@enfyra/mcp-server 0.0.79 → 0.0.80

package/README.md

@@ -219,6 +219,16 @@ When an LLM builds a Nuxt, Next, or other SSR frontend for Enfyra, follow the sa
 - Socket.IO browser clients use a same-origin bridge too. Connect to the namespace, e.g. `io("/chat", { path: "/socket.io", withCredentials: true })`, and proxy `/socket.io/**` to the Enfyra app bridge `/ws/socket.io/**`. The backend gateway metadata path remains `/chat`.
 - Use token-query OAuth callback pages only for non-SSR/manual-token apps.
 
+### OAuth provider setup checklist
+
+OAuth provider setup has three distinct URLs:
+
+- Provider callback URL: Enfyra handles this at `{ENFYRA_API_URL}/auth/{provider}/callback`. If the app proxy base is `http://localhost:3000/api`, the Google callback URL is `http://localhost:3000/api/auth/google/callback`.
+- Enfyra OAuth config: `oauth_config_definition.redirectUri` must exactly match the provider callback URL registered in Google, Facebook, or GitHub. The same row stores the provider client id/secret and enabled state.
+- App return URL: the frontend sends this as the `redirect` query when starting OAuth, for example `/enfyra/auth/google?redirect=https%3A%2F%2Fapp.example.com%2Fchat&cookieBridgePrefix=/enfyra`.
+
+Do not confuse `redirectUri` with `redirect`. `redirectUri` is the provider-to-Enfyra callback. `redirect` is where Enfyra sends the browser after cookies are set. `appCallbackUrl` is only for manual-token apps that intentionally read token query parameters instead of using proxy-owned cookies.
+
 ---
 
 ## Tools (summary)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enfyra/mcp-server",
-  "version": "0.0.79",
+  "version": "0.0.80",
   "description": "MCP server for Enfyra - manage your Enfyra instance via Claude Code",
   "type": "module",
   "license": "MIT",

package/src/lib/mcp-examples.js

@@ -153,6 +153,26 @@ onUnmounted(() => {
           'Disconnect the singleton socket when the current user/session clears.',
         ],
       },
+      {
+        name: 'OAuth provider setup values',
+        code: `// Enfyra OAuth config row, stored in oauth_config_definition.
+{
+  "provider": "google",
+  "clientId": "<google-client-id>",
+  "clientSecret": "<google-client-secret>",
+  "redirectUri": "http://localhost:3000/api/auth/google/callback",
+  "isEnabled": true
+}
+
+// Google Cloud Console -> Authorized redirect URIs:
+// http://localhost:3000/api/auth/google/callback`,
+        notes: [
+          'redirectUri is the Enfyra callback URL: {ENFYRA_API_URL}/auth/google/callback.',
+          'The provider console callback URL and oauth_config_definition.redirectUri must match exactly.',
+          'This callback URL is not the app return page; the app return page is sent as the redirect query when starting OAuth.',
+          'Use appCallbackUrl only for manual-token apps that intentionally read token query parameters.',
+        ],
+      },
       {
         name: 'Google OAuth button',
         code: `const redirect = new URL("/chat", window.location.origin)
@@ -164,6 +184,7 @@ window.location.href = url.toString()`,
           'redirect must be absolute and must include the app origin.',
           'cookieBridgePrefix is the app proxy prefix that forwards to Enfyra API routes.',
           'Enfyra redirects through {redirect.origin}{cookieBridgePrefix}/auth/set-cookies before returning to redirect.',
+          'After returning, call /enfyra/me to load the authenticated user; do not parse tokens from the URL in proxy-cookie mode.',
         ],
       },
     ],