Feature staging

src/auth/auth.module.ts

@@ -12,6 +12,6 @@ import { ProxyModule } from '../proxy/proxy.module';
   imports: [ProxyModule],
   controllers: [AuthController],
   providers: [OAuthService, DiscoveryService],
-  exports: [OAuthService],
+  exports: [OAuthService, DiscoveryService],
 })
 export class AuthModule {}

src/auth/services/discovery.service.ts

@@ -1,5 +1,6 @@
 import { Injectable, Logger } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
+import { buildSubdomainUrl } from '../../common/utils/url.utils';
 
 /**
  * OAuth 2.1 Discovery Service
@@ -85,4 +86,37 @@ export class DiscoveryService {
       op_tos_uri: `${baseUrl}/terms`,
     };
   }
+
+  getSubdomainResourceMetadata(alias: string): any {
+    const baseUrl = this.configService.get<string>('BASE_URL', 'http://localhost:3001');
+    const subdomainUrl = buildSubdomainUrl(baseUrl, alias);
+
+    this.logger.log(`Generating subdomain resource metadata for alias: ${alias}`);
+
+    return {
+      resource: subdomainUrl,
+      authorization_servers: [subdomainUrl],
+      bearer_methods_supported: ['header'],
+      scopes_supported: ['mcp.tools.read', 'mcp.tools.write'],
+    };
+  }
+
+  getSubdomainAuthServerMetadata(alias: string): any {
+    const baseUrl = this.configService.get<string>('BASE_URL', 'http://localhost:3001');
+    const subdomainUrl = buildSubdomainUrl(baseUrl, alias);
+
+    this.logger.log(`Generating subdomain auth server metadata for alias: ${alias}`);
+
+    return {
+      issuer: subdomainUrl,
+      authorization_endpoint: `${subdomainUrl}/authorize`,
+      token_endpoint: `${subdomainUrl}/token`,
+      registration_endpoint: `${subdomainUrl}/register`,
+      response_types_supported: ['code'],
+      grant_types_supported: ['authorization_code', 'refresh_token'],
+      token_endpoint_auth_methods_supported: ['none', 'client_secret_basic', 'client_secret_post'],
+      code_challenge_methods_supported: ['S256'],
+      scopes_supported: ['mcp.tools.read', 'mcp.tools.write'],
+    };
+  }
 }

src/auth/templates/login-page.template.ts

@@ -22,6 +22,7 @@ export function generateLoginPage(
   },
   meta?: AliasMeta,
   error?: string,
+  loginActionUrl?: string,
 ): string {
   const title = meta?.loginTitle ?? meta?.brandName ?? 'IoT Cloud';
   const logo = meta?.loginLogo ?? '🔐';
@@ -130,7 +131,7 @@ export function generateLoginPage(
         </div>
 
         ${error ? `<div style="background:#ffe6e6;border:1px solid #ffb3b3;color:#8a1f1f;padding:12px;border-radius:6px;margin-bottom:16px;">${error}</div>` : ''}
-        <form method="POST" action="/auth/${projectApiKey}/login">
+        <form method="POST" action="${loginActionUrl ?? `/auth/${projectApiKey}/login`}">
             <div class="form-group">
                 <label for="email">Email</label>
                 <input 

src/common/utils/url.utils.ts

@@ -0,0 +1,18 @@
+/**
+ * @example
+ *   buildSubdomainUrl('https://mcp-stag.dash.id.vn', 'rogo-64770705')
+ *   // → 'https://rogo-64770705.mcp-stag.dash.id.vn'
+ *
+ *   buildSubdomainUrl('http://localhost:3001', 'rogo-64770705')
+ *   // → 'http://localhost:3001'  (localhost/IP — no subdomain)
+ */
+export function buildSubdomainUrl(baseUrl: string, alias: string): string {
+  const url = new URL(baseUrl);
+
+  if (url.hostname === 'localhost' || /^\d+\.\d+\.\d+\.\d+$/.test(url.hostname)) {
+    return baseUrl.replace(/\/+$/, '');
+  }
+
+  url.hostname = `${alias}.${url.hostname}`;
+  return url.origin;
+}

