Severity: LOW
File: mcpgateway/services/dcr_service.py
Line: 210
Rule: TODO comment

Description

When registering a Dynamic Client Registration (DCR) client, the expires_at field is always set to None instead of being calculated from the response.

Code

# Line 210
expires_at=None,  # TODO: Calculate from client_id_issued_at + client_secret_expires_at

Impact

DCR clients may have expiration times but the system doesn't track them. This could lead to:

• Attempting to use expired client credentials
• No automatic re-registration when credentials expire

Suggested Fix

Calculate expiration from the DCR response:

# Calculate expires_at from DCR response
expires_at = None
client_secret_expires_at = registration_response.get("client_secret_expires_at")
if client_secret_expires_at and client_secret_expires_at > 0:
    expires_at = datetime.fromtimestamp(client_secret_expires_at, tz=timezone.utc)