u

src/api/middleware/auth.js

@@ -63,6 +63,12 @@ export const authMiddleware = async (req, res, next) => {
         return next();
     }
 
+    if (req.path === '/mcp' || req.path.startsWith('/.well-known') || req.path === '/oauth/register' || req.path === '/oauth/token' || req.path === '/oauth/introspect') {
+        return next();
+    }
+
+    const isOAuthAuthorize = req.path === '/oauth/authorize';
+
     const bearerToken = req.headers.authorization?.startsWith('Bearer ')
         ? req.headers.authorization.slice(7).trim()
         : null;
@@ -70,7 +76,7 @@ export const authMiddleware = async (req, res, next) => {
 
     const isDocs = req.path.startsWith('/docs') || req.path.startsWith('/api/docs');
     if (!token) {
-        if (isDocs) return next();
+        if (isDocs || isOAuthAuthorize) return next();
         return respondWithAuthPayload(res, req, 401, { error: 'Unauthorized' });
     }
 
@@ -118,7 +124,7 @@ export const authMiddleware = async (req, res, next) => {
         next();
     } catch {
         if (req.cookies.token) clearTokenCookie(res);
-        if (isDocs) return next();
+        if (isDocs || isOAuthAuthorize) return next();
         return respondWithAuthPayload(res, req, 401, { error: 'Invalid token' });
     }
 };