fix(oauth): add OpenID Configuration endpoint for ChatGPT compatibility (#531)

* fix(oauth): add OpenID Configuration endpoint for ChatGPT compatibility

ChatGPT's MCP connector expects /.well-known/openid-configuration in addition
to /.well-known/oauth-authorization-server. Per RFC 8414, many OAuth servers
support both endpoints with identical metadata for compatibility.

This adds the openid-configuration endpoint that returns the same enhanced
metadata as the oauth-authorization-server endpoint, fixing ChatGPT integration
while maintaining claude.ai compatibility.

Fixes #368

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix(oauth): grant default scopes when client registers without them

ChatGPT MCP connector registers clients without specifying scopes,
then requests scopes during authorization. The MCP SDK rejects this
with "invalid_scope: Client was not registered with scope X".

Fix: When a client registers without scopes, automatically grant all
valid scopes (homeassistant, mcp). This allows ChatGPT to complete
the OAuth flow while maintaining security (only valid scopes granted).

Changes:
- Auto-grant valid scopes when client_info.scope is None
- Add test for ChatGPT compatibility behavior
- Log when default scopes are granted for visibility

Fixes the "invalid_scope" error shown in network traces

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: julienld

src/ha_mcp/auth/provider.py

@@ -248,6 +248,21 @@ async def enhanced_metadata_handler(request: Request) -> Response:
             else:
                 enhanced_routes.append(route)
 
+        # Add OpenID Configuration endpoint for ChatGPT compatibility
+        # ChatGPT expects /.well-known/openid-configuration (OpenID Connect Discovery)
+        # in addition to /.well-known/oauth-authorization-server (OAuth 2.1)
+        # Per RFC 8414, many servers support both endpoints with identical metadata
+        from mcp.server.auth.routes import cors_middleware
+        enhanced_routes.append(
+            Route(
+                path="/.well-known/openid-configuration",
+                endpoint=cors_middleware(
+                    enhanced_metadata_handler, ["GET", "OPTIONS"]
+                ),
+                methods=["GET", "OPTIONS"],
+            )
+        )
+
         # Add consent form routes (these override the default authorize behavior)
         consent_routes = [
             Route("/consent", endpoint=self._consent_get, methods=["GET"]),
@@ -263,6 +278,17 @@ async def get_client(self, client_id: str) -> OAuthClientInformationFull | None:
 
     async def register_client(self, client_info: OAuthClientInformationFull) -> None:
         """Register a new OAuth client."""
+        # Set default scopes if client doesn't specify any (ChatGPT compatibility)
+        # ChatGPT registers without scopes, then requests them during authorization
+        if (
+            client_info.scope is None
+            and self.client_registration_options is not None
+            and self.client_registration_options.valid_scopes is not None
+        ):
+            # Grant all valid scopes by default
+            client_info.scope = " ".join(self.client_registration_options.valid_scopes)
+            logger.info(f"Client registered without scopes, granting all valid scopes: {client_info.scope}")
+
         # Validate scopes if configured
         if (
             client_info.scope is not None

tests/src/unit/test_oauth.py

@@ -152,6 +152,25 @@ async def test_register_client_validates_scopes(self, provider):
         with pytest.raises(ValueError, match="not valid"):
             await provider.register_client(client_info)
 
+    @pytest.mark.asyncio
+    async def test_register_client_without_scopes_gets_defaults(self, provider):
+        """Test client registration without scopes gets all valid scopes (ChatGPT compat)."""
+        from mcp.shared.auth import OAuthClientInformationFull
+
+        # ChatGPT registers without specifying scopes
+        client_info = OAuthClientInformationFull(
+            client_id="chatgpt-client",
+            redirect_uris=["https://chatgpt.com/callback"],
+            scope=None,  # No scopes specified
+        )
+
+        await provider.register_client(client_info)
+
+        # Should have been granted all valid scopes
+        stored = await provider.get_client("chatgpt-client")
+        assert stored is not None
+        assert stored.scope == "homeassistant mcp"
+
     @pytest.mark.asyncio
     async def test_get_client_not_found(self, provider):
         """Test getting non-existent client returns None."""
@@ -508,6 +527,21 @@ async def test_enhanced_metadata_handler(self, provider):
 
         # Note: Full handler testing requires ASGI app context, which is tested in E2E tests
 
+    @pytest.mark.asyncio
+    async def test_openid_configuration_endpoint(self, provider):
+        """Test OpenID Configuration endpoint exists for ChatGPT compatibility."""
+        routes = provider.get_routes()
+        openid_route = next(
+            (r for r in routes if r.path == "/.well-known/openid-configuration"),
+            None
+        )
+
+        # Verify the route exists (required by ChatGPT MCP connector)
+        assert openid_route is not None
+        assert openid_route.path == "/.well-known/openid-configuration"
+
+        # Note: Should return same metadata as oauth-authorization-server for compatibility
+
     @pytest.mark.asyncio
     async def test_consent_get_success(self, provider, mock_request):
         """Test consent form GET with valid transaction."""