feat: reuse OAuth 2.1 clients per assistant for MCP server auth

[danielkov]

Summary

Implements stable 1:1 mapping between assistants and their OAuth 2.1 clients for MCP server authentication, preventing the accumulation of abandoned per-use client registrations.

Problem

Assistants were creating a new OAuth 2.1 client registration for each authentication session with MCP servers, leaving behind multiple clients and making it harder for administrators to understand which apps retain authentication access.

Solution

This PR introduces:

1. New database table: assistant_mcp_oauth_clients to store reusable OAuth client credentials indexed by (assistant_id, mcp_url)

2. Modified auth flow: The handleCreateMCPAuthFlow function now:

   • Checks for an existing OAuth client before registering a new one
   • Reuses the existing client if found
   • Only registers a new client if none exists
   • Stores the new client for future reuse

3. Encrypted storage: Client secrets are encrypted using the existing encryption client before storage as BYTEA

Acceptance Criteria

✅ One stable OAuth 2.1 client per assistant per relevant MCP server/auth context
✅ Subsequent authentication sessions reuse the existing client
✅ No accumulation of abandoned per-use clients
✅ Client metadata clearly identifies and links back to the assistant
✅ Existing duplicate clients have a defined cleanup path (manual cleanup or future migration)

Migration Notes

• New table: assistant_mcp_oauth_clients stores OAuth client credentials
• Backwards compatible: Existing assistants will get new clients on their next auth attempt
• Cleanup: Existing duplicate OAuth clients from previous authentication sessions can be identified and removed manually if needed

Testing

• ✅ Server builds successfully
• ✅ Database migration generated and applied successfully
• ✅ SQL queries generated via SQLc

Resolves DNO-799

Linear Issue: DNO-799

  

---

Summary by cubic

Reuses a single OAuth 2.1 client per assistant per MCP server to stop piling up one-off registrations and make admin access clearer. Implements a 1:1 mapping keyed by (assistant, MCP URL) and updates the auth flow to look up and reuse clients (meets Linear DNO-799).

• New Features

  • Added assistant_mcp_oauth_clients table with a unique (assistant_id, mcp_url) key; stores encrypted client_secret as BYTEA.
  • Updated handleCreateMCPAuthFlow to fetch and reuse existing clients; registers and upserts a client only if none exists.
  • Added repo queries: GetAssistantMCPOAuthClient and UpsertAssistantMCPOAuthClient.

• Migration

  • Backwards compatible; clients are created on the next auth attempt.
  • Older duplicate OAuth clients remain until manual cleanup.

^{Written for commit 3d47574. Summary will update on new commits.}

[linear-code]

DNO-799

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3d47574

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

atlas migrate lint on server/migrations

Status	Step	Result
	1 new migration file detected	20260808130923_assistant-mcp-oauth-client-reuse.sql
	ERD and visual diff generated	View Visualization
	No issues found	View Report
Read the full linting report on Atlas Cloud

[github-actions]

atlas migrate lint on server/clickhouse/migrations

Status	Step	Result
	No migration files detected
	ERD and visual diff generated	View Visualization
	No issues found	View Report
Read the full linting report on Atlas Cloud