jubnl dd90c6d424 fix(mcp): add RFC 9728 PRM, RFC 8707 audience binding, and collab sub-feature gating ... Root cause: claude.ai's MCP connector (spec 2025-06-18) requires the resource server to publish Protected Resource Metadata and return WWW-Authenticate on 401s to bind the /mcp endpoint to its AS. Without these, it silently shows no tools after OAuth. - Add /.well-known/oauth-protected-resource (RFC 9728) with addon gating - Emit WWW-Authenticate: Bearer resource_metadata=... on 401/auth-failure 403s - Open CORS (origin: *) on both .well-known/* endpoints per RFC 8414/9728 - Accept resource parameter at authorize + token endpoints (RFC 8707) - Store audience on oauth_tokens; validate on every MCP request - Refresh tokens inherit audience; add resource_parameter_supported to AS metadata - DB migration: ADD COLUMN audience TEXT to oauth_tokens - Gate collab MCP tools/resources by chat/notes/polls sub-features individually - Invalidate MCP sessions when collab sub-features are toggled in admin - Update test mocks and MCP.md		2026-04-20 07:34:38 +02:00
..
fixtures	feat(import): selective GPX/KML element import and performance improvements	2026-04-18 01:28:37 +02:00
helpers	feat(notices): add system notice infrastructure	2026-04-16 14:36:33 +02:00
integration	fix: skip FORCE_HTTPS redirect for /api/health endpoint	2026-04-19 14:10:41 +02:00
unit	fix(mcp): add RFC 9728 PRM, RFC 8707 audience binding, and collab sub-feature gating	2026-04-20 07:34:38 +02:00
websocket	test: expand test suite to 87.3% backend coverage	2026-04-06 20:08:30 +02:00
setup.ts	Add comprehensive backend test suite (#339)	2026-04-03 13:17:53 +02:00