[Feat] Add inbound MCP client access management and revocation

.changeset/inbound-mcp-authorizations.md

@@ -0,0 +1,7 @@
+---
+'@roomote/web': major
+---
+
+Manage inbound MCP client authorizations from personal settings and, for admins, by user in users settings, including revoking all of a user's clients. Revocation now blocks already-issued OAuth access tokens on subsequent requests.
+
+**Breaking upgrade compatibility:** legacy already-issued MCP access tokens without client/grant identity are rejected with 401 once the new API enforcement is deployed. Deploy the new web token issuer and drain all old issuer instances **before** deploying API enforcement. Live legacy refresh sessions are automatically backfilled, and existing refresh tokens can obtain tracked access tokens while preserving the original remaining session lifetime. Clients without a usable refresh session, or unable to recover by refreshing after a 401, must reconnect and repeat browser consent. In-progress legacy authorization codes must repeat consent too. Redis authorization data must remain available; missing data cannot be backfilled. Rolling back the API removes prompt revocation enforcement, and rolling back the issuer may require reconnecting migrated clients.

.github/workflows/CI.yml

@@ -181,6 +181,9 @@ jobs:
         run: pnpm --filter @roomote/db db:push:test --force
         env:
           DATABASE_URL: postgres://postgres:password@localhost:5432/test
+      - name: Install isolated OAuth lifecycle test dependency
+        # Disposable Unix-socket servers keep Lua lifecycle tests isolated.
+        run: command -v redis-server || (sudo apt-get update && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y redis-server)
       - name: Run unit tests
         run: pnpm test:ci
         env:

apps/api/src/handlers/mcp/__tests__/oauth-fixture.ts

@@ -0,0 +1,28 @@
+import { randomUUID } from 'node:crypto';
+import {
+  createMcpOAuthCode,
+  getMcpOAuthCode,
+  exchangeMcpOAuthCode,
+  revokeMcpOAuthGrants,
+} from '@roomote/redis';
+
+const fixtureUsers = new Set<string>();
+afterAll(async () => {
+  for (const userId of fixtureUsers) await revokeMcpOAuthGrants(userId);
+});
+
+export async function oauthGrantFixture(userId: string, resource: string) {
+  fixtureUsers.add(userId);
+  const clientId = randomUUID();
+  const code = await createMcpOAuthCode({
+    userId,
+    clientId,
+    resource,
+    scopes: ['mcp:roomote'],
+    redirectUri: 'https://client.example/callback',
+    codeChallenge: 'fixture',
+  });
+  const grant = (await getMcpOAuthCode(code))!;
+  await exchangeMcpOAuthCode(code, grant, true);
+  return { clientId, grantId: grant.grantId };
+}

apps/api/src/handlers/mcp/models.ts

@@ -18,7 +18,7 @@ const cursorSchema = z
 export async function listMemberModels(c: Context<{ Variables: Variables }>) {
   c.header('Cache-Control', 'no-store, private');
   try {
-    resolveRoomoteMemberAuth(c.get('authContext'));
+    await resolveRoomoteMemberAuth(c.get('authContext'));
   } catch (error) {
     if (error instanceof McpProxyError)
       return Response.json(

apps/api/src/handlers/mcp/roomote-member-auth.ts

@@ -1,15 +1,16 @@
 import { getRoomoteMcpResourceUrl, ROOMOTE_MCP_SCOPE } from '@roomote/auth';
 import { Env } from '@roomote/env';
+import { isMcpOAuthGrantLive } from '@roomote/redis';
 import { isUserToken, PRODUCT_NAME } from '@roomote/types';
 
 import type { Variables } from '../../types';
 import type { McpAuth } from './middleware';
 import { McpProxyError } from './proxy-utils';
 
 /** Public member reads and downloads share the /mcp credential boundary. */
-export function resolveRoomoteMemberAuth(
+export async function resolveRoomoteMemberAuth(
   auth: Variables['authContext'],
-): McpAuth & { userId: string } {
+): Promise<McpAuth & { userId: string }> {
   if (!auth) throw new McpProxyError(401, 'Authentication required');
   if (auth.tokenType === 'run') {
     throw new McpProxyError(
@@ -24,6 +25,17 @@ export function resolveRoomoteMemberAuth(
       getRoomoteMcpResourceUrl(Env.R_PUBLIC_URL ?? Env.R_APP_URL) &&
     auth.scopes.includes(ROOMOTE_MCP_SCOPE)
   ) {
+    let live = false;
+    try {
+      live = await isMcpOAuthGrantLive(auth);
+    } catch {
+      /* Fail closed. */
+    }
+    if (!live)
+      throw new McpProxyError(
+        401,
+        'MCP authorization expired or revoked; reconnect your client',
+      );
     return {
       userId: auth.userId,
       authContext: {

apps/api/src/handlers/mcp/roomote.ts

@@ -106,7 +106,7 @@ async function resolveRoomoteMcpAuth(
   options: { allowLegacyAudience: boolean },
 ): Promise<McpAuthContext> {
   if (!options.allowLegacyAudience) {
-    const member = resolveRoomoteMemberAuth(authContext);
+    const member = await resolveRoomoteMemberAuth(authContext);
     return { userId: member.userId, tokenType: 'auth' };
   }
   if (!authContext) {
@@ -149,6 +149,10 @@ async function resolveRoomoteMcpAuth(
     ].includes(authContext.resource) &&
     authContext.scopes.includes(ROOMOTE_MCP_SCOPE)
   ) {
+    await resolveRoomoteMemberAuth({
+      ...authContext,
+      resource: getRoomoteMcpResourceUrl(Env.R_PUBLIC_URL ?? Env.R_APP_URL),
+    });
     return {
       userId: authContext.userId,
       tokenType: 'auth',