@dxheroes/local-mcp-backend 0.9.2 → 0.10.0

package/dist/__tests__/integration/proxy-auth.test.js

@@ -1,15 +1,16 @@
 /**
  * Integration Tests: Proxy controller auth
  *
- * Verifies that:
- * - Proxy routes are @Public() (no session cookie required)
- * - Bearer token validation via resolveUser flow
+ * Verifies:
+ * - McpOAuthGuard always enforces Bearer token
+ * - WWW-Authenticate header with resource_metadata_uri on 401
+ * - Valid tokens resolve user and pass through
  * - Org-scoped profile lookup through the proxy service
- * - Unauthenticated access uses __unauthenticated__ sentinel
- * - Gateway endpoint still works with handleGatewayRequest
+ * - Gateway endpoint uses default profile with user scoping
  */ import { NotFoundException, UnauthorizedException } from "@nestjs/common";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 // Dynamic import to handle ESM
+const { McpOAuthGuard } = await import("../../modules/auth/mcp-oauth.guard.js");
 const { ProxyController } = await import("../../modules/proxy/proxy.controller.js");
 // ────────────────────────────────────────────────
 // Mock factories
@@ -23,6 +24,19 @@ function createMockAuthService() {
         onModuleInit: vi.fn()
     };
 }
+function createMockConfigService(overrides = {}) {
+    const defaults = {
+        'app.port': 3001,
+        BETTER_AUTH_URL: 'http://localhost:3001'
+    };
+    const config = {
+        ...defaults,
+        ...overrides
+    };
+    return {
+        get: vi.fn((key)=>config[key])
+    };
+}
 function createMockProxyService() {
     return {
         handleRequest: vi.fn().mockResolvedValue({
@@ -72,120 +86,125 @@ function createMockEventEmitter() {
         off: vi.fn()
     };
 }
-function createMockRequest(headers = {}) {
+function createMockRequest(headers = {}, query = {}) {
     return {
         headers,
-        on: vi.fn()
+        query,
+        on: vi.fn(),
+        user: undefined
     };
 }
-describe('Proxy controller auth', ()=>{
-    let controller;
+function createMockExecutionContext(req) {
+    return {
+        switchToHttp: ()=>({
+                getRequest: ()=>req,
+                getResponse: ()=>({})
+            }),
+        getHandler: ()=>({}),
+        getClass: ()=>({})
+    };
+}
+// ────────────────────────────────────────────────
+// McpOAuthGuard tests
+// ────────────────────────────────────────────────
+describe('McpOAuthGuard', ()=>{
+    let guard;
     let authService;
-    let proxyService;
-    let settingsService;
-    let eventEmitter;
-    // ────────────────────────────────────────────────
-    // Unauthenticated access (no Bearer token)
-    // ────────────────────────────────────────────────
-    describe('unauthenticated access (no Bearer token)', ()=>{
-        beforeEach(()=>{
-            authService = createMockAuthService();
-            proxyService = createMockProxyService();
-            settingsService = createMockSettingsService();
-            eventEmitter = createMockEventEmitter();
-            controller = new ProxyController(proxyService, settingsService, eventEmitter, authService);
-        });
-        it('org-scoped POST request passes __unauthenticated__ to proxy service', async ()=>{
-            const req = createMockRequest();
-            const mcpRequest = {
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'tools/list'
-            };
-            await controller.handleOrgMcpRequest(req, 'my-org', 'my-profile', mcpRequest);
-            expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith('my-profile', 'my-org', mcpRequest, '__unauthenticated__');
-        });
-        it('gateway POST request passes __unauthenticated__', async ()=>{
-            const req = createMockRequest();
-            const mcpRequest = {
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'initialize'
-            };
-            await controller.handleGatewayRequest(req, mcpRequest);
-            expect(proxyService.handleRequest).toHaveBeenCalledWith('default', mcpRequest, '__unauthenticated__');
+    beforeEach(()=>{
+        authService = createMockAuthService();
+        const configService = createMockConfigService();
+        guard = new McpOAuthGuard(authService, configService);
+    });
+    it('rejects request without Bearer token with 401', async ()=>{
+        const req = createMockRequest();
+        const ctx = createMockExecutionContext(req);
+        await expect(guard.canActivate(ctx)).rejects.toThrow(UnauthorizedException);
+    });
+    it('returns WWW-Authenticate header on missing token', async ()=>{
+        const req = createMockRequest();
+        const ctx = createMockExecutionContext(req);
+        try {
+            await guard.canActivate(ctx);
+        } catch (error) {
+            expect(error.wwwAuthenticate).toContain('resource_metadata=');
+            expect(error.wwwAuthenticate).toContain('resource_metadata_uri=');
+            expect(error.wwwAuthenticate).toContain('/.well-known/oauth-protected-resource');
+        }
+    });
+    it('rejects invalid Bearer token', async ()=>{
+        authService.validateMcpToken.mockResolvedValue(null);
+        const req = createMockRequest({
+            authorization: 'Bearer bad-token'
         });
-        it('non-Bearer Authorization header falls back to __unauthenticated__', async ()=>{
-            const req = createMockRequest({
-                authorization: 'Basic dXNlcjpwYXNz'
-            });
-            const mcpRequest = {
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'tools/list'
-            };
-            await controller.handleOrgMcpRequest(req, 'my-org', 'my-profile', mcpRequest);
-            expect(authService.validateMcpToken).not.toHaveBeenCalled();
-            expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith('my-profile', 'my-org', mcpRequest, '__unauthenticated__');
+        const ctx = createMockExecutionContext(req);
+        await expect(guard.canActivate(ctx)).rejects.toThrow(UnauthorizedException);
+        expect(authService.validateMcpToken).toHaveBeenCalledWith('bad-token');
+    });
+    it('allows valid Bearer token and attaches user', async ()=>{
+        const user = {
+            id: 'user-1',
+            name: 'Test',
+            email: 'test@example.com'
+        };
+        authService.validateMcpToken.mockResolvedValue(user);
+        const req = createMockRequest({
+            authorization: 'Bearer valid-token'
         });
+        const ctx = createMockExecutionContext(req);
+        const result = await guard.canActivate(ctx);
+        expect(result).toBe(true);
+        expect(req.user).toEqual(user);
     });
-    // ────────────────────────────────────────────────
-    // Authenticated access with Bearer tokens
-    // ────────────────────────────────────────────────
-    describe('authenticated access with Bearer tokens', ()=>{
-        const validUser = {
+    it('accepts access_token query param (SSE fallback)', async ()=>{
+        const user = {
             id: 'user-1',
-            name: 'Token User',
-            email: 'token@example.com'
+            name: 'Test',
+            email: 'test@example.com'
         };
-        beforeEach(()=>{
-            authService = createMockAuthService();
-            proxyService = createMockProxyService();
-            settingsService = createMockSettingsService();
-            eventEmitter = createMockEventEmitter();
-            controller = new ProxyController(proxyService, settingsService, eventEmitter, authService);
+        authService.validateMcpToken.mockResolvedValue(user);
+        const req = createMockRequest({}, {
+            access_token: 'sse-token'
         });
-        it('valid Bearer token resolves to authenticated user for org-scoped request', async ()=>{
-            authService.validateMcpToken.mockResolvedValue(validUser);
-            const req = createMockRequest({
-                authorization: 'Bearer valid-mcp-token'
-            });
-            const mcpRequest = {
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'tools/list'
+        const ctx = createMockExecutionContext(req);
+        const result = await guard.canActivate(ctx);
+        expect(result).toBe(true);
+        expect(authService.validateMcpToken).toHaveBeenCalledWith('sse-token');
+    });
+});
+// ────────────────────────────────────────────────
+// Proxy controller auth tests
+// ────────────────────────────────────────────────
+describe('Proxy controller auth', ()=>{
+    let controller;
+    let proxyService;
+    let settingsService;
+    let eventEmitter;
+    beforeEach(()=>{
+        proxyService = createMockProxyService();
+        settingsService = createMockSettingsService();
+        eventEmitter = createMockEventEmitter();
+        controller = new ProxyController(proxyService, settingsService, eventEmitter);
+    });
+    describe('guard-authenticated user passthrough', ()=>{
+        it('uses req.user set by McpOAuthGuard', async ()=>{
+            const guardUser = {
+                id: 'guard-user',
+                name: 'Guard',
+                email: 'g@test.com'
             };
-            await controller.handleOrgMcpRequest(req, 'my-org', 'my-profile', mcpRequest);
