u

docs/api/README.md

@@ -158,6 +158,12 @@ Generated from `@openapi` annotations in [`src/api/routes/`](../../src/api/route
 | [`routes/ledger/manifestarticle/_manifestarticleId.md`](routes/ledger/manifestarticle/_manifestarticleId.md) | `GET /ledger/manifestarticle/{manifestarticleId}` |
 | [`routes/ledger/sku/_sku.md`](routes/ledger/sku/_sku.md) | `GET /ledger/sku/{sku}` |
 | [`routes/mcp.md`](routes/mcp.md) | `POST /mcp` |
+| [`routes/mcp/authorizations.md`](routes/mcp/authorizations.md) | `GET /mcp/authorizations` |
+| [`routes/mcp/authorizations/_clientId.md`](routes/mcp/authorizations/_clientId.md) | `DELETE /mcp/authorizations/{clientId}` |
+| [`routes/mcp/authorize.get.md`](routes/mcp/authorize.get.md) | `GET /mcp/authorize` |
+| [`routes/mcp/authorize.post.md`](routes/mcp/authorize.post.md) | `POST /mcp/authorize` |
+| [`routes/mcp/clients.md`](routes/mcp/clients.md) | `GET /mcp/clients` |
+| [`routes/mcp/clients/_clientId.md`](routes/mcp/clients/_clientId.md) | `DELETE /mcp/clients/{clientId}` |
 | [`routes/modelconversation.get.md`](routes/modelconversation.get.md) | `GET /modelconversation` |
 | [`routes/modelconversation.post.md`](routes/modelconversation.post.md) | `POST /modelconversation` |
 | [`routes/modelconversation/_id.delete.md`](routes/modelconversation/_id.delete.md) | `DELETE /modelconversation/{id}` |

docs/api/routes-all.md

@@ -1,6 +1,6 @@
 # Dash API Routes Overview (All)
 
-Overview of all 223 API endpoints across all modules.
+Overview of all 229 API endpoints across all modules.
 
 ### Notation
 
@@ -519,6 +519,24 @@ _none_
 #### Model Context Protocol (MCP) Streamable HTTP endpoint — `POST /mcp`
 _none_
 - Returns: `200`
+#### List active MCP client authorizations — `GET /mcp/authorizations`
+_none_
+- Returns: `200`
+#### Revoke MCP client authorizations — `DELETE /mcp/authorizations/{clientId}`
+- Params: `clientId: str`
+- Returns: `200`
+#### Get MCP authorization prompt details — `GET /mcp/authorize`
+- Params: `query: client_id: str, redirect_uri: str, response_type?: str, code_challenge?: str, code_challenge_method?: str, state?: str, scope?: str`
+- Returns: `200`
+#### Grant or deny MCP client authorization — `POST /mcp/authorize`
+- Params: `body: { client_id: str, redirect_uri: str, action: str, code_challenge?: str, code_challenge_method?: str, state?: str, scope?: str }`
+- Returns: `200`
+#### List registered MCP clients — `GET /mcp/clients`
+_none_
+- Returns: `200`
+#### Delete registered MCP client — `DELETE /mcp/clients/{clientId}`
+- Params: `clientId: str`
+- Returns: `200`
 
 ### Section: /modelconversation
 
@@ -556,8 +574,8 @@ _none_
 ### Section: /oauth
 
 #### OAuth 2.1 Authorization Endpoint (RFC 6749 & RFC 7636) — `GET /oauth/authorize`
-- Params: `query: client_id: str, redirect_uri: str, response_type: str, code_challenge: str, code_challenge_method: str, state?: str`
-- Returns: `200`
+- Params: `query: client_id?: str, redirect_uri?: str, response_type?: str, code_challenge?: str, code_challenge_method?: str, state?: str`
+_no response body_
 #### OAuth 2.0 Token Introspection (RFC 7662) — `POST /oauth/introspect`
 _none_
 - Returns: `200`

docs/api/routes.md

@@ -1,6 +1,6 @@
 # Dash API Routes Overview
 
-Overview of all 176 API endpoints across all modules.
+Overview of all 182 API endpoints across all modules.
 
 ### Notation
 
@@ -444,6 +444,24 @@ _none_
 #### Model Context Protocol (MCP) Streamable HTTP endpoint — `POST /mcp`
 _none_
 - Returns: `200`
+#### List active MCP client authorizations — `GET /mcp/authorizations`
+_none_
+- Returns: `200`
+#### Revoke MCP client authorizations — `DELETE /mcp/authorizations/{clientId}`
+- Params: `clientId: str`
+- Returns: `200`
+#### Get MCP authorization prompt details — `GET /mcp/authorize`
+- Params: `query: client_id: str, redirect_uri: str, response_type?: str, code_challenge?: str, code_challenge_method?: str, state?: str, scope?: str`
+- Returns: `200`
+#### Grant or deny MCP client authorization — `POST /mcp/authorize`
+- Params: `body: { client_id: str, redirect_uri: str, action: str, code_challenge?: str, code_challenge_method?: str, state?: str, scope?: str }`
+- Returns: `200`
+#### List registered MCP clients — `GET /mcp/clients`
+_none_
+- Returns: `200`
+#### Delete registered MCP client — `DELETE /mcp/clients/{clientId}`
+- Params: `clientId: str`
+- Returns: `200`
 
