@dxheroes/local-mcp-backend 0.10.0 → 0.12.0

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @dxheroes/local-mcp-backend@0.10.0 build /home/runner/work/local-mcp-gateway/local-mcp-gateway/apps/backend
+> @dxheroes/local-mcp-backend@0.12.0 build /home/runner/work/local-mcp-gateway/local-mcp-gateway/apps/backend
 > nest build
 
 -  TSC  Initializing type checker...
 ✔  TSC  Initializing type checker...
 >  TSC  Found 0 issues.
 >  SWC  Running...
-Successfully compiled: 60 files with swc (100.08ms)
+Successfully compiled: 68 files with swc (106.21ms)

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # Changelog
 
+## [0.12.0](https://github.com/DXHeroes/local-mcp-gateway/compare/backend-v0.11.0...backend-v0.12.0) (2026-03-16)
+
+
+### Features
+
+* **auth:** improve user organization handling during signup ([8447d08](https://github.com/DXHeroes/local-mcp-gateway/commit/8447d08e55274973e33d97fcc3b66a269b96be51))
+* **docs:** enhance documentation and user onboarding experience ([27adcf5](https://github.com/DXHeroes/local-mcp-gateway/commit/27adcf58b55926406fdc2a926a61ccfb92fad798))
+* **invitation:** implement organization invitation acceptance flow ([c3731c2](https://github.com/DXHeroes/local-mcp-gateway/commit/c3731c2e0ced853fa37868b9f560edb4bf0cff2f))
+* **mcp:** enhance MCP presets and server configuration ([d5ce8f3](https://github.com/DXHeroes/local-mcp-gateway/commit/d5ce8f3adb9513c03df2e97c2ba1236926350387))
+* **mcp:** enrich server creation with metadata and enhance documentation ([fb3d901](https://github.com/DXHeroes/local-mcp-gateway/commit/fb3d901d4ab97308732dbdb15218ec9968cf56c9))
+* **mcp:** streamline MCP presets and enhance server configuration ([9eb1f2c](https://github.com/DXHeroes/local-mcp-gateway/commit/9eb1f2c17ae8dea5d7d8035474adcfde9da56474))
+* **organization-domains:** add auto-join domain management for organizations ([2e5071d](https://github.com/DXHeroes/local-mcp-gateway/commit/2e5071d82811725df5ef1729cc2f657d11fade14))
+* **organization-domains:** implement blacklisted domains for auto-join prevention ([5226d48](https://github.com/DXHeroes/local-mcp-gateway/commit/5226d481b94b6fd192cfe46e385143b0f642a4d5))
+* **tests:** enhance integration tests for MCP services and sharing functionality ([d4550ba](https://github.com/DXHeroes/local-mcp-gateway/commit/d4550baefb3e623500e444cb6cbcfd911b88fefb))
+
+
+### Bug Fixes
+
+* **oauth:** standardize token type casing and enhance error logging ([47ef48b](https://github.com/DXHeroes/local-mcp-gateway/commit/47ef48ba45be779b059bf32faa062af2cea3eee4))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @dxheroes/local-mcp-core bumped to 0.9.0
+    * @dxheroes/local-mcp-database bumped to 0.6.0
+    * @dxheroes/mcp-abra-flexi bumped to 0.4.0
+    * @dxheroes/mcp-fakturoid bumped to 0.4.0
+    * @dxheroes/mcp-gemini-deep-research bumped to 0.5.8
+    * @dxheroes/mcp-merk bumped to 0.3.8
+    * @dxheroes/mcp-toggl bumped to 0.3.8
+  * devDependencies
+    * @dxheroes/local-mcp-config bumped to 0.4.13
+
+## [0.11.0](https://github.com/DXHeroes/local-mcp-gateway/compare/backend-v0.10.0...backend-v0.11.0) (2026-03-16)
+
+
+### Features
+
+* **auth:** enable toggle for email and password authentication ([a0c1dd0](https://github.com/DXHeroes/local-mcp-gateway/commit/a0c1dd0a192ffd4199af2bb00d9e83f1c526be5c))
+* **auth:** enhance MCP OAuth guard to support session cookies ([cc2f0d0](https://github.com/DXHeroes/local-mcp-gateway/commit/cc2f0d092150710691e8258c2fa3d891575e5a76))
+* **dependencies:** add new MCP packages to backend dependencies ([a29fdf4](https://github.com/DXHeroes/local-mcp-gateway/commit/a29fdf4c4af4db0b4df31a9b8a7d7f0fec5a5755))
+* **seo:** enhance SEO and session handling across frontend and backend ([2178043](https://github.com/DXHeroes/local-mcp-gateway/commit/21780436a9e93da63e3c6cec8318b4f8d1a6dbf6))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @dxheroes/local-mcp-core bumped to 0.8.1
+    * @dxheroes/local-mcp-database bumped to 0.5.4
+    * @dxheroes/mcp-abra-flexi bumped to 0.3.3
+    * @dxheroes/mcp-fakturoid bumped to 0.3.3
+    * @dxheroes/mcp-gemini-deep-research bumped to 0.5.7
+    * @dxheroes/mcp-merk bumped to 0.3.7
+    * @dxheroes/mcp-toggl bumped to 0.3.7
+  * devDependencies
+    * @dxheroes/local-mcp-config bumped to 0.4.12
+
 ## [0.10.0](https://github.com/DXHeroes/local-mcp-gateway/compare/backend-v0.9.2...backend-v0.10.0) (2026-03-12)
 
 

package/dist/__tests__/integration/mcp-proxy-auth-http.test.js

@@ -10,7 +10,8 @@ function createConfigService(values) {
 }
 function createAuthServiceMock() {
     return {
-        validateMcpToken: vi.fn().mockResolvedValue(null)
+        validateMcpToken: vi.fn().mockResolvedValue(null),
+        getSession: vi.fn().mockResolvedValue(null)
     };
 }
 async function startTestApp(options) {
@@ -241,6 +242,42 @@ describe('MCP proxy auth HTTP contract', ()=>{
         });
         expect(authService.validateMcpToken).toHaveBeenCalledWith('sse-token');
     });
+    it('accepts session cookie when no Bearer token is present', async ()=>{
+        authService.getSession.mockResolvedValue({
+            user: {
+                id: 'cookie-user',
+                name: 'Cookie User',
+                email: 'cookie@example.com'
+            },
+            session: {
+                id: 'sess-1',
+                userId: 'cookie-user'
+            }
+        });
+        const response = await fetch(`${baseUrl}/api/mcp/test`, {
+            headers: {
+                cookie: 'better-auth.session_token=valid-session'
+            }
+        });
+        const body = await response.json();
+        expect(response.status).toBe(200);
+        expect(body).toEqual({
+            ok: true,
+            userId: 'cookie-user'
+        });
+        expect(authService.getSession).toHaveBeenCalled();
+    });
+    it('returns 401 when session cookie is invalid and no Bearer token', async ()=>{
+        authService.getSession.mockResolvedValue(null);
+        const response = await fetch(`${baseUrl}/api/mcp/test`, {
+            headers: {
+                cookie: 'better-auth.session_token=expired'
+            }
+        });
+        const body = await response.json();
+        expect(response.status).toBe(401);
+        expect(body.message).toBe('Bearer token required');
+    });
 });
 
 //# sourceMappingURL=mcp-proxy-auth-http.test.js.map