src/mcp/mcp-auth.controller.ts

@@ -0,0 +1,219 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Options,
+  Body,
+  Query,
+  Param,
+  Res,
+  Headers,
+  HttpStatus,
+  Logger,
+  BadRequestException,
+  NotFoundException,
+} from '@nestjs/common';
+import { Response } from 'express';
+import { OAuthService } from '../auth/services/oauth.service';
+import { DiscoveryService } from '../auth/services/discovery.service';
+import { AuthorizeQueryDto } from '../auth/dto/authorize.dto';
+import { TokenRequestDto } from '../auth/dto/token-request.dto';
+import { TokenResponseDto } from '../auth/dto/token-response.dto';
+import { generateLoginPage } from '../auth/templates/login-page.template';
+import { PartnerMetaService } from '../alias/partner-meta.service';
+import { AliasService } from '../alias/alias.service';
+
+/**
+ * Subdomain-routed OAuth controller.
+ *
+ * Nginx rewrites {alias}.domain.com/* → /mcp/{alias}/*
+ * This controller mirrors AuthController's endpoints under that prefix
+ * so OAuth flows work through wildcard subdomains.
+ *
+ * Base-domain access (/auth/{alias}/*) continues to work via AuthController.
+ */
+@Controller('mcp/:alias')
+export class McpAuthController {
+  private readonly logger = new Logger(McpAuthController.name);
+
+  constructor(
+    private readonly oauthService: OAuthService,
+    private readonly discoveryService: DiscoveryService,
+    private readonly partnerMetaService: PartnerMetaService,
+    private readonly aliasService: AliasService,
+  ) {}
+
+  private async resolveOrFail(alias: string): Promise<string> {
+    const apiKey = await this.aliasService.resolveAlias(alias);
+    if (!apiKey) {
+      throw new NotFoundException(`Unknown alias '${alias}'`);
+    }
+    return apiKey;
+  }
+
+  @Get('.well-known/oauth-protected-resource')
+  async getResourceMetadata(@Param('alias') alias: string): Promise<any> {
+    await this.resolveOrFail(alias);
+    return this.discoveryService.getSubdomainResourceMetadata(alias);
+  }
+
+  @Get('.well-known/oauth-authorization-server')
+  async getAuthServerMetadata(@Param('alias') alias: string): Promise<any> {
+    await this.resolveOrFail(alias);
+    return this.discoveryService.getSubdomainAuthServerMetadata(alias);
+  }
+
+  @Get('authorize')
+  async authorize(
+    @Param('alias') alias: string,
+    @Query() query: AuthorizeQueryDto,
+    @Res() res: Response,
+  ): Promise<void> {
+    this.logger.log(`Subdomain authorize for alias: ${alias}`);
+
+    const projectApiKey = await this.resolveOrFail(alias);
+    const meta = await this.partnerMetaService.getAliasMeta(alias);
+
+    const html = generateLoginPage(alias, query, meta ?? undefined, undefined, '/login');
+    res.status(HttpStatus.OK).contentType('text/html').send(html);
+  }
+
+  @Post('login')
+  async login(
+    @Param('alias') alias: string,
+    @Body()
+    body: {
+      email: string;
+      password: string;
+      client_id: string;
+      redirect_uri: string;
+      state: string;
+      code_challenge: string;
+      code_challenge_method: string;
+      scope?: string;
+      resource?: string;
+    },
+    @Res() res: Response,
+  ): Promise<void> {
+    this.logger.log(`Subdomain login for alias: ${alias}`);
+
+    const projectApiKey = await this.resolveOrFail(alias);
+    const meta = await this.partnerMetaService.getAliasMeta(alias);
+
+    try {
+      const authCode = await this.oauthService.handleLogin(
+        projectApiKey,
+        body.email,
+        body.password,
+        body.code_challenge,
+        body.code_challenge_method,
+        body.redirect_uri,
+        body.state,
+        body.scope,
+        body.resource,
+      );
+
+      const redirectUrl = new URL(body.redirect_uri);
+      redirectUrl.searchParams.set('code', authCode);
+      redirectUrl.searchParams.set('state', body.state);
+
+      this.logger.log(`Login successful, redirecting to ${redirectUrl.toString()}`);
+      res.redirect(HttpStatus.FOUND, redirectUrl.toString());
+    } catch (err) {
+      this.logger.warn(`Login failed for ${body.email}: ${err.message}`);
+
+      const oauthParams = {
+        client_id: body.client_id,
+        redirect_uri: body.redirect_uri,
+        state: body.state,
+        code_challenge: body.code_challenge,
+        code_challenge_method: body.code_challenge_method,
+        scope: body.scope,
+        response_type: 'code' as const,
+        resource: body.resource,
+      };
+
+      const html = generateLoginPage(
+        alias,
+        oauthParams,
+        meta ?? undefined,
+        err.message || 'Login failed',
+        '/login',
+      );
+      res.status(HttpStatus.UNAUTHORIZED).contentType('text/html').send(html);
+    }
+  }
+
+  @Options('token')
+  tokenOptions(@Res() res: Response): void {
+    res.header('Access-Control-Allow-Origin', '*');
+    res.header('Access-Control-Allow-Methods', 'POST, OPTIONS');
+    res.header(
+      'Access-Control-Allow-Headers',
+      'Content-Type, Authorization, Accept, x-admin-api-key, x-project-api-key, mcp-protocol-version',
+    );
+    res.header('Access-Control-Allow-Credentials', 'true');
+    res.header('Access-Control-Max-Age', '86400');
+    res.status(HttpStatus.NO_CONTENT).send();
+  }
+
+  @Post('token')
+  async token(
+    @Param('alias') alias: string,
+    @Body() body: TokenRequestDto,
+    @Headers() headers: Record<string, string>,
+  ): Promise<TokenResponseDto> {
+    this.logger.log(`Subdomain token request for alias: ${alias}, grant_type: ${body.grant_type}`);
+
+    const projectApiKey = await this.resolveOrFail(alias);
+
+    let clientId: string | undefined;
+    const authHeader = headers.authorization || headers.Authorization;
+    if (authHeader && authHeader.startsWith('Basic ')) {
+      try {
+        const credentials = Buffer.from(authHeader.substring(6), 'base64').toString('utf-8');
+        const [id] = credentials.split(':');
+        clientId = id;
+        this.logger.debug(`Basic Auth parsed: client_id=${clientId}`);
+      } catch (error) {
+        this.logger.warn(`Failed to parse Basic Auth header: ${error.message}`);
+      }
+    }
+
+    if (body.grant_type === 'authorization_code') {
+      if (!body.code) {
+        throw new BadRequestException('code is required for authorization_code grant');
+      }
+      return this.oauthService.exchangeCode(
+        projectApiKey,
+        body.code,
+        body.code_verifier,
+        body.redirect_uri,
+        body.resource,
+      );
+    }
+
+    if (body.grant_type === 'refresh_token') {
+      if (!body.refresh_token) {
+        throw new BadRequestException('refresh_token is required for refresh_token grant');
+      }
+      return this.oauthService.refreshToken(projectApiKey, body.refresh_token, body.resource);
+    }
+
+    throw new BadRequestException('Unsupported grant_type');
+  }
+
+  @Post('register')
+  async register(@Param('alias') alias: string): Promise<any> {
+    this.logger.log(`Subdomain client registration for alias: ${alias}`);
+    await this.resolveOrFail(alias);
+
+    return {
+      client_id: 'web-client-static',
+      client_id_issued_at: Math.floor(Date.now() / 1000),
+      grant_types: ['authorization_code', 'refresh_token'],
+      response_types: ['code'],
+      token_endpoint_auth_method: 'none',
+    };
+  }
+}

