Feature/mcp bearer token auth - #645

Merged

jonthorarna merged 44 commits into

mainfrom

feature/mcp-bearer-token-auth-2

Jun 1, 2026

Commits on May 28, 2026

feat(ai): add ai chat database schema and migrations
jonthorarna
committed
ad7b8d0
design: scorebrawl MCP server spec
jonthorarna
committed
33a5224
plan: scorebrawl MCP server implementation plan
jonthorarna
committed
8f0c2e0
feat: add MCP router to worker
jonthorarna
committed
4684d5c
test: add MCP router integration tests
jonthorarna
committed
701b4fb
feat: add MCP login page
jonthorarna
committed
6303f17
feat: add MCP CLI package
jonthorarna
committed
563c63b
chore: MCP server implementation complete
jonthorarna
committed
ed5fe15
feat: support SCOREBRAWL_API_URL env var for local testing
jonthorarna
committed
29960fd
fix: correct production API base URL to scorebrawl.com/api
jonthorarna
committed
51becaf
fix: store root domain as base URL, always prepend /api to MCP endpoint
jonthorarna
committed
e5fed40
feat: add install command for agent harness auto-configuration
jonthorarna
committed
60b176c
feat(mcp): add mcp_auth_code and mcp_token tables
jonthorarna
committed
7b77a04
feat(mcp): add token + auth-code helpers
jonthorarna
committed
67842a5
feat(mcp): add authorize/exchange endpoints
jonthorarna
committed
02913cd
feat(mcp): bearer-token auth middleware
jonthorarna
committed
6d73176
feat(mcp): require bearer tokens for /api/mcp
jonthorarna
committed
48f7162
feat(mcp): mint exchange code on Authorize click
jonthorarna
committed
d0b672f
feat(mcp): exchange callback code for a stored token
jonthorarna
committed
de2c1f5
feat(mcp): send bearer token to /api/mcp
jonthorarna
committed
59a5da1
fix(mcp): auto-disable TLS verification for localhost URLs
jonthorarna
committed
bad5966
fix(mcp): fall through to file fallback when keytar returns null
jonthorarna
committed
a397a97
refactor(mcp): remove keytar, use file-only token storage
jonthorarna
committed
aa81767
chore: remove AI chat UI and services, keep MCP auth flow
jonthorarna
committed
25da1e0
fix(mcp): validate callback URL is localhost before redirecting
jonthorarna
committed
7a616d2
fix(mcp): atomic auth code consume to prevent double-spend
jonthorarna
committed
b77b814
fix(mcp): sanitize SQL join ON clauses and bind query params
jonthorarna
committed
caae9a4
fix(mcp): fix tool name mismatch and exclude render_chart from MCP tools/list
jonthorarna
committed
1086fdb
fix(mcp): add leagueId filter to prevent cross-tenant data access
jonthorarna
committed
0e0144e
fix(mcp): fix p1Name fallback, body parse error, empty inArray guard
jonthorarna
committed
b7de25b
perf(mcp): merge auth middleware queries and parallelize getLeagueRecords
jonthorarna
committed
951e367
feat(mcp): add 90-day token expiration
jonthorarna
committed
0a3df9c
fix(mcp): address code review - security, conventions, and quality issues
jonthorarna
committed
223e2d7
fix(mcp): use import.meta.url for local path in install --local
jonthorarna
committed
396d2be
chore: remove ai-chat schema and migrations from mcp branch
jonthorarna
committed
01c5dab
feat(auth): add bearer and deviceAuthorization plugins to better-auth
jonthorarna
committed
20fcd3e
refactor(mcp): remove custom auth, use better-auth bearer sessions
jonthorarna
committed
cbc1790
feat(mcp): rewrite CLI auth to use better-auth device flow
jonthorarna
committed
03e061d
feat(web): add /device page for MCP device authorization
jonthorarna
committed
f8152ec
test(mcp): remove stale mcp-auth tests, rewrite mcp-router tests for bearer session auth
jonthorarna
committed
525bd64
fix(web): fix device page league selector placeholder and state reset on setActive
jonthorarna
committed
d183ca2
fix(mcp): load accessToken from config file even when SCOREBRAWL_API_URL env is set
jonthorarna
committed
dc20d75
chore: cleanup PR — remove dead code, revert unrelated changes, remove comments
jonthorarna
committed
df2146d
fix(mcp): address PR review — N+1 queries, SQL injection, device auth tests
jonthorarna
committed
3e74118