update e2e configs

e2e/docker-compose.yaml

@@ -69,6 +69,8 @@ services:
       - OXYNOTE_AUTH_REALTIME_FRONTEND_URL=http://localhost:18080
       - OXYNOTE_AUTH_REALTIME_BETTER_AUTH_ORGANIZATION_INVITATION_URL=http://localhost:18080/accept-invite
       - OXYNOTE_AUTH_REALTIME_TRUSTED_ORIGINS=http://localhost:18080
+      # must match core's SERVER_MCP_RESOURCE_URL
+      - OXYNOTE_AUTH_REALTIME_MCP_RESOURCE=http://localhost:18080/core/api/mcp
       - OXYNOTE_AUTH_REALTIME_BETTER_AUTH_SECRET=e2esecret
       - OXYNOTE_AUTH_REALTIME_MAX_ORGANIZATION_MEMBERS=5
       - OXYNOTE_AUTH_REALTIME_MAX_ORGANIZATIONS=50
@@ -108,6 +110,12 @@ services:
       - OXYNOTE_CORE_STORAGE_SECRET_KEY=chad_warrior
       - OXYNOTE_CORE_STORAGE_BUCKET=e2e
       - OXYNOTE_CORE_SERVER_AUTH_BETTER_AUTH_URL=http://auth-realtime:8081/api/auth/get-session
+      # the MCP surface: core validates bearer tokens against auth-realtime
+      # over the compose network, and the resource URL is the public
+      # identity of that surface — it has to match auth-realtime's
+      # MCP_RESOURCE exactly or issued tokens fail their audience check.
+      - OXYNOTE_CORE_SERVER_MCP_SESSION_URL=http://auth-realtime:8081/api/internal/mcp/session
+      - OXYNOTE_CORE_SERVER_MCP_RESOURCE_URL=http://localhost:18080/core/api/mcp
       - OXYNOTE_CORE_AUTH_REALTIME_URL=http://auth-realtime:8081
       - OXYNOTE_CORE_SERVER_PUBLIC_URL=http://localhost:18080/core
       - OXYNOTE_CORE_BASE_APP_URL=http://localhost:18080

server/auth-realtime/src/auth.ts

@@ -23,7 +23,6 @@ const PUBLIC_AUTH_BASE_URL = process.env
 
 const AUTH_ORIGIN = new URL(PUBLIC_AUTH_BASE_URL).origin
 
-<<<<<<< HEAD
 // the canonical MCP protected-resource URL (RFC 8707/9728) — core's MCP
 // endpoint as clients reach it through the front door. Issued access tokens
 // are audience-bound to it.
@@ -33,7 +32,7 @@ export const MCP_RESOURCE = process.env
 // MCP access tokens carry better-auth's resolved base URL (origin + basePath)
 // as their issuer. The internal MCP session endpoint verifies against it.
 export const MCP_TOKEN_ISSUER = `${AUTH_ORIGIN}/api/auth`
-=======
+
 // better-auth's limiter buckets by client IP, and sign-in and sign-up
 // share one allowance of three requests per ten seconds. That is wrong
 // for any caller whose traffic arrives from a single address on behalf
@@ -42,7 +41,6 @@ export const MCP_TOKEN_ISSUER = `${AUTH_ORIGIN}/api/auth`
 // switched off and left to whatever sits in front.
 const RATE_LIMIT_DISABLED =
 	process.env.OXYNOTE_AUTH_REALTIME_RATE_LIMIT_DISABLED === "true"
->>>>>>> c8db990 (add e2e tests)
 
 const GOOGLE_CONFIGURED = Boolean(
 	process.env.OXYNOTE_AUTH_REALTIME_BETTER_AUTH_GOOGLE_CLIENT_ID &&