jubnl dd90c6d424 fix(mcp): add RFC 9728 PRM, RFC 8707 audience binding, and collab sub-feature gating ...

Root cause: claude.ai's MCP connector (spec 2025-06-18) requires the resource server
to publish Protected Resource Metadata and return WWW-Authenticate on 401s to bind
the /mcp endpoint to its AS. Without these, it silently shows no tools after OAuth.

- Add /.well-known/oauth-protected-resource (RFC 9728) with addon gating
- Emit WWW-Authenticate: Bearer resource_metadata=... on 401/auth-failure 403s
- Open CORS (origin: *) on both .well-known/* endpoints per RFC 8414/9728
- Accept resource parameter at authorize + token endpoints (RFC 8707)
- Store audience on oauth_tokens; validate on every MCP request
- Refresh tokens inherit audience; add resource_parameter_supported to AS metadata
- DB migration: ADD COLUMN audience TEXT to oauth_tokens
- Gate collab MCP tools/resources by chat/notes/polls sub-features individually
- Invalidate MCP sessions when collab sub-features are toggled in admin
- Update test mocks and MCP.md

2026-04-20 07:34:38 +02:00

..

resources.test.ts

refactor(mcp): replace direct DB access with service layer calls

2026-04-04 18:12:53 +02:00

scopes.test.ts

feat(mcp): granular OAuth scopes and per-client rate limiting

2026-04-11 02:06:32 +02:00

sessionManager.test.ts

test: add comprehensive coverage for OAuth scopes, MCP, and core services

2026-04-11 14:08:09 +02:00

tools-addon-gating.test.ts

fix(mcp): add RFC 9728 PRM, RFC 8707 audience binding, and collab sub-feature gating

2026-04-20 07:34:38 +02:00

tools-assignments-reservations-extra.test.ts

refactor(mcp): extract all MCP tools into dedicated modules and add shared helpers

2026-04-09 18:09:33 +02:00

tools-assignments.test.ts

refactor(mcp): replace direct DB access with service layer calls

2026-04-04 18:12:53 +02:00

tools-atlas-expanded.test.ts

fix(mcp): add RFC 9728 PRM, RFC 8707 audience binding, and collab sub-feature gating

2026-04-20 07:34:38 +02:00

tools-atlas.test.ts

refactor(mcp): replace direct DB access with service layer calls

2026-04-04 18:12:53 +02:00

tools-budget-advanced.test.ts

refactor(mcp): extract all MCP tools into dedicated modules and add shared helpers

2026-04-09 18:09:33 +02:00

tools-budget.test.ts

refactor(mcp): replace direct DB access with service layer calls

2026-04-04 18:12:53 +02:00

tools-collab-polls-chat.test.ts

fix(mcp): add RFC 9728 PRM, RFC 8707 audience binding, and collab sub-feature gating

2026-04-20 07:34:38 +02:00

tools-days-accommodations.test.ts

feat(mcp): granular OAuth scopes and per-client rate limiting

2026-04-11 02:06:32 +02:00

tools-days.test.ts

refactor(mcp): replace direct DB access with service layer calls

2026-04-04 18:12:53 +02:00

tools-notes.test.ts

refactor(mcp): replace direct DB access with service layer calls

2026-04-04 18:12:53 +02:00

tools-notifications.test.ts

fix(mcp): remove all file tools and remove ability to delete notifications

2026-04-09 18:17:31 +02:00

tools-packing-advanced.test.ts

refactor(mcp): extract all MCP tools into dedicated modules and add shared helpers

2026-04-09 18:09:33 +02:00

tools-packing.test.ts

refactor(mcp): replace direct DB access with service layer calls

2026-04-04 18:12:53 +02:00

tools-places.test.ts

feat(mcp): add list_places assignment filter for orphan activities

2026-04-09 12:45:09 +02:00

tools-prompts.test.ts

fix(mcp): add RFC 9728 PRM, RFC 8707 audience binding, and collab sub-feature gating

2026-04-20 07:34:38 +02:00

tools-reservations.test.ts

feat(mcp): align MCP surface with current app state

2026-04-19 16:03:32 +02:00

tools-tags-maps-weather.test.ts

refactor(mcp): extract all MCP tools into dedicated modules and add shared helpers

2026-04-09 18:09:33 +02:00

tools-todos.test.ts

refactor(mcp): extract all MCP tools into dedicated modules and add shared helpers

2026-04-09 18:09:33 +02:00

tools-trip-members.test.ts

refactor(mcp): extract all MCP tools into dedicated modules and add shared helpers

2026-04-09 18:09:33 +02:00

tools-trips.test.ts

test(mcp): add tests for OAuth 2.1, addon gating, and budget reorder

2026-04-09 23:12:59 +02:00

tools-vacay.test.ts

fix(mcp): add RFC 9728 PRM, RFC 8707 audience binding, and collab sub-feature gating

2026-04-20 07:34:38 +02:00