feat(mcp): admin overview — all users' tokens + OAuth clients, with revoke

[malickyeu]

MCP Admin overview — make MCP team-ready

The MCP feature (#31) gave each user a self-service MCP Access page for their own tokens. On a shared instance an administrator had no way to see or cut off MCP access across the fleet. This adds that.

What's new

A new admin-only page System → MCP Admin with a fleet-wide view:

• API tokens — all users. Every active token, annotated with its owner, scope and read-only flag, last-used / expiry. Revoke any of them; the tool using it loses access immediately.
• OAuth clients — registered connectors. Every dynamically-registered client. Remove any of them — which also purges its authorization codes and refresh tokens, so anything connected through it must re-authorize.

Secrets are never exposed here — only metadata (no raw token, no stored hash).

Backend

• store — ListAllAPITokens (joins users for the username), AdminRevokeAPIToken (not owner-scoped), ListOAuthClients, DeleteOAuthClient (cascades codes + refresh tokens in one tx).
• api — /api/mcp-admin/tokens (GET, DELETE {id}) and /api/mcp-admin/oauth-clients (GET, DELETE {id}), mounted in the authenticated group and gated by the __admin section (sectionForPath: mcp-admin → __admin), so the existing permissions middleware rejects non-admins before any handler runs.

Security & tests

This manages other users' credentials, so it gets adversarial coverage per the repo's feature-tests discipline:

• Store unit tests — listing/annotation, newest-first, revoke semantics (unknown id / double revoke), cascading client delete.
• HTTP functional test — admin lists both users' tokens, cross-user revoke, 404 on re-revoke, client list/delete/404.
• Pen tests (mcp_admin_pentest_test.go):
  • non-admin (even with every normal section) → 403 on every route, and no side effects (victim token still active, client still registered);
  • unauthenticated → 401, never a silent 200;
  • the self-service revoke route stays owner-scoped — a non-admin can't revoke another user's token by guessing its id (IDOR);
  • the admin list never leaks a token secret/hash.

go test -short ./..., go vet, gofmt, and tsc --noEmit all green; web/dist rebuilt.

Docs

docs/mcp.md admin-overview section + CHANGELOG.md entry.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds an admin-only “MCP Admin” overview to manage MCP credentials fleet-wide, complementing the existing per-user “MCP Access” token management and making shared instances easier to administer safely.

Changes:

• Adds new admin UI page to list/revoke all users’ MCP API tokens and list/delete dynamically registered OAuth clients.
• Introduces new admin API endpoints + store methods for listing/revoking tokens and listing/deleting OAuth clients (with cascading purge of codes/refresh tokens).
• Expands access control mapping so /api/mcp-admin/* routes are gated by the __admin section; adds unit/HTTP/pen-test coverage and docs/changelog updates.

Reviewed changes

Copilot reviewed 15 out of 19 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
web/src/pages/MCPAdmin.tsx	New admin UI page for fleet-wide MCP token + OAuth client overview with revoke/delete actions.
web/src/lib/types.ts	Adds admin-specific response types for MCP tokens and OAuth clients.
web/src/lib/api.ts	Adds frontend API helpers for /api/mcp-admin/* endpoints.
web/src/layout/Shell.tsx	Adds “MCP Admin” navigation item (admin-only) and icon import.
web/src/App.tsx	Registers the /mcp-admin route.
web/dist/index.html	Rebuilt frontend bundle references.
web/dist/assets/index-DlPBIcda.css	Rebuilt compiled CSS output.
web/dist/assets/CodeEditor-R6mzRIeK.js	Rebuilt compiled JS output.
internal/store/oauth.go	Adds store methods to list OAuth clients and delete a client while purging dependent auth state in one transaction.
internal/store/mcp_admin_test.go	Store-level tests for admin token listing/revocation and OAuth client list/delete cascade behavior.
internal/store/api_tokens.go	Adds ListAllAPITokens (with username join) and AdminRevokeAPIToken (non-owner-scoped).
internal/api/server.go	Mounts new /api/mcp-admin/* routes.
internal/api/mcp_admin_pentest_test.go	Adversarial tests for admin gating, unauthenticated behavior, IDOR protection, and secret/hash non-leakage.
internal/api/mcp_admin_handlers.go	Implements admin handlers for listing/revoking tokens and listing/deleting OAuth clients.
internal/api/mcp_admin_handlers_test.go	HTTP functional test covering admin list/revoke and client list/delete flows.
internal/api/access_middleware.go	Maps mcp-admin segment to __admin section for permissions middleware.
docs/mcp.md	Documents the new MCP Admin overview page and behavior.
CHANGELOG.md	Adds an Unreleased entry describing the MCP Admin overview feature.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.