e77f605c9c
Phase A needed a token pasted into a header, which Anthropic documents as an org-admin-scoped beta on claude.ai and is undocumented on ChatGPT. This makes the app its own authorization server so both connect through their normal "add a connector" flow, with a per-user consent screen. The whole thing funnels into the existing verifyMcpToken: an issued access token is an ordinary McpAccessToken row with source "oauth", so the resource server gained no OAuth awareness and Phase A's verification path is unchanged. Notes on the parts that fail quietly if got wrong: - scopes_supported is published in the protected resource metadata. When a 401 challenge carries no explicit scope Claude requests exactly what is advertised there, so omitting it silently makes every connection read-only. - Loopback redirect URIs match with the port ignored. Claude Code registers http://localhost/callback and then redirects to an ephemeral port; exact matching would reject every native client. RFC 8252 7.3 requires this. - CIMD is deliberately not advertised. Claude only selects it when the metadata carries client_id_metadata_document_supported, and supporting it would mean fetching a client-supplied URL server-side from a host that also reaches MinIO, Postgres and the gateway on the LAN. DCR costs nothing by comparison. - The consent page validates client_id and redirect_uri before it will redirect anywhere, because an unvalidated redirect_uri is an open redirect. - Authorization codes are consumed by one guarded updateMany, so a replay under concurrency cannot mint a second token. A PKCE mismatch burns the whole grant rather than just the code. - Refresh tokens rotate and keep the previous hash; presenting it revokes the grant, since that is either theft or a client that cannot be trusted to hold state. Also fixes the login page, which hardcoded callbackUrl and so dropped anyone sent to sign in for the consent screen onto /dashboard instead. Same-origin destinations only, absolute or relative - the middleware writes absolute. "/.well-known" joins PUBLIC_ROUTES. It is a prefix match, so nothing else should be served from there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W1Ee4Mc1X1SX8HgYa52zu7
This is a Next.js project bootstrapped with create-next-app.
Getting Started
First, run the development server:
npm run dev
# or
yarn dev
# or
pnpm dev
# or
bun dev
Open http://localhost:3000 with your browser to see the result.
You can start editing the page by modifying app/page.tsx. The page auto-updates as you edit the file.
This project uses next/font to automatically optimize and load Geist, a new font family for Vercel.
AI Gateway (Switchboard)
All AI features — menu scanning, label identification, drink search, the bartender
and the recommendation engine — go through Switchboard,
an OpenAI-compatible gateway that routes each request to the best available model.
The app never pins a model id; it always sends switchboard/auto and lets the gateway
choose, then logs which model answered and what it cost.
Setup:
- Set
SWITCHBOARD_BASE_URLin your env file (defaults tohttp://192.168.2.11:8787/v1). - Mint an API key in the Switchboard UI under Settings → API keys.
- Add that key in the app under Settings → AI Gateway.
Per-feature routing (cost/quality levers, token budgets, timeouts) lives in
src/lib/ai/routing.ts. Note that a Switchboard key carries its own routing defaults,
so the app sets category and prefer_free explicitly on every request rather than
inheriting whatever the key was minted for.
Migrating from the old Claude/OpenAI integration
Earlier versions stored a per-user Anthropic or OpenAI key. Those rows are ignored at runtime and the Settings page offers to remove them, so no migration is required. To clear them in bulk instead:
DELETE FROM "UserApiKey" WHERE provider IN ('claude','openai');
DELETE FROM "SearchCache" WHERE provider IN ('claude','openai');
UPDATE "UserPreference" SET "defaultProvider" = NULL;
Learn More
To learn more about Next.js, take a look at the following resources:
- Next.js Documentation - learn about Next.js features and API.
- Learn Next.js - an interactive Next.js tutorial.
You can check out the Next.js GitHub repository - your feedback and contributions are welcome!
Deploy on Vercel
The easiest way to deploy your Next.js app is to use the Vercel Platform from the creators of Next.js.
Check out our Next.js deployment documentation for more details.