feat(server): catch client RAR types Config.RAR doesn't register

[osanderson]

Summary

This is DevX follow-up: a client registered for a RAR type Config.RAR doesn't register (usually a typo, e.g. paymnet) was refused at request time with nothing to say why. Clients live in the ClientRepository, out of server.New's sight, so New can't check them.

• Server.CheckClientRegistration(client storage.RegisteredClient) error reports registration types Config.RAR doesn't register. Call it when registering a client, or over every client at startup. The four RAR demos now call it after server.New, so a typo fails startup.
• A better cause. When a request is refused for a type the client isn't registered for, and the registration lists a type Config.RAR doesn't register, the cause names it ("the client's registration lists ["paymnet"], which Config.RAR doesn't register"). The cause goes to logs, never the response.
• storage.RegisteredClient.AuthorizationDetailsTypes() returns the registered list, sorted.

A gap from #506, fixed here. server.AutomaticRegistrationConfig had no AuthorizationDetailsTypes, and server.New never set federation.AutomaticRegistrationConfig.AuthorizationDetailsTypes. So an automatically registered client could request no RAR type at all on a server using RAR. The field now exists and is passed through, and New refuses a type Config.RAR doesn't register. Here, unlike a repository client, the config is in sight at startup.

All of this is additive (feat).

Tests

• TestRefusalNamesAMistypedRegistration: a client registered for paymnet is refused payment at PAR with invalid_authorization_details, and the cause names "paymnet" and Config.RAR.
• TestCheckClientRegistration: registered types and no types give nil. payment plus paymnet gives an error naming paymnet alone.
• TestAutomaticRegistrationAuthorizationDetailsTypes (real Trust Anchor to RP federation fixture): with AuthorizationDetailsTypes: ["payment"], an automatically registered client's client-credentials request for a payment detail succeeds. With none, it gets invalid_authorization_details. New refuses ["paymnet"] and names it.
• Storage: TestNewRegisteredClientAuthorizationDetailsTypes covers the sorted accessor.
• Mutation checks: dropping the pass-through, the startup check, or the cause hint each fails a test.
• Other checks:
  • go test -race ./server/... ./storage/... ./federation/... passes.
  • golangci-lint is clean.
  • The four RAR demos start (with the check) and pass their tests and lint.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud