@lenne.tech/nest-server 12.2.0 → 12.3.0

package/src/core/modules/ai/helpers/ai-mcp-oauth-consent.helper.ts

@@ -125,9 +125,31 @@ export function mcpOAuthConsentHeaders(nonce: string): Record<string, string> {
   };
 }
 
+/** Every text of the page in one locale. */
+export type McpOAuthConsentTexts = (typeof TEXTS)[McpOAuthConsentLocale];
+
+/**
+ * Project adjustments for {@link renderMcpOAuthConsentPage}: replacement texts per locale (merged over
+ * the built-in ones, so a project changes only what it needs, e.g. its form of address) and CSS
+ * appended after the built-in styles (its colours and font). Neither touches the markup, the scripts or
+ * the security headers — what makes the page safe stays the framework's.
+ *
+ * Fill both from code or configuration, never from user or tenant input. Texts are escaped like the
+ * built-in ones; styles cannot leave their `<style>` element (every `<` becomes the CSS escape `\3c `), and
+ * the page's CSP blocks what CSS could load from elsewhere (`img-src 'self' data:`, no font source, no
+ * `@import` without the nonce) — but CSS still decides what the page shows.
+ */
+export interface IMcpOAuthConsentPageOptions {
+  styles?: string;
+  texts?: Partial<Record<McpOAuthConsentLocale, Partial<McpOAuthConsentTexts>>>;
+}
+
 /** Renders the page. Every dynamic value goes through {@link escapeHtml}. */
-export function renderMcpOAuthConsentPage(view: IMcpOAuthConsentView): string {
-  const t = TEXTS[view.locale];
+export function renderMcpOAuthConsentPage(
+  view: IMcpOAuthConsentView,
+  options: IMcpOAuthConsentPageOptions = {},
+): string {
+  const t: Texts = { ...TEXTS[view.locale], ...options.texts?.[view.locale] };
   const clientName = view.client.name?.trim() || t.unnamedClient;
   // One pass: a client name is chosen by whoever registered the client, so a name containing
   // `{app}` must not be expanded by a second replace.
@@ -146,7 +168,7 @@ export function renderMcpOAuthConsentPage(view: IMcpOAuthConsentView): string {
 <meta name="robots" content="noindex">
 <link rel="icon" href="data:,">
 <title>${escapeHtml(t.title)} – ${escapeHtml(view.appHost)}</title>
-<style nonce="${escapeHtml(view.nonce)}">${STYLES}</style>
+<style nonce="${escapeHtml(view.nonce)}">${STYLES}${confinedStyles(options.styles)}</style>
 </head>
 <body>
 <main class="card">
@@ -158,7 +180,16 @@ ${pageScript(view)}
 `;
 }
 
-type Texts = (typeof TEXTS)[McpOAuthConsentLocale];
+type Texts = McpOAuthConsentTexts;
+
+/**
+ * Project CSS that cannot end the `<style>` element: a `</style>` in it would continue as markup — an injected
+ * form, for one, since the page sets no `form-action`. `<` has no meaning in CSS outside strings and comments, and
+ * the CSS escape `\3c ` keeps it where it does.
+ */
+function confinedStyles(styles: string | undefined): string {
+  return typeof styles === 'string' ? styles.replace(/</g, '\\3c ') : '';
+}
 
 function consentView(view: IMcpOAuthConsentView, t: Texts, fill: (text: string) => string): string {
   const target = view.redirect.loopback

package/src/core/modules/ai/helpers/ai-mcp-oauth.helper.ts

@@ -122,6 +122,7 @@ async function mountRouter(
   const { getOAuthProtectedResourceMetadataUrl, mcpAuthRouter } =
     await import('@modelcontextprotocol/sdk/server/auth/router.js');
   const provider = oauthService.buildOAuthProvider() as any;
+  markAuthorizeReached(provider);
 
   let router: unknown;
   try {
@@ -136,7 +137,7 @@ async function mountRouter(
     });
   }
 
-  use(router);
+  use(guardErrorRedirects(router as (req: any, res: any, next: (error?: unknown) => void) => void));
   const mounted: IMountedMcpOAuth = {
     authBasePath: options.authBasePath,
     baseUrl: baseUrl.replace(/\/$/, ''),
@@ -153,6 +154,72 @@ async function mountRouter(
   return mounted;
 }
 
+/** `res.locals` key: the SDK's authorize handler handed this request to the provider */
+const AUTHORIZE_REACHED = Symbol('ltMcpOAuthAuthorizeReached');
+
+/** Marks every request the provider's `authorize` receives, so {@link refuseUnvouchedErrorRedirects} lets its redirects pass */
+function markAuthorizeReached(provider: { authorize?: (...args: any[]) => Promise<void> }): void {
+  const authorize = provider.authorize;
+  if (typeof authorize !== 'function') {
+    return;
+  }
+  provider.authorize = (client: unknown, params: unknown, res: any) => {
+    if (res) {
+      res.locals = res.locals ?? {};
+      res.locals[AUTHORIZE_REACHED] = true;
+    }
+    return authorize.call(provider, client, params, res);
+  };
+}
+
+/**
+ * The SDK router behind a guard on `/authorize`: an error the SDK finds after the client check (a missing
+ * `code_challenge`, a wrong `response_type`) is answered here, never sent to the client's redirect URI. Dynamic client
+ * registration takes any redirect URI — it must, for claude.ai, ChatGPT, Cursor and Claude Code — so that 302 made
+ * `/authorize` an open redirect on this domain for whoever registered a client (RFC 9700 §4.11.2). The answer has the
+ * shape of the SDK's own errors before the client check. What the provider does keeps its redirects: the signed-in
+ * user's Allow or Deny, which carry the consent form's token, and the provider's own refusals. One handler, so the
+ * router is still mounted with a single `use()`.
+ */
+function guardErrorRedirects(
+  router: (req: any, res: any, next: (error?: unknown) => void) => void,
+): (req: any, res: any, next: (error?: unknown) => void) => void {
+  return (req, res, next) => {
+    if (
+      String(req.path ?? '')
+        .toLowerCase()
+        .replace(/\/+$/, '') === '/authorize'
+    ) {
+      refuseUnvouchedErrorRedirects(res);
+    }
+    router(req, res, next);
+  };
+}
+
+/** Answers an error redirect of the SDK directly unless the request reached the provider's `authorize` */
+function refuseUnvouchedErrorRedirects(res: any): void {
+  const redirect = res.redirect.bind(res);
+  res.redirect = (...args: unknown[]) => {
+    const target = typeof args[0] === 'number' ? args[1] : args[0];
+    let error: null | string = null;
+    let description: null | string = null;
+    try {
+      const url = new URL(String(target));
+      error = url.searchParams.get('error');
+      description = url.searchParams.get('error_description');
+    } catch {
+      // Not an absolute URL: nothing the SDK's error redirect would produce
+    }
+    if (error && !res.locals?.[AUTHORIZE_REACHED]) {
+      res
+        .status(error === 'server_error' ? 500 : 400)
+        .json({ error, ...(description ? { error_description: description } : {}) });
+      return;
+    }
+    return redirect(...args);
+  };
+}
+
 /** The Express instance behind a Nest application, or the object itself for any other shape. */
 function mountTargetOf(app: IAiMcpOAuthMountTarget): object {
   const instance = app.getHttpAdapter?.()?.getInstance?.();

package/src/core/modules/ai/helpers/ai-tool-authorization.helper.ts

@@ -0,0 +1,99 @@
+import { Logger } from '@nestjs/common';
+
+import { ConfigService } from '../../../common/services/config.service.js';
+import type { AiToolAuthorization, AiToolContext, IAiTool } from '../interfaces/ai-tool.interface.js';
+
+const logger = new Logger('AiToolAuthorization');
+
+/**
+ * Runs a tool's `authorize()` for one call. Shared by the chat orchestrator (auto and plan mode) and the MCP
+ * endpoint, so a data-level check holds on every path a tool is executed on (12.3.0+).
+ *
+ * Fails closed: a thrown `authorize()`, a missing answer or an `allowed` that is not exactly `true` is a refusal. The
+ * error itself is logged, never handed to the model or the MCP client, because it may name records or internals.
+ * A tool without `authorize()` is allowed — the registry role filter has already decided that the user may see it.
+ */
+export async function authorizeToolCall(
+  tool: IAiTool,
+  args: Record<string, any>,
+  context: AiToolContext,
+): Promise<AiToolAuthorization> {
+  if (!tool.authorize) {
+    return { allowed: true };
+  }
+  try {
+    const result = await tool.authorize(args, context);
+    if (typeof result === 'boolean') {
+      return { allowed: result };
+    }
+    if (!result || typeof result !== 'object') {
+      return { allowed: false };
+    }
+    return { ...result, allowed: result.allowed === true };
+  } catch (err) {
+    logger.warn(`authorize() of AI tool "${tool.name}" threw, call refused: ${(err as Error).message}`);
+    return { allowed: false, reason: 'The authorization check for this action failed.' };
+  }
+}
+
+/**
+ * Whether a call of this tool needs the user's confirmation before it runs: a `destructive` tool always, a
+ * `mutating` tool as the `ai.confirmation.mutating` policy says (`enforced`, else the caller's `requireConfirmation`,
+ * else `default`), any other tool never.
+ *
+ * `requireConfirmation` is the chat client's per-prompt wish; the MCP endpoint passes none, so there the policy's
+ * `default` decides.
+ */
+export function toolRequiresConfirmation(tool: IAiTool, requireConfirmation?: boolean): boolean {
+  if (tool.destructive) {
+    return true;
+  }
+  if (!tool.mutating) {
+    return false;
+  }
+  const cfg = ConfigService.get<{ default?: boolean; enabled?: boolean; enforced?: boolean }>(
+    'ai.confirmation.mutating',
+  );
+  if (cfg?.enforced === true) {
+    return true;
+  }
+  return requireConfirmation ?? cfg?.default === true;
+}
+
+/**
+ * The server's MCP confirmation policy, from `ai.mcp.confirmation` (12.3.0+): `default` is whether MCP asks a user
+ * who has not chosen for themselves, `enforced` whether users may choose at all.
+ */
+export interface AiMcpConfirmationPolicy {
+  default: boolean;
+  enforced: boolean;
+}
+
+/**
+ * Reads `ai.mcp.confirmation`: `false` → asks nobody unless a user switches it on; `true`, `{}`, unset or any other
+ * value → asks everybody unless a user switches it off; `{ default, enforced }` as written. Only `false` switches the
+ * default off and only `true` enforces, so a misspelt value never relaxes the gate.
+ */
+export function mcpConfirmationPolicy(): AiMcpConfirmationPolicy {
+  const mcp = ConfigService.get<unknown>('ai.mcp');
+  const setting = mcp && typeof mcp === 'object' ? (mcp as { confirmation?: unknown }).confirmation : undefined;
+  if (setting === false) {
+    return { default: false, enforced: false };
+  }
+  if (setting && typeof setting === 'object') {
+    const { default: defaultValue, enforced } = setting as { default?: unknown; enforced?: unknown };
+    return { default: defaultValue !== false, enforced: enforced === true };
+  }
+  return { default: true, enforced: false };
+}
+
+/**
+ * Whether MCP asks a user before a tool that needs confirmation: the user's own choice, unless the policy is
+ * enforced or the user has not chosen.
+ */
+export function effectiveMcpConfirmation(policy: AiMcpConfirmationPolicy, userChoice?: boolean | null): boolean {
+  if (policy.enforced || typeof userChoice !== 'boolean') {
+    return policy.default;
+  }
+  return userChoice;
+}

