philihp / kennerspiel / 27411134570

96%

push

github

MCP server: OAuth 2.1 per-user authorization (replaces static bearer token) (#1740)

The MCP server now identifies its caller via OAuth 2.1 instead of a single
shared MCP_AUTH_TOKEN. Each Claude.ai user authorizes with their existing
Supabase account and the MCP tools act as that user, removing the need for
AGENT_PROFILE_ID.

- supabase: oauth_authorization_code and oauth_access_token tables
- web: /.well-known/oauth-authorization-server and oauth-protected-resource
- web: /oauth/authorize consent page (Supabase-gated) and /oauth/token
- web: account/login supports ?next= so the OAuth flow can resume after sign-in
- web: MCP verifyToken now looks up the access token in the DB and threads the
  user id through to listMyGames/getGame/getLegalMoves/makeMove

New env vars: OAUTH_ISSUER, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET,
OAUTH_REDIRECT_URIS. AGENT_PROFILE_ID and MCP_AUTH_TOKEN are no longer used.

Also unblocks the pre-commit hook for Next 16 by migrating the legacy
.eslintrc to a flat eslint.config.mjs, pinning eslint to 9.x (eslint-config-next
16 / eslint-plugin-react do not yet support eslint 10), and pointing
lint-staged at eslint directly instead of the removed \`next lint --fix\`.

https://claude.ai/code/session_01BMeHWGVWwn2E47t7cYp3uu

Co-authored-by: Claude <noreply@anthropic.com>

1311 of 1501 branches covered (87.34%)

Branch coverage included in aggregate %.

3505 of 3506 relevant lines covered (99.97%)

707.13 hits per line