feat: add mcp support

.gitignore

@@ -50,4 +50,5 @@ next-env.d.ts
 .nx/
 
 # session status (not committed)
+STATUS.md
 status.md

AGENTS.md

@@ -8,6 +8,7 @@ pnpm workspace + Turborepo. Package manager: `pnpm@11.5.2`.
 apps/
   calendar/        Next.js 16 web app (one-calendar) — main product
   calendar-client/ Tauri + React + Vite desktop client
+  web/             Astro 7 marketing/site app (@astrojs/react + Tailwind v4)
 packages/
   ui/              @zntr/ui — shadcn/ui components (radix-nova style)
   utils/           @zntr/utils — cn(), tailwind-merge, clsx
@@ -16,13 +17,13 @@ packages/
 
 ## Essential commands (run from root)
 
-| Command | What it does |
-|---|---|
-| `pnpm dev` | Start all dev servers |
-| `pnpm build` | Full build (i18n generate → mdx → next build) |
-| `pnpm lint` | oxlint + eslint via turbo (both run per-package) |
-| `pnpm type-check` | `tsc --noEmit` across all packages |
-| `pnpm test` | `vitest run` across all packages |
+| Command           | What it does                                     |
+| ----------------- | ------------------------------------------------ |
+| `pnpm dev`        | Start all dev servers                            |
+| `pnpm build`      | Full build (i18n generate → mdx → next build)    |
+| `pnpm lint`       | oxlint + eslint via turbo (both run per-package) |
+| `pnpm type-check` | `tsc --noEmit` across all packages               |
+| `pnpm test`       | `vitest run` across all packages                 |
 
 Single-package: use `pnpm --filter <name> <script>`, e.g. `pnpm --filter one-calendar dev`.
 
@@ -77,4 +78,4 @@ Conventional commits enforced by commitlint (pre-commit hook): `feat`, `fix`, `d
 - Component UI library (`@zntr/ui`) uses single-file components at `packages/ui/src/*.tsx` with barrel `index.ts`.
 - `calednar-client` is a Tauri desktop app; its `build:tauri` script runs `tsc && vite build`.
 - knip config in root `package.json` tracks known dead-code exceptions.
-- Vercel cron runs daily via `vercel.json`: `GET /api/blob/check` at midnight UTC.
+- Vercel cron runs daily via `vercel.json`: `GET /api/blob/check` at midnight UTC.

apps/calendar/.env.example

@@ -8,6 +8,7 @@ BETTER_AUTH_URL=http://localhost:3000
 
 # Optional
 POSTGRES_URL=postgres://postgres:postgres@localhost:5432/onecalendar
+REDIS_URL=rediss://default:password@your-region.upstash.io:6379
 BETTER_AUTH_API_KEY=your-api-key
 NEXT_PUBLIC_TURNSTILE_SITE_KEY=site-key
 TURNSTILE_SECRET_KEY=secret-key

apps/calendar/app/.well-known/oauth-authorization-server/route.ts

@@ -0,0 +1,31 @@
+import { NextResponse } from 'next/server'
+
+const MCP_BASE_URL = process.env.BETTER_AUTH_URL || 'http://localhost:3000'
+
+export async function GET() {
+  return NextResponse.json({
+    issuer: MCP_BASE_URL,
+    authorization_endpoint: `${MCP_BASE_URL}/oauth/authorize`,
+    token_endpoint: `${MCP_BASE_URL}/api/oauth/token`,
+    registration_endpoint: `${MCP_BASE_URL}/api/oauth/register`,
+    device_authorization_endpoint: `${MCP_BASE_URL}/api/oauth/device`,
+    response_types_supported: ['code'],
+    grant_types_supported: [
+      'authorization_code',
+      'urn:ietf:params:oauth:grant-type:device_code',
+    ],
+    token_endpoint_auth_methods_supported: ['none'],
+    scopes_supported: [
+      'events:read',
+      'events:write',
+      'categories:read',
+      'categories:write',
+      'countdowns:read',
+      'countdowns:write',
+      'settings:read',
+      'settings:write',
+      'profile:read',
+    ],
+    code_challenge_methods_supported: ['S256'],
+  })
+}

apps/calendar/app/.well-known/oauth-protected-resource/route.ts

@@ -0,0 +1,22 @@
+import { NextResponse } from 'next/server'
+
+const MCP_BASE_URL = process.env.BETTER_AUTH_URL || 'http://localhost:3000'
+
+export async function GET() {
+  return NextResponse.json({
+    resource: MCP_BASE_URL,
+    authorization_servers: [MCP_BASE_URL],
+    scopes_supported: [
+      'events:read',
+      'events:write',
+      'categories:read',
+      'categories:write',
+      'countdowns:read',
+      'countdowns:write',
+      'settings:read',
+      'settings:write',
+      'profile:read',
+    ],
+    bearer_methods_supported: ['header'],
+  })
+}

