[Feat] Connect OAuth clients to Roomote member tools

apps/api/src/handlers/index.ts

@@ -22,6 +22,7 @@ export { trpc } from './trpc';
 // mcp
 export { mcp } from './mcp';
 export { mcpRouting } from './mcp/routing';
+export { mcpOAuthMetadata } from './mcp-oauth';
 
 // inference gateway
 export { inference } from './inference';

apps/api/src/handlers/mcp-oauth.ts

@@ -0,0 +1,23 @@
+import { Hono } from 'hono';
+
+import { getRoomoteMcpResourceUrl, ROOMOTE_MCP_SCOPE } from '@roomote/auth';
+import { Env } from '@roomote/env';
+
+import type { Variables } from '../types';
+
+const ROOMOTE_MCP_PROTECTED_RESOURCE_METADATA_PATH =
+  '/.well-known/oauth-protected-resource/api/mcp-routing/roomote';
+
+export const mcpOAuthMetadata = new Hono<{ Variables: Variables }>();
+
+mcpOAuthMetadata.get(ROOMOTE_MCP_PROTECTED_RESOURCE_METADATA_PATH, (c) => {
+  const authorizationServer = Env.R_PUBLIC_URL ?? Env.R_APP_URL;
+
+  c.header('Cache-Control', 'public, max-age=3600');
+  return c.json({
+    resource: getRoomoteMcpResourceUrl(Env.TRPC_URL),
+    authorization_servers: [new URL(authorizationServer).origin],
+    bearer_methods_supported: ['header'],
+    scopes_supported: [ROOMOTE_MCP_SCOPE],
+  });
+});

apps/api/src/handlers/mcp/roomote.ts

@@ -109,6 +109,18 @@ async function resolveRoomoteMcpAuth(
     };
   }
 
+  if (
+    authContext.tokenType === 'mcp' &&
+    authContext.resource ===
+      new URL('/api/mcp-routing/roomote', Env.TRPC_URL).toString() &&
+    authContext.scopes.includes('mcp:roomote')
+  ) {
+    return {
+      userId: authContext.userId,
+      tokenType: 'auth',
+    };
+  }
+
   throw new McpProxyError(
     403,
     `${PRODUCT_NAME} MCP requires a user-scoped auth token or task run token`,

apps/api/src/middleware/routePolicyMiddleware.ts

@@ -3,7 +3,7 @@ import { createHash } from 'node:crypto';
 import type { Context } from 'hono';
 import { createMiddleware } from 'hono/factory';
 
-import type { RunTokenContext } from '@roomote/types';
+import type { McpAccessTokenContext, RunTokenContext } from '@roomote/types';
 import { getRedis } from '@roomote/redis';
 
 import type { Variables } from '../types';
@@ -40,6 +40,12 @@ function isRunTokenContext(
   return Boolean(auth && 'runId' in auth);
 }
 
+function isMcpTokenContext(
+  auth: Variables['authContext'],
+): auth is McpAccessTokenContext {
+  return auth?.tokenType === 'mcp';
+}
+
 /**
  * Pure policy evaluation: given a route's declared policy class and the
  * request's validated auth context, decide whether the request may proceed.
@@ -61,6 +67,14 @@ export function evaluateRoutePolicy(
       // in `server.ts` (outside development).
       return undefined;
     case 'authenticated':
+      if (!authContext) {
+        return { status: 401, body: { error: 'authentication_required' } };
+      }
+      if (isMcpTokenContext(authContext)) {
+        return { status: 403, body: { error: 'mcp_token_not_allowed' } };
+      }
+      return undefined;
+    case 'roomote-mcp':
       if (!authContext) {
         return { status: 401, body: { error: 'authentication_required' } };
       }
@@ -69,7 +83,7 @@ export function evaluateRoutePolicy(
       if (!authContext) {
         return { status: 401, body: { error: 'authentication_required' } };
       }
-      if (isRunTokenContext(authContext)) {
+      if (authContext.tokenType !== 'auth') {
         return { status: 403, body: { error: 'user_token_required' } };
       }
       return undefined;
@@ -89,6 +103,17 @@ function rejectionResponse(
   rule: RoutePolicyRule,
   rejection: RoutePolicyRejection,
 ): Response {
+  if (rule.name === 'roomote-mcp' && rejection.status === 401) {
+    const resourceMetadata = new URL(
+      '/.well-known/oauth-protected-resource/api/mcp-routing/roomote',
+      c.req.url,
+    );
+    c.header(
+      'WWW-Authenticate',
+      `Bearer resource_metadata="${resourceMetadata.toString()}"`,
+    );
+  }
+
   if (rule.errorFormat === 'json-rpc') {
     // Match the JSON-RPC error envelope the MCP handlers emit themselves
     // (see `handlers/mcp/proxy-utils.ts`) so Streamable HTTP clients that

apps/api/src/middleware/tokenAuthMiddleware.ts

@@ -1,7 +1,11 @@
 import type { Context, Next } from 'hono';
 import { createMiddleware } from 'hono/factory';
 
-import { validateRunToken, validateAuthToken } from '@roomote/auth';
+import {
+  validateAuthToken,
+  validateMcpAccessToken,
+  validateRunToken,
+} from '@roomote/auth';
 import { db, deploymentSettings, eq, users } from '@roomote/db/server';
 import { isRoomoteDeploymentDisabled } from '@roomote/types';
 
@@ -71,23 +75,43 @@ export const tokenAuthMiddleware = () =>
         return;
       }
 
+      let userScopedAuth:
+        | Awaited<ReturnType<typeof validateMcpAccessToken>>
+        | Awaited<ReturnType<typeof validateAuthToken>>
+        | undefined;
+
       try {
-        const authContext = await validateAuthToken(token);
-        if (await deploymentAllowsTokenAuth()) {
+        userScopedAuth = await validateMcpAccessToken(token);
+      } catch {
+        // Not an MCP OAuth token, try the internal user auth token below.
+      }
+
+      try {
+        userScopedAuth ??= await validateAuthToken(token);
+      } catch (error) {
+        if (!userScopedAuth) {
+          console.error(
+            `Failed to validate token: ${error instanceof Error ? error.message : String(error)}`,
+          );
+        }
+      }
+
+      if (userScopedAuth && (await deploymentAllowsTokenAuth())) {
+        try {
           const user = await db.query.users.findFirst({
-            where: eq(users.id, authContext.userId),
+            where: eq(users.id, userScopedAuth.userId),
             columns: { id: true, deletedAt: true },
           });
 
           // Removed users keep no standing access: their API tokens die with them.
           if (user && user.deletedAt == null) {
-            c.set('authContext', authContext);
+            c.set('authContext', userScopedAuth);
           }
+        } catch (error) {
+          console.error(
+            `Failed to resolve token user: ${error instanceof Error ? error.message : String(error)}`,
+          );
         }
-      } catch (error) {
-        console.error(
-          `Failed to validate token: ${error instanceof Error ? error.message : String(error)}`,
-        );
       }
     }