package/src/core/modules/ai/index.ts

@@ -2,6 +2,20 @@
 export * from './core-ai-mcp-oauth.initializer.js';
 export * from './core-ai-mcp.controller.js';
 export * from './helpers/ai-mcp-oauth.helper.js';
+// Named on purpose: the page's scripts and security headers stay internal, so a project cannot pin them
+export {
+  MCP_OAUTH_CONSENT_DECISION_FIELD,
+  MCP_OAUTH_CONSENT_TOKEN_FIELD,
+  mcpOAuthConsentLocale,
+  renderMcpOAuthConsentPage,
+} from './helpers/ai-mcp-oauth-consent.helper.js';
+export type {
+  IMcpOAuthConsentPageOptions,
+  IMcpOAuthConsentView,
+  McpOAuthConsentLocale,
+  McpOAuthConsentTexts,
+} from './helpers/ai-mcp-oauth-consent.helper.js';
+export * from './helpers/ai-tool-authorization.helper.js';
 export * from './core-ai.controller.js';
 export * from './core-ai.module.js';
 export * from './core-ai.resolver.js';
@@ -19,6 +33,7 @@ export * from './inputs/core-ai-prompt-update.input.js';
 export * from './inputs/core-ai-slot-create.input.js';
 export * from './inputs/core-ai-slot-update.input.js';
 export * from './inputs/core-ai-prompt.input.js';
+export * from './inputs/core-ai-settings.input.js';
 export * from './hooks/ai-hook.base.js';
 export * from './hooks/ai-hook.registry.js';
 export * from './interfaces/ai-interaction-record.interface.js';
@@ -41,6 +56,8 @@ export * from './models/core-ai-slot.model.js';
 export * from './models/core-ai-tool-grant.model.js';
 export * from './models/core-ai-mode.model.js';
 export * from './models/core-ai-tool-policy.model.js';
+export * from './models/core-ai-settings.model.js';
+export * from './models/core-ai-user-setting.model.js';
 export * from './models/core-ai-response.model.js';
 export * from './models/core-ai-usage-info.model.js';
 export * from './models/core-ai-usage.model.js';
@@ -65,6 +82,7 @@ export * from './services/core-ai-tool-grant.service.js';
 export * from './services/core-ai-mcp-client.service.js';
 export * from './services/core-ai-mode.service.js';
 export * from './services/core-ai-tool-policy.service.js';
+export * from './services/core-ai-user-setting.service.js';
 export * from './services/core-ai.service.js';
 export * from './tools/ai-tool.base.js';
 export * from './tools/ai-tool.registry.js';

package/src/core/modules/ai/inputs/core-ai-settings.input.ts

@@ -0,0 +1,24 @@
+import { InputType } from '@nestjs/graphql';
+
+import { Restricted } from '../../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+
+/**
+ * Changes to the current user's own AI settings (12.3.0+). A field left out stays as it is.
+ */
+@InputType({ description: "Changes to the current user's AI settings" })
+@Restricted(RoleEnum.S_USER)
+export class CoreAiSettingsInput {
+  /**
+   * Whether MCP asks before a tool that needs confirmation. Refused with 403 while the server enforces the setting
+   * (`ai.mcp.confirmation.enforced`).
+   */
+  @UnifiedField({
+    description: 'Whether MCP asks before a tool that needs confirmation',
+    isOptional: true,
+    roles: RoleEnum.S_USER,
+    type: () => Boolean,
+  })
+  mcpConfirmation?: boolean = undefined;
+}

package/src/core/modules/ai/interfaces/ai-hook.interface.ts

@@ -39,7 +39,7 @@ export interface AiHookEvent {
  * **Security:** hooks can only ADD restrictions (block calls, redact args) — they
  * cannot relax the permission system. A hook returning no block does not bypass
  * `@Restricted`/`@Roles`/`securityCheck()`; those still apply on every path
- * (`authorize()` only runs in plan mode).
+ * (`authorize()` runs before every execution since 12.3.0, on the arguments after the PreToolUse hooks).
  */
 export interface IAiHook {
   /** Unique hook name (for diagnostics and deterministic ordering). */

package/src/core/modules/ai/interfaces/ai-tool.interface.ts

@@ -12,7 +12,13 @@ export interface AiToolContext {
   /** Authenticated user (shortcut for `serviceOptions.currentUser`). */
   currentUser?: { [key: string]: any; id: string; roles?: string[] };
 
