fix: allow custom URI schemes in OAuth Dynamic Client Registration

[ItsYash1421]

What kind of change does this PR introduce?

Bug fix - Fixes OAuth Dynamic Client Registration to support custom URI schemes

What is the current behavior?

Issue: #2285

The OAuth 2.0 Dynamic Client Registration endpoint (POST /oauth/clients/register) rejects custom URI schemes (e.g., cursor://, exp://, myapp://) even when they are explicitly whitelisted in the additional_redirect_urls configuration or GOTRUE_URI_ALLOW_LIST environment variable.

Current Error

{
  "code": 400,
  "error_code": "validation_failed",
  "msg": "400: invalid redirect_uri 'cursor://anysphere.cursor-mcp/callback': scheme must be HTTPS or HTTP (localhost only)"
}

Root Cause

The OAuth server's client registration logic uses strict validation that only allows http and https schemes, which is inconsistent with PR #711 that relaxed this validation for general auth flows to support native applications.

What is the new behavior?

The OAuth server now uses the same allow-list-based validation as the rest of the auth system (introduced in PR #711). Custom URI schemes work when explicitly configured in the allow list.

Test Results

All validation tests pass successfully:

![Test Results]

PASS: TestValidateRequestOrigin (9 test cases)
PASS: TestValidateRequestOriginEdgeCases (5 test cases)
PASS: TestInferClientTypeFromAuthMethod (5 test cases)
PASS: TestGetValidAuthMethodsForClientType (4 test cases)
PASS: TestValidateClientTypeConsistency (8 test cases)
PASS: TestDetermineClientType (7 test cases)
PASS: TestIsValidAuthMethodForClientType (7 test cases)
PASS: TestValidateClientAuthentication (5 test cases)
PASS: TestGetAllValidAuthMethods

Total: 8 test suites, 40+ test cases - ALL PASS 

Additional context

Changes Made

Files Modified:

1. internal/api/oauthserver/service.go (~40 lines)

   • Changed validateRedirectURI() to use utilities.IsRedirectURLValid()
   • Updated validation methods to be Server methods for config access
   • Modified validate() methods to accept *Server parameter

2. internal/api/oauthserver/service_test.go (~80 lines)

   • Updated TestRedirectURIValidation() to use new method signature
   • Added comprehensive TestCustomURISchemes() test
   • Updated SetupTest() to configure test URIs

References

• Issue: OAuth Dynamic Client Registration rejects custom URI schemes (inconsistency with PR #711) #2285
• Related PR: fix: allow all URL forms in redirects #711 (fix: allow all URL forms in redirects)
• OAuth 2.1 Specification