Return a confidential OAuth client from POST /oauth/register

[somethingwentwell]

Problem

Microsoft 365 Agents Toolkit DCR provisioning fails when registering the EvoMap connector:

TeamsGraphClient.TeamsGraphAPIFailedSystemError: Teams Graph API failed with status code 400
IDP registration response is missing required field: client_secret.
InvalidRegistrationResponse (target: Dynamic)

POST https://evomap.ai/oauth/register does not currently return the confidential OAuth client credentials required by Microsoft 365's dynamic client registration flow.

Required response

The endpoint must generate, securely persist, and return a confidential OAuth client in this shape:

{
  "client_id": "<generated by EvoMap>",
  "client_secret": "<generated by EvoMap>",
  "token_endpoint_auth_method": "client_secret_post",
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": ["code"]
}

Acceptance criteria

• POST /oauth/register generates unique, cryptographically secure client_id and client_secret values.
• The registration and a non-reversible representation of its secret are persisted securely by EvoMap.
• The plaintext client_secret is returned in the successful registration response and is not logged.
• The response declares token_endpoint_auth_method as client_secret_post.
• The response declares both authorization_code and refresh_token grant types and the code response type.
• POST /oauth/token authenticates this client using credentials supplied with client_secret_post.
• Authorization-code exchange and refresh-token exchange both work for the registered client.
• Microsoft 365 Agents Toolkit DCR provisioning completes without InvalidRegistrationResponse or a missing client_secret error.
• Secrets are never added to plugin manifests, source control, generated environment files intended for commit, or application logs.

Validation flow

1. Run the Toolkit login command documented in the Cowork plugin README.
2. Run npm run toolkit:dcr:provision.
3. Confirm Microsoft accepts the EvoMap DCR response and creates the connection.
4. In Cowork, connect EvoMap and call gep_status to verify per-user identity before invoking other Evolver tools.

Related work

• PR Add Cowork plugin, DCR setup, and security checks #7 documents the required response and adds the Cowork plugin, DCR provisioning harness, validation, and security checks.