-            expect(authService.validateMcpToken).toHaveBeenCalledWith('valid-mcp-token');
-            expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith('my-profile', 'my-org', mcpRequest, 'user-1');
-        });
-        it('invalid Bearer token throws UnauthorizedException', async ()=>{
-            authService.validateMcpToken.mockResolvedValue(null);
             const req = createMockRequest({
-                authorization: 'Bearer invalid-token'
+                authorization: 'Bearer some-token'
             });
-            const mcpRequest = {
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'tools/list'
-            };
-            await expect(controller.handleOrgMcpRequest(req, 'my-org', 'my-profile', mcpRequest)).rejects.toThrow(UnauthorizedException);
-        });
-        it('no Authorization header falls back to __unauthenticated__', async ()=>{
-            const req = createMockRequest();
+            req.user = guardUser;
             const mcpRequest = {
                 jsonrpc: '2.0',
                 id: 1,
                 method: 'tools/list'
             };
             await controller.handleOrgMcpRequest(req, 'my-org', 'my-profile', mcpRequest);
-            expect(authService.validateMcpToken).not.toHaveBeenCalled();
-            expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith('my-profile', 'my-org', mcpRequest, '__unauthenticated__');
+            expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith('my-profile', 'my-org', mcpRequest, 'guard-user');
         });
     });
-    // ────────────────────────────────────────────────
-    // Org-scoped profile lookup through proxy
-    // ────────────────────────────────────────────────
     describe('org-scoped profile lookup', ()=>{
         const userA = {
             id: 'user-a',
@@ -197,18 +216,11 @@ describe('Proxy controller auth', ()=>{
             name: 'User B',
             email: 'b@test.com'
         };
-        beforeEach(()=>{
-            authService = createMockAuthService();
-            proxyService = createMockProxyService();
-            settingsService = createMockSettingsService();
-            eventEmitter = createMockEventEmitter();
-            controller = new ProxyController(proxyService, settingsService, eventEmitter, authService);
-        });
         it('org slug and user are passed through to proxy service', async ()=>{
-            authService.validateMcpToken.mockResolvedValue(userA);
             const req = createMockRequest({
                 authorization: 'Bearer token-a'
             });
+            req.user = userA;
             const mcpRequest = {
                 jsonrpc: '2.0',
                 id: 1,
@@ -218,32 +230,30 @@ describe('Proxy controller auth', ()=>{
             expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith('user-a-profile', 'org-a', mcpRequest, 'user-a');
         });
         it('different users get different userId passed to proxy', async ()=>{
-            // First request from User A
-            authService.validateMcpToken.mockResolvedValue(userA);
             const reqA = createMockRequest({
                 authorization: 'Bearer token-a'
             });
+            reqA.user = userA;
             const mcpReq = {
                 jsonrpc: '2.0',
                 id: 1,
                 method: 'tools/list'
             };
             await controller.handleOrgMcpRequest(reqA, 'shared-org', 'shared-profile', mcpReq);
-            // Second request from User B
-            authService.validateMcpToken.mockResolvedValue(userB);
             const reqB = createMockRequest({
                 authorization: 'Bearer token-b'
             });
+            reqB.user = userB;
             await controller.handleOrgMcpRequest(reqB, 'shared-org', 'shared-profile', mcpReq);
             expect(proxyService.handleRequestByOrgSlug).toHaveBeenNthCalledWith(1, 'shared-profile', 'shared-org', mcpReq, 'user-a');
             expect(proxyService.handleRequestByOrgSlug).toHaveBeenNthCalledWith(2, 'shared-profile', 'shared-org', mcpReq, 'user-b');
         });
         it('gateway endpoint uses default profile with user scoping', async ()=>{
-            authService.validateMcpToken.mockResolvedValue(userA);
             settingsService.getDefaultGatewayProfile.mockResolvedValue('my-default');
             const req = createMockRequest({
                 authorization: 'Bearer token-a'
             });
+            req.user = userA;
             const mcpRequest = {
                 jsonrpc: '2.0',
                 id: 1,
@@ -253,12 +263,12 @@ describe('Proxy controller auth', ()=>{
             expect(proxyService.handleRequest).toHaveBeenCalledWith('my-default', mcpRequest, 'user-a');
         });
         it('gateway wraps NotFoundException with descriptive message', async ()=>{
-            authService.validateMcpToken.mockResolvedValue(userA);
             settingsService.getDefaultGatewayProfile.mockResolvedValue('missing-profile');
             proxyService.handleRequest.mockRejectedValue(new NotFoundException('Profile "missing-profile" not found'));
             const req = createMockRequest({
                 authorization: 'Bearer token-a'
             });
+            req.user = userA;
             const mcpRequest = {
                 jsonrpc: '2.0',
                 id: 1,

package/dist/__tests__/integration/proxy-auth.test.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/__tests__/integration/proxy-auth.test.ts"],"sourcesContent":["/**\n * Integration Tests: Proxy controller auth\n *\n * Verifies that:\n * - Proxy routes are @Public() (no session cookie required)\n * - Bearer token validation via resolveUser flow\n * - Org-scoped profile lookup through the proxy service\n * - Unauthenticated access uses __unauthenticated__ sentinel\n * - Gateway endpoint still works with handleGatewayRequest\n */\n\nimport { NotFoundException, UnauthorizedException } from '@nestjs/common';\nimport type { EventEmitter2 } from '@nestjs/event-emitter';\nimport { beforeEach, describe, expect, it, vi } from 'vitest';\nimport { type AuthService, type AuthUser } from '../../modules/auth/auth.service.js';\nimport type { McpRequest, McpResponse, ProxyService } from '../../modules/proxy/proxy.service.js';\nimport type { SettingsService } from '../../modules/settings/settings.service.js';\n\n// Dynamic import to handle ESM\nconst { ProxyController } = await import('../../modules/proxy/proxy.controller.js');\n\n// ────────────────────────────────────────────────\n// Mock factories\n// ────────────────────────────────────────────────\n\nfunction createMockAuthService() {\n  return {\n    getAuth: vi.fn(),\n    getSession: vi.fn().mockResolvedValue(null),\n    validateMcpToken: vi.fn().mockResolvedValue(null),\n    getUserOrganizations: vi.fn().mockResolvedValue([]),\n    onModuleInit: vi.fn(),\n  };\n}\n\nfunction createMockProxyService() {\n  return {\n    handleRequest: vi.fn().mockResolvedValue({\n      jsonrpc: '2.0',\n      id: 1,\n      result: { tools: [] },\n    } as McpResponse),\n    handleRequestByOrgSlug: vi.fn().mockResolvedValue({\n      jsonrpc: '2.0',\n      id: 1,\n      result: { tools: [] },\n    } as McpResponse),\n    getProfileInfo: vi.fn().mockResolvedValue({\n      tools: [],\n      serverStatus: { total: 0, connected: 0, servers: {} },\n    }),\n    getProfileInfoByOrgSlug: vi.fn().mockResolvedValue({\n      tools: [],\n      serverStatus: { total: 0, connected: 0, servers: {} },\n    }),\n    getToolsForServer: vi.fn().mockResolvedValue([]),\n  };\n}\n\nfunction createMockSettingsService() {\n  return {\n    getDefaultGatewayProfile: vi.fn().mockResolvedValue('default'),\n    getSetting: vi.fn(),\n    setSetting: vi.fn(),\n  };\n}\n\nfunction createMockEventEmitter() {\n  return {\n    emit: vi.fn(),\n    on: vi.fn(),\n    off: vi.fn(),\n  };\n}\n\nfunction createMockRequest(headers: Record<string, string> = {}) {\n  return {\n    headers,\n    on: vi.fn(),\n  } as unknown as import('express').Request;\n}\n\ndescribe('Proxy controller auth', () => {\n  let controller: InstanceType<typeof ProxyController>;\n  let authService: ReturnType<typeof createMockAuthService>;\n  let proxyService: ReturnType<typeof createMockProxyService>;\n  let settingsService: ReturnType<typeof createMockSettingsService>;\n  let eventEmitter: ReturnType<typeof createMockEventEmitter>;\n\n  // ────────────────────────────────────────────────\n  // Unauthenticated access (no Bearer token)\n  // ────────────────────────────────────────────────\n\n  describe('unauthenticated access (no Bearer token)', () => {\n    beforeEach(() => {\n      authService = createMockAuthService();\n      proxyService = createMockProxyService();\n      settingsService = createMockSettingsService();\n      eventEmitter = createMockEventEmitter();\n\n      controller = new ProxyController(\n        proxyService as unknown as ProxyService,\n        settingsService as unknown as SettingsService,\n        eventEmitter as unknown as EventEmitter2,\n        authService as unknown as AuthService\n      );\n    });\n\n    it('org-scoped POST