-  /** Accept-Language of the original request. */
+  /**
+   * The decision {@link IAiTool.authorize} returned for THIS call, handed to `execute()` (12.3.0+). Lets a tool reuse
+   * what its check loaded (`data`) instead of loading it twice. Absent for a tool without `authorize()`.
+   */
+  authorization?: AiToolAuthorization;
+
+  /** Accept-Language of the original request. Absent over MCP, which carries no request language. */
   language?: string;
 
   /**
@@ -26,10 +32,19 @@ export interface AiToolContext {
  * Result of a tool's pre-flight authorization check ({@link IAiTool.authorize}).
  */
 export interface AiToolAuthorization {
-  /** Whether the user may run the tool with these arguments. */
+  /** Whether the user may run the tool with these arguments. Only `true` allows; anything else refuses. */
   allowed: boolean;
 
-  /** Optional human-readable reason when not allowed. */
+  /**
+   * Whatever the check loaded and `execute()` may reuse (e.g. the record whose ownership it verified). Reaches
+   * `execute()` as `context.authorization.data`; never sent to the model or the client.
+   */
+  data?: unknown;
+
+  /**
+   * Optional reason when not allowed. It reaches the model (chat) or the MCP client, so it must not name anything
+   * the user may not know.
+   */
   reason?: string;
 }
 
@@ -69,21 +84,15 @@ export interface IAiTool {
 
   /**
    * Whether the tool performs a destructive/irreversible action (delete, bulk
-   * update, payment, …). In the CHAT orchestrator destructive tools always require
-   * confirmation: they are NOT executed until the prompt is re-sent with
-   * `confirm: true`; the first response lists them as `pendingActions` with
-   * `requiresConfirmation: true`.
+   * update, payment, …). Such a tool always needs the user's confirmation:
    *
-   * **No confirmation gate over MCP.** `CoreAiMcpService.mcpCallTool` consults
-   * neither this flag nor {@link IAiTool.mutating}, so a destructive tool invoked
-   * through `/ai/mcp` executes IMMEDIATELY, on the first call. This flag is
-   * therefore a chat-orchestrator contract, not a global execution barrier. The
-   * barriers that DO hold on every path are the registry role filter ({@link
-   * IAiTool.roles}, applied by `forUser()` before `execute()`) and the authorization
-   * inside `execute()` itself — so a destructive tool restricted to a real role stays
-   * unreachable by lesser-privileged MCP clients; MCP only skips the extra confirmation
-   * step for clients that may already see the tool. Expose MCP only to clients you trust
-   * to obtain user consent themselves.
+   * - **Chat:** it is NOT executed until the prompt is re-sent with `confirm: true`;
+   *   the first response lists it as `pendingActions` with `requiresConfirmation: true`.
+   * - **MCP (12.3.0+):** `tools/call` asks the user through MCP elicitation and runs the
+   *   tool only after they accepted. A client that cannot ask (no `elicitation`
+   *   capability) gets a refusal. Whether MCP asks is `ai.mcp.confirmation` (on by
+   *   default), which each user may switch for themselves unless it is enforced;
+   *   `tools/list` marks the tool with `destructiveHint: true`.
    */
   readonly destructive?: boolean;
 
@@ -93,22 +102,25 @@ export interface IAiTool {
    * optionally client-overridable, optionally enforced). `destructive` is the
    * stronger flag and always requires confirmation regardless of policy.
    *
-   * Same MCP caveat as {@link IAiTool.destructive}: the confirmation policy is not
-   * evaluated on the `/ai/mcp` path at all.
+   * Over MCP (12.3.0+) the same policy applies through elicitation, with the
+   * policy's `default` in place of the chat client's `requireConfirmation`.
    */
   readonly mutating?: boolean;
 
