Merge pull request #271 from guillermoscript/feature/mcp

Feature/mcp

Author: guillermoscript

app/[locale]/oauth/mcp-authorize/mcp-consent-form.tsx

@@ -1,6 +1,6 @@
 "use client"
 
-import { useState } from "react"
+import { useState, useEffect } from "react"
 import { Button } from "@/components/ui/button"
 
 interface McpConsentFormProps {
@@ -11,32 +11,29 @@ interface McpConsentFormProps {
   mcpCallbackUrl: string
 }
 
-/**
- * Client component for MCP OAuth consent approve/deny buttons.
- *
- * On approve: POSTs to MCP server /auth/callback with user identity.
- * The MCP server then generates an auth code and redirects the browser
- * back to the MCP client (Claude Desktop).
- *
- * On deny: Redirects back to MCP client with error=access_denied.
- */
 export function McpConsentForm({
   sessionId,
   userId,
   userRole,
   tenantId,
   mcpCallbackUrl,
 }: McpConsentFormProps) {
-  const [loading, setLoading] = useState<"approve" | "deny" | null>(null)
+  const [state, setState] = useState<"idle" | "redirecting" | "success" | "denied" | "error">("idle")
   const [error, setError] = useState<string | null>(null)
 
-  const handleApprove = async () => {
-    setLoading("approve")
+  // After redirecting, show success state (the redirect may take a moment)
+  useEffect(() => {
+    if (state === "redirecting") {
+      const timer = setTimeout(() => setState("success"), 1500)
+      return () => clearTimeout(timer)
+    }
+  }, [state])
+
+  const handleApprove = () => {
+    setState("redirecting")
     setError(null)
 
     try {
-      // Redirect to MCP server callback via GET with query params
-      // The callback will generate an auth code and redirect back to Claude
       const url = new URL(mcpCallbackUrl)
       url.searchParams.set("session_id", sessionId)
       url.searchParams.set("user_id", userId)
@@ -45,19 +42,49 @@ export function McpConsentForm({
       window.location.href = url.toString()
     } catch (err) {
       setError(err instanceof Error ? err.message : "Failed to authorize")
-      setLoading(null)
+      setState("error")
     }
   }
 
   const handleDeny = () => {
-    setLoading("deny")
-    // Close the window or show denied message
+    setState("denied")
     window.close()
-    // If window.close() doesn't work (not opened by script), show message
-    setTimeout(() => {
-      setLoading(null)
-      setError("Authorization denied. You can close this window.")
-    }, 500)
+  }
+
+  if (state === "success") {
+    return (
+      <div className="space-y-4 text-center">
+        <div className="mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-green-100 dark:bg-green-900/30">
+          <svg className="h-6 w-6 text-green-600 dark:text-green-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+            <path strokeLinecap="round" strokeLinejoin="round" d="M5 13l4 4L19 7" />
+          </svg>
+        </div>
+        <div>
+          <p className="font-medium">Authorization complete</p>
+          <p className="mt-1 text-sm text-muted-foreground">
+            You can close this window and return to Claude Desktop.
+          </p>
+        </div>
+      </div>
+    )
+  }
+
+  if (state === "denied") {
+    return (
+      <div className="space-y-4 text-center">
+        <div className="mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-muted">
+          <svg className="h-6 w-6 text-muted-foreground" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+            <path strokeLinecap="round" strokeLinejoin="round" d="M6 18L18 6M6 6l12 12" />
+          </svg>
+        </div>
+        <div>
+          <p className="font-medium">Authorization denied</p>
+          <p className="mt-1 text-sm text-muted-foreground">
+            You can close this window.
+          </p>
+        </div>
+      </div>
+    )
   }
 
   return (
@@ -70,19 +97,19 @@ export function McpConsentForm({
 
       <Button
         onClick={handleApprove}
-        disabled={loading !== null}
+        disabled={state === "redirecting"}
         className="w-full"
       >
-        {loading === "approve" ? "Authorizing..." : "Approve"}
+        {state === "redirecting" ? "Authorizing..." : "Approve"}
       </Button>
 
       <Button
         onClick={handleDeny}
-        disabled={loading !== null}
+        disabled={state === "redirecting"}
         variant="outline"
         className="w-full"
       >
-        {loading === "deny" ? "Denying..." : "Deny"}
+        Deny
       </Button>
     </div>
   )

app/api/mcp/[[...path]]/route.ts

@@ -38,7 +38,7 @@ function getOrigin(request: NextRequest): string {
 
 function getSubpath(request: NextRequest): string {
   const path = new URL(request.url).pathname;
-  return path.replace(/^\/api\/mcp/, '') || '/';
+  return path.replace(/^\/api\/mcp/, '') || '/mcp';
 }
 
 // ─── OAuth Metadata (served directly by proxy, tenant-aware) ───────────────

mcp-server/src/http-server-oauth.ts

@@ -288,7 +288,8 @@ app.get("/auth/callback", (req, res) => {
 });
 