request passes __unauthenticated__ to proxy service', async () => {\n      const req = createMockRequest();\n      const mcpRequest: McpRequest = {\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'tools/list',\n      };\n\n      await controller.handleOrgMcpRequest(req, 'my-org', 'my-profile', mcpRequest);\n\n      expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith(\n        'my-profile',\n        'my-org',\n        mcpRequest,\n        '__unauthenticated__'\n      );\n    });\n\n    it('gateway POST request passes __unauthenticated__', async () => {\n      const req = createMockRequest();\n      const mcpRequest: McpRequest = {\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'initialize',\n      };\n\n      await controller.handleGatewayRequest(req, mcpRequest);\n\n      expect(proxyService.handleRequest).toHaveBeenCalledWith(\n        'default',\n        mcpRequest,\n        '__unauthenticated__'\n      );\n    });\n\n    it('non-Bearer Authorization header falls back to __unauthenticated__', async () => {\n      const req = createMockRequest({\n        authorization: 'Basic dXNlcjpwYXNz',\n      });\n      const mcpRequest: McpRequest = {\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'tools/list',\n      };\n\n      await controller.handleOrgMcpRequest(req, 'my-org', 'my-profile', mcpRequest);\n\n      expect(authService.validateMcpToken).not.toHaveBeenCalled();\n      expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith(\n        'my-profile',\n        'my-org',\n        mcpRequest,\n        '__unauthenticated__'\n      );\n    });\n  });\n\n  // ────────────────────────────────────────────────\n  // Authenticated access with Bearer tokens\n  // ────────────────────────────────────────────────\n\n  describe('authenticated access with Bearer tokens', () => {\n    const validUser: AuthUser = {\n      id: 'user-1',\n      name: 'Token User',\n      email: 'token@example.com',\n    };\n\n    beforeEach(() => {\n      authService = createMockAuthService();\n      proxyService = createMockProxyService();\n      settingsService = createMockSettingsService();\n      eventEmitter = createMockEventEmitter();\n\n      controller = new ProxyController(\n        proxyService as unknown as ProxyService,\n        settingsService as unknown as SettingsService,\n        eventEmitter as unknown as EventEmitter2,\n        authService as unknown as AuthService\n      );\n    });\n\n    it('valid Bearer token resolves to authenticated user for org-scoped request', async () => {\n      authService.validateMcpToken.mockResolvedValue(validUser);\n      const req = createMockRequest({\n        authorization: 'Bearer valid-mcp-token',\n      });\n      const mcpRequest: McpRequest = {\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'tools/list',\n      };\n\n      await controller.handleOrgMcpRequest(req, 'my-org', 'my-profile', mcpRequest);\n\n      expect(authService.validateMcpToken).toHaveBeenCalledWith('valid-mcp-token');\n      expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith(\n        'my-profile',\n        'my-org',\n        mcpRequest,\n        'user-1'\n      );\n    });\n\n    it('invalid Bearer token throws UnauthorizedException', async () => {\n      authService.validateMcpToken.mockResolvedValue(null);\n      const req = createMockRequest({\n        authorization: 'Bearer invalid-token',\n      });\n      const mcpRequest: McpRequest = {\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'tools/list',\n      };\n\n      await expect(\n        controller.handleOrgMcpRequest(req, 'my-org', 'my-profile', mcpRequest)\n      ).rejects.toThrow(UnauthorizedException);\n    });\n\n    it('no Authorization header falls back to __unauthenticated__', async () => {\n      const req = createMockRequest();\n      const mcpRequest: McpRequest = {\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'tools/list',\n      };\n\n      await controller.handleOrgMcpRequest(req, 'my-org', 'my-profile', mcpRequest);\n\n      expect(authService.validateMcpToken).not.toHaveBeenCalled();\n      expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith(\n        'my-profile',\n        'my-org',\n        mcpRequest,\n        '__unauthenticated__'\n      );\n    });\n  });\n\n  // ────────────────────────────────────────────────\n  // Org-scoped profile lookup through proxy\n  // ────────────────────────────────────────────────\n\n  describe('org-scoped profile lookup', () => {\n    const userA: AuthUser = { id: 'user-a', name: 'User A', email: 'a@test.com' };\n    const userB: AuthUser = { id: 'user-b', name: 'User B', email: 'b@test.com' };\n\n    beforeEach(() => {\n      authService = createMockAuthService();\n      proxyService = createMockProxyService();\n      settingsService = createMockSettingsService();\n      eventEmitter = createMockEventEmitter();\n\n      controller = new ProxyController(\n        proxyService as unknown as ProxyService,\n        settingsService as unknown as SettingsService,\n        eventEmitter as unknown as EventEmitter2,\n        authService as unknown as AuthService\n      );\n    });\n\n    it('org slug and user are passed through to proxy service', async () => {\n      authService.validateMcpToken.mockResolvedValue(userA);\n      const req = createMockRequest({ authorization: 'Bearer token-a' });\n      const mcpRequest: McpRequest = { jsonrpc: '2.0', id: 1, method: 'tools/list' };\n\n      await controller.handleOrgMcpRequest(req, 'org-a', 'user-a-profile', mcpRequest);\n\n      expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith(\n        'user-a-profile',\n        'org-a',\n        mcpRequest,\n        'user-a'\n      );\n    });\n\n    it('different users get different userId passed to proxy', async () => {\n      // First request from User A\n      authService.validateMcpToken.mockResolvedValue(userA);\n      const reqA = createMockRequest({ authorization: 'Bearer token-a' });\n      const mcpReq: McpRequest = { jsonrpc: '2.0', id: 1, method: 'tools/list' };\n\n      await controller.handleOrgMcpRequest(reqA, 'shared-org', 'shared-profile', mcpReq);\n\n      // Second request from User B\n      authService.validateMcpToken.mockResolvedValue(userB);\n      const reqB = createMockRequest({ authorization: 'Bearer token-b' });\n\n      await controller.handleOrgMcpRequest(reqB, 'shared-org', 'shared-profile', mcpReq);\n\n      expect(proxyService.handleRequestByOrgSlug).toHaveBeenNthCalledWith(\n        1,\n        'shared-profile',\n        'shared-org',\n        mcpReq,\n        'user-a'\n      );\n      expect(proxyService.handleRequestByOrgSlug).toHaveBeenNthCalledWith(\n        2,\n        'shared-profile',\n        'shared-org',\n        mcpReq,\n        'user-b'\n      );\n    });\n\n    it('gateway endpoint uses default profile with user scoping', async () => {\n      authService.validateMcpToken.mockResolvedValue(userA);\n      settingsService.getDefaultGatewayProfile.mockResolvedValue('my-default');\n\n      const req = createMockRequest({ authorization: 'Bearer token-a' });\n      const mcpRequest: McpRequest = { jsonrpc: '2.0', id: 1, method: 'tools/list' };\n\n      await controller.handleGatewayRequest(req, mcpRequest);\n\n      expect(proxyService.handleRequest).toHaveBeenCalledWith('my-default', mcpRequest, 'user-a');\n    });\n\n    it('gateway wraps NotFoundException with descriptive message', async () => {\n      authService.validateMcpToken.mockResolvedValue(userA);\n      settingsService.getDefaultGatewayProfile.mockResolvedValue('missing-profile');\n      proxyService.handleRequest.mockRejectedValue(\n        new NotFoundException('Profile \"missing-profile\" not found')\n      );\n\n      const req = createMockRequest({ authorization: 'Bearer token-a' });\n      const mcpRequest: McpRequest = { jsonrpc: '2.0', id: 1, method: 'tools/list' };\n\n      await expect(controller.handleGatewayRequest(req, mcpRequest)).rejects.toThrow(\n        NotFoundException\n      );\n    });\n\n    it('org-scoped profile info endpoint uses orgSlug', async () => {\n      await controller.getOrgProfileInfo('my-org', 'my-profile');\n\n      expect(proxyService.getProfileInfoByOrgSlug).toHaveBeenCalledWith('my-profile', 'my-org');\n    });\n  });\n});\n"],"names":["NotFoundException","UnauthorizedException","beforeEach","describe","expect","it","vi","ProxyController","createMockAuthService","getAuth","fn","getSession","mockResolvedValue","validateMcpToken","getUserOrganizations","onModuleInit","createMockProxyService","handleRequest","jsonrpc","id","result","tools","handleRequestByOrgSlug","getProfileInfo","serverStatus","total","connected","servers","getProfileInfoByOrgSlug","getToolsForServer","createMockSettingsService","getDefaultGatewayProfile","getSetting","setSetting","createMockEventEmitter","emit","on","off","createMockRequest","headers","controller","authService","proxyService","settingsService","eventEmitter","req","mcpRequest","method","handleOrgMcpRequest","toHaveBeenCalledWith","handleGatewayRequest","authorization","not","toHaveBeenCalled","validUser","name","email","rejects","toThrow","userA","userB","reqA","mcpReq","reqB","toHaveBeenNthCalledWith","mockRejectedValue","getOrgProfileInfo"],"mappings":"AAAA;;;;;;;;;CASC,GAED,SAASA,iBAAiB,EAAEC,qBAAqB,QAAQ,iBAAiB;AAE1E,SAASC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAS;AAK9D,+BAA+B;AAC/B,MAAM,EAAEC,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC;AAEzC,mDAAmD;AACnD,iBAAiB;AACjB,mDAAmD;AAEnD,SAASC;IACP,OAAO;QACLC,SAASH,GAAGI,EAAE;QACdC,YAAYL,GAAGI,EAAE,GAAGE,iBAAiB,CAAC;QACtCC,kBAAkBP,GAAGI,EAAE,GAAGE,iBAAiB,CAAC;QAC5CE,sBAAsBR,GAAGI,EAAE,GAAGE,iBAAiB,CAAC,EAAE;QAClDG,cAAcT,GAAGI,EAAE;IACrB;AACF;AAEA,SAASM;IACP,OAAO;QACLC,eAAeX,GAAGI,EAAE,GAAGE,iBAAiB,CAAC;YACvCM,SAAS;YACTC,IAAI;YACJC,QAAQ;gBAAEC,OAAO,EAAE;YAAC;QACtB;QACAC,wBAAwBhB,GAAGI,EAAE,GAAGE,iBAAiB,CAAC;YAChDM,SAAS;YACTC,IAAI;YACJC,QAAQ;gBAAEC,OAAO,EAAE;YAAC;QACtB;QACAE,gBAAgBjB,GAAGI,EAAE,GAAGE,iBAAiB,CAAC;YACxCS,OAAO,EAAE;YACTG,cAAc;gBAAEC,OAAO;gBAAGC,WAAW;gBAAGC,SAAS,CAAC;YAAE;QACtD;QACAC,yBAAyBtB,GAAGI,EAAE,GAAGE,iBAAiB,CAAC;YACjDS,OAAO,EAAE;YACTG,cAAc;gBAAEC,OAAO;gBAAGC,WAAW;gBAAGC,SAAS,CAAC;YAAE;QACtD;QACAE,mBAAmBvB,GAAGI,EAAE,GAAGE,iBAAiB,CAAC,EAAE;IACjD;AACF;AAEA,SAASkB;IACP,OAAO;QACLC,0BAA0BzB,GAAGI,EAAE,GAAGE,iBAAiB,CAAC;QACpDoB,YAAY1B,GAAGI,EAAE;QACjBuB,YAAY3B,GAAGI,EAAE;IACnB;AACF;AAEA,SAASwB;IACP,OAAO;QACLC,MAAM7B,GAAGI,EAAE;QACX0B,IAAI9B,GAAGI,EAAE;QACT2B,KAAK/B,GAAGI,EAAE;IACZ;AACF;AAEA,SAAS4B,kBAAkBC,UAAkC,CAAC,CAAC;IAC7D,OAAO;QACLA;QACAH,IAAI9B,GAAGI,EAAE;IACX;AACF;AAEAP,SAAS,yBAAyB;IAChC,IAAIqC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAEJ,mDAAmD;IACnD,2CAA2C;IAC3C,mDAAmD;IAEnDzC,SAAS,4CAA4C;QACnDD,WAAW;YACTuC,cAAcjC;YACdkC,eAAe1B;YACf2B,kBAAkBb;YAClBc,eAAeV;YAEfM,aAAa,IAAIjC,gBACfmC,cACAC,iBACAC,cACAH;QAEJ;QAEApC,GAAG,uEAAuE;YACxE,MAAMwC,MAAMP;YACZ,MAAMQ,aAAyB;gBAC7B5B,SAAS;gBACTC,IAAI;gBACJ4B,QAAQ;YACV;YAEA,MAAMP,WAAWQ,mBAAmB,CAACH,KAAK,UAAU,cAAcC;YAElE1C,OAAOsC,aAAapB,sBAAsB,EAAE2B,oBAAoB,CAC9D,cACA,UACAH,YACA;QAEJ;QAEAzC,GAAG,mDAAmD;YACpD,MAAMwC,MAAMP;YACZ,MAAMQ,aAAyB;gBAC7B5B,SAAS;gBACTC,IAAI;gBACJ4B,QAAQ;YACV;YAEA,MAAMP,WAAWU,oBAAoB,CAACL,KAAKC;YAE3C1C,OAAOsC,aAAazB,aAAa,EAAEgC,oBAAoB,CACrD,WACAH,YACA;QAEJ;QAEAzC,GAAG,qEAAqE;YACtE,MAAMwC,MAAMP,kBAAkB;gBAC5Ba,eAAe;YACjB;YACA,MAAML,aAAyB;gBAC7B5B,SAAS;gBACTC,IAAI;gBACJ4B,QAAQ;YACV;YAEA,MAAMP,WAAWQ,mBAAmB,CAACH,KAAK,UAAU,cAAcC;YAElE1C,OAAOqC,YAAY5B,gBAAgB,EAAEuC,GAAG,CAACC,gBAAgB;YACzDjD,OAAOsC,aAAapB,sBAAsB,EAAE2B,oBAAoB,CAC9D,cACA,UACAH,YACA;QAEJ;IACF;IAEA,mDAAmD;IACnD,0CAA0C;IAC1C,mDAAmD;IAEnD3C,SAAS,2CAA2C;QAClD,MAAMmD,YAAsB;YAC1BnC,IAAI;YACJoC,MAAM;YACNC,OAAO;QACT;QAEAtD,WAAW;YACTuC,cAAcjC;YACdkC,eAAe1B;YACf2B,kBAAkBb;YAClBc,eAAeV;YAEfM,aAAa,IAAIjC,gBACfmC,cACAC,iBACAC,cACAH;QAEJ;QAEApC,GAAG,4EAA4E;YAC7EoC,YAAY5B,gBAAgB,CAACD,iBAAiB,CAAC0C;YAC/C,MAAMT,MAAMP,kBAAkB;gBAC5Ba,eAAe;YACjB;YACA,MAAML,aAAyB;gBAC7B5B,SAAS;gBACTC,IAAI;gBACJ4B,QAAQ;YACV;YAEA,MAAMP,WAAWQ,mBAAmB,CAACH,KAAK,UAAU,cAAcC;YAElE1C,OAAOqC,YAAY5B,gBAAgB,EAAEoC,oBAAoB,CAAC;YAC1D7C,OAAOsC,aAAapB,sBAAsB,EAAE2B,oBAAoB,CAC9D,cACA,UACAH,YACA;QAEJ;QAEAzC,GAAG,qDAAqD;YACtDoC,YAAY5B,gBAAgB,CAACD,iBAAiB,CAAC;YAC/C,MAAMiC,MAAMP,kBAAkB;gBAC5Ba,eAAe;YACjB;YACA,MAAML,aAAyB;gBAC7B5B,SAAS;gBACTC,IAAI;gBACJ4B,QAAQ;YACV;YAEA,MAAM3C,OACJoC,WAAWQ,mBAAmB,CAACH,KAAK,UAAU,cAAcC,aAC5DW,OAAO,CAACC,OAAO,CAACzD;QACpB;QAEAI,GAAG,6DAA6D;YAC9D,MAAMwC,MAAMP;YACZ,MAAMQ,aAAyB;gBAC7B5B,SAAS;gBACTC,IAAI;gBACJ4B,QAAQ;YACV;YAEA,MAAMP,WAAWQ,mBAAmB,CAACH,KAAK,UAAU,cAAcC;YAElE1C,OAAOqC,YAAY5B,gBAAgB,EAAEuC,GAAG,CAACC,gBAAgB;YACzDjD,OAAOsC,aAAapB,sBAAsB,EAAE2B,oBAAoB,CAC9D,cACA,UACAH,YACA;QAEJ;IACF;IAEA,mDAAmD;IACnD,0CAA0C;IAC1C,mDAAmD;IAEnD3C,SAAS,6BAA6B;QACpC,MAAMwD,QAAkB;YAAExC,IAAI;YAAUoC,MAAM;YAAUC,OAAO;QAAa;QAC5E,MAAMI,QAAkB;YAAEzC,IAAI;YAAUoC,MAAM;YAAUC,OAAO;QAAa;QAE5EtD,WAAW;YACTuC,cAAcjC;YACdkC,eAAe1B;YACf2B,kBAAkBb;YAClBc,eAAeV;YAEfM,aAAa,IAAIjC,gBACfmC,cACAC,iBACAC,cACAH;QAEJ;QAEApC,GAAG,yDAAyD;YAC1DoC,YAAY5B,gBAAgB,CAACD,iBAAiB,CAAC+C;YAC/C,MAAMd,MAAMP,kBAAkB;gBAAEa,eAAe;YAAiB;YAChE,MAAML,aAAyB;gBAAE5B,SAAS;gBAAOC,IAAI;gBAAG4B,QAAQ;YAAa;YAE7E,MAAMP,WAAWQ,mBAAmB,CAACH,KAAK,SAAS,kBAAkBC;YAErE1C,OAAOsC,aAAapB,sBAAsB,EAAE2B,oBAAoB,CAC9D,kBACA,SACAH,YACA;QAEJ;QAEAzC,GAAG,wDAAwD;YACzD,4BAA4B;YAC5BoC,YAAY5B,gBAAgB,CAACD,iBAAiB,CAAC+C;YAC/C,MAAME,OAAOvB,kBAAkB;gBAAEa,eAAe;YAAiB;YACjE,MAAMW,SAAqB;gBAAE5C,SAAS;gBAAOC,IAAI;gBAAG4B,QAAQ;YAAa;YAEzE,MAAMP,WAAWQ,mBAAmB,CAACa,MAAM,cAAc,kBAAkBC;YAE3E,6BAA6B;YAC7BrB,YAAY5B,gBAAgB,CAACD,iBAAiB,CAACgD;YAC/C,MAAMG,OAAOzB,kBAAkB;gBAAEa,eAAe;YAAiB;YAEjE,MAAMX,WAAWQ,mBAAmB,CAACe,MAAM,cAAc,kBAAkBD;YAE3E1D,OAAOsC,aAAapB,sBAAsB,EAAE0C,uBAAuB,CACjE,GACA,kBACA,cACAF,QACA;YAEF1D,OAAOsC,aAAapB,sBAAsB,EAAE0C,uBAAuB,CACjE,GACA,kBACA,cACAF,QACA;QAEJ;QAEAzD,GAAG,2DAA2D;YAC5DoC,YAAY5B,gBAAgB,CAACD,iBAAiB,CAAC+C;YAC/ChB,gBAAgBZ,wBAAwB,CAACnB,iBAAiB,CAAC;YAE3D,MAAMiC,MAAMP,kBAAkB;gBAAEa,eAAe;YAAiB;YAChE,MAAML,aAAyB;gBAAE5B,SAAS;gBAAOC,IAAI;gBAAG4B,QAAQ;YAAa;YAE7E,MAAMP,WAAWU,oBAAoB,CAACL,KAAKC;YAE3C1C,OAAOsC,aAAazB,aAAa,EAAEgC,oBAAoB,CAAC,cAAcH,YAAY;QACpF;QAEAzC,GAAG,4DAA4D;YAC7DoC,YAAY5B,gBAAgB,CAACD,iBAAiB,CAAC+C;YAC/ChB,gBAAgBZ,wBAAwB,CAACnB,iBAAiB,CAAC;YAC3D8B,aAAazB,aAAa,CAACgD,iBAAiB,CAC1C,IAAIjE,kBAAkB;YAGxB,MAAM6C,MAAMP,kBAAkB;gBAAEa,eAAe;YAAiB;YAChE,MAAML,aAAyB;gBAAE5B,SAAS;gBAAOC,IAAI;gBAAG4B,QAAQ;YAAa;YAE7E,MAAM3C,OAAOoC,WAAWU,oBAAoB,CAACL,KAAKC,aAAaW,OAAO,CAACC,OAAO,CAC5E1D;QAEJ;QAEAK,GAAG,iDAAiD;YAClD,MAAMmC,WAAW0B,iBAAiB,CAAC,UAAU;YAE7C9D,OAAOsC,aAAad,uBAAuB,EAAEqB,oBAAoB,CAAC,cAAc;QAClF;IACF;AACF"}
+{"version":3,"sources":["../../../src/__tests__/integration/proxy-auth.test.ts"],"sourcesContent":["/**\n * Integration Tests: Proxy controller auth\n *\n * Verifies:\n * - McpOAuthGuard always enforces Bearer token\n * - WWW-Authenticate header with resource_metadata_uri on 401\n * - Valid tokens resolve user and pass through\n * - Org-scoped profile lookup through the proxy service\n * - Gateway endpoint uses default profile with user scoping\n */\n\nimport { NotFoundException, UnauthorizedException } from '@nestjs/common';\nimport type { EventEmitter2 } from '@nestjs/event-emitter';\nimport { beforeEach, describe, expect, it, vi } from 'vitest';\nimport { type AuthService, type AuthUser } from '../../modules/auth/auth.service.js';\nimport type { McpRequest, McpResponse, ProxyService } from '../../modules/proxy/proxy.service.js';\nimport type { SettingsService } from '../../modules/settings/settings.service.js';\n\n// Dynamic import to handle ESM\nconst { McpOAuthGuard } = await import('../../modules/auth/mcp-oauth.guard.js');\nconst { ProxyController } = await import('../../modules/proxy/proxy.controller.js');\n\n// ────────────────────────────────────────────────\n// Mock factories\n// ────────────────────────────────────────────────\n\nfunction createMockAuthService() {\n  return {\n    getAuth: vi.fn(),\n    getSession: vi.fn().mockResolvedValue(null),\n    validateMcpToken: vi.fn().mockResolvedValue(null),\n    getUserOrganizations: vi.fn().mockResolvedValue([]),\n    onModuleInit: vi.fn(),\n  };\n}\n\nfunction createMockConfigService(overrides: Record<string, unknown> = {}) {\n  const defaults: Record<string, unknown> = {\n    'app.port': 3001,\n    BETTER_AUTH_URL: 'http://localhost:3001',\n  };\n  const config = { ...defaults, ...overrides };\n  return {\n    get: vi.fn((key: string) => config[key]),\n  };\n}\n\nfunction createMockProxyService() {\n  return {\n    handleRequest: vi.fn().mockResolvedValue({\n      jsonrpc: '2.0',\n      id: 1,\n      result: { tools: [] },\n    } as McpResponse),\n    handleRequestByOrgSlug: vi.fn().mockResolvedValue({\n      jsonrpc: '2.0',\n      id: 1,\n      result: { tools: [] },\n    } as McpResponse),\n    getProfileInfo: vi.fn().mockResolvedValue({\n      tools: [],\n      serverStatus: { total: 0, connected: 0, servers: {} },\n    }),\n    getProfileInfoByOrgSlug: vi.fn().mockResolvedValue({\n      tools: [],\n      serverStatus: { total: 0, connected: 0, servers: {} },\n    }),\n    getToolsForServer: vi.fn().mockResolvedValue([]),\n  };\n}\n\nfunction createMockSettingsService() {\n  return {\n    getDefaultGatewayProfile: vi.fn().mockResolvedValue('default'),\n    getSetting: vi.fn(),\n    setSetting: vi.fn(),\n  };\n}\n\nfunction createMockEventEmitter() {\n  return {\n    emit: vi.fn(),\n    on: vi.fn(),\n    off: vi.fn(),\n  };\n}\n\nfunction createMockRequest(headers: Record<string, string> = {}, query: Record<string, string> = {}) {\n  return {\n    headers,\n    query,\n    on: vi.fn(),\n    user: undefined as any,\n  } as unknown as import('express').Request;\n}\n\nfunction createMockExecutionContext(req: import('express').Request) {\n  return {\n    switchToHttp: () => ({\n      getRequest: () => req,\n      getResponse: () => ({}),\n    }),\n    getHandler: () => ({}),\n    getClass: () => ({}),\n  } as any;\n}\n\n// ────────────────────────────────────────────────\n// McpOAuthGuard tests\n// ────────────────────────────────────────────────\n\ndescribe('McpOAuthGuard', () => {\n  let guard: InstanceType<typeof McpOAuthGuard>;\n  let authService: ReturnType<typeof createMockAuthService>;\n\n  beforeEach(() => {\n    authService = createMockAuthService();\n    const configService = createMockConfigService();\n    guard = new McpOAuthGuard(\n      authService as unknown as AuthService,\n      configService as any\n    );\n  });\n\n  it('rejects request without Bearer token with 401', async () => {\n    const req = createMockRequest();\n    const ctx = createMockExecutionContext(req);\n\n    await expect(guard.canActivate(ctx)).rejects.toThrow(UnauthorizedException);\n  });\n\n  it('returns WWW-Authenticate header on missing token', async () => {\n    const req = createMockRequest();\n    const ctx = createMockExecutionContext(req);\n\n    try {\n      await guard.canActivate(ctx);\n    } catch (error: any) {\n      expect(error.wwwAuthenticate).toContain('resource_metadata=');\n      expect(error.wwwAuthenticate).toContain('resource_metadata_uri=');\n      expect(error.wwwAuthenticate).toContain('/.well-known/oauth-protected-resource');\n    }\n  });\n\n  it('rejects invalid Bearer token', async () => {\n    authService.validateMcpToken.mockResolvedValue(null);\n    const req = createMockRequest({ authorization: 'Bearer bad-token' });\n    const ctx = createMockExecutionContext(req);\n\n    await expect(guard.canActivate(ctx)).rejects.toThrow(UnauthorizedException);\n    expect(authService.validateMcpToken).toHaveBeenCalledWith('bad-token');\n  });\n\n  it('allows valid Bearer token and attaches user', async () => {\n    const user: AuthUser = { id: 'user-1', name: 'Test', email: 'test@example.com' };\n    authService.validateMcpToken.mockResolvedValue(user);\n    const req = createMockRequest({ authorization: 'Bearer valid-token' });\n    const ctx = createMockExecutionContext(req);\n\n    const result = await guard.canActivate(ctx);\n\n    expect(result).toBe(true);\n    expect(req.user).toEqual(user);\n  });\n\n  it('accepts access_token query param (SSE fallback)', async () => {\n    const user: AuthUser = { id: 'user-1', name: 'Test', email: 'test@example.com' };\n    authService.validateMcpToken.mockResolvedValue(user);\n    const req = createMockRequest({}, { access_token: 'sse-token' });\n    const ctx = createMockExecutionContext(req);\n\n    const result = await guard.canActivate(ctx);\n\n    expect(result).toBe(true);\n    expect(authService.validateMcpToken).toHaveBeenCalledWith('sse-token');\n  });\n});\n\n// ────────────────────────────────────────────────\n// Proxy controller auth tests\n// ────────────────────────────────────────────────\n\ndescribe('Proxy controller auth', () => {\n  let controller: InstanceType<typeof ProxyController>;\n  let proxyService: ReturnType<typeof createMockProxyService>;\n  let settingsService: ReturnType<typeof createMockSettingsService>;\n  let eventEmitter: ReturnType<typeof createMockEventEmitter>;\n\n  beforeEach(() => {\n    proxyService = createMockProxyService();\n    settingsService = createMockSettingsService();\n    eventEmitter = createMockEventEmitter();\n\n    controller = new ProxyController(\n      proxyService as unknown as ProxyService,\n      settingsService as unknown as SettingsService,\n      eventEmitter as unknown as EventEmitter2\n    );\n  });\n\n  describe('guard-authenticated user passthrough', () => {\n    it('uses req.user set by McpOAuthGuard', async () => {\n      const guardUser: AuthUser = { id: 'guard-user', name: 'Guard', email: 'g@test.com' };\n      const req = createMockRequest({ authorization: 'Bearer some-token' });\n      (req as any).user = guardUser;\n\n      const mcpRequest: McpRequest = { jsonrpc: '2.0', id: 1, method: 'tools/list' };\n\n      await controller.handleOrgMcpRequest(req, 'my-org', 'my-profile', mcpRequest);\n\n      expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith(\n        'my-profile',\n        'my-org',\n        mcpRequest,\n        'guard-user'\n      );\n    });\n  });\n\n  describe('org-scoped profile lookup', () => {\n    const userA: AuthUser = { id: 'user-a', name: 'User A', email: 'a@test.com' };\n    const userB: AuthUser = { id: 'user-b', name: 'User B', email: 'b@test.com' };\n\n    it('org slug and user are passed through to proxy service', async () => {\n      const req = createMockRequest({ authorization: 'Bearer token-a' });\n      (req as any).user = userA;\n      const mcpRequest: McpRequest = { jsonrpc: '2.0', id: 1, method: 'tools/list' };\n\n      await controller.handleOrgMcpRequest(req, 'org-a', 'user-a-profile', mcpRequest);\n\n      expect(proxyService.handleRequestByOrgSlug).toHaveBeenCalledWith(\n        'user-a-profile',\n        'org-a',\n        mcpRequest,\n        'user-a'\n      );\n    });\n\n    it('different users get different userId passed to proxy', async () => {\n      const reqA = createMockRequest({ authorization: 'Bearer token-a' });\n      (reqA as any).user = userA;\n      const mcpReq: McpRequest = { jsonrpc: '2.0', id: 1, method: 'tools/list' };\n\n      await controller.handleOrgMcpRequest(reqA, 'shared-org', 'shared-profile', mcpReq);\n\n      const reqB = createMockRequest({ authorization: 'Bearer token-b' });\n      (reqB as any).user = userB;\n\n      await controller.handleOrgMcpRequest(reqB, 'shared-org', 'shared-profile', mcpReq);\n\n      expect(proxyService.handleRequestByOrgSlug).toHaveBeenNthCalledWith(\n        1,\n        'shared-profile',\n        'shared-org',\n        mcpReq,\n        'user-a'\n      );\n      expect(proxyService.handleRequestByOrgSlug).toHaveBeenNthCalledWith(\n        2,\n        'shared-profile',\n        'shared-org',\n        mcpReq,\n        'user-b'\n      );\n    });\n\n    it('gateway endpoint uses default profile with user scoping', async () => {\n      settingsService.getDefaultGatewayProfile.mockResolvedValue('my-default');\n\n      const req = createMockRequest({ authorization: 'Bearer token-a' });\n      (req as any).user = userA;\n      const mcpRequest: McpRequest = { jsonrpc: '2.0', id: 1, method: 'tools/list' };\n\n      await controller.handleGatewayRequest(req, mcpRequest);\n\n      expect(proxyService.handleRequest).toHaveBeenCalledWith('my-default', mcpRequest, 'user-a');\n    });\n\n    it('gateway wraps NotFoundException with descriptive message', async () => {\n      settingsService.getDefaultGatewayProfile.mockResolvedValue('missing-profile');\n      proxyService.handleRequest.mockRejectedValue(\n        new NotFoundException('Profile \"missing-profile\" not found')\n      );\n\n      const req = createMockRequest({ authorization: 'Bearer token-a' });\n      (req as any).user = userA;\n      const mcpRequest: McpRequest = { jsonrpc: '2.0', id: 1, method: 'tools/list' };\n\n      await expect(controller.handleGatewayRequest(req, mcpRequest)).rejects.toThrow(\n        NotFoundException\n      );\n    });\n\n    it('org-scoped profile info endpoint uses orgSlug', async () => {\n      await controller.getOrgProfileInfo('my-org', 'my-profile');\n\n      expect(proxyService.getProfileInfoByOrgSlug).toHaveBeenCalledWith('my-profile', 'my-org');\n    });\n  });\n});\n"],"names":["NotFoundException","UnauthorizedException","beforeEach","describe","expect","it","vi","McpOAuthGuard","ProxyController","createMockAuthService","getAuth","fn","getSession","mockResolvedValue","validateMcpToken","getUserOrganizations","onModuleInit","createMockConfigService","overrides","defaults","BETTER_AUTH_URL","config","get","key","createMockProxyService","handleRequest","jsonrpc","id","result","tools","handleRequestByOrgSlug","getProfileInfo","serverStatus","total","connected","servers","getProfileInfoByOrgSlug","getToolsForServer","createMockSettingsService","getDefaultGatewayProfile","getSetting","setSetting","createMockEventEmitter","emit","on","off","createMockRequest","headers","query","user","undefined","createMockExecutionContext","req","switchToHttp","getRequest","getResponse","getHandler","getClass","guard","authService","configService","ctx","canActivate","rejects","toThrow","error","wwwAuthenticate","toContain","authorization","toHaveBeenCalledWith","name","email","toBe","toEqual","access_token","controller","proxyService","settingsService","eventEmitter","guardUser","mcpRequest","method","handleOrgMcpRequest","userA","userB","reqA","mcpReq","reqB","toHaveBeenNthCalledWith","handleGatewayRequest","mockRejectedValue","getOrgProfileInfo"],"mappings":"AAAA;;;;;;;;;CASC,GAED,SAASA,iBAAiB,EAAEC,qBAAqB,QAAQ,iBAAiB;AAE1E,SAASC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAS;AAK9D,+BAA+B;AAC/B,MAAM,EAAEC,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC;AACvC,MAAM,EAAEC,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC;AAEzC,mDAAmD;AACnD,iBAAiB;AACjB,mDAAmD;AAEnD,SAASC;IACP,OAAO;QACLC,SAASJ,GAAGK,EAAE;QACdC,YAAYN,GAAGK,EAAE,GAAGE,iBAAiB,CAAC;QACtCC,kBAAkBR,GAAGK,EAAE,GAAGE,iBAAiB,CAAC;QAC5CE,sBAAsBT,GAAGK,EAAE,GAAGE,iBAAiB,CAAC,EAAE;QAClDG,cAAcV,GAAGK,EAAE;IACrB;AACF;AAEA,SAASM,wBAAwBC,YAAqC,CAAC,CAAC;IACtE,MAAMC,WAAoC;QACxC,YAAY;QACZC,iBAAiB;IACnB;IACA,MAAMC,SAAS;QAAE,GAAGF,QAAQ;QAAE,GAAGD,SAAS;IAAC;IAC3C,OAAO;QACLI,KAAKhB,GAAGK,EAAE,CAAC,CAACY,MAAgBF,MAAM,CAACE,IAAI;IACzC;AACF;AAEA,SAASC;IACP,OAAO;QACLC,eAAenB,GAAGK,EAAE,GAAGE,iBAAiB,CAAC;YACvCa,SAAS;YACTC,IAAI;YACJC,QAAQ;gBAAEC,OAAO,EAAE;YAAC;QACtB;QACAC,wBAAwBxB,GAAGK,EAAE,GAAGE,iBAAiB,CAAC;YAChDa,SAAS;YACTC,IAAI;YACJC,QAAQ;gBAAEC,OAAO,EAAE;YAAC;QACtB;QACAE,gBAAgBzB,GAAGK,EAAE,GAAGE,iBAAiB,CAAC;YACxCgB,OAAO,EAAE;YACTG,cAAc;gBAAEC,OAAO;gBAAGC,WAAW;gBAAGC,SAAS,CAAC;YAAE;QACtD;QACAC,yBAAyB9B,GAAGK,EAAE,GAAGE,iBAAiB,CAAC;YACjDgB,OAAO,EAAE;YACTG,cAAc;gBAAEC,OAAO;gBAAGC,WAAW;gBAAGC,SAAS,CAAC;YAAE;QACtD;QACAE,mBAAmB/B,GAAGK,EAAE,GAAGE,iBAAiB,CAAC,EAAE;IACjD;AACF;AAEA,SAASyB;IACP,OAAO;QACLC,0BAA0BjC,GAAGK,EAAE,GAAGE,iBAAiB,CAAC;QACpD2B,YAAYlC,GAAGK,EAAE;QACjB8B,YAAYnC,GAAGK,EAAE;IACnB;AACF;AAEA,SAAS+B;IACP,OAAO;QACLC,MAAMrC,GAAGK,EAAE;QACXiC,IAAItC,GAAGK,EAAE;QACTkC,KAAKvC,GAAGK,EAAE;IACZ;AACF;AAEA,SAASmC,kBAAkBC,UAAkC,CAAC,CAAC,EAAEC,QAAgC,CAAC,CAAC;IACjG,OAAO;QACLD;QACAC;QACAJ,IAAItC,GAAGK,EAAE;QACTsC,MAAMC;IACR;AACF;AAEA,SAASC,2BAA2BC,GAA8B;IAChE,OAAO;QACLC,cAAc,IAAO,CAAA;gBACnBC,YAAY,IAAMF;gBAClBG,aAAa,IAAO,CAAA,CAAC,CAAA;YACvB,CAAA;QACAC,YAAY,IAAO,CAAA,CAAC,CAAA;QACpBC,UAAU,IAAO,CAAA,CAAC,CAAA;IACpB;AACF;AAEA,mDAAmD;AACnD,sBAAsB;AACtB,mDAAmD;AAEnDtD,SAAS,iBAAiB;IACxB,IAAIuD;IACJ,IAAIC;IAEJzD,WAAW;QACTyD,cAAclD;QACd,MAAMmD,gBAAgB3C;QACtByC,QAAQ,IAAInD,cACVoD,aACAC;IAEJ;IAEAvD,GAAG,iDAAiD;QAClD,MAAM+C,MAAMN;QACZ,MAAMe,MAAMV,2BAA2BC;QAEvC,MAAMhD,OAAOsD,MAAMI,WAAW,CAACD,MAAME,OAAO,CAACC,OAAO,CAAC/D;IACvD;IAEAI,GAAG,oDAAoD;QACrD,MAAM+C,MAAMN;QACZ,MAAMe,MAAMV,2BAA2BC;QAEvC,IAAI;YACF,MAAMM,MAAMI,WAAW,CAACD;QAC1B,EAAE,OAAOI,OAAY;YACnB7D,OAAO6D,MAAMC,eAAe,EAAEC,SAAS,CAAC;YACxC/D,OAAO6D,MAAMC,eAAe,EAAEC,SAAS,CAAC;YACxC/D,OAAO6D,MAAMC,eAAe,EAAEC,SAAS,CAAC;QAC1C;IACF;IAEA9D,GAAG,gCAAgC;QACjCsD,YAAY7C,gBAAgB,CAACD,iBAAiB,CAAC;QAC/C,MAAMuC,MAAMN,kBAAkB;YAAEsB,eAAe;QAAmB;QAClE,MAAMP,MAAMV,2BAA2BC;QAEvC,MAAMhD,OAAOsD,MAAMI,WAAW,CAACD,MAAME,OAAO,CAACC,OAAO,CAAC/D;QACrDG,OAAOuD,YAAY7C,gBAAgB,EAAEuD,oBAAoB,CAAC;IAC5D;IAEAhE,GAAG,+CAA+C;QAChD,MAAM4C,OAAiB;YAAEtB,IAAI;YAAU2C,MAAM;YAAQC,OAAO;QAAmB;QAC/EZ,YAAY7C,gBAAgB,CAACD,iBAAiB,CAACoC;QAC/C,MAAMG,MAAMN,kBAAkB;YAAEsB,eAAe;QAAqB;QACpE,MAAMP,MAAMV,2BAA2BC;QAEvC,MAAMxB,SAAS,MAAM8B,MAAMI,WAAW,CAACD;QAEvCzD,OAAOwB,QAAQ4C,IAAI,CAAC;QACpBpE,OAAOgD,IAAIH,IAAI,EAAEwB,OAAO,CAACxB;IAC3B;IAEA5C,GAAG,mDAAmD;QACpD,MAAM4C,OAAiB;YAAEtB,IAAI;YAAU2C,MAAM;YAAQC,OAAO;QAAmB;QAC/EZ,YAAY7C,gBAAgB,CAACD,iBAAiB,CAACoC;QAC/C,MAAMG,MAAMN,kBAAkB,CAAC,GAAG;YAAE4B,cAAc;QAAY;QAC9D,MAAMb,MAAMV,2BAA2BC;QAEvC,MAAMxB,SAAS,MAAM8B,MAAMI,WAAW,CAACD;QAEvCzD,OAAOwB,QAAQ4C,IAAI,CAAC;QACpBpE,OAAOuD,YAAY7C,gBAAgB,EAAEuD,oBAAoB,CAAC;IAC5D;AACF;AAEA,mDAAmD;AACnD,8BAA8B;AAC9B,mDAAmD;AAEnDlE,SAAS,yBAAyB;IAChC,IAAIwE;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAEJ5E,WAAW;QACT0E,eAAepD;QACfqD,kBAAkBvC;QAClBwC,eAAepC;QAEfiC,aAAa,IAAInE,gBACfoE,cACAC,iBACAC;IAEJ;IAEA3E,SAAS,wCAAwC;QAC/CE,GAAG,sCAAsC;YACvC,MAAM0E,YAAsB;gBAAEpD,IAAI;gBAAc2C,MAAM;gBAASC,OAAO;YAAa;YACnF,MAAMnB,MAAMN,kBAAkB;gBAAEsB,eAAe;YAAoB;YAClEhB,IAAYH,IAAI,GAAG8B;YAEpB,MAAMC,aAAyB;gBAAEtD,SAAS;gBAAOC,IAAI;gBAAGsD,QAAQ;YAAa;YAE7E,MAAMN,WAAWO,mBAAmB,CAAC9B,KAAK,UAAU,cAAc4B;YAElE5E,OAAOwE,aAAa9C,sBAAsB,EAAEuC,oBAAoB,CAC9D,cACA,UACAW,YACA;QAEJ;IACF;IAEA7E,SAAS,6BAA6B;QACpC,MAAMgF,QAAkB;YAAExD,IAAI;YAAU2C,MAAM;YAAUC,OAAO;QAAa;QAC5E,MAAMa,QAAkB;YAAEzD,IAAI;YAAU2C,MAAM;YAAUC,OAAO;QAAa;QAE5ElE,GAAG,yDAAyD;YAC1D,MAAM+C,MAAMN,kBAAkB;gBAAEsB,eAAe;YAAiB;YAC/DhB,IAAYH,IAAI,GAAGkC;YACpB,MAAMH,aAAyB;gBAAEtD,SAAS;gBAAOC,IAAI;gBAAGsD,QAAQ;YAAa;YAE7E,MAAMN,WAAWO,mBAAmB,CAAC9B,KAAK,SAAS,kBAAkB4B;YAErE5E,OAAOwE,aAAa9C,sBAAsB,EAAEuC,oBAAoB,CAC9D,kBACA,SACAW,YACA;QAEJ;QAEA3E,GAAG,wDAAwD;YACzD,MAAMgF,OAAOvC,kBAAkB;gBAAEsB,eAAe;YAAiB;YAChEiB,KAAapC,IAAI,GAAGkC;YACrB,MAAMG,SAAqB;gBAAE5D,SAAS;gBAAOC,IAAI;gBAAGsD,QAAQ;YAAa;YAEzE,MAAMN,WAAWO,mBAAmB,CAACG,MAAM,cAAc,kBAAkBC;YAE3E,MAAMC,OAAOzC,kBAAkB;gBAAEsB,eAAe;YAAiB;YAChEmB,KAAatC,IAAI,GAAGmC;YAErB,MAAMT,WAAWO,mBAAmB,CAACK,MAAM,cAAc,kBAAkBD;YAE3ElF,OAAOwE,aAAa9C,sBAAsB,EAAE0D,uBAAuB,CACjE,GACA,kBACA,cACAF,QACA;YAEFlF,OAAOwE,aAAa9C,sBAAsB,EAAE0D,uBAAuB,CACjE,GACA,kBACA,cACAF,QACA;QAEJ;QAEAjF,GAAG,2DAA2D;YAC5DwE,gBAAgBtC,wBAAwB,CAAC1B,iBAAiB,CAAC;YAE3D,MAAMuC,MAAMN,kBAAkB;gBAAEsB,eAAe;YAAiB;YAC/DhB,IAAYH,IAAI,GAAGkC;YACpB,MAAMH,aAAyB;gBAAEtD,SAAS;gBAAOC,IAAI;gBAAGsD,QAAQ;YAAa;YAE7E,MAAMN,WAAWc,oBAAoB,CAACrC,KAAK4B;YAE3C5E,OAAOwE,aAAanD,aAAa,EAAE4C,oBAAoB,CAAC,cAAcW,YAAY;QACpF;QAEA3E,GAAG,4DAA4D;YAC7DwE,gBAAgBtC,wBAAwB,CAAC1B,iBAAiB,CAAC;YAC3D+D,aAAanD,aAAa,CAACiE,iBAAiB,CAC1C,IAAI1F,kBAAkB;YAGxB,MAAMoD,MAAMN,kBAAkB;gBAAEsB,eAAe;YAAiB;YAC/DhB,IAAYH,IAAI,GAAGkC;YACpB,MAAMH,aAAyB;gBAAEtD,SAAS;gBAAOC,IAAI;gBAAGsD,QAAQ;YAAa;YAE7E,MAAM7E,OAAOuE,WAAWc,oBAAoB,CAACrC,KAAK4B,aAAajB,OAAO,CAACC,OAAO,CAC5EhE;QAEJ;QAEAK,GAAG,iDAAiD;YAClD,MAAMsE,WAAWgB,iBAAiB,CAAC,UAAU;YAE7CvF,OAAOwE,aAAaxC,uBAAuB,EAAEiC,oBAAoB,CAAC,cAAc;QAClF;IACF;AACF"}

package/dist/__tests__/unit/auth.guard.test.js

@@ -1,6 +1,6 @@
 /**
  * Tests for AuthGuard
- */ import { UnauthorizedException } from "@nestjs/common";
+ */ import { ForbiddenException, UnauthorizedException } from "@nestjs/common";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { AuthGuard } from "../../modules/auth/auth.guard.js";
 function createMockExecutionContext(headers = {}) {
@@ -54,7 +54,7 @@ describe('AuthGuard', ()=>{
         const mockSession = {
             id: 'sess-1',
             userId: 'user-1',
-            activeOrganizationId: null
+            activeOrganizationId: 'org-1'
         };
         authService.getSession.mockResolvedValue({
             user: mockUser,
@@ -69,6 +69,27 @@ describe('AuthGuard', ()=>{
         expect(request.user).toEqual(mockUser);
         expect(request.sessionData).toEqual(mockSession);
     });
+    it('should throw ForbiddenException when session has no active organization', async ()=>{
+        const mockUser = {
+            id: 'user-1',
+            name: 'Test',
+            email: 'test@example.com',
+            image: null
+        };
+        const mockSession = {
+            id: 'sess-1',
+            userId: 'user-1',
+            activeOrganizationId: null
+        };
+        authService.getSession.mockResolvedValue({
+            user: mockUser,
+            session: mockSession
+        });
+        const ctx = createMockExecutionContext({
+            cookie: 'session=abc'
+        });
+        await expect(guard.canActivate(ctx)).rejects.toThrow(ForbiddenException);
+    });
 });
 
 //# sourceMappingURL=auth.guard.test.js.map

package/dist/__tests__/unit/auth.guard.test.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/__tests__/unit/auth.guard.test.ts"],"sourcesContent":["/**\n * Tests for AuthGuard\n */\n\nimport { ExecutionContext, UnauthorizedException } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { beforeEach, describe, expect, it, vi } from 'vitest';\nimport { AuthGuard } from '../../modules/auth/auth.guard.js';\nimport { AuthService } from '../../modules/auth/auth.service.js';\n\nfunction createMockExecutionContext(headers: Record<string, string> = {}): ExecutionContext {\n  const request = { headers, user: undefined, sessionData: undefined };\n  return {\n    switchToHttp: () => ({\n      getRequest: () => request,\n    }),\n    getHandler: () => ({}),\n    getClass: () => ({}),\n  } as unknown as ExecutionContext;\n}\n\ndescribe('AuthGuard', () => {\n  let guard: AuthGuard;\n  let authService: { getSession: ReturnType<typeof vi.fn> };\n  let reflector: { getAllAndOverride: ReturnType<typeof vi.fn> };\n\n  beforeEach(() => {\n    authService = {\n      getSession: vi.fn(),\n    };\n    reflector = {\n      getAllAndOverride: vi.fn().mockReturnValue(false),\n    };\n    guard = new AuthGuard(authService as unknown as AuthService, reflector as unknown as Reflector);\n  });\n\n  it('should allow @Public() routes without auth', async () => {\n    reflector.getAllAndOverride.mockReturnValue(true);\n    const ctx = createMockExecutionContext();\n    const result = await guard.canActivate(ctx);\n\n    expect(result).toBe(true);\n    expect(authService.getSession).not.toHaveBeenCalled();\n  });\n\n  it('should throw UnauthorizedException when no session', async () => {\n    authService.getSession.mockResolvedValue(null);\n    const ctx = createMockExecutionContext({ cookie: 'session=abc' });\n\n    await expect(guard.canActivate(ctx)).rejects.toThrow(UnauthorizedException);\n  });\n\n  it('should attach user and session when valid session exists', async () => {\n    const mockUser = { id: 'user-1', name: 'Test', email: 'test@example.com', image: null };\n    const mockSession = { id: 'sess-1', userId: 'user-1', activeOrganizationId: null };\n    authService.getSession.mockResolvedValue({ user: mockUser, session: mockSession });\n\n    const ctx = createMockExecutionContext({ cookie: 'session=abc' });\n    const result = await guard.canActivate(ctx);\n\n    expect(result).toBe(true);\n    const request = ctx.switchToHttp().getRequest();\n    expect(request.user).toEqual(mockUser);\n    expect(request.sessionData).toEqual(mockSession);\n  });\n});\n"],"names":["UnauthorizedException","beforeEach","describe","expect","it","vi","AuthGuard","createMockExecutionContext","headers","request","user","undefined","sessionData","switchToHttp","getRequest","getHandler","getClass","guard","authService","reflector","getSession","fn","getAllAndOverride","mockReturnValue","ctx","result","canActivate","toBe","not","toHaveBeenCalled","mockResolvedValue","cookie","rejects","toThrow","mockUser","id","name","email","image","mockSession","userId","activeOrganizationId","session","toEqual"],"mappings":"AAAA;;CAEC,GAED,SAA2BA,qBAAqB,QAAQ,iBAAiB;AAEzE,SAASC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAS;AAC9D,SAASC,SAAS,QAAQ,mCAAmC;AAG7D,SAASC,2BAA2BC,UAAkC,CAAC,CAAC;IACtE,MAAMC,UAAU;QAAED;QAASE,MAAMC;QAAWC,aAAaD;IAAU;IACnE,OAAO;QACLE,cAAc,IAAO,CAAA;gBACnBC,YAAY,IAAML;YACpB,CAAA;QACAM,YAAY,IAAO,CAAA,CAAC,CAAA;QACpBC,UAAU,IAAO,CAAA,CAAC,CAAA;IACpB;AACF;AAEAd,SAAS,aAAa;IACpB,IAAIe;IACJ,IAAIC;IACJ,IAAIC;IAEJlB,WAAW;QACTiB,cAAc;YACZE,YAAYf,GAAGgB,EAAE;QACnB;QACAF,YAAY;YACVG,mBAAmBjB,GAAGgB,EAAE,GAAGE,eAAe,CAAC;QAC7C;QACAN,QAAQ,IAAIX,UAAUY,aAAuCC;IAC/D;IAEAf,GAAG,8CAA8C;QAC/Ce,UAAUG,iBAAiB,CAACC,eAAe,CAAC;QAC5C,MAAMC,MAAMjB;QACZ,MAAMkB,SAAS,MAAMR,MAAMS,WAAW,CAACF;QAEvCrB,OAAOsB,QAAQE,IAAI,CAAC;QACpBxB,OAAOe,YAAYE,UAAU,EAAEQ,GAAG,CAACC,gBAAgB;IACrD;IAEAzB,GAAG,sDAAsD;QACvDc,YAAYE,UAAU,CAACU,iBAAiB,CAAC;QACzC,MAAMN,MAAMjB,2BAA2B;YAAEwB,QAAQ;QAAc;QAE/D,MAAM5B,OAAOc,MAAMS,WAAW,CAACF,MAAMQ,OAAO,CAACC,OAAO,CAACjC;IACvD;IAEAI,GAAG,4DAA4D;QAC7D,MAAM8B,WAAW;YAAEC,IAAI;YAAUC,MAAM;YAAQC,OAAO;YAAoBC,OAAO;QAAK;QACtF,MAAMC,cAAc;YAAEJ,IAAI;YAAUK,QAAQ;YAAUC,sBAAsB;QAAK;QACjFvB,YAAYE,UAAU,CAACU,iBAAiB,CAAC;YAAEpB,MAAMwB;YAAUQ,SAASH;QAAY;QAEhF,MAAMf,MAAMjB,2BAA2B;YAAEwB,QAAQ;QAAc;QAC/D,MAAMN,SAAS,MAAMR,MAAMS,WAAW,CAACF;QAEvCrB,OAAOsB,QAAQE,IAAI,CAAC;QACpB,MAAMlB,UAAUe,IAAIX,YAAY,GAAGC,UAAU;QAC7CX,OAAOM,QAAQC,IAAI,EAAEiC,OAAO,CAACT;QAC7B/B,OAAOM,QAAQG,WAAW,EAAE+B,OAAO,CAACJ;IACtC;AACF"}
+{"version":3,"sources":["../../../src/__tests__/unit/auth.guard.test.ts"],"sourcesContent":["/**\n * Tests for AuthGuard\n */\n\nimport { ExecutionContext, ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { beforeEach, describe, expect, it, vi } from 'vitest';\nimport { AuthGuard } from '../../modules/auth/auth.guard.js';\nimport { AuthService } from '../../modules/auth/auth.service.js';\n\nfunction createMockExecutionContext(headers: Record<string, string> = {}): ExecutionContext {\n  const request = { headers, user: undefined, sessionData: undefined };\n  return {\n    switchToHttp: () => ({\n      getRequest: () => request,\n    }),\n    getHandler: () => ({}),\n    getClass: () => ({}),\n  } as unknown as ExecutionContext;\n}\n\ndescribe('AuthGuard', () => {\n  let guard: AuthGuard;\n  let authService: { getSession: ReturnType<typeof vi.fn> };\n  let reflector: { getAllAndOverride: ReturnType<typeof vi.fn> };\n\n  beforeEach(() => {\n    authService = {\n      getSession: vi.fn(),\n    };\n    reflector = {\n      getAllAndOverride: vi.fn().mockReturnValue(false),\n    };\n    guard = new AuthGuard(authService as unknown as AuthService, reflector as unknown as Reflector);\n  });\n\n  it('should allow @Public() routes without auth', async () => {\n    reflector.getAllAndOverride.mockReturnValue(true);\n    const ctx = createMockExecutionContext();\n    const result = await guard.canActivate(ctx);\n\n    expect(result).toBe(true);\n    expect(authService.getSession).not.toHaveBeenCalled();\n  });\n\n  it('should throw UnauthorizedException when no session', async () => {\n    authService.getSession.mockResolvedValue(null);\n    const ctx = createMockExecutionContext({ cookie: 'session=abc' });\n\n    await expect(guard.canActivate(ctx)).rejects.toThrow(UnauthorizedException);\n  });\n\n  it('should attach user and session when valid session exists', async () => {\n    const mockUser = { id: 'user-1', name: 'Test', email: 'test@example.com', image: null };\n    const mockSession = { id: 'sess-1', userId: 'user-1', activeOrganizationId: 'org-1' };\n    authService.getSession.mockResolvedValue({ user: mockUser, session: mockSession });\n\n    const ctx = createMockExecutionContext({ cookie: 'session=abc' });\n    const result = await guard.canActivate(ctx);\n\n    expect(result).toBe(true);\n    const request = ctx.switchToHttp().getRequest();\n    expect(request.user).toEqual(mockUser);\n    expect(request.sessionData).toEqual(mockSession);\n  });\n\n  it('should throw ForbiddenException when session has no active organization', async () => {\n    const mockUser = { id: 'user-1', name: 'Test', email: 'test@example.com', image: null };\n    const mockSession = { id: 'sess-1', userId: 'user-1', activeOrganizationId: null };\n    authService.getSession.mockResolvedValue({ user: mockUser, session: mockSession });\n\n    const ctx = createMockExecutionContext({ cookie: 'session=abc' });\n\n    await expect(guard.canActivate(ctx)).rejects.toThrow(ForbiddenException);\n  });\n});\n"],"names":["ForbiddenException","UnauthorizedException","beforeEach","describe","expect","it","vi","AuthGuard","createMockExecutionContext","headers","request","user","undefined","sessionData","switchToHttp","getRequest","getHandler","getClass","guard","authService","reflector","getSession","fn","getAllAndOverride","mockReturnValue","ctx","result","canActivate","toBe","not","toHaveBeenCalled","mockResolvedValue","cookie","rejects","toThrow","mockUser","id","name","email","image","mockSession","userId","activeOrganizationId","session","toEqual"],"mappings":"AAAA;;CAEC,GAED,SAA2BA,kBAAkB,EAAEC,qBAAqB,QAAQ,iBAAiB;AAE7F,SAASC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAS;AAC9D,SAASC,SAAS,QAAQ,mCAAmC;AAG7D,SAASC,2BAA2BC,UAAkC,CAAC,CAAC;IACtE,MAAMC,UAAU;QAAED;QAASE,MAAMC;QAAWC,aAAaD;IAAU;IACnE,OAAO;QACLE,cAAc,IAAO,CAAA;gBACnBC,YAAY,IAAML;YACpB,CAAA;QACAM,YAAY,IAAO,CAAA,CAAC,CAAA;QACpBC,UAAU,IAAO,CAAA,CAAC,CAAA;IACpB;AACF;AAEAd,SAAS,aAAa;IACpB,IAAIe;IACJ,IAAIC;IACJ,IAAIC;IAEJlB,WAAW;QACTiB,cAAc;YACZE,YAAYf,GAAGgB,EAAE;QACnB;QACAF,YAAY;YACVG,mBAAmBjB,GAAGgB,EAAE,GAAGE,eAAe,CAAC;QAC7C;QACAN,QAAQ,IAAIX,UAAUY,aAAuCC;IAC/D;IAEAf,GAAG,8CAA8C;QAC/Ce,UAAUG,iBAAiB,CAACC,eAAe,CAAC;QAC5C,MAAMC,MAAMjB;QACZ,MAAMkB,SAAS,MAAMR,MAAMS,WAAW,CAACF;QAEvCrB,OAAOsB,QAAQE,IAAI,CAAC;QACpBxB,OAAOe,YAAYE,UAAU,EAAEQ,GAAG,CAACC,gBAAgB;IACrD;IAEAzB,GAAG,sDAAsD;QACvDc,YAAYE,UAAU,CAACU,iBAAiB,CAAC;QACzC,MAAMN,MAAMjB,2BAA2B;YAAEwB,QAAQ;QAAc;QAE/D,MAAM5B,OAAOc,MAAMS,WAAW,CAACF,MAAMQ,OAAO,CAACC,OAAO,CAACjC;IACvD;IAEAI,GAAG,4DAA4D;QAC7D,MAAM8B,WAAW;YAAEC,IAAI;YAAUC,MAAM;YAAQC,OAAO;YAAoBC,OAAO;QAAK;QACtF,MAAMC,cAAc;YAAEJ,IAAI;YAAUK,QAAQ;YAAUC,sBAAsB;QAAQ;QACpFvB,YAAYE,UAAU,CAACU,iBAAiB,CAAC;YAAEpB,MAAMwB;YAAUQ,SAASH;QAAY;QAEhF,MAAMf,MAAMjB,2BAA2B;YAAEwB,QAAQ;QAAc;QAC/D,MAAMN,SAAS,MAAMR,MAAMS,WAAW,CAACF;QAEvCrB,OAAOsB,QAAQE,IAAI,CAAC;QACpB,MAAMlB,UAAUe,IAAIX,YAAY,GAAGC,UAAU;QAC7CX,OAAOM,QAAQC,IAAI,EAAEiC,OAAO,CAACT;QAC7B/B,OAAOM,QAAQG,WAAW,EAAE+B,OAAO,CAACJ;IACtC;IAEAnC,GAAG,2EAA2E;QAC5E,MAAM8B,WAAW;YAAEC,IAAI;YAAUC,MAAM;YAAQC,OAAO;YAAoBC,OAAO;QAAK;QACtF,MAAMC,cAAc;YAAEJ,IAAI;YAAUK,QAAQ;YAAUC,sBAAsB;QAAK;QACjFvB,YAAYE,UAAU,CAACU,iBAAiB,CAAC;YAAEpB,MAAMwB;YAAUQ,SAASH;QAAY;QAEhF,MAAMf,MAAMjB,2BAA2B;YAAEwB,QAAQ;QAAc;QAE/D,MAAM5B,OAAOc,MAAMS,WAAW,CAACF,MAAMQ,OAAO,CAACC,OAAO,CAAClC;IACvD;AACF"}

package/dist/common/filters/all-exceptions.filter.js

@@ -48,6 +48,12 @@ export class AllExceptionsFilter {
         if (typeof requestId === 'string') {
             errorResponse.requestId = requestId;
         }
+        // Set WWW-Authenticate header for MCP OAuth errors (RFC 9728)
+        const mcpException = exception instanceof HttpException ? exception : null;
+        if (mcpException?.wwwAuthenticate) {
+            response.setHeader('WWW-Authenticate', mcpException.wwwAuthenticate);
+            response.setHeader('Access-Control-Expose-Headers', 'WWW-Authenticate');
+        }
         response.status(status).json(errorResponse);
     }
     constructor(){

package/dist/common/filters/all-exceptions.filter.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/common/filters/all-exceptions.filter.ts"],"sourcesContent":["/**\n * Global Exception Filter\n *\n * Catches all exceptions and formats them consistently.\n */\n\nimport {\n  ArgumentsHost,\n  Catch,\n  ExceptionFilter,\n  HttpException,\n  HttpStatus,\n  Logger,\n} from '@nestjs/common';\nimport { Request, Response } from 'express';\n\ninterface ErrorResponse {\n  statusCode: number;\n  message: string;\n  error: string;\n  timestamp: string;\n  path: string;\n  requestId?: string;\n}\n\n@Catch()\nexport class AllExceptionsFilter implements ExceptionFilter {\n  private readonly logger = new Logger(AllExceptionsFilter.name);\n\n  catch(exception: unknown, host: ArgumentsHost): void {\n    const ctx = host.switchToHttp();\n    const response = ctx.getResponse<Response>();\n    const request = ctx.getRequest<Request>();\n\n    let status = HttpStatus.INTERNAL_SERVER_ERROR;\n    let message = 'Internal server error';\n    let error = 'Internal Server Error';\n\n    if (exception instanceof HttpException) {\n      status = exception.getStatus();\n      const exceptionResponse = exception.getResponse();\n\n      if (typeof exceptionResponse === 'string') {\n        message = exceptionResponse;\n      } else if (typeof exceptionResponse === 'object') {\n        const responseObj = exceptionResponse as Record<string, unknown>;\n        message = (responseObj.message as string) || message;\n        error = (responseObj.error as string) || exception.name;\n      }\n    } else if (exception instanceof Error) {\n      message = exception.message;\n      error = exception.name;\n    }\n\n    // Log error\n    this.logger.error(`${request.method} ${request.url} - ${status} - ${message}`, {\n      