apps/calendar/app/api/events/route.ts

@@ -5,6 +5,13 @@ import { eq, and, gte, lte, inArray } from 'drizzle-orm'
 import { encryptField, encryptJsonField } from '@/lib/field-crypto'
 import crypto from 'crypto'
 import { getAuthedUser, decryptEvent } from '@/lib/api-helpers'
+import {
+  getCachedEvents,
+  setCachedEvents,
+  invalidateEventCache,
+  groupByMonth,
+} from '@/lib/cache/events'
+import { fullMonthRange } from '@/lib/cache/keys'
 
 export const runtime = 'nodejs'
 
@@ -35,8 +42,21 @@ export const GET = async function GET(request: NextRequest) {
   const filters = [eq(calendarEvents.userId, user.id)]
 
   if (startDate && endDate) {
-    filters.push(gte(calendarEvents.startDate, new Date(startDate)))
-    filters.push(lte(calendarEvents.endDate, new Date(endDate)))
+    const cached = await getCachedEvents(user.id, startDate, endDate)
+    if (cached) {
+      let events = cached.map(decryptEvent)
+      if (categoryIds) {
+        const ids = categoryIds.split(',')
+        events = events.filter(
+          (e) => e.categoryId && ids.includes(e.categoryId),
+        )
+      }
+      return NextResponse.json({ events })
+    }
+
+    const range = fullMonthRange(startDate, endDate)
+    filters.push(gte(calendarEvents.startDate, range.start))
+    filters.push(lte(calendarEvents.endDate, range.end))
   }
 
   if (categoryIds) {
@@ -48,7 +68,22 @@ export const GET = async function GET(request: NextRequest) {
     .from(calendarEvents)
     .where(and(...filters))
 
-  return NextResponse.json({ events: results.map(decryptEvent) })
+  const grouped = groupByMonth(results)
+  for (const [ym, monthEvents] of grouped) {
+    await setCachedEvents(user.id, ym, monthEvents)
+  }
+
+  const decrypted = results.map(decryptEvent)
+
+  if (startDate && endDate) {
+    const start = new Date(startDate)
+    const end = new Date(endDate)
+    return NextResponse.json({
+      events: decrypted.filter((e) => e.startDate >= start && e.endDate <= end),
+    })
+  }
+
+  return NextResponse.json({ events: decrypted })
 }
 
 export const POST = async function POST(request: NextRequest) {
@@ -59,6 +94,24 @@ export const POST = async function POST(request: NextRequest) {
   const body: EventInput = await request.json()
   const id = body.id ?? crypto.randomUUID()
 
+  const isUpdate = !!body.id
+  if (isUpdate) {
+    const [old] = await getDb()
+      .select({
+        startDate: calendarEvents.startDate,
+        endDate: calendarEvents.endDate,
+      })
+      .from(calendarEvents)
+      .where(eq(calendarEvents.id, id))
+    if (old) {
+      await invalidateEventCache(
+        user.id,
+        old.startDate.toISOString(),
+        old.endDate.toISOString(),
+      )
+    }
+  }
+
   const [event] = await getDb()
     .insert(calendarEvents)
     .values({
@@ -93,6 +146,8 @@ export const POST = async function POST(request: NextRequest) {
     })
     .returning()
 
+  await invalidateEventCache(user.id, body.startDate, body.endDate)
+
   return NextResponse.json({ event: decryptEvent(event) })
 }
 
@@ -106,9 +161,26 @@ export const DELETE = async function DELETE(request: NextRequest) {
   if (!id)
     return NextResponse.json({ error: 'Missing event id' }, { status: 400 })
 
+  const [old] = await getDb()
+    .select({
+      startDate: calendarEvents.startDate,
+      endDate: calendarEvents.endDate,
+    })
+    .from(calendarEvents)
+    .where(and(eq(calendarEvents.id, id), eq(calendarEvents.userId, user.id)))
+
+  if (!old)
+    return NextResponse.json({ error: 'Event not found' }, { status: 404 })
+
   await getDb()
     .delete(calendarEvents)
     .where(and(eq(calendarEvents.id, id), eq(calendarEvents.userId, user.id)))
 
