.CutPrefix(arg, "--permission-config="); ok {
 				if path == "" {
@@ -91,6 +108,23 @@ func mcpLoginRemedy(err error) error {
 	var rejected *oauthlogin.CallbackRejectedError
 	var bind *oauthlogin.CallbackBindError
 	switch {
+	case errors.Is(err, mcp.ErrOAuthDCRRecoveryRequired):
+		switch mcp.OAuthDCRRecoveryCategoryOf(err) {
+		case mcp.OAuthDCRRecoveryPending:
+			return errors.New("MCP OAuth DCR previous registration attempt did not complete and its exact safe failure stage was not recorded; use --retry-dcr-registration only if creating a duplicate or orphan client is acceptable")
+		case mcp.OAuthDCRRecoveryRegistrationOutcomeUnknown:
+			return errors.New("MCP OAuth DCR registration request outcome is unknown; use --retry-dcr-registration only if a possible orphan client is acceptable")
+		case mcp.OAuthDCRRecoveryResponseInvalid:
+			return errors.New("the OAuth provider returned a registration response that Mecatl could not safely use for DCR; use --retry-dcr-registration only if a possible orphan client is acceptable")
+		case mcp.OAuthDCRRecoveryReadyPersistence:
+			return errors.New("MCP OAuth DCR registration response was accepted but the ready record was not persisted; use --retry-dcr-registration only if a possible orphan client is acceptable")
+		case mcp.OAuthDCRRecoveryResetRequired:
+			return errors.New("MCP OAuth DCR valid ready registration identity differs from the current profile, principal, canonical resource, or exact issuer; use --reset-dcr-registration")
+		case mcp.OAuthDCRRecoveryPendingIdentityMismatch:
+			return errors.New("MCP OAuth DCR pending registration identity does not match the current configuration; restore the matching profile, principal, canonical resource, and exact issuer, then use --retry-dcr-registration")
+		default:
+			return errors.New("MCP OAuth DCR registration state is corrupt or unreadable; do not retry or reset registration. Preserve the records and configuration without editing, deleting, or renaming them. Contact the deployment operator or support team with only the server name and redacted command error; never send credential contents, OAuth URLs, client IDs, tokens, keys, or a raw response. Reset/retry do not repair corrupt state or revoke an upstream client")
+		}
 	case errors.As(err, &provider) && errors.Is(err, app.ErrMCPLoginAuthorization):
 		return fmt.Errorf("MCP OAuth authorization server rejected login (%s); review the requested scopes and provider policy", provider.Sanitized())
 	case errors.As(err, &rejected) && errors.Is(err, app.ErrMCPLoginAuthorization):
@@ -115,12 +149,12 @@ func mcpLoginRemedy(err error) error {
 	}
 }
 
-var executeMCPLogin = func(ctx context.Context, server mcp.ServerConfig, opts oauthlogin.Options) error {
-	runtime, err := oauthlogin.New(opts)
+var executeMCPLogin = func(ctx context.Context, server mcp.ServerConfig, runtimeOpts oauthlogin.Options, loginOpts app.MCPLoginOptions) error {
+	runtime, err := oauthlogin.New(runtimeOpts)
 	if err != nil {
 		return errors.New("MCP OAuth login runtime unavailable")
 	}
-	return app.LoginMCP(ctx, server, runtime)
+	return app.LoginMCPWithOptions(ctx, server, runtime, loginOpts)
 }
 
 func loadMCPLoginProfiles(explicit []string) (*cliconfig.MCPProfiles, error) {
@@ -155,7 +189,7 @@ func runMCPLogin(args []string, stdout io.Writer) error {
 	}
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
-	if err := executeMCPLogin(ctx, server, opts); err != nil {
+	if err := executeMCPLogin(ctx, server, opts, app.MCPLoginOptions{DCRAction: parsed.dcrAction}); err != nil {
 		return mcpLoginRemedy(err)
 	}
 	_, err = fmt.Fprintf(stdout, "MCP OAuth login succeeded for %s\n", server.Name)