u

src/index.js

@@ -240,6 +240,8 @@ import mcpConsumeAuthCode from './store/mcp/consumeAuthCode.js';
 import mcpCreateRefreshToken from './store/mcp/createRefreshToken.js';
 import mcpGetRefreshToken from './store/mcp/getRefreshToken.js';
 import mcpRevokeRefreshToken from './store/mcp/revokeRefreshToken.js';
+import mcpListAuthorizations from './store/mcp/listAuthorizations.js';
+import mcpRevokeAuthorizations from './store/mcp/revokeAuthorizations.js';
 
 export default class LibDashStore {
   /**
@@ -640,6 +642,8 @@ export default class LibDashStore {
       createRefreshToken: mcpCreateRefreshToken(provider),
       getRefreshToken: mcpGetRefreshToken(provider),
       revokeRefreshToken: mcpRevokeRefreshToken(provider),
+      listAuthorizations: mcpListAuthorizations(provider),
+      revokeAuthorizations: mcpRevokeAuthorizations(provider),
     };
 
     this.purge = storePurge(provider);

src/providers/mssql/queries/mcp.js

@@ -88,3 +88,26 @@ UPDATE mcp_token
 SET revoked = 1
 WHERE refresh_token = @refreshToken
 `;
+
+export const LIST_AUTHORIZATIONS_BY_USER = `
+SELECT
+    c.id AS clientDbId,
+    c.client_id AS clientId,
+    c.client_name AS clientName,
+    c.scope,
+    c.created_at AS clientCreatedAt,
+    MAX(t.created_at) AS authorizedAt,
+    COUNT(t.id) AS tokenCount
+FROM mcp_token t
+JOIN mcp_client c ON t.client_id = c.client_id
+WHERE t.google_auth_id = @googleAuthId AND t.revoked = 0
+GROUP BY c.id, c.client_id, c.client_name, c.scope, c.created_at
+ORDER BY MAX(t.created_at) DESC
+`;
+
+export const REVOKE_USER_AUTHORIZATIONS = `
+UPDATE mcp_token
+SET revoked = 1
+WHERE google_auth_id = @googleAuthId AND client_id = @clientId
+`;
+

src/providers/sqlite3/queries/mcp.js

@@ -13,4 +13,6 @@ export const {
   INSERT_REFRESH_TOKEN,
   GET_REFRESH_TOKEN,
   REVOKE_REFRESH_TOKEN,
+  LIST_AUTHORIZATIONS_BY_USER,
+  REVOKE_USER_AUTHORIZATIONS,
 } = queries;

src/store/mcp/listAuthorizations.js

@@ -0,0 +1,16 @@
+import { LIST_AUTHORIZATIONS_BY_USER as MSSQL_LIST } from '../../providers/mssql/queries/mcp.js';
+import { LIST_AUTHORIZATIONS_BY_USER as SQLITE_LIST } from '../../providers/sqlite3/queries/mcp.js';
+
+export default function listAuthorizations(provider) {
+  const sql = provider.dialect === 'sqlite3' ? SQLITE_LIST : MSSQL_LIST;
+  /**
+   * Lists active authorizations for a Google Auth user.
+   *
+   * @param {number} googleAuthId - The user ID.
+   * @returns {Promise<Array<object>>} List of authorized clients and token counts.
+   */
+  return async (googleAuthId) => {
+    const result = await provider.query(sql, { googleAuthId });
+    return result.rows ?? [];
+  };
+}

src/store/mcp/revokeAuthorizations.js

@@ -0,0 +1,17 @@
+import { REVOKE_USER_AUTHORIZATIONS as MSSQL_REVOKE } from '../../providers/mssql/queries/mcp.js';
+import { REVOKE_USER_AUTHORIZATIONS as SQLITE_REVOKE } from '../../providers/sqlite3/queries/mcp.js';
+
+export default function revokeAuthorizations(provider) {
+  const sql = provider.dialect === 'sqlite3' ? SQLITE_REVOKE : MSSQL_REVOKE;
+  /**
+   * Revokes all active authorizations (tokens) for a user and MCP client.
+   *
+   * @param {number} googleAuthId - The user ID.
+   * @param {string} clientId - The MCP client ID.
+   * @returns {Promise<boolean>} True once revoked.
+   */
+  return async (googleAuthId, clientId) => {
+    await provider.query(sql, { googleAuthId, clientId });
+    return true;
+  };
+}