package/dist/__tests__/integration/mcp-proxy-auth-http.test.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/__tests__/integration/mcp-proxy-auth-http.test.ts"],"sourcesContent":["import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport type { ConfigService } from '@nestjs/config';\nimport { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';\nimport { AllExceptionsFilter } from '../../common/filters/all-exceptions.filter.js';\nimport { AuthService, type AuthUser } from '../../modules/auth/auth.service.js';\nimport { McpOAuthGuard } from '../../modules/auth/mcp-oauth.guard.js';\nimport {\n  createMcpProtectedResourceMetadata,\n  resolvePublicAuthBaseUrl,\n  resolvePublicBackendOrigin,\n} from '../../modules/auth/mcp-oauth.utils.js';\n\ntype MockAuthService = {\n  validateMcpToken: ReturnType<typeof vi.fn>;\n};\n\ntype MockConfigService = {\n  get: ReturnType<typeof vi.fn>;\n};\n\nfunction createConfigService(values: Record<string, unknown>): MockConfigService {\n  return {\n    get: vi.fn((key: string) => values[key]),\n  };\n}\n\nfunction createAuthServiceMock(): MockAuthService {\n  return {\n    validateMcpToken: vi.fn().mockResolvedValue(null),\n  };\n}\n\nasync function startTestApp(options?: {\n  backendUrl?: string;\n}): Promise<{\n  close: () => Promise<void>;\n  authService: MockAuthService;\n  baseUrl: string;\n}> {\n  const authService = createAuthServiceMock();\n  const configService = createConfigService({\n    'app.port': 3001,\n    BETTER_AUTH_URL: options?.backendUrl ?? 'http://localhost:3001',\n  });\n  const guard = new McpOAuthGuard(authService as unknown as AuthService, configService as never);\n  const filter = new AllExceptionsFilter();\n  const backendOrigin = resolvePublicBackendOrigin(configService as unknown as ConfigService);\n  const authBaseUrl = resolvePublicAuthBaseUrl(configService as unknown as ConfigService);\n\n  const createRequest = (req: IncomingMessage) => {\n    const url = new URL(req.url ?? '/', `http://${req.headers.host ?? '127.0.0.1'}`);\n    return {\n      method: req.method ?? 'GET',\n      url: `${url.pathname}${url.search}`,\n      headers: req.headers,\n      query: Object.fromEntries(url.searchParams.entries()),\n      user: undefined,\n    };\n  };\n\n  const createResponse = (res: ServerResponse) => {\n    const response = {\n      setHeader(name: string, value: string) {\n        res.setHeader(name, value);\n        return response;\n      },\n      status(statusCode: number) {\n        res.statusCode = statusCode;\n        return response;\n      },\n      json(body: unknown) {\n        res.setHeader('content-type', 'application/json');\n        res.end(JSON.stringify(body));\n      },\n    };\n\n    return response;\n  };\n\n  const handleGuardedRoute = async (\n    nodeRequest: IncomingMessage,\n    nodeResponse: ServerResponse,\n    responseBody: (request: ReturnType<typeof createRequest>) => Record<string, unknown>\n  ) => {\n    const request = createRequest(nodeRequest);\n    const response = createResponse(nodeResponse);\n    const context = {\n      switchToHttp: () => ({\n        getRequest: () => request,\n        getResponse: () => response,\n      }),\n    } as never;\n\n    const host = {\n      switchToHttp: () => ({\n        getRequest: () => request,\n        getResponse: () => response,\n      }),\n    } as never;\n\n    try {\n      await guard.canActivate(context);\n      response.json(responseBody(request));\n    } catch (error) {\n      filter.catch(error, host);\n    }\n  };\n\n  const server = await new Promise<import('node:http').Server>((resolve) => {\n    const listeningServer = createServer(async (req, res) => {\n      const url = new URL(req.url ?? '/', `http://${req.headers.host ?? '127.0.0.1'}`);\n\n      if (req.method === 'GET' && url.pathname === '/api/mcp/test') {\n        await handleGuardedRoute(req, res, (request) => ({\n          ok: true,\n          userId: (request as { user?: AuthUser }).user?.id ?? null,\n        }));\n        return;\n      }\n\n      if (req.method === 'GET' && url.pathname === '/api/mcp/sse') {\n        await handleGuardedRoute(req, res, (request) => ({\n          ok: true,\n          token: request.query.access_token ?? null,\n          userId: (request as { user?: AuthUser }).user?.id ?? null,\n        }));\n        return;\n      }\n\n      if (req.method === 'GET' && url.pathname === '/.well-known/oauth-protected-resource') {\n        res.setHeader('content-type', 'application/json');\n        res.end(JSON.stringify(createMcpProtectedResourceMetadata(configService as unknown as ConfigService)));\n        return;\n      }\n\n      if (req.method === 'GET' && url.pathname === '/.well-known/oauth-authorization-server') {\n        res.setHeader('content-type', 'application/json');\n        res.end(\n          JSON.stringify({\n            issuer: backendOrigin,\n            authorization_endpoint: `${authBaseUrl}/mcp/authorize`,\n            token_endpoint: `${authBaseUrl}/mcp/token`,\n            registration_endpoint: `${authBaseUrl}/mcp/register`,\n            jwks_uri: `${authBaseUrl}/mcp/jwks`,\n            response_types_supported: ['code'],\n            grant_types_supported: ['authorization_code', 'refresh_token'],\n            code_challenge_methods_supported: ['S256'],\n          })\n        );\n        return;\n      }\n\n      if (req.method === 'POST' && url.pathname === '/api/auth/mcp/register') {\n        res.statusCode = 201;\n        res.setHeader('content-type', 'application/json');\n        res.end(\n          JSON.stringify({\n            client_id: 'cursor-client',\n            client_secret: 'cursor-secret',\n            redirect_uris: ['https://cursor.sh/callback'],\n          })\n        );\n        return;\n      }\n\n      res.statusCode = 404;\n      res.end();\n    }).listen(0, () => resolve(listeningServer));\n  });\n  const address = server.address();\n  if (!address || typeof address === 'string') {\n    throw new Error('Failed to resolve test server address');\n  }\n\n  return {\n    close: () =>\n      new Promise<void>((resolve, reject) => {\n        server.close((error) => {\n          if (error) {\n            reject(error);\n            return;\n          }\n          resolve();\n        });\n      }),\n    authService,\n    baseUrl: `http://127.0.0.1:${address.port}`,\n  };\n}\n\ndescribe('MCP proxy auth HTTP contract', () => {\n  let close: (() => Promise<void>) | undefined;\n  let authService: MockAuthService;\n  let baseUrl: string;\n\n  beforeEach(async () => {\n    const result = await startTestApp({\n      backendUrl: 'http://localhost:9631',\n    });\n    close = result.close;\n    authService = result.authService;\n    baseUrl = result.baseUrl;\n  });\n\n  afterEach(async () => {\n    if (close) {\n      await close();\n    }\n  });\n\n  it('returns 401 with MCP discovery headers when token is missing', async () => {\n    const response = await fetch(`${baseUrl}/api/mcp/test`);\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(401);\n    expect(response.headers.get('access-control-expose-headers')).toBe('WWW-Authenticate');\n    expect(response.headers.get('www-authenticate')).toContain('resource_metadata=');\n    expect(response.headers.get('www-authenticate')).toContain('resource_metadata_uri=');\n    expect(body.message).toBe('Bearer token required');\n  });\n\n  it('serves protected resource metadata with Better Auth-backed URLs', async () => {\n    const response = await fetch(`${baseUrl}/.well-known/oauth-protected-resource`);\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(200);\n    expect(body).toEqual({\n      resource: 'http://localhost:9631/api/mcp',\n      authorization_servers: ['http://localhost:9631'],\n      bearer_methods_supported: ['header'],\n      scopes_supported: ['openid', 'profile', 'email', 'offline_access'],\n      jwks_uri: 'http://localhost:9631/api/auth/mcp/jwks',\n      resource_signing_alg_values_supported: ['RS256', 'none'],\n    });\n  });\n\n  it('serves authorization server metadata with MCP registration endpoint', async () => {\n    const response = await fetch(`${baseUrl}/.well-known/oauth-authorization-server`);\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(200);\n    expect(body.registration_endpoint).toBe('http://localhost:9631/api/auth/mcp/register');\n    expect(body.authorization_endpoint).toBe('http://localhost:9631/api/auth/mcp/authorize');\n    expect(body.token_endpoint).toBe('http://localhost:9631/api/auth/mcp/token');\n  });\n\n  it('exposes the advertised registration endpoint', async () => {\n    const response = await fetch(`${baseUrl}/api/auth/mcp/register`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n      },\n      body: JSON.stringify({\n        redirect_uris: ['https://cursor.sh/callback'],\n      }),\n    });\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(201);\n    expect(body.client_id).toBe('cursor-client');\n  });\n\n  it('accepts access_token query params for SSE fallback', async () => {\n    authService.validateMcpToken.mockResolvedValue({\n      id: 'user-sse',\n      name: 'SSE User',\n      email: 'sse@example.com',\n    });\n\n    const response = await fetch(`${baseUrl}/api/mcp/sse?access_token=sse-token`);\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(200);\n    expect(body).toEqual({\n      ok: true,\n      token: 'sse-token',\n      userId: 'user-sse',\n    });\n    expect(authService.validateMcpToken).toHaveBeenCalledWith('sse-token');\n  });\n});\n"],"names":["createServer","afterEach","beforeEach","describe","expect","it","vi","AllExceptionsFilter","McpOAuthGuard","createMcpProtectedResourceMetadata","resolvePublicAuthBaseUrl","resolvePublicBackendOrigin","createConfigService","values","get","fn","key","createAuthServiceMock","validateMcpToken","mockResolvedValue","startTestApp","options","authService","configService","BETTER_AUTH_URL","backendUrl","guard","filter","backendOrigin","authBaseUrl","createRequest","req","url","URL","headers","host","method","pathname","search","query","Object","fromEntries","searchParams","entries","user","undefined","createResponse","res","response","setHeader","name","value","status","statusCode","json","body","end","JSON","stringify","handleGuardedRoute","nodeRequest","nodeResponse","responseBody","request","context","switchToHttp","getRequest","getResponse","canActivate","error","catch","server","Promise","resolve","listeningServer","ok","userId","id","token","access_token","issuer","authorization_endpoint","token_endpoint","registration_endpoint","jwks_uri","response_types_supported","grant_types_supported","code_challenge_methods_supported","client_id","client_secret","redirect_uris","listen","address","Error","close","reject","baseUrl","port","result","fetch","toBe","toContain","message","toEqual","resource","authorization_servers","bearer_methods_supported","scopes_supported","resource_signing_alg_values_supported","email","toHaveBeenCalledWith"],"mappings":"AAAA,SAASA,YAAY,QAAmD,YAAY;AAEpF,SAASC,SAAS,EAAEC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAS;AACzE,SAASC,mBAAmB,QAAQ,gDAAgD;AAEpF,SAASC,aAAa,QAAQ,wCAAwC;AACtE,SACEC,kCAAkC,EAClCC,wBAAwB,EACxBC,0BAA0B,QACrB,wCAAwC;AAU/C,SAASC,oBAAoBC,MAA+B;IAC1D,OAAO;QACLC,KAAKR,GAAGS,EAAE,CAAC,CAACC,MAAgBH,MAAM,CAACG,IAAI;IACzC;AACF;AAEA,SAASC;IACP,OAAO;QACLC,kBAAkBZ,GAAGS,EAAE,GAAGI,iBAAiB,CAAC;IAC9C;AACF;AAEA,eAAeC,aAAaC,OAE3B;IAKC,MAAMC,cAAcL;IACpB,MAAMM,gBAAgBX,oBAAoB;QACxC,YAAY;QACZY,iBAAiBH,SAASI,cAAc;IAC1C;IACA,MAAMC,QAAQ,IAAIlB,cAAcc,aAAuCC;IACvE,MAAMI,SAAS,IAAIpB;IACnB,MAAMqB,gBAAgBjB,2BAA2BY;IACjD,MAAMM,cAAcnB,yBAAyBa;IAE7C,MAAMO,gBAAgB,CAACC;QACrB,MAAMC,MAAM,IAAIC,IAAIF,IAAIC,GAAG,IAAI,KAAK,CAAC,OAAO,EAAED,IAAIG,OAAO,CAACC,IAAI,IAAI,aAAa;QAC/E,OAAO;YACLC,QAAQL,IAAIK,MAAM,IAAI;YACtBJ,KAAK,GAAGA,IAAIK,QAAQ,GAAGL,IAAIM,MAAM,EAAE;YACnCJ,SAASH,IAAIG,OAAO;YACpBK,OAAOC,OAAOC,WAAW,CAACT,IAAIU,YAAY,CAACC,OAAO;YAClDC,MAAMC;QACR;IACF;IAEA,MAAMC,iBAAiB,CAACC;QACtB,MAAMC,WAAW;YACfC,WAAUC,IAAY,EAAEC,KAAa;gBACnCJ,IAAIE,SAAS,CAACC,MAAMC;gBACpB,OAAOH;YACT;YACAI,QAAOC,UAAkB;gBACvBN,IAAIM,UAAU,GAAGA;gBACjB,OAAOL;YACT;YACAM,MAAKC,IAAa;gBAChBR,IAAIE,SAAS,CAAC,gBAAgB;gBAC9BF,IAAIS,GAAG,CAACC,KAAKC,SAAS,CAACH;YACzB;QACF;QAEA,OAAOP;IACT;IAEA,MAAMW,qBAAqB,OACzBC,aACAC,cACAC;QAEA,MAAMC,UAAUjC,cAAc8B;QAC9B,MAAMZ,WAAWF,eAAee;QAChC,MAAMG,UAAU;YACdC,cAAc,IAAO,CAAA;oBACnBC,YAAY,IAAMH;oBAClBI,aAAa,IAAMnB;gBACrB,CAAA;QACF;QAEA,MAAMb,OAAO;YACX8B,cAAc,IAAO,CAAA;oBACnBC,YAAY,IAAMH;oBAClBI,aAAa,IAAMnB;gBACrB,CAAA;QACF;QAEA,IAAI;YACF,MAAMtB,MAAM0C,WAAW,CAACJ;YACxBhB,SAASM,IAAI,CAACQ,aAAaC;QAC7B,EAAE,OAAOM,OAAO;YACd1C,OAAO2C,KAAK,CAACD,OAAOlC;QACtB;IACF;IAEA,MAAMoC,SAAS,MAAM,IAAIC,QAAoC,CAACC;QAC5D,MAAMC,kBAAkB1E,aAAa,OAAO+B,KAAKgB;YAC/C,MAAMf,MAAM,IAAIC,IAAIF,IAAIC,GAAG,IAAI,KAAK,CAAC,OAAO,EAAED,IAAIG,OAAO,CAACC,IAAI,IAAI,aAAa;YAE/E,IAAIJ,IAAIK,MAAM,KAAK,SAASJ,IAAIK,QAAQ,KAAK,iBAAiB;gBAC5D,MAAMsB,mBAAmB5B,KAAKgB,KAAK,CAACgB,UAAa,CAAA;wBAC/CY,IAAI;wBACJC,QAAQ,AAACb,QAAgCnB,IAAI,EAAEiC,MAAM;oBACvD,CAAA;gBACA;YACF;YAEA,IAAI9C,IAAIK,MAAM,KAAK,SAASJ,IAAIK,QAAQ,KAAK,gBAAgB;gBAC3D,MAAMsB,mBAAmB5B,KAAKgB,KAAK,CAACgB,UAAa,CAAA;wBAC/CY,IAAI;wBACJG,OAAOf,QAAQxB,KAAK,CAACwC,YAAY,IAAI;wBACrCH,QAAQ,AAACb,QAAgCnB,IAAI,EAAEiC,MAAM;oBACvD,CAAA;gBACA;YACF;YAEA,IAAI9C,IAAIK,MAAM,KAAK,SAASJ,IAAIK,QAAQ,KAAK,yCAAyC;gBACpFU,IAAIE,SAAS,CAAC,gBAAgB;gBAC9BF,IAAIS,GAAG,CAACC,KAAKC,SAAS,CAACjD,mCAAmCc;gBAC1D;YACF;YAEA,IAAIQ,IAAIK,MAAM,KAAK,SAASJ,IAAIK,QAAQ,KAAK,2CAA2C;gBACtFU,IAAIE,SAAS,CAAC,gBAAgB;gBAC9BF,IAAIS,GAAG,CACLC,KAAKC,SAAS,CAAC;oBACbsB,QAAQpD;oBACRqD,wBAAwB,GAAGpD,YAAY,cAAc,CAAC;oBACtDqD,gBAAgB,GAAGrD,YAAY,UAAU,CAAC;oBAC1CsD,uBAAuB,GAAGtD,YAAY,aAAa,CAAC;oBACpDuD,UAAU,GAAGvD,YAAY,SAAS,CAAC;oBACnCwD,0BAA0B;wBAAC;qBAAO;oBAClCC,uBAAuB;wBAAC;wBAAsB;qBAAgB;oBAC9DC,kCAAkC;wBAAC;qBAAO;gBAC5C;gBAEF;YACF;YAEA,IAAIxD,IAAIK,MAAM,KAAK,UAAUJ,IAAIK,QAAQ,KAAK,0BAA0B;gBACtEU,IAAIM,UAAU,GAAG;gBACjBN,IAAIE,SAAS,CAAC,gBAAgB;gBAC9BF,IAAIS,GAAG,CACLC,KAAKC,SAAS,CAAC;oBACb8B,WAAW;oBACXC,eAAe;oBACfC,eAAe;wBAAC;qBAA6B;gBAC/C;gBAEF;YACF;YAEA3C,IAAIM,UAAU,GAAG;YACjBN,IAAIS,GAAG;QACT,GAAGmC,MAAM,CAAC,GAAG,IAAMlB,QAAQC;IAC7B;IACA,MAAMkB,UAAUrB,OAAOqB,OAAO;IAC9B,IAAI,CAACA,WAAW,OAAOA,YAAY,UAAU;QAC3C,MAAM,IAAIC,MAAM;IAClB;IAEA,OAAO;QACLC,OAAO,IACL,IAAItB,QAAc,CAACC,SAASsB;gBAC1BxB,OAAOuB,KAAK,CAAC,CAACzB;oBACZ,IAAIA,OAAO;wBACT0B,OAAO1B;wBACP;oBACF;oBACAI;gBACF;YACF;QACFnD;QACA0E,SAAS,CAAC,iBAAiB,EAAEJ,QAAQK,IAAI,EAAE;IAC7C;AACF;AAEA9F,SAAS,gCAAgC;IACvC,IAAI2F;IACJ,IAAIxE;IACJ,IAAI0E;IAEJ9F,WAAW;QACT,MAAMgG,SAAS,MAAM9E,aAAa;YAChCK,YAAY;QACd;QACAqE,QAAQI,OAAOJ,KAAK;QACpBxE,cAAc4E,OAAO5E,WAAW;QAChC0E,UAAUE,OAAOF,OAAO;IAC1B;IAEA/F,UAAU;QACR,IAAI6F,OAAO;YACT,MAAMA;QACR;IACF;IAEAzF,GAAG,gEAAgE;QACjE,MAAM2C,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,aAAa,CAAC;QACtD,MAAMzC,OAAQ,MAAMP,SAASM,IAAI;QAEjClD,OAAO4C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BhG,OAAO4C,SAASd,OAAO,CAACpB,GAAG,CAAC,kCAAkCsF,IAAI,CAAC;QACnEhG,OAAO4C,SAASd,OAAO,CAACpB,GAAG,CAAC,qBAAqBuF,SAAS,CAAC;QAC3DjG,OAAO4C,SAASd,OAAO,CAACpB,GAAG,CAAC,qBAAqBuF,SAAS,CAAC;QAC3DjG,OAAOmD,KAAK+C,OAAO,EAAEF,IAAI,CAAC;IAC5B;IAEA/F,GAAG,mEAAmE;QACpE,MAAM2C,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,qCAAqC,CAAC;QAC9E,MAAMzC