[Refactor] Give inbound MCP authentication one request-scoped owner

apps/api/src/handlers/mcp/models.ts

@@ -18,7 +18,7 @@ const cursorSchema = z
 export async function listMemberModels(c: Context<{ Variables: Variables }>) {
   c.header('Cache-Control', 'no-store, private');
   try {
-    await resolveRoomoteMemberAuth(c.get('authContext'));
+    await resolveRoomoteMemberAuth(c);
   } catch (error) {
     if (error instanceof McpProxyError)
       return Response.json(

apps/api/src/handlers/mcp/roomote-member-auth.ts

@@ -1,16 +1,23 @@
-import { getRoomoteMcpResourceUrl, ROOMOTE_MCP_SCOPE } from '@roomote/auth';
+import type { Context } from 'hono';
+import {
+  getLegacyRoomoteMcpResourceUrl,
+  getRoomoteMcpResourceUrl,
+  ROOMOTE_MCP_SCOPE,
+} from '@roomote/auth';
 import { Env } from '@roomote/env';
-import { isMcpOAuthGrantLive } from '@roomote/redis';
 import { isUserToken, PRODUCT_NAME } from '@roomote/types';
 
 import type { Variables } from '../../types';
+import { getRequestAuth } from '../../middleware/tokenAuthMiddleware';
 import type { McpAuth } from './middleware';
 import { McpProxyError } from './proxy-utils';
 
 /** Public member reads and downloads share the /mcp credential boundary. */
 export async function resolveRoomoteMemberAuth(
-  auth: Variables['authContext'],
+  c: Context<{ Variables: Variables }>,
+  options: { allowLegacyAudience?: boolean } = {},
 ): Promise<McpAuth & { userId: string }> {
+  const auth = c.get('authContext');
   if (!auth) throw new McpProxyError(401, 'Authentication required');
   if (auth.tokenType === 'run') {
     throw new McpProxyError(
@@ -19,23 +26,20 @@ export async function resolveRoomoteMemberAuth(
     );
   }
   if (isUserToken(auth)) return { userId: auth.userId, authContext: auth };
+  // Internal in-process calls retain user/run semantics, but an OAuth object
+  // alone is not proof of live-grant authentication for this HTTP request.
+  if (getRequestAuth(c) !== auth)
+    throw new McpProxyError(401, 'Authentication required');
   if (
     auth.tokenType === 'mcp' &&
-    auth.resource ===
-      getRoomoteMcpResourceUrl(Env.R_PUBLIC_URL ?? Env.R_APP_URL) &&
+    [
+      getRoomoteMcpResourceUrl(Env.R_PUBLIC_URL ?? Env.R_APP_URL),
+      ...(options.allowLegacyAudience
+        ? [getLegacyRoomoteMcpResourceUrl(Env.TRPC_URL)]
+        : []),
+    ].includes(auth.resource) &&
     auth.scopes.includes(ROOMOTE_MCP_SCOPE)
   ) {
-    let live = false;
-    try {
-      live = await isMcpOAuthGrantLive(auth);
-    } catch {
-      /* Fail closed. */
-    }
-    if (!live)
-      throw new McpProxyError(
-        401,
-        'MCP authorization expired or revoked; reconnect your client',
-      );
     return {
       userId: auth.userId,
       authContext: {