exception: exception instanceof Error ? exception.stack : String(exception),\n      requestId: request.headers['x-request-id'],\n    });\n\n    const errorResponse: ErrorResponse = {\n      statusCode: status,\n      message,\n      error,\n      timestamp: new Date().toISOString(),\n      path: request.url,\n    };\n\n    // Add request ID if present\n    const requestId = request.headers['x-request-id'];\n    if (typeof requestId === 'string') {\n      errorResponse.requestId = requestId;\n    }\n\n    response.status(status).json(errorResponse);\n  }\n}\n"],"names":["Catch","HttpException","HttpStatus","Logger","AllExceptionsFilter","catch","exception","host","ctx","switchToHttp","response","getResponse","request","getRequest","status","INTERNAL_SERVER_ERROR","message","error","getStatus","exceptionResponse","responseObj","name","Error","logger","method","url","stack","String","requestId","headers","errorResponse","statusCode","timestamp","Date","toISOString","path","json"],"mappings":";;;;;;AAAA;;;;CAIC,GAED,SAEEA,KAAK,EAELC,aAAa,EACbC,UAAU,EACVC,MAAM,QACD,iBAAiB;AAaxB,OAAO,MAAMC;IAGXC,MAAMC,SAAkB,EAAEC,IAAmB,EAAQ;QACnD,MAAMC,MAAMD,KAAKE,YAAY;QAC7B,MAAMC,WAAWF,IAAIG,WAAW;QAChC,MAAMC,UAAUJ,IAAIK,UAAU;QAE9B,IAAIC,SAASZ,WAAWa,qBAAqB;QAC7C,IAAIC,UAAU;QACd,IAAIC,QAAQ;QAEZ,IAAIX,qBAAqBL,eAAe;YACtCa,SAASR,UAAUY,SAAS;YAC5B,MAAMC,oBAAoBb,UAAUK,WAAW;YAE/C,IAAI,OAAOQ,sBAAsB,UAAU;gBACzCH,UAAUG;YACZ,OAAO,IAAI,OAAOA,sBAAsB,UAAU;gBAChD,MAAMC,cAAcD;gBACpBH,UAAU,AAACI,YAAYJ,OAAO,IAAeA;gBAC7CC,QAAQ,AAACG,YAAYH,KAAK,IAAeX,UAAUe,IAAI;YACzD;QACF,OAAO,IAAIf,qBAAqBgB,OAAO;YACrCN,UAAUV,UAAUU,OAAO;YAC3BC,QAAQX,UAAUe,IAAI;QACxB;QAEA,YAAY;QACZ,IAAI,CAACE,MAAM,CAACN,KAAK,CAAC,GAAGL,QAAQY,MAAM,CAAC,CAAC,EAAEZ,QAAQa,GAAG,CAAC,GAAG,EAAEX,OAAO,GAAG,EAAEE,SAAS,EAAE;YAC7EV,WAAWA,qBAAqBgB,QAAQhB,UAAUoB,KAAK,GAAGC,OAAOrB;YACjEsB,WAAWhB,QAAQiB,OAAO,CAAC,eAAe;QAC5C;QAEA,MAAMC,gBAA+B;YACnCC,YAAYjB;YACZE;YACAC;YACAe,WAAW,IAAIC,OAAOC,WAAW;YACjCC,MAAMvB,QAAQa,GAAG;QACnB;QAEA,4BAA4B;QAC5B,MAAMG,YAAYhB,QAAQiB,OAAO,CAAC,eAAe;QACjD,IAAI,OAAOD,cAAc,UAAU;YACjCE,cAAcF,SAAS,GAAGA;QAC5B;QAEAlB,SAASI,MAAM,CAACA,QAAQsB,IAAI,CAACN;IAC/B;;aAhDiBP,SAAS,IAAIpB,OAAOC,oBAAoBiB,IAAI;;AAiD/D"}
+{"version":3,"sources":["../../../src/common/filters/all-exceptions.filter.ts"],"sourcesContent":["/**\n * Global Exception Filter\n *\n * Catches all exceptions and formats them consistently.\n */\n\nimport {\n  ArgumentsHost,\n  Catch,\n  ExceptionFilter,\n  HttpException,\n  HttpStatus,\n  Logger,\n} from '@nestjs/common';\nimport { Request, Response } from 'express';\n\ninterface ErrorResponse {\n  statusCode: number;\n  message: string;\n  error: string;\n  timestamp: string;\n  path: string;\n  requestId?: string;\n}\n\ntype McpHttpException = HttpException & {\n  wwwAuthenticate?: string;\n};\n\n@Catch()\nexport class AllExceptionsFilter implements ExceptionFilter {\n  private readonly logger = new Logger(AllExceptionsFilter.name);\n\n  catch(exception: unknown, host: ArgumentsHost): void {\n    const ctx = host.switchToHttp();\n    const response = ctx.getResponse<Response>();\n    const request = ctx.getRequest<Request>();\n\n    let status = HttpStatus.INTERNAL_SERVER_ERROR;\n    let message = 'Internal server error';\n    let error = 'Internal Server Error';\n\n    if (exception instanceof HttpException) {\n      status = exception.getStatus();\n      const exceptionResponse = exception.getResponse();\n\n      if (typeof exceptionResponse === 'string') {\n        message = exceptionResponse;\n      } else if (typeof exceptionResponse === 'object') {\n        const responseObj = exceptionResponse as Record<string, unknown>;\n        message = (responseObj.message as string) || message;\n        error = (responseObj.error as string) || exception.name;\n      }\n    } else if (exception instanceof Error) {\n      message = exception.message;\n      error = exception.name;\n    }\n\n    // Log error\n    this.logger.error(`${request.method} ${request.url} - ${status} - ${message}`, {\n      exception: exception instanceof Error ? exception.stack : String(exception),\n      requestId: request.headers['x-request-id'],\n    });\n\n    const errorResponse: ErrorResponse = {\n      statusCode: status,\n      message,\n      error,\n      timestamp: new Date().toISOString(),\n      path: request.url,\n    };\n\n    // Add request ID if present\n    const requestId = request.headers['x-request-id'];\n    if (typeof requestId === 'string') {\n      errorResponse.requestId = requestId;\n    }\n\n    // Set WWW-Authenticate header for MCP OAuth errors (RFC 9728)\n    const mcpException = exception instanceof HttpException ? (exception as McpHttpException) : null;\n    if (mcpException?.wwwAuthenticate) {\n      response.setHeader('WWW-Authenticate', mcpException.wwwAuthenticate);\n      response.setHeader('Access-Control-Expose-Headers', 'WWW-Authenticate');\n    }\n\n    response.status(status).json(errorResponse);\n  }\n}\n"],"names":["Catch","HttpException","HttpStatus","Logger","AllExceptionsFilter","catch","exception","host","ctx","switchToHttp","response","getResponse","request","getRequest","status","INTERNAL_SERVER_ERROR","message","error","getStatus","exceptionResponse","responseObj","name","Error","logger","method","url","stack","String","requestId","headers","errorResponse","statusCode","timestamp","Date","toISOString","path","mcpException","wwwAuthenticate","setHeader","json"],"mappings":";;;;;;AAAA;;;;CAIC,GAED,SAEEA,KAAK,EAELC,aAAa,EACbC,UAAU,EACVC,MAAM,QACD,iBAAiB;AAiBxB,OAAO,MAAMC;IAGXC,MAAMC,SAAkB,EAAEC,IAAmB,EAAQ;QACnD,MAAMC,MAAMD,KAAKE,YAAY;QAC7B,MAAMC,WAAWF,IAAIG,WAAW;QAChC,MAAMC,UAAUJ,IAAIK,UAAU;QAE9B,IAAIC,SAASZ,WAAWa,qBAAqB;QAC7C,IAAIC,UAAU;QACd,IAAIC,QAAQ;QAEZ,IAAIX,qBAAqBL,eAAe;YACtCa,SAASR,UAAUY,SAAS;YAC5B,MAAMC,oBAAoBb,UAAUK,WAAW;YAE/C,IAAI,OAAOQ,sBAAsB,UAAU;gBACzCH,UAAUG;YACZ,OAAO,IAAI,OAAOA,sBAAsB,UAAU;gBAChD,MAAMC,cAAcD;gBACpBH,UAAU,AAACI,YAAYJ,OAAO,IAAeA;gBAC7CC,QAAQ,AAACG,YAAYH,KAAK,IAAeX,UAAUe,IAAI;YACzD;QACF,OAAO,IAAIf,qBAAqBgB,OAAO;YACrCN,UAAUV,UAAUU,OAAO;YAC3BC,QAAQX,UAAUe,IAAI;QACxB;QAEA,YAAY;QACZ,IAAI,CAACE,MAAM,CAACN,KAAK,CAAC,GAAGL,QAAQY,MAAM,CAAC,CAAC,EAAEZ,QAAQa,GAAG,CAAC,GAAG,EAAEX,OAAO,GAAG,EAAEE,SAAS,EAAE;YAC7EV,WAAWA,qBAAqBgB,QAAQhB,UAAUoB,KAAK,GAAGC,OAAOrB;YACjEsB,WAAWhB,QAAQiB,OAAO,CAAC,eAAe;QAC5C;QAEA,MAAMC,gBAA+B;YACnCC,YAAYjB;YACZE;YACAC;YACAe,WAAW,IAAIC,OAAOC,WAAW;YACjCC,MAAMvB,QAAQa,GAAG;QACnB;QAEA,4BAA4B;QAC5B,MAAMG,YAAYhB,QAAQiB,OAAO,CAAC,eAAe;QACjD,IAAI,OAAOD,cAAc,UAAU;YACjCE,cAAcF,SAAS,GAAGA;QAC5B;QAEA,8DAA8D;QAC9D,MAAMQ,eAAe9B,qBAAqBL,gBAAiBK,YAAiC;QAC5F,IAAI8B,cAAcC,iBAAiB;YACjC3B,SAAS4B,SAAS,CAAC,oBAAoBF,aAAaC,eAAe;YACnE3B,SAAS4B,SAAS,CAAC,iCAAiC;QACtD;QAEA5B,SAASI,MAAM,CAACA,QAAQyB,IAAI,CAACT;IAC/B;;aAvDiBP,SAAS,IAAIpB,OAAOC,oBAAoBiB,IAAI;;AAwD/D"}

package/dist/main.js

@@ -13,6 +13,7 @@ import { AppModule } from "./app.module.js";
 import { AllExceptionsFilter } from "./common/filters/all-exceptions.filter.js";
 import { LoggingInterceptor } from "./common/interceptors/logging.interceptor.js";
 import { AuthService } from "./modules/auth/auth.service.js";
+import { createMcpProtectedResourceMetadata, resolvePublicAuthBaseUrl, resolvePublicBackendOrigin } from "./modules/auth/mcp-oauth.utils.js";
 async function bootstrap() {
     // Determine log levels from environment
     const logLevel = process.env.LOG_LEVEL || 'log';
@@ -85,6 +86,42 @@ async function bootstrap() {
         if (!auth) return next();
         toNodeHandler(auth)(req, res);
     };
+    expressApp.get('/.well-known/oauth-protected-resource', (_req, res)=>{
+        res.json(createMcpProtectedResourceMetadata(configService));
+    });
+    // RFC 8414 – OAuth 2.0 Authorization Server Metadata
+    // MCP clients fetch this to discover the correct DCR endpoint (/api/auth/mcp/register)
+    // instead of falling back to the root /register which returns 404.
+    expressApp.get('/.well-known/oauth-authorization-server', (_req, res)=>{
+        const backendOrigin = resolvePublicBackendOrigin(configService);
+        const authBaseUrl = resolvePublicAuthBaseUrl(configService);
+        res.json({
+            issuer: backendOrigin,
+            authorization_endpoint: `${authBaseUrl}/mcp/authorize`,
+            token_endpoint: `${authBaseUrl}/mcp/token`,
+            registration_endpoint: `${authBaseUrl}/mcp/register`,
+            jwks_uri: `${authBaseUrl}/mcp/jwks`,
+            response_types_supported: [
+                'code'
+            ],
+            grant_types_supported: [
+                'authorization_code',
+                'refresh_token'
+            ],
+            token_endpoint_auth_methods_supported: [
+                'none'
+            ],
+            code_challenge_methods_supported: [
+                'S256'
+            ],
+            scopes_supported: [
+                'openid',
+                'profile',
+                'email',
+                'offline_access'
+            ]
+        });
+    });
     expressApp.all('/api/auth/*splat', lazyAuthHandler);
     expressApp.all('/.well-known/*splat', lazyAuthHandler);
     logger.log('Better Auth routes registered (lazy) on /api/auth/* and /.well-known/*');