 ### Section: /number
 
@@ -457,8 +475,8 @@ _none_
 ### Section: /oauth
 
 #### OAuth 2.1 Authorization Endpoint (RFC 6749 & RFC 7636) — `GET /oauth/authorize`
-- Params: `query: client_id: str, redirect_uri: str, response_type: str, code_challenge: str, code_challenge_method: str, state?: str`
-- Returns: `200`
+- Params: `query: client_id?: str, redirect_uri?: str, response_type?: str, code_challenge?: str, code_challenge_method?: str, state?: str`
+_no response body_
 #### OAuth 2.0 Token Introspection (RFC 7662) — `POST /oauth/introspect`
 _none_
 - Returns: `200`

docs/api/routes/mcp/authorizations.md

@@ -0,0 +1,21 @@
+# `GET /mcp/authorizations`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+List active MCP client authorizations
+
+Lists all MCP clients authorized by the authenticated user with token counts and authorization timestamps.
+
+## Response `200`
+
+List of active user authorizations
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 401 | User not authenticated |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/mcp/authorizations/_clientId.md

@@ -0,0 +1,28 @@
+# `DELETE /mcp/authorizations/{clientId}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Revoke MCP client authorizations
+
+Revokes all tokens and authorizations granted to an MCP client by the authenticated user.
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `clientId` | yes | string |  |
+
+## Response `200`
+
+Authorizations revoked
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Missing clientId |
+| 401 | User not authenticated |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/mcp/authorize.get.md

@@ -0,0 +1,35 @@
+# `GET /mcp/authorize`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Get MCP authorization prompt details
+
+Fetches client information and current user context for the frontend MCP authorization consent screen.
+
+## Query parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `client_id` | yes | string |  |
+| `redirect_uri` | yes | string |  |
+| `response_type` | no | string |  |
+| `code_challenge` | no | string |  |
+| `code_challenge_method` | no | string |  |
+| `state` | no | string |  |
+| `scope` | no | string |  |
+
+## Response `200`
+
+Client and user consent metadata
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid request or unregistered redirect_uri |
+| 401 | User not authenticated |
+| 404 | Client not found |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/mcp/authorize.post.md

@@ -0,0 +1,47 @@
+# `POST /mcp/authorize`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Grant or deny MCP client authorization
+
+Issues an OAuth authorization code or refusal for the requesting MCP client on behalf of the authenticated user.
+
+## Body (JSON)
+
+| Field | Required | Type | Description |
+|-------|----------|------|-------------|
+| `client_id` | yes | string |  |
+| `redirect_uri` | yes | string |  |
+| `code_challenge` | no | string |  |
+| `code_challenge_method` | no | string |  |
+| `state` | no | string |  |
+| `scope` | no | string |  |
+| `action` | yes | string |  |
+
+```json
+{
+  "client_id": "…",
+  "redirect_uri": "…",
+  "code_challenge": "…",
+  "code_challenge_method": "…",
+  "state": "…",
+  "scope": "…",
+  "action": "allow"
+}
+```
+
+## Response `200`
+
+Success with redirect URL containing code or error
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid request parameters |
+| 401 | User not authenticated |
+| 404 | Client not found |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/mcp/clients.md

@@ -0,0 +1,21 @@
+# `GET /mcp/clients`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+List registered MCP clients
+
+Lists all registered OAuth MCP clients.
+
+## Response `200`
+
+List of registered clients
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 401 | User not authenticated |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/mcp/clients/_clientId.md

@@ -0,0 +1,28 @@
+# `DELETE /mcp/clients/{clientId}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Delete registered MCP client
+
+Deletes an MCP client registration.
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `clientId` | yes | string |  |
+
+## Response `200`
+
+Client deleted
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Missing clientId |
+| 401 | User not authenticated |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/oauth/authorize.md

@@ -4,28 +4,24 @@ Public. No cookie required.
 
 OAuth 2.1 Authorization Endpoint (RFC 6749 & RFC 7636)
 
-Authorization prompt for end-users to grant access to an MCP client.
+Redirects browser to frontend authorization consent page.
 
 ## Query parameters
 
 | Param | Required | Type | Description |
 |-------|----------|------|-------------|
-| `client_id` | yes | string |  |
-| `redirect_uri` | yes | string |  |
-| `response_type` | yes | string |  |
-| `code_challenge` | yes | string |  |
-| `code_challenge_method` | yes | string |  |
+| `client_id` | no | string |  |
+| `redirect_uri` | no | string |  |
+| `response_type` | no | string |  |
+| `code_challenge` | no | string |  |
+| `code_challenge_method` | no | string |  |
 | `state` | no | string |  |
 
-## Response `200`
-
-Authorization / Consent HTML form
-
 ## Errors
 
 | Status | Description |
 |--------|-------------|
-| 302 | Redirect back to client callback |
+| 302 | Redirects to frontend /oauth/authorize |
 
 ---