+  await invalidateEventCache(
+    user.id,
+    old.startDate.toISOString(),
+    old.endDate.toISOString(),
+  )
+
   return NextResponse.json({ success: true })
 }

apps/calendar/app/api/mcp/api-keys/route.ts

@@ -0,0 +1,78 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { getAuthedUser } from '@/lib/api-helpers'
+import {
+  generateApiKey,
+  listApiKeys,
+  revokeApiKey,
+  updateApiKeyScopes,
+} from '@/lib/mcp/auth'
+
+export const runtime = 'nodejs'
+
+export async function GET() {
+  const user = await getAuthedUser()
+  if (!user)
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const keys = await listApiKeys(user.id)
+  return NextResponse.json({ keys })
+}
+
+export async function POST(request: NextRequest) {
+  const user = await getAuthedUser()
+  if (!user)
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const body = await request.json().catch(() => ({}))
+  const { name, scopes } = body as { name?: string; scopes?: string[] }
+
+  if (!name || typeof name !== 'string') {
+    return NextResponse.json({ error: 'Name is required' }, { status: 400 })
+  }
+
+  const key = await generateApiKey(name, user.id, scopes ?? [])
+
+  return NextResponse.json({
+    key,
+    message: 'Save this key now — it will not be shown again',
+  })
+}
+
+export async function PUT(request: NextRequest) {
+  const user = await getAuthedUser()
+  if (!user)
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const body = await request.json().catch(() => ({}))
+  const { id, scopes } = body as { id?: string; scopes?: string[] }
+
+  if (!id) {
+    return NextResponse.json({ error: 'Key ID is required' }, { status: 400 })
+  }
+
+  if (scopes) {
+    await updateApiKeyScopes(id, user.id, scopes)
+  }
+
+  return NextResponse.json({ success: true })
+}
+
+export async function DELETE(request: NextRequest) {
+  const user = await getAuthedUser()
+  if (!user)
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const body = await request.json().catch(() => ({}))
+  const { id } = body as { id?: string }
+
+  if (!id) {
+    return NextResponse.json({ error: 'Key ID is required' }, { status: 400 })
+  }
+
+  const revoked = await revokeApiKey(id, user.id)
+  if (!revoked) {
+    return NextResponse.json({ error: 'Key not found' }, { status: 404 })
+  }
+
+  return NextResponse.json({ success: true })
+}

apps/calendar/app/api/mcp/audit-logs/route.ts

@@ -0,0 +1,30 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { getAuthedUser } from '@/lib/api-helpers'
+import { getAuditLogs, getAuditLogsCount } from '@/lib/mcp/audit'
+
+export const runtime = 'nodejs'
+
+export async function GET(request: NextRequest) {
+  const user = await getAuthedUser()
+  if (!user)
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const { searchParams } = request.nextUrl
+  const page = Number(searchParams.get('page') ?? 1)
+  const limit = Math.min(Number(searchParams.get('limit') ?? 50), 100)
+
+  const [logs, total] = await Promise.all([
+    getAuditLogs(user.id, limit, (page - 1) * limit),
+    getAuditLogsCount(user.id),
+  ])
+
+  return NextResponse.json({
+    logs,
+    pagination: {
+      page,
+      limit,
+      total,
+      totalPages: Math.ceil(total / limit),
+    },
+  })
+}

apps/calendar/app/api/mcp/authorized-apps/route.ts

@@ -0,0 +1,53 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { getAuthedUser } from '@/lib/api-helpers'
+import { getDb } from '@/lib/drizzle/client'
+import { mcpTokens } from '@/lib/drizzle/schema'
+import { eq, and, gte } from 'drizzle-orm'
+
+export const runtime = 'nodejs'
+
+export async function GET() {
+  const user = await getAuthedUser()
+  if (!user)
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const db = await getDb()
+  const apps = await db
+    .select({
+      id: mcpTokens.id,
+      clientId: mcpTokens.clientId,
+      clientName: mcpTokens.clientName,
+      scopes: mcpTokens.scopes,
+      createdAt: mcpTokens.createdAt,
+      expiresAt: mcpTokens.expiresAt,
+      isRevoked: mcpTokens.isRevoked,
+    })
+    .from(mcpTokens)
+    .where(
+      and(eq(mcpTokens.userId, user.id), gte(mcpTokens.expiresAt, new Date())),
+    )
+    .orderBy(mcpTokens.createdAt)
+
+  return NextResponse.json({ apps })
+}
+
+export async function DELETE(request: NextRequest) {
+  const user = await getAuthedUser()
+  if (!user)
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const body = await request.json().catch(() => ({}))
+  const { id } = body as { id?: string }
+
+  if (!id) {
+    return NextResponse.json({ error: 'Token ID is required' }, { status: 400 })
+  }
+
+  const db = await getDb()
+  await db
+    .update(mcpTokens)
+    .set({ isRevoked: true })
+    .where(and(eq(mcpTokens.id, id), eq(mcpTokens.userId, user.id)))
+
+  return NextResponse.json({ success: true })
+}