src/mcp/mcp.controller.ts

@@ -17,6 +17,7 @@ import { randomUUID } from 'crypto';
 import { SessionManagerService } from './services/session-manager.service';
 import { McpServerFactory } from './services/mcp-server.factory';
 import { decodeJwt } from '../common/utils/jwt.utils';
+import { buildSubdomainUrl } from '../common/utils/url.utils';
 import { ConfigService } from '@nestjs/config';
 import { AliasService } from '../alias/alias.service';
 import { PartnerMetaService } from '../alias/partner-meta.service';
@@ -86,9 +87,10 @@ export class McpController {
     if (!authorization || !authorization.startsWith('Bearer ')) {
       this.logger.warn(`Missing or invalid Authorization header for alias: ${alias}`);
       const baseUrl = this.configService.get<string>('BASE_URL', 'http://localhost:3001');
+      const subdomainUrl = buildSubdomainUrl(baseUrl, alias);
       res.setHeader(
         'WWW-Authenticate',
-        `Bearer realm="MCP Gateway", resource_metadata="${baseUrl}/.well-known/oauth-protected-resource/mcp/${alias}"`,
+        `Bearer realm="MCP Gateway", resource_metadata="${subdomainUrl}/.well-known/oauth-protected-resource"`,
       );
       res.status(HttpStatus.UNAUTHORIZED).json({
         jsonrpc: '2.0',
@@ -119,9 +121,10 @@ export class McpController {
     } catch (error) {
       this.logger.error(`JWT decode failed for alias ${alias}: ${error.message}`);
       const baseUrl = this.configService.get<string>('BASE_URL', 'http://localhost:3001');
+      const subdomainUrl = buildSubdomainUrl(baseUrl, alias);
       res.setHeader(
         'WWW-Authenticate',
-        `Bearer realm="MCP Gateway", resource_metadata="${baseUrl}/.well-known/oauth-protected-resource/mcp/${alias}"`,
+        `Bearer realm="MCP Gateway", resource_metadata="${subdomainUrl}/.well-known/oauth-protected-resource"`,
       );
       res.status(HttpStatus.UNAUTHORIZED).json({
         jsonrpc: '2.0',

src/mcp/mcp.module.ts

@@ -1,5 +1,6 @@
 import { Module } from '@nestjs/common';
 import { McpController } from './mcp.controller';
+import { McpAuthController } from './mcp-auth.controller';
 import { SessionManagerService } from './services/session-manager.service';
 import { McpServerFactory } from './services/mcp-server.factory';
 import { RedisSessionRepository } from './services/redis-session.repository';
@@ -27,7 +28,7 @@ import { CommonModule } from '../common/common.module';
     AuthModule, // For JWT validation
     CommonModule, // For shared utilities and decorators
   ],
-  controllers: [McpController],
+  controllers: [McpAuthController, McpController],
   providers: [SessionManagerService, McpServerFactory, RedisSessionRepository],
   exports: [SessionManagerService, McpServerFactory, RedisSessionRepository],
 })