feat: opt web ux

packages/mcp/src/auth.ts

@@ -12,22 +12,37 @@ export async function mcpAuth(req: Request, res: Response, next: NextFunction):
   }
 
   const apiKey = header.slice(7);
-  const project = await prisma.project.findUnique({
-    where: { id: projectId },
+  const prefix = apiKey.slice(0, 12);
+
+  // Find user by API key prefix for fast lookup
+  const user = await prisma.user.findFirst({
+    where: { apiKeyPrefix: prefix },
     select: { id: true, apiKeyHash: true },
   });
 
+  if (!user || !user.apiKeyHash) {
+    res.status(401).json({ error: 'Invalid API key' });
+    return;
+  }
+
+  // Verify API key with bcrypt
+  const valid = await bcrypt.compare(apiKey, user.apiKeyHash);
+  if (!valid) {
+    res.status(401).json({ error: 'Invalid API key' });
+    return;
+  }
+
+  // Verify user owns the project
+  const project = await prisma.project.findFirst({
+    where: { id: projectId, userId: user.id },
+    select: { id: true },
+  });
+
   if (!project) {
     res.status(404).json({ error: 'Project not found' });
     return;
   }
 
-  const valid = await bcrypt.compare(apiKey, project.apiKeyHash);
-  if (!valid) {
-    res.status(401).json({ error: 'Invalid API key' });
-    return;
-  }
-
   (req as any).projectId = projectId;
   next();
 }