feat(auth): per-user OAuth on downstream MCP connections + no-DCR provider support

[AriOliv]

Summary

Two related features, re-implemented on the current apps/api layout:

1. Per-user OAuth on downstream MCP connections (auth_mode: "shared" | "per_user")

Connections gain an opt-in per_user mode: instead of one org-wide downstream token, each member authorizes with their own account and tokens are keyed by (connection, user). Audit logs at the provider show the real person acting, and members only reach what their own account can see (e.g. each member's own Google Drive).

• Migration 171: connections.auth_mode (default 'shared', existing rows untouched) + re-introduces downstream_tokens.userId as nullable, enforced by two partial unique indexes (one shared row per connection; one row per (connection, user)).
• outbound/errors.ts (new): PerUserAuthorizationRequiredError + a 401 renderer (WWW-Authenticate + X-Authorize-Url) so MCP clients can surface the "connect your account" URL. (This is the file that was missing from fix(mcp-oauth): let external OAuth clients use aggregate/virtual MCP endpoints #4263 — sorry about that, and thanks @vibegui for catching it.)
• headers.ts: per-user mode is strict — the caller's own token or an actionable 401, checked before the shared connection_token fallback so a stale admin token never leaks an identity to another member. The superuser fallback used for JWT minting is intentionally NOT applied to token resolution.
• Circuit breaker: per-user-authorization-required is an expected state, not a downstream outage — it doesn't trip the breaker or auto-disable the connection (proxy + lazy-client + virtual-mcp routes).
• Web: a "Per-user authentication" toggle on connection settings (dirty-field-guarded so unrelated saves never demote the policy), per-user copy on the OAuth state, i18n (en + pt-BR).

2. Providers without Dynamic Client Registration (e.g. Google-hosted MCPs)

drivemcp.googleapis.com/mcp/v1 breaks the standard flow twice: initialize/tools/list answer 200 unauthenticated (only tools/call 401s), and accounts.google.com has no DCR endpoint.

• Detection: a 200 probe no longer short-circuits to "all set" — when the caller has no stored token, RFC 9728 protected-resource discovery runs; published metadata means the server declares itself OAuth-protected, so the authenticate flow is offered.
• Pre-registered client: when the downstream AS lacks registration_endpoint and the connection carries oauth_config, the oauth-proxy advertises + answers a synthetic registration (token_endpoint_auth_method: "none"), pins the authorize client_id, guarantees a scope (config scopes → resource scopes_supported), appends Google's offline-consent params, and injects the client secret on the token leg server-side only — the secret never reaches the browser.

Context

• Replaces the per-user portion of fix(mcp-oauth): let external OAuth clients use aggregate/virtual MCP endpoints #4263 (based on the pre-restructure apps/mesh layout and missing outbound/errors.ts); the other pieces of that PR (namespaceCode, metadata.oauthResource) were already cherry-picked in dc1dca2.
• Relates to [Bug] Org member can self-promote to admin and bypass role boundaries #3388.

Testing

• bun run check green across all 13 workspaces; bun run fmt + bun run lint clean (0 errors, no new warnings).
• Unit tests updated for the new (connection, user) keying (refresh-access-token, downstream-token integration, sandbox/start).
• Live-validated on a self-hosted deployment (GKE + Cloud SQL): both paths produced per-user rows with working refresh tokens —
  • DCR path: a standard OAuth MCP server, per_user toggle → 401 challenge → authorize → token stored keyed to the member.
  • No-DCR path: drivemcp.googleapis.com/mcp/v1 with a pre-registered Google client via oauth_config → full flow incl. access_type=offline refresh token. (Google's MCP service itself is Developer Preview-gated; the OAuth flow and the raw Drive API were verified end-to-end with the minted per-user token.)

Follow-ups (not in this PR)

• Chat/agent UX: when an agent subtask hits PerUserAuthorizationRequiredError, surface the authorize link in the thread instead of a generic failed step.
• Editing connectors on the synthesized Decopilot agent 500s with an FK violation on conn_agg_parent_fk (COLLECTION_VIRTUAL_MCP_UPDATE inserts aggregations for a parent that has no connections row) — pre-existing, happy to file separately.

🤖 Generated with Claude Code

---

Summary by cubic

Adds per-user OAuth for downstream MCP connections and supports OAuth providers without Dynamic Client Registration. Previously all connections used a shared org token; in per-user mode the server uses the caller’s token and returns a 401 with an authorize URL when missing. Read caches for per-user connections now key by principal to prevent cross-user leaks.

• Per-user OAuth

  • Migration 171 adds connections.auth_mode (default shared) and nullable downstream_tokens.userId, enforced by partial unique indexes (one shared row per connection; one row per (connectionId, userId)).
  • Token resolution in per-user mode uses only the caller’s token; if absent, returns 401 with WWW-Authenticate and X-Authorize-Url. No fallback to connection_token.
  • Circuit breaker does not trip on per-user authorization errors in proxy, virtual-mcp, and lazy client paths.
  • Read cache keys by principal for auth_mode: "per_user" to avoid serving one member’s results to another; unidentified callers get isolated scope.
  • Web adds a “Per-user authentication” toggle and guards auth_mode updates so unrelated edits don’t change policy; i18n (en, pt-BR).
  • Required action: run DB migrations; enable per-user mode per connection where user-scoped access is desired.

• Providers without Dynamic Client Registration

  • Detect OAuth-protected resources via RFC 9728 when unauthenticated probes return 200 and no stored token; offer the authenticate flow.
  • When registration_endpoint is missing and oauth_config provides a pre-registered client, the proxy advertises synthetic register, pins client_id, ensures scope (prefer config scopes, fallback to resource scopes_supported), adds Google access_type=offline and prompt=consent, and injects client_secret server-side on token exchange.
  • Required action: for Google-hosted MCPs, set oauth_config.clientId, oauth_config.clientSecret, and oauth_config.scopes on the connection.

^{Written for commit 901fc7c. Summary will update on new commits.}