Support expiring old DCR clients

[segevfiner]

Thanks to the "wondrous" use of DCR by MCP servers, they often register many clients using fully open DCR endpoints, such clients will accumulate on the DB even if only used once. A mechanism to allow expiring such old clients can be useful in this case. Fully deleting them from the backing store on expiry.

[panva]

Your adapter, your document TTLs. Fully under your control already.

[segevfiner]

Oh. I see, so I can just implement it under the adapter. I guess there is no mechanism to report the expiry time to the client though, and I don't see support for setting the client secret expiry time at least?

[panva]

If you know the TTL you'll be expiring clients after you can certainly use a middleware to change the one from the response. That is if there is one because DCR clients are not guaranteed to have a secret, one is generated only based on the need indicated by the client metadata (e.g. a client using pkjwt and not using any HMAC based algorithms doesn't need a secret, none is returned to the client).

[segevfiner]

Thanks! Yeah I see that those clients are using token_endpoint_auth_method, although they could have easily generated a secret or let the server generate one, as they already store the client ID and access the token in their secret storage. Oh well, LLM stuff never did care too hard on security stuff...