 // MCP endpoint (protected by OAuth bearer token)
-app.post("/mcp", bearerAuth, async (req, res) => {
+// Handle both /mcp and / (the proxy strips /api/mcp prefix, leaving "/" for the root path)
+app.post(["/mcp", "/"], bearerAuth, async (req, res) => {
   const authInfo = req.auth!;
   const userContext: UserContext = {
     userId: authInfo.extra?.userId as string,

mcp-server/src/tools/exams.ts

@@ -153,6 +153,7 @@ export function registerExamTools(server: McpServer, auth: AuthManager) {
             )`
           )
           .eq("exam_id", exam_id)
+          .order("question_id", { referencedTable: "exam_questions" })
           .single();
 
         if (error || !data) return errorResult(`Exam ${exam_id} not found.`);
@@ -294,6 +295,11 @@ export function registerExamTools(server: McpServer, auth: AuthManager) {
 
         for (let i = 0; i < questions.length; i++) {
           const q = questions[i];
+          if ((q.question_type === "multiple_choice" || q.question_type === "true_false") && (!q.options || q.options.length === 0)) {
+            errors.push(`Q${i + 1}: type '${q.question_type}' requires at least one option`);
+            continue;
+          }
+
           const { data: question, error: qError } = await supabase
             .from("exam_questions")
             .insert({
@@ -446,6 +452,10 @@ export function registerExamTools(server: McpServer, auth: AuthManager) {
     },
     async ({ exam_id, question_text, question_type, options, ai_grading_criteria, expected_keywords }) => {
       try {
+        if ((question_type === "multiple_choice" || question_type === "true_false") && (!options || options.length === 0)) {
+          return errorResult(`Questions of type '${question_type}' require at least one option.`);
+        }
+
         await auth.verifyExamOwnership(exam_id);
         const supabase = auth.getClient();
 
@@ -564,6 +574,44 @@ export function registerExamTools(server: McpServer, auth: AuthManager) {
     }
   );
 
+  server.registerTool(
+    "lms_delete_exam",
+    {
+      title: "Delete Exam",
+      description:
+        "Permanently delete an exam and all its questions, options, and submissions. This action is irreversible. Only use on draft exams or when sure there are no important submissions.",
+      inputSchema: z.object({ exam_id: z.number().describe("The exam ID to delete") }).strict(),
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true,
+      },
+    },
+    async ({ exam_id }) => {
+      try {
+        await auth.verifyExamOwnership(exam_id);
+        const supabase = auth.getClient();
+
+        const { data: exam } = await supabase
+          .from("exams")
+          .select("title")
+          .eq("exam_id", exam_id)
+          .single();
+
+        const { error } = await supabase.from("exams").delete().eq("exam_id", exam_id);
+        if (error) return errorResult(`Deleting exam: ${error.message}`);
+
+        return {
+          content: [{ type: "text", text: `Exam "${exam?.title ?? exam_id}" (ID: ${exam_id}) and all its questions have been deleted.` }],
+          structuredContent: { success: true, deleted_exam_id: exam_id },
+        };
+      } catch (err) {
+        return errorResult(err instanceof Error ? err.message : String(err));
+      }
+    }
+  );
+
   server.registerTool(
     "lms_delete_exam_question",
     {
@@ -573,7 +621,7 @@ export function registerExamTools(server: McpServer, auth: AuthManager) {
       annotations: {
         readOnlyHint: false,
         destructiveHint: true,
-        idempotentHint: true,
+        idempotentHint: false,
         openWorldHint: true,
       },
     },

mcp-server/src/tools/exercises.ts

@@ -212,7 +212,10 @@ export function registerExerciseTools(server: McpServer, auth: AuthManager) {
     async ({ category }) => {
       try {
         const supabase = auth.getClient();
-        let query = supabase.from("prompt_templates").select("id, name, category, description, variables");
+        let query = supabase
+          .from("prompt_templates")
+          .select("id, name, category, description, variables")
+          .or(`is_system.eq.true,created_by.eq.${auth.getUserId()}`);
         if (category) query = query.eq("category", category);
 
         const { data, error } = await query;
@@ -324,6 +327,7 @@ export function registerExerciseTools(server: McpServer, auth: AuthManager) {
             system_prompt: finalSystemPrompt,
             time_limit: time_limit ?? null,
             created_by: auth.getUserId(),
+            tenant_id: auth.getTenantId(),
             template_id: template_id ?? null,
             template_variables: template_variables ?? null,
           })
@@ -352,6 +356,43 @@ export function registerExerciseTools(server: McpServer, auth: AuthManager) {
     }
   );
 
+  server.registerTool(
+    "lms_delete_exercise",
+    {
+      title: "Delete Exercise",
+      description: "Permanently delete a practice exercise. This action is irreversible.",
+      inputSchema: z.object({ exercise_id: z.number().describe("The exercise ID to delete") }).strict(),
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true,
+      },
+    },
+    async ({ exercise_id }) => {
+      try {
+        await auth.verifyExerciseOwnership(exercise_id);
+        const supabase = auth.getClient();
+
+        const { data: exercise } = await supabase
+          .from("exercises")
+          .select("title")
+          .eq("id", exercise_id)
+          .single();
+
+        const { error } = await supabase.from("exercises").delete().eq("id", exercise_id);
+        if (error) return errorResult(`Deleting exercise: ${error.message}`);
+
+        return {
+          content: [{ type: "text", text: `Exercise "${exercise?.title ?? exercise_id}" (ID: ${exercise_id}) has been deleted.` }],
+          structuredContent: { success: true, deleted_exercise_id: exercise_id },
+        };
+      } catch (err) {
+        return errorResult(err instanceof Error ? err.message : String(err));
+      }
+    }
+  );
+
   server.registerTool(
     "lms_update_exercise",
     {