fix(mcp): correct JWT issuer and consent response parsing

Two bugs found by the integration test:

1. /api/mcp handlers verified JWT with issuer = BETTER_AUTH_URL but
   better-auth sets iss = ctx.context.baseURL which includes the /api/auth
   path prefix. Fix: use BETTER_AUTH_URL + "/api/auth" as the expected
   issuer in all three mcp.*.ts handlers.

2. /api/oauth/consent forwarded the Allow/Deny to better-auth but:
   a) Missing Origin header caused a MISSING_OR_NULL_ORIGIN 403. Fix:
      forward the incoming Origin or fall back to BETTER_AUTH_URL's origin.
   b) Response body was read as { redirect_uri } but better-auth returns
      { redirect: true, url: "..." }. Fix: read json.url as the redirect URI.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Ripwords

apps/dashboard/server/api/mcp.delete.ts

@@ -5,11 +5,17 @@ import { env } from "../lib/env"
 import { buildContextFromJwt } from "../mcp/context"
 import { buildMcpServer } from "../mcp/server"
 
+// better-auth mounts the auth handler at /api/auth, so the JWT issuer is
+// BETTER_AUTH_URL + "/api/auth" (better-auth sets iss = ctx.context.baseURL,
+// and baseURL in auth.ts is configured as env.BETTER_AUTH_URL which Nitro
+// then appends "/api/auth" to during the handler registration).
+const ISSUER = `${env.BETTER_AUTH_URL}/api/auth`
+
 const handler = mcpHandler(
   {
     jwksUrl: `${env.BETTER_AUTH_URL}/api/auth/jwks`,
     verifyOptions: {
-      issuer: env.BETTER_AUTH_URL,
+      issuer: ISSUER,
       audience: `${env.BETTER_AUTH_URL}/api/mcp`,
     },
   },

apps/dashboard/server/api/mcp.get.ts

@@ -5,11 +5,17 @@ import { env } from "../lib/env"
 import { buildContextFromJwt } from "../mcp/context"
 import { buildMcpServer } from "../mcp/server"
 
+// better-auth mounts the auth handler at /api/auth, so the JWT issuer is
+// BETTER_AUTH_URL + "/api/auth" (better-auth sets iss = ctx.context.baseURL,
+// and baseURL in auth.ts is configured as env.BETTER_AUTH_URL which Nitro
+// then appends "/api/auth" to during the handler registration).
+const ISSUER = `${env.BETTER_AUTH_URL}/api/auth`
+
 const handler = mcpHandler(
   {
     jwksUrl: `${env.BETTER_AUTH_URL}/api/auth/jwks`,
     verifyOptions: {
-      issuer: env.BETTER_AUTH_URL,
+      issuer: ISSUER,
       audience: `${env.BETTER_AUTH_URL}/api/mcp`,
     },
   },

apps/dashboard/server/api/mcp.post.ts

@@ -5,11 +5,17 @@ import { env } from "../lib/env"
 import { buildContextFromJwt } from "../mcp/context"
 import { buildMcpServer } from "../mcp/server"
 
+// better-auth mounts the auth handler at /api/auth, so the JWT issuer is
+// BETTER_AUTH_URL + "/api/auth" (better-auth sets iss = ctx.context.baseURL,
+// and baseURL in auth.ts is configured as env.BETTER_AUTH_URL which Nitro
+// then appends "/api/auth" to during the handler registration).
+const ISSUER = `${env.BETTER_AUTH_URL}/api/auth`
+
 const handler = mcpHandler(
   {
     jwksUrl: `${env.BETTER_AUTH_URL}/api/auth/jwks`,
     verifyOptions: {
-      issuer: env.BETTER_AUTH_URL,
+      issuer: ISSUER,
       audience: `${env.BETTER_AUTH_URL}/api/mcp`,
     },
   },

apps/dashboard/server/api/oauth/consent.post.ts

@@ -32,13 +32,19 @@ export default defineEventHandler(async (event) => {
   const body = await readValidatedBody(event, Body.parse)
 
   const url = new URL(`${env.BETTER_AUTH_URL}/api/auth/oauth2/consent`)
+  // better-auth's oauthProvider requires an Origin header on the consent
+  // endpoint to protect against CSRF. Forward the incoming Origin if present,
+  // or use the BETTER_AUTH_URL origin as a fallback (this request comes from
+  // our own frontend, so the origin is known and trusted).
+  const origin = event.headers.get("origin") ?? new URL(env.BETTER_AUTH_URL).origin
   const res = await auth.handler(
     new Request(url, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         accept: "application/json",
         cookie: event.headers.get("cookie") ?? "",
+        origin,
       },
       body: JSON.stringify({
         accept: body.allow,
@@ -54,6 +60,8 @@ export default defineEventHandler(async (event) => {
     })
   }
 
-  const json = (await res.json()) as { redirect_uri: string }
-  return { redirectUri: json.redirect_uri }
+  // better-auth's /oauth2/consent handler returns { redirect: true, url: "..." }
+  // (not { redirect_uri }) — the `url` field is the authorization code redirect.
+  const json = (await res.json()) as { redirect: boolean; url: string }
+  return { redirectUri: json.url }
 })