fix(auth): prevent cross-tenant connection enumeration via OAuth metadata endpoints

[0xcucumbersalad]

Summary

• AUTHZ-VULN-06: OAuth discovery endpoints (/.well-known/oauth-protected-resource/mcp/:connectionId) performed unscoped findById and returned distinct 404/502 status codes, creating an unauthenticated connection existence oracle
• Passes ctx.organization?.id to findById so connection lookups are org-scoped when auth context is available
• Normalizes error responses: both "connection not found" and "upstream fetch failed" now return identical 404 responses, eliminating the enumeration oracle
• Same fix applied to the authorization server metadata endpoint (/.well-known/oauth-authorization-server/oauth-proxy/:connectionId)

Test plan

• bun test apps/mesh/src/api/routes/oauth-proxy.test.ts — 26/26 pass
• Updated existing "returns 502 when origin fetch fails" test to verify new 404 behavior
• Added new test: "returns same 404 for non-existent and unreachable connections (no enumeration oracle)"
• bun run lint — passes
• bun run fmt — passes

🤖 Generated with Claude Code

---

Summary by cubic

Prevents cross-tenant connection enumeration by scoping OAuth discovery lookups to the organization and normalizing errors to a single 404 response.

• Bug Fixes
  • Pass ctx.organization?.id to findById so connection lookups are org-scoped.
  • Return 404 for both “connection not found” and upstream fetch failures to avoid existence oracles.
  • Apply the same behavior to both endpoints: /.well-known/oauth-protected-resource/mcp/:connectionId and /.well-known/oauth-authorization-server/oauth-proxy/:connectionId.
  • Update tests to assert unified 404 responses and prevent enumeration.

^{Written for commit 60911bd. Summary will update on new commits.}

[github-actions]

🧪 Benchmark

Should we run the Virtual MCP strategy benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[github-actions]

Release Options

Suggested: Patch (2.248.8) — based on fix: prefix

React with an emoji to override the release type:

Reaction	Type	Next Version
👍	Prerelease	2.248.8-alpha.1
🎉	Patch	2.248.8
❤️	Minor	2.249.0
🚀	Major	3.0.0

Current version: 2.248.7

Note: If multiple reactions exist, the smallest bump wins. If no reactions, the suggested bump is used (default: patch).

[cubic-dev-ai]

No issues found across 2 files