From 455abc8ad9101dac7cb446ae69bbb1593d84835c Mon Sep 17 00:00:00 2001
From: swithek <52840391+swithek@users.noreply.github.com>
Date: Sun, 23 Aug 2026 17:56:28 +0200
Subject: [PATCH] update e2e configs

---
 e2e/docker-compose.yaml          | 8 ++++++++
 server/auth-realtime/src/auth.ts | 4 +---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/e2e/docker-compose.yaml b/e2e/docker-compose.yaml
index a180f858..b3b1ff4f 100644
--- a/e2e/docker-compose.yaml
+++ b/e2e/docker-compose.yaml
@@ -69,6 +69,8 @@ services:
       - OXYNOTE_AUTH_REALTIME_FRONTEND_URL=http://localhost:18080
       - OXYNOTE_AUTH_REALTIME_BETTER_AUTH_ORGANIZATION_INVITATION_URL=http://localhost:18080/accept-invite
       - OXYNOTE_AUTH_REALTIME_TRUSTED_ORIGINS=http://localhost:18080
+      # must match core's SERVER_MCP_RESOURCE_URL
+      - OXYNOTE_AUTH_REALTIME_MCP_RESOURCE=http://localhost:18080/core/api/mcp
       - OXYNOTE_AUTH_REALTIME_BETTER_AUTH_SECRET=e2esecret
       - OXYNOTE_AUTH_REALTIME_MAX_ORGANIZATION_MEMBERS=5
       - OXYNOTE_AUTH_REALTIME_MAX_ORGANIZATIONS=50
@@ -108,6 +110,12 @@ services:
       - OXYNOTE_CORE_STORAGE_SECRET_KEY=chad_warrior
       - OXYNOTE_CORE_STORAGE_BUCKET=e2e
       - OXYNOTE_CORE_SERVER_AUTH_BETTER_AUTH_URL=http://auth-realtime:8081/api/auth/get-session
+      # the MCP surface: core validates bearer tokens against auth-realtime
+      # over the compose network, and the resource URL is the public
+      # identity of that surface — it has to match auth-realtime's
+      # MCP_RESOURCE exactly or issued tokens fail their audience check.
+      - OXYNOTE_CORE_SERVER_MCP_SESSION_URL=http://auth-realtime:8081/api/internal/mcp/session
+      - OXYNOTE_CORE_SERVER_MCP_RESOURCE_URL=http://localhost:18080/core/api/mcp
       - OXYNOTE_CORE_AUTH_REALTIME_URL=http://auth-realtime:8081
       - OXYNOTE_CORE_SERVER_PUBLIC_URL=http://localhost:18080/core
       - OXYNOTE_CORE_BASE_APP_URL=http://localhost:18080
diff --git a/server/auth-realtime/src/auth.ts b/server/auth-realtime/src/auth.ts
index f21be5c2..b26c362f 100644
--- a/server/auth-realtime/src/auth.ts
+++ b/server/auth-realtime/src/auth.ts
@@ -23,7 +23,6 @@ const PUBLIC_AUTH_BASE_URL = process.env
 
 const AUTH_ORIGIN = new URL(PUBLIC_AUTH_BASE_URL).origin
 
-<<<<<<< HEAD
 // the canonical MCP protected-resource URL (RFC 8707/9728) — core's MCP
 // endpoint as clients reach it through the front door. Issued access tokens
 // are audience-bound to it.
@@ -33,7 +32,7 @@ export const MCP_RESOURCE = process.env
 // MCP access tokens carry better-auth's resolved base URL (origin + basePath)
 // as their issuer. The internal MCP session endpoint verifies against it.
 export const MCP_TOKEN_ISSUER = `${AUTH_ORIGIN}/api/auth`
-=======
+
 // better-auth's limiter buckets by client IP, and sign-in and sign-up
 // share one allowance of three requests per ten seconds. That is wrong
 // for any caller whose traffic arrives from a single address on behalf
@@ -42,7 +41,6 @@ export const MCP_TOKEN_ISSUER = `${AUTH_ORIGIN}/api/auth`
 // switched off and left to whatever sits in front.
 const RATE_LIMIT_DISABLED =
 	process.env.OXYNOTE_AUTH_REALTIME_RATE_LIMIT_DISABLED === "true"
->>>>>>> c8db990 (add e2e tests)
 
 const GOOGLE_CONFIGURED = Boolean(
 	process.env.OXYNOTE_AUTH_REALTIME_BETTER_AUTH_GOOGLE_CLIENT_ID &&