   /**
-   * Optional pre-flight authorization check. MUST NOT mutate anything — it only
+   * Optional authorization check for one call. MUST NOT mutate anything — it only
    * decides whether the user may run the tool with these arguments (e.g. load the
    * target record and verify ownership).
    *
-   * **Runs in PLAN MODE ONLY.** Auto mode (the default, `ai.defaultMode`) and the
-   * MCP endpoint call {@link IAiTool.execute} directly, without consulting this
-   * method. A data-level check placed ONLY here therefore does not run for most
-   * callers — put ownership and tenant checks INSIDE `execute()`, routed through
-   * `CrudService` with `context.serviceOptions`, and treat `authorize()` as the
-   * plan-mode pre-flight that lets a whole plan be rejected before any step runs.
+   * **Runs before every execution (12.3.0+)**: in auto mode, in plan mode (once for
+   * the whole plan before any step runs, and again before each step) and over MCP. It
+   * sees the arguments that will be executed, i.e. after the PreToolUse hooks. A refusal,
+   * a thrown error or an `allowed` that is not `true` skips the call. Return `data` to
+   * hand what the check loaded to `execute()` (`context.authorization.data`).
+   *
+   * Still route the data access in `execute()` through `CrudService` with
+   * `context.serviceOptions`: `authorize()` decides whether to try, the service decides
+   * what the user may read and write.
    *
    * When omitted, only the registry role filter applies.
    */

package/src/core/modules/ai/models/core-ai-mode.model.ts

@@ -19,7 +19,7 @@ export type AiModeDocument = CoreAiMode & Document;
  * domain-specialized assistants without forking the orchestrator. Like every
  * other ai layer, modes can only ADD restrictions; they cannot relax the
  * permission model (`@Restricted` / `@Roles` / `securityCheck()` still apply;
- * `authorize()` only in plan mode).
+ * `authorize()` before every execution).
  */
 @MongooseSchema({ collection: 'aiModes', timestamps: true })
 @ObjectType({ description: 'Named agent mode' })

package/src/core/modules/ai/models/core-ai-settings.model.ts

@@ -0,0 +1,23 @@
+import { Field, ObjectType } from '@nestjs/graphql';
+
+import { Restricted } from '../../../common/decorators/restricted.decorator.js';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+
+/**
+ * The current user's AI settings as they take effect (12.3.0+): the user's own choice where the server allows one,
+ * else the server configuration. Answer of `GET/PUT /ai/settings`, `aiSettings` and `updateAiSettings`.
+ */
+@ObjectType({ description: "The current user's effective AI settings" })
+@Restricted(RoleEnum.S_EVERYONE)
+export class CoreAiSettings {
+  /**
+   * Whether MCP asks this user before a tool that needs confirmation (`destructive`, or `mutating` under
+   * `ai.confirmation.mutating`). `false` works like a "bypass permissions" mode for this user's MCP clients.
+   */
+  @Field(() => Boolean, { description: 'Whether MCP asks before a tool that needs confirmation' })
+  mcpConfirmation: boolean;
+
+  /** Whether the server fixed {@link mcpConfirmation} (`ai.mcp.confirmation.enforced`), so the user cannot change it. */
+  @Field(() => Boolean, { description: 'Whether the server fixed mcpConfirmation, so it cannot be changed' })
+  mcpConfirmationEnforced: boolean;
+}

package/src/core/modules/ai/models/core-ai-tool-policy.model.ts

@@ -51,7 +51,7 @@ export class CoreAiToolPolicyRule {
  * `user`. A more specific scope wins over a more generic one. Hints only ever
  * tighten or relax the confirmation gate; the underlying permission model
  * (`@Restricted`, `@Roles`, `securityCheck()`) is enforced regardless;
- * `authorize()` adds to that in plan mode only.
+ * `authorize()` adds to that before every execution. Rules apply in the chat and over MCP (12.3.0+).
  */
 @MongooseSchema({ collection: 'aiToolPolicies', timestamps: true })
 @ObjectType({ description: 'Admin-editable scoped policy for a tool call' })

package/src/core/modules/ai/models/core-ai-user-setting.model.ts

@@ -0,0 +1,46 @@
+import { ObjectType } from '@nestjs/graphql';
+import { Schema as MongooseSchema, SchemaFactory } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Document } from 'mongoose';
+
+import { Restricted } from '../../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { CorePersistenceModel } from '../../../common/models/core-persistence.model.js';
+
+export type AiUserSettingDocument = CoreAiUserSetting & Document;
+
+/**
+ * Personal AI settings of one user (12.3.0+), one record per user. Only what the user chose is stored; an unset
+ * field follows the server configuration.
+ *
+ * Users read and change their own settings through `GET/PUT /ai/settings` and the `aiSettings` /
+ * `updateAiSettings` operations, which answer with {@link CoreAiSettings} (the effective values), never with this
+ * record — hence admin-only here.
+ */
+@MongooseSchema({ collection: 'aiUserSettings', timestamps: true })
+@ObjectType({ description: 'Personal AI settings of one user' })
+@Restricted(RoleEnum.ADMIN)
+export class CoreAiUserSetting extends CorePersistenceModel {
+  /**
+   * Whether MCP asks this user before a tool that needs confirmation. Unset follows `ai.mcp.confirmation`; ignored
+   * while that is `enforced`.
+   */
+  @UnifiedField({
+    description: 'Whether MCP asks this user before a tool that needs confirmation (unset = server default)',
+    isOptional: true,
+    mongoose: true,
+    roles: RoleEnum.ADMIN,
+    type: () => Boolean,
+  })
+  mcpConfirmation?: boolean = undefined;
+
+  /** The user the settings belong to. */
+  @UnifiedField({
+    description: 'The user the settings belong to',
+    mongoose: { unique: true },
+    roles: RoleEnum.ADMIN,
+  })
+  userId: string = undefined;
+}
+
+export const AiUserSettingSchema = SchemaFactory.createForClass(CoreAiUserSetting);

package/src/core/modules/ai/services/core-ai-conversation.service.ts

@@ -1,4 +1,4 @@
-import { Inject, Injectable } from '@nestjs/common';
+import { Inject, Injectable, Logger } from '@nestjs/common';
 import { InjectConnection, InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
 import type { Connection, Model } from 'mongoose';
 
@@ -41,6 +41,8 @@ export class CoreAiConversationService extends CrudService<
   CoreAiConversationCreateInput,
   CoreAiConversationInput
 > {
+  protected readonly logger = new Logger(CoreAiConversationService.name);
+
   /** Maximum number of messages retained per conversation (capped on `$push`). */
   protected readonly maxRetainedMessages = 500;
 
@@ -155,12 +157,35 @@ export class CoreAiConversationService extends CrudService<
   }
 
