Merge pull request #260 from guillermoscript/feature/mcp

Feature/mcp

Author: guillermoscript

app/[locale]/dashboard/admin/api-tokens/page.tsx

@@ -1,4 +1,5 @@
 import { getUserRole } from '@/lib/supabase/get-user-role'
+import { getCurrentTenant } from '@/lib/supabase/tenant'
 import { redirect } from 'next/navigation'
 import { listMcpTokens } from '@/app/actions/mcp-tokens'
 import ApiTokensPage from '@/components/dashboard/api-tokens-page'
@@ -10,11 +11,15 @@ export default async function AdminApiTokensPage() {
   }
 
   const { data: tokens } = await listMcpTokens()
-  const domain = process.env.NEXT_PUBLIC_PLATFORM_DOMAIN || 'localhost:3000'
+  const tenant = await getCurrentTenant()
+  const platformDomain = process.env.NEXT_PUBLIC_PLATFORM_DOMAIN || 'localhost:3000'
+  const mcpUrl = tenant?.slug
+    ? `https://${tenant.slug}.${platformDomain}/api/mcp/cli`
+    : `https://${platformDomain}/api/mcp/cli`
 
   return (
     <div className="p-6 lg:p-8">
-      <ApiTokensPage tokens={tokens ?? []} domain={domain} />
+      <ApiTokensPage tokens={tokens ?? []} mcpUrl={mcpUrl} />
     </div>
   )
 }

app/[locale]/dashboard/teacher/api-tokens/page.tsx

@@ -1,4 +1,5 @@
 import { getUserRole } from '@/lib/supabase/get-user-role'
+import { getCurrentTenant } from '@/lib/supabase/tenant'
 import { redirect } from 'next/navigation'
 import { listMcpTokens } from '@/app/actions/mcp-tokens'
 import ApiTokensPage from '@/components/dashboard/api-tokens-page'
@@ -10,11 +11,15 @@ export default async function TeacherApiTokensPage() {
   }
 
   const { data: tokens } = await listMcpTokens()
-  const domain = process.env.NEXT_PUBLIC_PLATFORM_DOMAIN || 'localhost:3000'
+  const tenant = await getCurrentTenant()
+  const platformDomain = process.env.NEXT_PUBLIC_PLATFORM_DOMAIN || 'localhost:3000'
+  const mcpUrl = tenant?.slug
+    ? `https://${tenant.slug}.${platformDomain}/api/mcp/cli`
+    : `https://${platformDomain}/api/mcp/cli`
 
   return (
     <div className="p-6 lg:p-8">
-      <ApiTokensPage tokens={tokens ?? []} domain={domain} />
+      <ApiTokensPage tokens={tokens ?? []} mcpUrl={mcpUrl} />
     </div>
   )
 }

components/dashboard/api-tokens-page.tsx

@@ -27,10 +27,10 @@ import { createMcpToken, revokeMcpToken, deleteMcpToken, type McpToken } from '@
 
 interface ApiTokensPageProps {
   tokens: McpToken[]
-  domain: string
+  mcpUrl: string
 }
 
-export default function ApiTokensPage({ tokens, domain }: ApiTokensPageProps) {
+export default function ApiTokensPage({ tokens, mcpUrl }: ApiTokensPageProps) {
   const t = useTranslations('dashboard.admin.apiTokens')
   const [createOpen, setCreateOpen] = useState(false)
   const [revealedToken, setRevealedToken] = useState<string | null>(null)
@@ -96,7 +96,7 @@ export default function ApiTokensPage({ tokens, domain }: ApiTokensPageProps) {
   const configSnippet = (token: string) => JSON.stringify({
     mcpServers: {
       lms: {
-        url: `https://${domain}/api/mcp/cli`,
+        url: mcpUrl,
         headers: {
           Authorization: `Bearer ${token}`,
         },

supabase/migrations/20260301193428_fix_validate_mcp_api_token_rpc.sql

@@ -0,0 +1,32 @@
+-- Fix validate_mcp_api_token RPC to use tenant_users (authoritative role source)
+-- instead of the legacy user_roles/roles join which had wrong column references
+DROP FUNCTION IF EXISTS validate_mcp_api_token(TEXT);
+
+CREATE FUNCTION validate_mcp_api_token(token_input TEXT)
+RETURNS TABLE(user_id UUID, email TEXT, user_role TEXT, token_id BIGINT)
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  token_hash_input TEXT;
+BEGIN
+  -- Hash the input token
+  token_hash_input := encode(digest(token_input, 'sha256'), 'hex');
+
+  -- Find matching token and get user info via tenant_users (authoritative role source)
+  RETURN QUERY
+  SELECT
+    t.user_id,
+    u.email::TEXT,
+    tu.role::TEXT,
+    t.id
+  FROM mcp_api_tokens t
+  JOIN auth.users u ON u.id = t.user_id
+  JOIN tenant_users tu ON tu.user_id = t.user_id AND tu.status = 'active'
+  WHERE t.token_hash = token_hash_input
+    AND t.is_active = true
+    AND (t.expires_at IS NULL OR t.expires_at > NOW())
+    AND tu.role IN ('teacher', 'admin')
+  LIMIT 1;
+END;
+$$;