[Pyhroff]

Description

Addresses #3723 by ensuring RFC 6749 §5.2 and RFC 7009 §2.2.1 compliance for OAuth 2.0 error responses in the token and revocation endpoints:

1. Token endpoint (/token):
   • When a requested grant type is unsupported by the authorization server (e.g. client_credentials, password), return unsupported_grant_type (status 400) rather than failing discriminator validation with invalid_request.
   • When an authenticated client is not authorized to use the requested grant type (i.e. token_request.grant_type not in client_info.grant_types), return unauthorized_client (status 400) per RFC 6749 §5.2 ("The authenticated client is not authorized to use this authorization grant type"), rather than unsupported_grant_type.
2. Revocation endpoint (/revoke):
   • When client authentication fails (AuthenticationError), return error="invalid_client" with status 401 per RFC 7009 §2.2.1 and RFC 6749 §5.2 ("Client authentication failed"), rather than unauthorized_client.
   • Extended RevocationErrorResponse to allow invalid_client.

Testing

• Added regression tests in tests/server/auth/test_error_handling.py:
  • test_token_unsupported_grant_type_returns_unsupported_grant_type
  • test_token_unauthorized_client_grant_type_returns_unauthorized_client
  • test_revoke_invalid_client_authentication_returns_401
• Updated test_identity_assertion.py to assert unauthorized_client when a registered client is not authorized for the grant.
• Verified all 175 tests in tests/server/auth and tests/interaction/auth pass.
• Formatted and linted with ruff.

Closes #3723

[github-actions]

This PR has been closed automatically. This repo only keeps pull requests open when they come from a maintainer, or from a contributor a maintainer has assigned to the linked issue, and you aren't currently assigned to #3723.

If a maintainer assigns you to #3723, this PR reopens on its own and there's nothing more you need to do here. Assignment is a maintainer call based on capacity; comments that only ask to be assigned don't factor in. What does help is engaging on the issue itself by confirming the repro, explaining why it matters for your use case, or describing the approach you'd take.

You're welcome to keep pushing commits here (just avoid force-pushing, since GitHub can't reopen a rewritten branch), but that on its own won't get the PR reviewed or the issue assigned, and realistically most auto-closed PRs stay closed. There's no need to open a new PR either way.

CONTRIBUTING.md has the full reasoning, but in short:

• We're a small team with very little capacity to review community PRs right now.
• Many recent PRs are AI-generated with little human review, and reviewing one carefully still costs a maintainer as much time as it ever did. A well-described issue is usually more useful to us than the code.

Maintainers: reopen, remove missing-issue-link, or add bypass-issue-check to override.