feat(mcp): rotate MCP OAuth refresh tokens with replay detection - #8273

…agents

Extend the OAuth2 flow so external MCP agents (Claude, Cursor, etc.) can
authenticate. Rather than a single hardcoded client id, agents register
dynamically per RFC 7591: POST /account/client persists a public AuthClient
(type 'mcp', no secret) with its approved redirect URIs and returns a generated
client id. The authorize, complete, and token endpoints recognise these clients
by looking them up, skip the project/device ownership checks (MCP is
user-scoped), and drive an MCP consent step that records the read-only and team
selection before issuing a scoped personal access token. Redirect URIs must be
loopback http (RFC 8252, port-flexible) or https for hosted clients; token
issuance and refresh require no client secret.

Also forward the caller scope through the platform automation handler and add a
platform_get_active_user tool that reports the calling token's scope.

Adds AuthClient.type/name/redirectURIs (migration + model), an
AuthClient.createMCPClient controller, and AccessToken.createMCPOAuthToken.

Ref #7432

Add the AccessRequestMCP.vue consent page and its /account/request/:id/mcp
modal route. The page lets the user pick read-only or full access and scope
the grant to specific teams before approving the MCP agent request.

Ref #7433

Move the RFC 9728 protected-resource document out of the root
.well-known handler into the license-gated EE mcp plugin, so it is only
advertised where the /mcp resource exists. Serve it at the path-inserted
/.well-known/oauth-protected-resource/mcp (RFC 9728 3.1) with the bare
path kept as an alias, and challenge unauthenticated /mcp requests with a
WWW-Authenticate header pointing at that metadata.

…auth-pkce

An AccessToken row holds both the access token and its refresh token,
and getOrExpire destroyed the row when the access token expired, taking
the refresh token with it so a client could never refresh (RFC 6749
1.5). Add a separate refreshTokenExpiresAt lifetime: reject an expired
access token but keep the row while its refresh token is still valid.

The MCP refresh token is stable rather than rotating, and concurrent
refreshes coalesce through a shared cache so they reuse the most
recently minted access token instead of overwriting the row.

Capture the pre-refresh expiry after lowering it, so the assertion
compares against the shortened lifetime rather than the original one and
no longer ties when the refresh lands in the same millisecond.

Link the MCP OAuth token to the AuthClient it was issued to and name it
after the registered client instead of the fixed 'MCP Agent', so the
user's token list and later audit attribution can tell agents apart.

Rotate the refresh token on every MCP refresh instead of keeping it
stable: each refresh issues a new refresh token and records the previous
one. A rotated-out token presented within a short grace window returns
the current tokens, so a concurrent or retried refresh still succeeds;
presented after the window it is treated as a replay and the grant is
revoked (RFC 9700 section 4.14.2).

Concurrent refreshes are serialised with a compare-and-swap on the
current refresh token: the update only matches while the token is still
current, so exactly one refresh rotates and the loser returns the
winner's tokens from the shared cache rather than a token that never
reached the row.

Platform tool calls were always stamped source 'mcp:expert', so a
third-party agent's actions rendered as the first-party Expert. The MCP
door now records the caller's registered client name against its
mcpSessionId, and the comms handler reads it to stamp source 'mcp' with
that client name. The Expert path never opens that door, so it keeps the
'mcp:expert' default. The audit entry surfaces the client name.

Closes #8271.

…resh-token-rotation

…resh-token-rotation

The refresh_token grant returned access_token, expires_in and
refresh_token but omitted token_type, which RFC 6749 section 5.1
requires. A spec-compliant client rejects the response and falls back to
re-authorization even though the server rotated the token successfully.
Return token_type: bearer to match the authorization_code response.

…tribution

…resh-token-rotation

…tribution

…resh-token-rotation

…resh-token-rotation

# Conflicts:
#	forge/db/models/AccessToken.js