Three bugs fixed for social-login users connecting Claude.ai via OAuth:
1. User OAuth clients now allow 'admin' scope by default — previously
defaulted to ['read', 'write'], causing invalid_scope when Claude.ai
requests 'admin' scope during authorization.
2. Fix JWT tokens with 'aud' claim being rejected by middleware — when
Claude.ai sends RFC 8707 resource parameter, the issued JWT gets an
aud claim. validate_access_token() now sets verify_aud=False to
prevent PyJWT InvalidAudienceError from silently marking valid tokens
as invalid in _is_valid_token().
3. Fix NameError in user_mcp_handler tools/call scope check — key_info
was only defined in the mhu_ auth path but referenced in tools/call
for both paths. Replaced with key_scopes variable set by both mhu_
and JWT auth paths.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Bug fixes (ordered by priority):
- BUG-14 (P1): Fix ImportError in per-user MCP endpoint
- BUG-8 (P2): Raise clear error when PUBLIC_URL missing for OAuth
- BUG-12 (P3): Validate ENCRYPTION_KEY at startup
- BUG-13 (P4): Handle stale JWT gracefully on site creation
- BUG-11 (P5): Add auth validation to WordPress health checks
- BUG-15 (P6): Fix copy button showing Python repr (dict method shadow)
- BUG-1 (P7): Dynamic version from pyproject.toml instead of hardcoded
- BUG-5 (P8): Fix server mode default (sse → streamable-http)
- BUG-9 (P9): Plugin-specific example tools in endpoint instructions
- BUG-4 (P10): Fix settings page sidebar RBAC (session type mismatch)
- BUG-6 (P11): Show real plugin descriptions instead of 'No description'
- BUG-2 (P12): Remove stale 'phase: X.3' from system info
- BUG-10 (P13): Guard timestamps against None in Recent Activity
- BUG-3 (P14): Guard timestamps against None in audit logs
- BUG-7 (P15): Styled 404 page instead of plain text
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Major release introducing the Live Platform architecture:
- SQLite database backend with async operations and migrations (E.1)
- AES-256-GCM credential encryption with HKDF key derivation (E.1)
- OAuth Social Login with GitHub and Google (E.2)
- Site management API with encrypted credential storage (E.3)
- Per-user MCP endpoints at /u/{user_id}/{alias}/mcp (E.3)
- User API keys with bcrypt hashing (E.3)
- Auto-generated config snippets for 5 MCP clients (E.3)
- Dashboard: dark/light mode, RBAC, My Sites, Connect page
- Active background health checks
- 452 tests (up from 303), all passing
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