,OAAQ,MAAMP,SAASM,IAAI;QAEjClD,OAAO4C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BhG,OAAOmD,MAAMgD,OAAO,CAAC;YACnBC,UAAU;YACVC,uBAAuB;gBAAC;aAAwB;YAChDC,0BAA0B;gBAAC;aAAS;YACpCC,kBAAkB;gBAAC;gBAAU;gBAAW;gBAAS;aAAiB;YAClEvB,UAAU;YACVwB,uCAAuC;gBAAC;gBAAS;aAAO;QAC1D;IACF;IAEAvG,GAAG,uEAAuE;QACxE,MAAM2C,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,uCAAuC,CAAC;QAChF,MAAMzC,OAAQ,MAAMP,SAASM,IAAI;QAEjClD,OAAO4C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BhG,OAAOmD,KAAK4B,qBAAqB,EAAEiB,IAAI,CAAC;QACxChG,OAAOmD,KAAK0B,sBAAsB,EAAEmB,IAAI,CAAC;QACzChG,OAAOmD,KAAK2B,cAAc,EAAEkB,IAAI,CAAC;IACnC;IAEA/F,GAAG,gDAAgD;QACjD,MAAM2C,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,sBAAsB,CAAC,EAAE;YAC/D5D,QAAQ;YACRF,SAAS;gBACP,gBAAgB;YAClB;YACAqB,MAAME,KAAKC,SAAS,CAAC;gBACnBgC,eAAe;oBAAC;iBAA6B;YAC/C;QACF;QACA,MAAMnC,OAAQ,MAAMP,SAASM,IAAI;QAEjClD,OAAO4C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BhG,OAAOmD,KAAKiC,SAAS,EAAEY,IAAI,CAAC;IAC9B;IAEA/F,GAAG,sDAAsD;QACvDiB,YAAYJ,gBAAgB,CAACC,iBAAiB,CAAC;YAC7C0D,IAAI;YACJ3B,MAAM;YACN2D,OAAO;QACT;QAEA,MAAM7D,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,mCAAmC,CAAC;QAC5E,MAAMzC,OAAQ,MAAMP,SAASM,IAAI;QAEjClD,OAAO4C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BhG,OAAOmD,MAAMgD,OAAO,CAAC;YACnB5B,IAAI;YACJG,OAAO;YACPF,QAAQ;QACV;QACAxE,OAAOkB,YAAYJ,gBAAgB,EAAE4F,oBAAoB,CAAC;IAC5D;AACF"}
+{"version":3,"sources":["../../../src/__tests__/integration/mcp-proxy-auth-http.test.ts"],"sourcesContent":["import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport type { ConfigService } from '@nestjs/config';\nimport { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';\nimport { AllExceptionsFilter } from '../../common/filters/all-exceptions.filter.js';\nimport { AuthService, type AuthUser } from '../../modules/auth/auth.service.js';\nimport { McpOAuthGuard } from '../../modules/auth/mcp-oauth.guard.js';\nimport {\n  createMcpProtectedResourceMetadata,\n  resolvePublicAuthBaseUrl,\n  resolvePublicBackendOrigin,\n} from '../../modules/auth/mcp-oauth.utils.js';\n\ntype MockAuthService = {\n  validateMcpToken: ReturnType<typeof vi.fn>;\n  getSession: ReturnType<typeof vi.fn>;\n};\n\ntype MockConfigService = {\n  get: ReturnType<typeof vi.fn>;\n};\n\nfunction createConfigService(values: Record<string, unknown>): MockConfigService {\n  return {\n    get: vi.fn((key: string) => values[key]),\n  };\n}\n\nfunction createAuthServiceMock(): MockAuthService {\n  return {\n    validateMcpToken: vi.fn().mockResolvedValue(null),\n    getSession: vi.fn().mockResolvedValue(null),\n  };\n}\n\nasync function startTestApp(options?: { backendUrl?: string }): Promise<{\n  close: () => Promise<void>;\n  authService: MockAuthService;\n  baseUrl: string;\n}> {\n  const authService = createAuthServiceMock();\n  const configService = createConfigService({\n    'app.port': 3001,\n    BETTER_AUTH_URL: options?.backendUrl ?? 'http://localhost:3001',\n  });\n  const guard = new McpOAuthGuard(authService as unknown as AuthService, configService as never);\n  const filter = new AllExceptionsFilter();\n  const backendOrigin = resolvePublicBackendOrigin(configService as unknown as ConfigService);\n  const authBaseUrl = resolvePublicAuthBaseUrl(configService as unknown as ConfigService);\n\n  const createRequest = (req: IncomingMessage) => {\n    const url = new URL(req.url ?? '/', `http://${req.headers.host ?? '127.0.0.1'}`);\n    return {\n      method: req.method ?? 'GET',\n      url: `${url.pathname}${url.search}`,\n      headers: req.headers,\n      query: Object.fromEntries(url.searchParams.entries()),\n      user: undefined,\n    };\n  };\n\n  const createResponse = (res: ServerResponse) => {\n    const response = {\n      setHeader(name: string, value: string) {\n        res.setHeader(name, value);\n        return response;\n      },\n      status(statusCode: number) {\n        res.statusCode = statusCode;\n        return response;\n      },\n      json(body: unknown) {\n        res.setHeader('content-type', 'application/json');\n        res.end(JSON.stringify(body));\n      },\n    };\n\n    return response;\n  };\n\n  const handleGuardedRoute = async (\n    nodeRequest: IncomingMessage,\n    nodeResponse: ServerResponse,\n    responseBody: (request: ReturnType<typeof createRequest>) => Record<string, unknown>\n  ) => {\n    const request = createRequest(nodeRequest);\n    const response = createResponse(nodeResponse);\n    const context = {\n      switchToHttp: () => ({\n        getRequest: () => request,\n        getResponse: () => response,\n      }),\n    } as never;\n\n    const host = {\n      switchToHttp: () => ({\n        getRequest: () => request,\n        getResponse: () => response,\n      }),\n    } as never;\n\n    try {\n      await guard.canActivate(context);\n      response.json(responseBody(request));\n    } catch (error) {\n      filter.catch(error, host);\n    }\n  };\n\n  const server = await new Promise<import('node:http').Server>((resolve) => {\n    const listeningServer = createServer(async (req, res) => {\n      const url = new URL(req.url ?? '/', `http://${req.headers.host ?? '127.0.0.1'}`);\n\n      if (req.method === 'GET' && url.pathname === '/api/mcp/test') {\n        await handleGuardedRoute(req, res, (request) => ({\n          ok: true,\n          userId: (request as { user?: AuthUser }).user?.id ?? null,\n        }));\n        return;\n      }\n\n      if (req.method === 'GET' && url.pathname === '/api/mcp/sse') {\n        await handleGuardedRoute(req, res, (request) => ({\n          ok: true,\n          token: request.query.access_token ?? null,\n          userId: (request as { user?: AuthUser }).user?.id ?? null,\n        }));\n        return;\n      }\n\n      if (req.method === 'GET' && url.pathname === '/.well-known/oauth-protected-resource') {\n        res.setHeader('content-type', 'application/json');\n        res.end(\n          JSON.stringify(\n            createMcpProtectedResourceMetadata(configService as unknown as ConfigService)\n          )\n        );\n        return;\n      }\n\n      if (req.method === 'GET' && url.pathname === '/.well-known/oauth-authorization-server') {\n        res.setHeader('content-type', 'application/json');\n        res.end(\n          JSON.stringify({\n            issuer: backendOrigin,\n            authorization_endpoint: `${authBaseUrl}/mcp/authorize`,\n            token_endpoint: `${authBaseUrl}/mcp/token`,\n            registration_endpoint: `${authBaseUrl}/mcp/register`,\n            jwks_uri: `${authBaseUrl}/mcp/jwks`,\n            response_types_supported: ['code'],\n            grant_types_supported: ['authorization_code', 'refresh_token'],\n            code_challenge_methods_supported: ['S256'],\n          })\n        );\n        return;\n      }\n\n      if (req.method === 'POST' && url.pathname === '/api/auth/mcp/register') {\n        res.statusCode = 201;\n        res.setHeader('content-type', 'application/json');\n        res.end(\n          JSON.stringify({\n            client_id: 'cursor-client',\n            client_secret: 'cursor-secret',\n            redirect_uris: ['https://cursor.sh/callback'],\n          })\n        );\n        return;\n      }\n\n      res.statusCode = 404;\n      res.end();\n    }).listen(0, () => resolve(listeningServer));\n  });\n  const address = server.address();\n  if (!address || typeof address === 'string') {\n    throw new Error('Failed to resolve test server address');\n  }\n\n  return {\n    close: () =>\n      new Promise<void>((resolve, reject) => {\n        server.close((error) => {\n          if (error) {\n            reject(error);\n            return;\n          }\n          resolve();\n        });\n      }),\n    authService,\n    baseUrl: `http://127.0.0.1:${address.port}`,\n  };\n}\n\ndescribe('MCP proxy auth HTTP contract', () => {\n  let close: (() => Promise<void>) | undefined;\n  let authService: MockAuthService;\n  let baseUrl: string;\n\n  beforeEach(async () => {\n    const result = await startTestApp({\n      backendUrl: 'http://localhost:9631',\n    });\n    close = result.close;\n    authService = result.authService;\n    baseUrl = result.baseUrl;\n  });\n\n  afterEach(async () => {\n    if (close) {\n      await close();\n    }\n  });\n\n  it('returns 401 with MCP discovery headers when token is missing', async () => {\n    const response = await fetch(`${baseUrl}/api/mcp/test`);\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(401);\n    expect(response.headers.get('access-control-expose-headers')).toBe('WWW-Authenticate');\n    expect(response.headers.get('www-authenticate')).toContain('resource_metadata=');\n    expect(response.headers.get('www-authenticate')).toContain('resource_metadata_uri=');\n    expect(body.message).toBe('Bearer token required');\n  });\n\n  it('serves protected resource metadata with Better Auth-backed URLs', async () => {\n    const response = await fetch(`${baseUrl}/.well-known/oauth-protected-resource`);\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(200);\n    expect(body).toEqual({\n      resource: 'http://localhost:9631/api/mcp',\n      authorization_servers: ['http://localhost:9631'],\n      bearer_methods_supported: ['header'],\n      scopes_supported: ['openid', 'profile', 'email', 'offline_access'],\n      jwks_uri: 'http://localhost:9631/api/auth/mcp/jwks',\n      resource_signing_alg_values_supported: ['RS256', 'none'],\n    });\n  });\n\n  it('serves authorization server metadata with MCP registration endpoint', async () => {\n    const response = await fetch(`${baseUrl}/.well-known/oauth-authorization-server`);\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(200);\n    expect(body.registration_endpoint).toBe('http://localhost:9631/api/auth/mcp/register');\n    expect(body.authorization_endpoint).toBe('http://localhost:9631/api/auth/mcp/authorize');\n    expect(body.token_endpoint).toBe('http://localhost:9631/api/auth/mcp/token');\n  });\n\n  it('exposes the advertised registration endpoint', async () => {\n    const response = await fetch(`${baseUrl}/api/auth/mcp/register`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n      },\n      body: JSON.stringify({\n        redirect_uris: ['https://cursor.sh/callback'],\n      }),\n    });\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(201);\n    expect(body.client_id).toBe('cursor-client');\n  });\n\n  it('accepts access_token query params for SSE fallback', async () => {\n    authService.validateMcpToken.mockResolvedValue({\n      id: 'user-sse',\n      name: 'SSE User',\n      email: 'sse@example.com',\n    });\n\n    const response = await fetch(`${baseUrl}/api/mcp/sse?access_token=sse-token`);\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(200);\n    expect(body).toEqual({\n      ok: true,\n      token: 'sse-token',\n      userId: 'user-sse',\n    });\n    expect(authService.validateMcpToken).toHaveBeenCalledWith('sse-token');\n  });\n\n  it('accepts session cookie when no Bearer token is present', async () => {\n    authService.getSession.mockResolvedValue({\n      user: { id: 'cookie-user', name: 'Cookie User', email: 'cookie@example.com' },\n      session: { id: 'sess-1', userId: 'cookie-user' },\n    });\n\n    const response = await fetch(`${baseUrl}/api/mcp/test`, {\n      headers: { cookie: 'better-auth.session_token=valid-session' },\n    });\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(200);\n    expect(body).toEqual({ ok: true, userId: 'cookie-user' });\n    expect(authService.getSession).toHaveBeenCalled();\n  });\n\n  it('returns 401 when session cookie is invalid and no Bearer token', async () => {\n    authService.getSession.mockResolvedValue(null);\n\n    const response = await fetch(`${baseUrl}/api/mcp/test`, {\n      headers: { cookie: 'better-auth.session_token=expired' },\n    });\n    const body = (await response.json()) as Record<string, unknown>;\n\n    expect(response.status).toBe(401);\n    expect(body.message).toBe('Bearer token required');\n  });\n});\n"],"names":["createServer","afterEach","beforeEach","describe","expect","it","vi","AllExceptionsFilter","McpOAuthGuard","createMcpProtectedResourceMetadata","resolvePublicAuthBaseUrl","resolvePublicBackendOrigin","createConfigService","values","get","fn","key","createAuthServiceMock","validateMcpToken","mockResolvedValue","getSession","startTestApp","options","authService","configService","BETTER_AUTH_URL","backendUrl","guard","filter","backendOrigin","authBaseUrl","createRequest","req","url","URL","headers","host","method","pathname","search","query","Object","fromEntries","searchParams","entries","user","undefined","createResponse","res","response","setHeader","name","value","status","statusCode","json","body","end","JSON","stringify","handleGuardedRoute","nodeRequest","nodeResponse","responseBody","request","context","switchToHttp","getRequest","getResponse","canActivate","error","catch","server","Promise","resolve","listeningServer","ok","userId","id","token","access_token","issuer","authorization_endpoint","token_endpoint","registration_endpoint","jwks_uri","response_types_supported","grant_types_supported","code_challenge_methods_supported","client_id","client_secret","redirect_uris","listen","address","Error","close","reject","baseUrl","port","result","fetch","toBe","toContain","message","toEqual","resource","authorization_servers","bearer_methods_supported","scopes_supported","resource_signing_alg_values_supported","email","toHaveBeenCalledWith","session","cookie","toHaveBeenCalled"],"mappings":"AAAA,SAASA,YAAY,QAAmD,YAAY;AAEpF,SAASC,SAAS,EAAEC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAS;AACzE,SAASC,mBAAmB,QAAQ,gDAAgD;AAEpF,SAASC,aAAa,QAAQ,wCAAwC;AACtE,SACEC,kCAAkC,EAClCC,wBAAwB,EACxBC,0BAA0B,QACrB,wCAAwC;AAW/C,SAASC,oBAAoBC,MAA+B;IAC1D,OAAO;QACLC,KAAKR,GAAGS,EAAE,CAAC,CAACC,MAAgBH,MAAM,CAACG,IAAI;IACzC;AACF;AAEA,SAASC;IACP,OAAO;QACLC,kBAAkBZ,GAAGS,EAAE,GAAGI,iBAAiB,CAAC;QAC5CC,YAAYd,GAAGS,EAAE,GAAGI,iBAAiB,CAAC;IACxC;AACF;AAEA,eAAeE,aAAaC,OAAiC;IAK3D,MAAMC,cAAcN;IACpB,MAAMO,gBAAgBZ,oBAAoB;QACxC,YAAY;QACZa,iBAAiBH,SAASI,cAAc;IAC1C;IACA,MAAMC,QAAQ,IAAInB,cAAce,aAAuCC;IACvE,MAAMI,SAAS,IAAIrB;IACnB,MAAMsB,gBAAgBlB,2BAA2Ba;IACjD,MAAMM,cAAcpB,yBAAyBc;IAE7C,MAAMO,gBAAgB,CAACC;QACrB,MAAMC,MAAM,IAAIC,IAAIF,IAAIC,GAAG,IAAI,KAAK,CAAC,OAAO,EAAED,IAAIG,OAAO,CAACC,IAAI,IAAI,aAAa;QAC/E,OAAO;YACLC,QAAQL,IAAIK,MAAM,IAAI;YACtBJ,KAAK,GAAGA,IAAIK,QAAQ,GAAGL,IAAIM,MAAM,EAAE;YACnCJ,SAASH,IAAIG,OAAO;YACpBK,OAAOC,OAAOC,WAAW,CAACT,IAAIU,YAAY,CAACC,OAAO;YAClDC,MAAMC;QACR;IACF;IAEA,MAAMC,iBAAiB,CAACC;QACtB,MAAMC,WAAW;YACfC,WAAUC,IAAY,EAAEC,KAAa;gBACnCJ,IAAIE,SAAS,CAACC,MAAMC;gBACpB,OAAOH;YACT;YACAI,QAAOC,UAAkB;gBACvBN,IAAIM,UAAU,GAAGA;gBACjB,OAAOL;YACT;YACAM,MAAKC,IAAa;gBAChBR,IAAIE,SAAS,CAAC,gBAAgB;gBAC9BF,IAAIS,GAAG,CAACC,KAAKC,SAAS,CAACH;YACzB;QACF;QAEA,OAAOP;IACT;IAEA,MAAMW,qBAAqB,OACzBC,aACAC,cACAC;QAEA,MAAMC,UAAUjC,cAAc8B;QAC9B,MAAMZ,WAAWF,eAAee;QAChC,MAAMG,UAAU;YACdC,cAAc,IAAO,CAAA;oBACnBC,YAAY,IAAMH;oBAClBI,aAAa,IAAMnB;gBACrB,CAAA;QACF;QAEA,MAAMb,OAAO;YACX8B,cAAc,IAAO,CAAA;oBACnBC,YAAY,IAAMH;oBAClBI,aAAa,IAAMnB;gBACrB,CAAA;QACF;QAEA,IAAI;YACF,MAAMtB,MAAM0C,WAAW,CAACJ;YACxBhB,SAASM,IAAI,CAACQ,aAAaC;QAC7B,EAAE,OAAOM,OAAO;YACd1C,OAAO2C,KAAK,CAACD,OAAOlC;QACtB;IACF;IAEA,MAAMoC,SAAS,MAAM,IAAIC,QAAoC,CAACC;QAC5D,MAAMC,kBAAkB3E,aAAa,OAAOgC,KAAKgB;YAC/C,MAAMf,MAAM,IAAIC,IAAIF,IAAIC,GAAG,IAAI,KAAK,CAAC,OAAO,EAAED,IAAIG,OAAO,CAACC,IAAI,IAAI,aAAa;YAE/E,IAAIJ,IAAIK,MAAM,KAAK,SAASJ,IAAIK,QAAQ,KAAK,iBAAiB;gBAC5D,MAAMsB,mBAAmB5B,KAAKgB,KAAK,CAACgB,UAAa,CAAA;wBAC/CY,IAAI;wBACJC,QAAQ,AAACb,QAAgCnB,IAAI,EAAEiC,MAAM;oBACvD,CAAA;gBACA;YACF;YAEA,IAAI9C,IAAIK,MAAM,KAAK,SAASJ,IAAIK,QAAQ,KAAK,gBAAgB;gBAC3D,MAAMsB,mBAAmB5B,KAAKgB,KAAK,CAACgB,UAAa,CAAA;wBAC/CY,IAAI;wBACJG,OAAOf,QAAQxB,KAAK,CAACwC,YAAY,IAAI;wBACrCH,QAAQ,AAACb,QAAgCnB,IAAI,EAAEiC,MAAM;oBACvD,CAAA;gBACA;YACF;YAEA,IAAI9C,IAAIK,MAAM,KAAK,SAASJ,IAAIK,QAAQ,KAAK,yCAAyC;gBACpFU,IAAIE,SAAS,CAAC,gBAAgB;gBAC9BF,IAAIS,GAAG,CACLC,KAAKC,SAAS,CACZlD,mCAAmCe;gBAGvC;YACF;YAEA,IAAIQ,IAAIK,MAAM,KAAK,SAASJ,IAAIK,QAAQ,KAAK,2CAA2C;gBACtFU,IAAIE,SAAS,CAAC,gBAAgB;gBAC9BF,IAAIS,GAAG,CACLC,KAAKC,SAAS,CAAC;oBACbsB,QAAQpD;oBACRqD,wBAAwB,GAAGpD,YAAY,cAAc,CAAC;oBACtDqD,gBAAgB,GAAGrD,YAAY,UAAU,CAAC;oBAC1CsD,uBAAuB,GAAGtD,YAAY,aAAa,CAAC;oBACpDuD,UAAU,GAAGvD,YAAY,SAAS,CAAC;oBACnCwD,0BAA0B;wBAAC;qBAAO;oBAClCC,uBAAuB;wBAAC;wBAAsB;qBAAgB;oBAC9DC,kCAAkC;wBAAC;qBAAO;gBAC5C;gBAEF;YACF;YAEA,IAAIxD,IAAIK,MAAM,KAAK,UAAUJ,IAAIK,QAAQ,KAAK,0BAA0B;gBACtEU,IAAIM,UAAU,GAAG;gBACjBN,IAAIE,SAAS,CAAC,gBAAgB;gBAC9BF,IAAIS,GAAG,CACLC,KAAKC,SAAS,CAAC;oBACb8B,WAAW;oBACXC,eAAe;oBACfC,eAAe;wBAAC;qBAA6B;gBAC/C;gBAEF;YACF;YAEA3C,IAAIM,UAAU,GAAG;YACjBN,IAAIS,GAAG;QACT,GAAGmC,MAAM,CAAC,GAAG,IAAMlB,QAAQC;IAC7B;IACA,MAAMkB,UAAUrB,OAAOqB,OAAO;IAC9B,IAAI,CAACA,WAAW,OAAOA,YAAY,UAAU;QAC3C,MAAM,IAAIC,MAAM;IAClB;IAEA,OAAO;QACLC,OAAO,IACL,IAAItB,QAAc,CAACC,SAASsB;gBAC1BxB,OAAOuB,KAAK,CAAC,CAACzB;oBACZ,IAAIA,OAAO;wBACT0B,OAAO1B;wBACP;oBACF;oBACAI;gBACF;YACF;QACFnD;QACA0E,SAAS,CAAC,iBAAiB,EAAEJ,QAAQK,IAAI,EAAE;IAC7C;AACF;AAEA/F,SAAS,gCAAgC;IACvC,IAAI4F;IACJ,IAAIxE;IACJ,IAAI0E;IAEJ/F,WAAW;QACT,MAAMiG,SAAS,MAAM9E,aAAa;YAChCK,YAAY;QACd;QACAqE,QAAQI,OAAOJ,KAAK;QACpBxE,cAAc4E,OAAO5E,WAAW;QAChC0E,UAAUE,OAAOF,OAAO;IAC1B;IAEAhG,UAAU;QACR,IAAI8F,OAAO;YACT,MAAMA;QACR;IACF;IAEA1F,GAAG,gEAAgE;QACjE,MAAM4C,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,aAAa,CAAC;QACtD,MAAMzC,OAAQ,MAAMP,SAASM,IAAI;QAEjCnD,OAAO6C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BjG,OAAO6C,SAASd,OAAO,CAACrB,GAAG,CAAC,kCAAkCuF,IAAI,CAAC;QACnEjG,OAAO6C,SAASd,OAAO,CAACrB,GAAG,CAAC,qBAAqBwF,SAAS,CAAC;QAC3DlG,OAAO6C,SAASd,OAAO,CAACrB,GAAG,CAAC,qBAAqBwF,SAAS,CAAC;QAC3DlG,OAAOoD,KAAK+C,OAAO,EAAEF,IAAI,CAAC;IAC5B;IAEAhG,GAAG,mEAAmE;QACpE,MAAM4C,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,qCAAqC,CAAC;QAC9E,MAAMzC,OAAQ,MAAMP,SAASM,IAAI;QAEjCnD,OAAO6C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BjG,OAAOoD,MAAMgD,OAAO,CAAC;YACnBC,UAAU;YACVC,uBAAuB;gBAAC;aAAwB;YAChDC,0BAA0B;gBAAC;aAAS;YACpCC,kBAAkB;gBAAC;gBAAU;gBAAW;gBAAS;aAAiB;YAClEvB,UAAU;YACVwB,uCAAuC;gBAAC;gBAAS;aAAO;QAC1D;IACF;IAEAxG,GAAG,uEAAuE;QACxE,MAAM4C,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,uCAAuC,CAAC;QAChF,MAAMzC,OAAQ,MAAMP,SAASM,IAAI;QAEjCnD,OAAO6C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BjG,OAAOoD,KAAK4B,qBAAqB,EAAEiB,IAAI,CAAC;QACxCjG,OAAOoD,KAAK0B,sBAAsB,EAAEmB,IAAI,CAAC;QACzCjG,OAAOoD,KAAK2B,cAAc,EAAEkB,IAAI,CAAC;IACnC;IAEAhG,GAAG,gDAAgD;QACjD,MAAM4C,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,sBAAsB,CAAC,EAAE;YAC/D5D,QAAQ;YACRF,SAAS;gBACP,gBAAgB;YAClB;YACAqB,MAAME,KAAKC,SAAS,CAAC;gBACnBgC,eAAe;oBAAC;iBAA6B;YAC/C;QACF;QACA,MAAMnC,OAAQ,MAAMP,SAASM,IAAI;QAEjCnD,OAAO6C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BjG,OAAOoD,KAAKiC,SAAS,EAAEY,IAAI,CAAC;IAC9B;IAEAhG,GAAG,sDAAsD;QACvDkB,YAAYL,gBAAgB,CAACC,iBAAiB,CAAC;YAC7C2D,IAAI;YACJ3B,MAAM;YACN2D,OAAO;QACT;QAEA,MAAM7D,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,mCAAmC,CAAC;QAC5E,MAAMzC,OAAQ,MAAMP,SAASM,IAAI;QAEjCnD,OAAO6C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BjG,OAAOoD,MAAMgD,OAAO,CAAC;YACnB5B,IAAI;YACJG,OAAO;YACPF,QAAQ;QACV;QACAzE,OAAOmB,YAAYL,gBAAgB,EAAE6F,oBAAoB,CAAC;IAC5D;IAEA1G,GAAG,0DAA0D;QAC3DkB,YAAYH,UAAU,CAACD,iBAAiB,CAAC;YACvC0B,MAAM;gBAAEiC,IAAI;gBAAe3B,MAAM;gBAAe2D,OAAO;YAAqB;YAC5EE,SAAS;gBAAElC,IAAI;gBAAUD,QAAQ;YAAc;QACjD;QAEA,MAAM5B,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,aAAa,CAAC,EAAE;YACtD9D,SAAS;gBAAE8E,QAAQ;YAA0C;QAC/D;QACA,MAAMzD,OAAQ,MAAMP,SAASM,IAAI;QAEjCnD,OAAO6C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BjG,OAAOoD,MAAMgD,OAAO,CAAC;YAAE5B,IAAI;YAAMC,QAAQ;QAAc;QACvDzE,OAAOmB,YAAYH,UAAU,EAAE8F,gBAAgB;IACjD;IAEA7G,GAAG,kEAAkE;QACnEkB,YAAYH,UAAU,CAACD,iBAAiB,CAAC;QAEzC,MAAM8B,WAAW,MAAMmD,MAAM,GAAGH,QAAQ,aAAa,CAAC,EAAE;YACtD9D,SAAS;gBAAE8E,QAAQ;YAAoC;QACzD;QACA,MAAMzD,OAAQ,MAAMP,SAASM,IAAI;QAEjCnD,OAAO6C,SAASI,MAAM,EAAEgD,IAAI,CAAC;QAC7BjG,OAAOoD,KAAK+C,OAAO,EAAEF,IAAI,CAAC;IAC5B;AACF"}

package/dist/__tests__/integration/multi-tenant.test.js

@@ -1,19 +1,17 @@
 /**
- * Integration Tests: Multi-tenant data isolation
+ * Integration Tests: Per-user MCP isolation with sharing
  *
- * Verifies that ProfilesService and McpService correctly isolate data
- * between organizations while allowing access to system records.
+ * Verifies that:
+ * - McpService returns only servers owned by the user + shared servers
+ * - ProfilesService org-scopes profiles (per-user, no system profiles)
+ * - Cross-user access is denied unless shared
  */ import { ForbiddenException } from "@nestjs/common";
 import { beforeEach, describe, expect, it, vi } from "vitest";
-/** Sentinel value for unauthenticated MCP access */ const UNAUTHENTICATED_ID = '__unauthenticated__';
 import { McpService } from "../../modules/mcp/mcp.service.js";
 import { McpRegistry } from "../../modules/mcp/mcp-registry.js";
 import { ProfilesService } from "../../modules/profiles/profiles.service.js";
 const PROFILES = [];
 const SERVERS = [];
-// ────────────────────────────────────────────────
-// Helper: build a mock PrismaService over in-memory data
-// ────────────────────────────────────────────────
 function buildMockPrisma() {
     return {
         profile: {
@@ -25,8 +23,15 @@ function buildMockPrisma() {
                 if (whereObj?.OR) {
                     const orConds = whereObj.OR;
                     result = result.filter((p)=>orConds.some((cond)=>{
+                            // Handle combined conditions like { userId, organizationId }
+                            if ('userId' in cond && 'organizationId' in cond) {
