Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Personal access tokens for the MCP server and the GraphQL API

Aperta
  • Qualcosa non va?
#4,618 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
graphql, typescript
Ambito
authentication, backend-api-design, frontend, security

Direzione di ricerca

Start by reading the referenced auth plugin, auth-context provider, MCP auth files, and upstream GraphQL client, then review the existing API-key helper and connector-gaps document. Trace how JWT identity, memberships, forwarding, rate limits, and audit logging currently work before deciding the PAT design. Done means the listed acceptance criteria pass, including creation and revocation through the client, scope and membership enforcement, 401 responses, and the required checks.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement

Part of #4611 (step M4, phase 4).

Context

Some MCP hosts, as well as headless and CI clients, cannot complete interactive OAuth.

The current workaround should not be recommended. It means copying the web app's access token from the browser into a client's Authorization header. This works, because both the MCP server and the GraphQL API accept any valid Auth0 access token for the shared audience. But the token:

  • is short-lived and never refreshes;
  • carries the user's full API power;
  • is taken from the SPA's localStorage.

The existing API keys are not a substitute:

  • They live in accounter_schema.api_keys, are sent as X-API-Key, and are managed with generateApiKey / listApiKeys / revokeApiKey.
  • They are restricted to the scraper and gmail_listener roles (packages/server/src/modules/auth/helpers/api-keys.helper.ts).
  • Each key is pinned to one business.
  • The MCP server only accepts JWTs (packages/mcp-server/src/auth/token.ts, verifier.ts), so it can't take an API key.

Scope

Token model. User-scoped personal access tokens (PATs) that are:

  • hashed at rest;
  • named;
  • required to expire;
  • revocable;
  • tracked by last use;
  • least privilege: read-only by default, with explicit opt-in for write scopes;
  • optionally restricted to a subset of the user's businesses.

Server. Add a PAT path to packages/server/src/plugins/auth-plugin.ts and auth-context.provider.ts. It resolves to the owning user's identity and memberships, intersected with the token's scopes and businesses.

MCP server.

  • Accept PATs alongside JWTs and forward them upstream. src/upstream/graphql-client.ts currently forwards Authorization.
  • Key rate limits and audit lines by user.

Client. Add create, list and revoke UI, either on the Account page from #4615 or under Access Management.

Audit. Write audit-log entries when a token is created, used and revoked.

Acceptance criteria

  • A user creates a read-only PAT, uses it in an MCP client's header config and against GraphQL, then revokes it.
  • Revoked and expired tokens get 401.
  • A PAT never grants more than its owner currently has. Removing a membership takes effect immediately.
  • yarn generate, yarn lint and yarn test pass.

Dependencies

Phase 4. Independent of #4616 and #4617. The UI may reuse the Account page from #4615.

References

  • packages/server/src/plugins/auth-plugin.ts
  • packages/server/src/modules/auth/providers/auth-context.provider.ts
  • packages/server/src/modules/auth/helpers/api-keys.helper.ts
  • packages/mcp-server/src/auth/, src/upstream/graphql-client.ts
  • packages/mcp-server/docs/connector-gaps-and-decisions.md (gap 3: shared audience)
Lingua principale
TypeScript
Stelle
30
Fork
8
Merge medio
1g 14h
PR unite (30g)
198

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Urigo/accounter-fullstack

Tutte le issue di Urigo/accounter-fullstack

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.