   /**
-   * Append a message to a conversation via `$push` (system-internal; the user
-   * already authorized the prompt that produced it). The array is capped at
-   * {@link maxRetainedMessages} via `$slice` so a long-lived conversation cannot
-   * grow unbounded.
+   * Whether the conversation exists and was created by `userId`. Admins are not owners: they may READ any
+   * conversation (`securityCheck`), but a prompt only ever continues the caller's own one, because its turns
+   * become part of that conversation's next runs.
    */
-  async appendMessage(id: string, message: { content: string; createdAt?: Date; role: string }): Promise<void> {
+  async isOwnedBy(id: string, userId: string | undefined): Promise<boolean> {
+    if (!isWellFormedId(id) || !isWellFormedId(userId)) {
+      return false;
+    }
+    return !!(await this.dataStore.findOne({ createdBy: userId, id }, { select: ['id'] }));
+  }
+
+  /**
+   * Append a message to the conversation of `ownerId` via `$push` (system-internal; the user already authorized
+   * the prompt that produced it). Writes nothing unless `ownerId` created the conversation: a conversation's turns
+   * feed its owner's next runs, in which tools act with the owner's rights, so a write on anybody else's behalf
+   * would plant prompt input into another user's assistant. The check sits here rather than in each caller so that
+   * no caller can leave it out. `createdBy` is never changed after creation, so nothing can happen between the
+   * check and the push that would make the write foreign. The array is capped at {@link maxRetainedMessages} via
+   * `$slice` so a long-lived conversation cannot grow unbounded.
+   */
+  async appendMessage(
+    id: string,
+    message: { content: string; createdAt?: Date; role: string },
+    ownerId: string | undefined,
+  ): Promise<void> {
+    if (!(await this.isOwnedBy(id, ownerId))) {
+      this.logger.warn(`Message not appended: conversation ${id} is not owned by user ${ownerId ?? '(none)'}`);
+      return;
+    }
     await this.dataStore.pushToArray(id, 'messages', [{ ...message, createdAt: message.createdAt ?? new Date() }], {
       slice: -this.maxRetainedMessages,
     });

package/src/core/modules/ai/services/core-ai-mcp-oauth.service.ts

@@ -597,8 +597,10 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
    * - signed in, GET → the consent view: which client, where the code goes, Allow / Deny, with a
    *   CSRF token bound to user, client, redirect URI and PKCE challenge.
    * - signed in, POST with Allow and a valid token → the code is issued, the browser goes to
-   *   `redirect_uri?code=…&state=…`. Deny → `access_denied`. A stale token shows the form again; a
-   *   foreign or tampered one too, and issues nothing.
+   *   `redirect_uri?code=…&state=…`. Deny with a valid token → `access_denied`. A stale token shows the
+   *   form again; a foreign or tampered one too, and decides nothing.
+   * - an error before this method runs (a malformed request) is answered with 400, never sent to the
+   *   client's redirect URI — `mountAiMcpOAuthRouter()` guards `/authorize` (RFC 9700 §4.11.2).
    *
    * The signed-in user is whoever the Better-Auth middleware put on the request (session cookie or
    * bearer). An API token never gets here — `buildOAuthProvider().authorize` refuses it first — and a
@@ -615,20 +617,21 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
     const user = await this.consentUser(req);
     const decision = req?.method === 'POST' ? req.body?.[MCP_OAUTH_CONSENT_DECISION_FIELD] : undefined;
 
-    if (user && decision === 'deny') {
-      const { AccessDeniedError } = await this.loadOAuthErrors();
-      throw new AccessDeniedError('The user denied access');
-    }
-
     let notice: IMcpOAuthConsentView['notice'];
-    if (user && decision === 'approve') {
+    if (user && (decision === 'approve' || decision === 'deny')) {
       const binding: IAiMcpOAuthConsentBinding = {
         clientId: String(client.client_id),
         codeChallenge: String(params.codeChallenge),
         redirectUri: String(params.redirectUri),
         userId: user.id,
       };
+      // Deny needs the token as Allow does: it sends the browser to the client's redirect URI, and without the token a
+      // cross-site POST could do that for a signed-in user whose session cookie is `SameSite=None`
       const verdict = this.verifyConsentToken(req.body?.[MCP_OAUTH_CONSENT_TOKEN_FIELD], binding);
+      if (verdict === 'valid' && decision === 'deny') {
+        const { AccessDeniedError } = await this.loadOAuthErrors();
+        throw new AccessDeniedError('The user denied access');
+      }
       if (verdict === 'valid') {
         const code = this.generateId();
         await this.saveAuthorizationCode(code, {
@@ -649,7 +652,7 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
       } else {
         this.logger.warn(
           `MCP OAuth consent for client ${binding.clientId} carried an invalid token (forged, tampered, or from ` +
-            'another session); no code issued, the form is shown again.',
+            'another session); neither approved nor denied, the form is shown again.',
         );
       }
     }