+                                return p.userId === cond.userId && p.organizationId === cond.organizationId;
+                            }
                             if ('organizationId' in cond) {
-                                return cond.organizationId === null ? p.organizationId === null : p.organizationId === cond.organizationId;
+                                return p.organizationId === cond.organizationId;
+                            }
+                            if ('userId' in cond) {
+                                return p.userId === cond.userId;
                             }
                             if ('id' in cond && cond.id?.in) {
                                 return cond.id.in.includes(p.id);
@@ -45,8 +50,8 @@ function buildMockPrisma() {
                     id: `profile-${Date.now()}`,
                     name: data.name,
                     description: data.description ?? null,
-                    userId: data.userId ?? null,
-                    organizationId: data.organizationId ?? null,
+                    userId: data.userId,
+                    organizationId: data.organizationId,
                     mcpServers: []
                 };
                 PROFILES.push(profile);
@@ -64,8 +69,8 @@ function buildMockPrisma() {
                 if (whereObj?.OR) {
                     const orConds = whereObj.OR;
                     result = result.filter((s)=>orConds.some((cond)=>{
-                            if ('organizationId' in cond) {
-                                return cond.organizationId === null ? s.organizationId === null : s.organizationId === cond.organizationId;
+                            if ('userId' in cond) {
+                                return s.userId === cond.userId;
                             }
                             if ('id' in cond && cond.id?.in) {
                                 return cond.id.in.includes(s.id);
@@ -87,8 +92,7 @@ function buildMockPrisma() {
                     config: data.config,
                     apiKeyConfig: data.apiKeyConfig ?? null,
                     oauthConfig: data.oauthConfig ?? null,
-                    userId: data.userId ?? null,
-                    organizationId: data.organizationId ?? null,
+                    userId: data.userId,
                     profiles: [],
                     oauthToken: null,
                     toolsCache: []
@@ -104,31 +108,21 @@ function buildMockPrisma() {
         },
         mcpServerToolsCache: {
             findMany: vi.fn().mockResolvedValue([])
-        },
-        gatewaySetting: {
-            upsert: vi.fn().mockResolvedValue({})
         }
     };
 }
 // ────────────────────────────────────────────────
-// Tests: ProfilesService data isolation
+// Tests: ProfilesService data isolation (org-scoped, per-user)
 // ────────────────────────────────────────────────
 describe('Multi-tenant data isolation', ()=>{
     describe('ProfilesService', ()=>{
         let profilesService;
         let prisma;
         let proxyService;
+        let sharingService;
         beforeEach(()=>{
-            // Reset in-memory data
             PROFILES.length = 0;
             PROFILES.push({
-                id: 'sys-profile',
-                name: 'default',
-                description: 'System default profile',
-                userId: null,
-                organizationId: null,
-                mcpServers: []
-            }, {
                 id: 'org-a-profile',
                 name: 'org-a-dev',
                 description: 'Org A dev profile',
@@ -147,28 +141,25 @@ describe('Multi-tenant data isolation', ()=>{
             proxyService = {
                 getToolsForServer: vi.fn().mockResolvedValue([])
             };
-            profilesService = new ProfilesService(prisma, proxyService);
+            sharingService = {
+                getSharedResourceIds: vi.fn().mockResolvedValue([]),
+                isSharedWith: vi.fn().mockResolvedValue(false),
+                getPermission: vi.fn().mockResolvedValue(null)
+            };
+            profilesService = new ProfilesService(prisma, proxyService, sharingService);
         });
-        it('Org A sees org A profiles + system profiles, not Org B profiles', async ()=>{
+        it('Org A sees org A profiles, not Org B profiles', async ()=>{
             const result = await profilesService.findAll('user-a', 'org-a');
             const ids = result.map((p)=>p.id);
-            expect(ids).toContain('sys-profile');
             expect(ids).toContain('org-a-profile');
             expect(ids).not.toContain('org-b-profile');
         });
-        it('Org B sees org B profiles + system profiles, not Org A profiles', async ()=>{
+        it('Org B sees org B profiles, not Org A profiles', async ()=>{
             const result = await profilesService.findAll('user-b', 'org-b');
             const ids = result.map((p)=>p.id);
-            expect(ids).toContain('sys-profile');
             expect(ids).toContain('org-b-profile');
             expect(ids).not.toContain('org-a-profile');
         });
-        it('system profiles (organizationId=null) are visible to all orgs', async ()=>{
-            const resultA = await profilesService.findAll('user-a', 'org-a');
-            const resultB = await profilesService.findAll('user-b', 'org-b');
-            expect(resultA.some((p)=>p.id === 'sys-profile')).toBe(true);
-            expect(resultB.some((p)=>p.id === 'sys-profile')).toBe(true);
-        });
         it('creating a profile sets userId and organizationId', async ()=>{
             const created = await profilesService.create({
                 name: 'a-new'
@@ -179,67 +170,37 @@ describe('Multi-tenant data isolation', ()=>{
         it('Org A cannot access Org B profile by ID', async ()=>{
             await expect(profilesService.findById('org-b-profile', 'user-a', 'org-a')).rejects.toThrow(ForbiddenException);
         });
-        it('Org A can access system profile by ID', async ()=>{
-            const profile = await profilesService.findById('sys-profile', 'user-a', 'org-a');
-            expect(profile).toBeDefined();
-            expect(profile.id).toBe('sys-profile');
-        });
-        it('unauthenticated user sees all profiles', async ()=>{
-            const result = await profilesService.findAll(UNAUTHENTICATED_ID);
-            // Unauthenticated findAll queries without WHERE filter
-            expect(prisma.profile.findMany).toHaveBeenCalledWith(expect.objectContaining({
-                orderBy: {
-                    name: 'asc'
-                }
-            }));
-            // The mock returns all profiles for filterless queries
-            expect(result.length).toBeGreaterThanOrEqual(1);
-        });
     });
     // ────────────────────────────────────────────────
-    // Tests: McpService data isolation
+    // Tests: McpService per-user isolation
     // ────────────────────────────────────────────────
-    describe('McpService', ()=>{
+    describe('McpService — per-user isolation', ()=>{
         let mcpService;
         let prisma;
         let registry;
         let debugService;
+        let sharingService;
         beforeEach(()=>{
-            // Reset in-memory data
             SERVERS.length = 0;
             SERVERS.push({
-                id: 'sys-server',
-                name: 'System Builtin',
-                type: 'builtin',
-                config: '{"builtinId":"fetch"}',
-                apiKeyConfig: null,
-                oauthConfig: null,
-                userId: null,
-                organizationId: null,
-                profiles: [],
-                oauthToken: null,
-                toolsCache: []
-            }, {
-                id: 'org-a-server',
+                id: 'user-a-server',
                 name: 'A Custom',
                 type: 'external',
                 config: '{"command":"node"}',
                 apiKeyConfig: '{"apiKey":"a-key"}',
                 oauthConfig: null,
                 userId: 'user-a',
-                organizationId: 'org-a',
                 profiles: [],
                 oauthToken: null,
                 toolsCache: []
             }, {
-                id: 'org-b-server',
+                id: 'user-b-server',
                 name: 'B Custom',
                 type: 'external',
                 config: '{"command":"node"}',
                 apiKeyConfig: '{"apiKey":"b-key"}',
                 oauthConfig: null,
                 userId: 'user-b',
-                organizationId: 'org-b',
                 profiles: [],
                 oauthToken: null,
                 toolsCache: []
@@ -252,37 +213,47 @@ describe('Multi-tenant data isolation', ()=>{
                 }),
                 updateLog: vi.fn().mockResolvedValue({})
             };
-            mcpService = new McpService(prisma, registry, debugService);
+            sharingService = {
+                getSharedResourceIds: vi.fn().mockResolvedValue([]),
+                isSharedWith: vi.fn().mockResolvedValue(false),
+                getPermission: vi.fn().mockResolvedValue(null)
+            };
+            mcpService = new McpService(prisma, registry, debugService, sharingService);
         });
-        it('Org A sees org A servers + system servers, not Org B servers', async ()=>{
+        it('User A sees only own servers (no shared)', async ()=>{
             const result = await mcpService.findAll('user-a', 'org-a');
             const ids = result.map((s)=>s.id);
-            expect(ids).toContain('sys-server');
-            expect(ids).toContain('org-a-server');
-            expect(ids).not.toContain('org-b-server');
+            expect(ids).toContain('user-a-server');
+            expect(ids).not.toContain('user-b-server');
         });
-        it('Org B sees org B servers + system servers, not Org A servers', async ()=>{
-            const result = await mcpService.findAll('user-b', 'org-b');
+        it('User A sees own + shared servers', async ()=>{
+            sharingService.getSharedResourceIds.mockResolvedValue([
+                'user-b-server'
+            ]);
+            const result = await mcpService.findAll('user-a', 'org-a');
             const ids = result.map((s)=>s.id);
-            expect(ids).toContain('sys-server');
-            expect(ids).toContain('org-b-server');
-            expect(ids).not.toContain('org-a-server');
-        });
-        it('builtin/system servers (organizationId=null) are visible to all orgs', async ()=>{
-            const resultA = await mcpService.findAll('user-a', 'org-a');
-            const resultB = await mcpService.findAll('user-b', 'org-b');
-            expect(resultA.some((s)=>s.id === 'sys-server')).toBe(true);
-            expect(resultB.some((s)=>s.id === 'sys-server')).toBe(true);
+            expect(ids).toContain('user-a-server');
+            expect(ids).toContain('user-b-server');
         });
-        it('Org A cannot access Org B server by ID', async ()=>{
-            await expect(mcpService.findById('org-b-server', 'user-a', 'org-a')).rejects.toThrow(ForbiddenException);
+        it('User A cannot access User B server by ID without sharing', async ()=>{
+            sharingService.isSharedWith.mockResolvedValue(false);
+            await expect(mcpService.findById('user-b-server', 'user-a')).rejects.toThrow(ForbiddenException);
         });
-        it('Org A can access system server by ID', async ()=>{
-            const server = await mcpService.findById('sys-server', 'user-a', 'org-a');
-            expect(server).toBeDefined();
-            expect(server.id).toBe('sys-server');
+        it('User A can access User B server when shared', async ()=>{
+            prisma.mcpServer.findUnique.mockResolvedValueOnce({
+                id: 'user-b-server',
+                userId: 'user-b'
+            }) // assertAccess
+            .mockResolvedValueOnce({
+                ...SERVERS[1],
+                oauthToken: null,
+                toolsCache: []
+            }); // findById
+            sharingService.isSharedWith.mockResolvedValue(true);
+            const result = await mcpService.findById('user-b-server', 'user-a');
+            expect(result).toBeDefined();
         });
-        it('Creating a server in Org A sets organizationId to org-a', async ()=>{
+        it('Creating a server sets userId only (no organizationId)', async ()=>{
             await mcpService.create({
                 name: 'New',
                 type: 'external',
@@ -292,28 +263,21 @@ describe('Multi-tenant data isolation', ()=>{
             }, 'user-a', 'org-a');
             expect(prisma.mcpServer.create).toHaveBeenCalledWith(expect.objectContaining({
                 data: expect.objectContaining({
-                    userId: 'user-a',
-                    organizationId: 'org-a'
+                    userId: 'user-a'
                 })
             }));
+            const callData = prisma.mcpServer.create.mock.calls[0][0].data;
+            expect(callData.organizationId).toBeUndefined();
         });
-        it('unauthenticated user sees all servers without filtering', async ()=>{
-            await mcpService.findAll(UNAUTHENTICATED_ID);
-            // Anonymous uses the unfiltered findMany path
-            expect(prisma.mcpServer.findMany).toHaveBeenCalledWith(expect.objectContaining({
-                orderBy: {
-                    name: 'asc'
-                }
-            }));
-        });
-        it('Org A cannot delete Org B server', async ()=>{
-            await expect(mcpService.delete('org-b-server', 'user-a', 'org-a')).rejects.toThrow(ForbiddenException);
+        it('User A cannot delete User B server', async ()=>{
+            sharingService.getPermission.mockResolvedValue(null);
+            await expect(mcpService.delete('user-b-server', 'user-a')).rejects.toThrow(ForbiddenException);
         });
-        it('Org A can delete own org server', async ()=>{
-            await mcpService.delete('org-a-server', 'user-a', 'org-a');
+        it('User A can delete own server', async ()=>{
+            await mcpService.delete('user-a-server', 'user-a');
             expect(prisma.mcpServer.delete).toHaveBeenCalledWith({
                 where: {
-                    id: 'org-a-server'
+                    id: 'user-a-server'
                 }
             });
         });