From 08ea548eb3b9b27b921796c11e275789b196f3c7 Mon Sep 17 00:00:00 2001
From: Volodymyr Vreshch <vreshch@gmail.com>
Date: Sun, 30 Nov 2025 23:29:57 +0100
Subject: [PATCH] fix: resolve user ID mismatch in agent routes for device auth
 flow

The JWT auth middleware sets req.user.userId, but agent routes were
accessing req.user.id (only set during OAuth callback). This caused
'User not found' errors when publishing agents via CLI/device code auth.

Updated all agent routes to support both authentication methods:
- req.user.userId (JWT/device code auth)
- req.user.id or req.user._id (OAuth callback auth)

Affected routes:
- publish.ts, delete.ts, update-metadata.ts (required auth)
- get-agent.ts, search.ts, list.ts, versions.ts, get-version.ts, mcp-servers.ts (optional auth)
---
 packages/backend/src/routes/agents/delete.ts          | 10 +++++++++-
 packages/backend/src/routes/agents/get-agent.ts       |  3 ++-
 packages/backend/src/routes/agents/get-version.ts     |  3 ++-
 packages/backend/src/routes/agents/list.ts            |  3 ++-
 packages/backend/src/routes/agents/mcp-servers.ts     |  6 ++++--
 packages/backend/src/routes/agents/publish.ts         | 10 +++++++++-
 packages/backend/src/routes/agents/search.ts          |  3 ++-
 packages/backend/src/routes/agents/update-metadata.ts | 10 +++++++++-
 packages/backend/src/routes/agents/versions.ts        |  3 ++-
 9 files changed, 41 insertions(+), 10 deletions(-)

diff --git a/packages/backend/src/routes/agents/delete.ts b/packages/backend/src/routes/agents/delete.ts
index 597f75b..2199c41 100644
--- a/packages/backend/src/routes/agents/delete.ts
+++ b/packages/backend/src/routes/agents/delete.ts
@@ -29,7 +29,15 @@ export const deleteAgentHandler = (serviceProvider: ServiceProvider<AppServiceMa
 
       const { owner, name } = req.params;
       const { version } = req.query;
-      const userId = (req.user as { id: string }).id;
+      // Support both JWT auth (userId) and OAuth callback (id/_id)
+      const userId = req.user.userId || req.user.id || req.user._id?.toString();
+      if (!userId) {
+        return res.status(401).json({
+          success: false,
+          error: 'Unauthorized',
+          message: 'User ID not found in token',
+        });
+      }
 
       if (version) {
         logger.info('Delete agent version requested', { owner, name, version, userId });
diff --git a/packages/backend/src/routes/agents/get-agent.ts b/packages/backend/src/routes/agents/get-agent.ts
index f8fbeef..f34c4d3 100644
--- a/packages/backend/src/routes/agents/get-agent.ts
+++ b/packages/backend/src/routes/agents/get-agent.ts
@@ -18,7 +18,8 @@ export const getAgentHandler = (serviceProvider: ServiceProvider<AppServiceMap>)
       const agentService = await serviceProvider.get('agent');
 
       const { owner, name } = req.params;
-      const userId = (req.user as { id: string } | undefined)?.id;
+      // Support both JWT auth (userId) and OAuth callback (id/_id)
+      const userId = req.user?.userId || req.user?.id || req.user?._id?.toString();
 
       logger.info('Get agent requested', { owner, name, userId });
 
diff --git a/packages/backend/src/routes/agents/get-version.ts b/packages/backend/src/routes/agents/get-version.ts
index a5d00f3..9a3c7b3 100644
--- a/packages/backend/src/routes/agents/get-version.ts
+++ b/packages/backend/src/routes/agents/get-version.ts
@@ -19,7 +19,8 @@ export const getAgentVersionHandler = (serviceProvider: ServiceProvider<AppServi
       const agentService = await serviceProvider.get('agent');
 
       const { owner, name, version } = req.params;
-      const userId = (req.user as { id: string } | undefined)?.id;
+      // Support both JWT auth (userId) and OAuth callback (id/_id)
+      const userId = req.user?.userId || req.user?.id || req.user?._id?.toString();
 
       logger.info('Get agent version requested', { owner, name, version, userId });
 
diff --git a/packages/backend/src/routes/agents/list.ts b/packages/backend/src/routes/agents/list.ts
index 6f212fc..399e6a9 100644
--- a/packages/backend/src/routes/agents/list.ts
+++ b/packages/backend/src/routes/agents/list.ts
@@ -23,7 +23,8 @@ export const getListAgentsHandler = (serviceProvider: ServiceProvider<AppService
         sort: (req.query.sort as 'downloads' | 'updated' | 'created' | 'name') || 'downloads',
       };
 
-      const userId = (req.user as { id: string } | undefined)?.id;
+      // Support both JWT auth (userId) and OAuth callback (id/_id)
+      const userId = req.user?.userId || req.user?.id || req.user?._id?.toString();
 
       logger.info('List agents requested', { filters, userId });
 
diff --git a/packages/backend/src/routes/agents/mcp-servers.ts b/packages/backend/src/routes/agents/mcp-servers.ts
index 458ffe2..18206d4 100644
--- a/packages/backend/src/routes/agents/mcp-servers.ts
+++ b/packages/backend/src/routes/agents/mcp-servers.ts
@@ -19,7 +19,8 @@ export const getMcpServersHandler = (serviceProvider: ServiceProvider<AppService
 
       const page = Number(req.query.page) || 1;
       const limit = Number(req.query.limit) || 20;
-      const userId = (req.user as { id: string } | undefined)?.id;
+      // Support both JWT auth (userId) and OAuth callback (id/_id)
+      const userId = req.user?.userId || req.user?.id || req.user?._id?.toString();
 
       logger.info('List agents with MCP servers requested', { page, limit, userId });
 
@@ -62,7 +63,8 @@ export const getAgentsByMcpServerHandler = (serviceProvider: ServiceProvider<App
       const { serverName } = req.params;
       const page = Number(req.query.page) || 1;
       const limit = Number(req.query.limit) || 20;
-      const userId = (req.user as { id: string } | undefined)?.id;
+      // Support both JWT auth (userId) and OAuth callback (id/_id)
+      const userId = req.user?.userId || req.user?.id || req.user?._id?.toString();
 
       logger.info('List agents by MCP server requested', { serverName, page, limit, userId });
 
diff --git a/packages/backend/src/routes/agents/publish.ts b/packages/backend/src/routes/agents/publish.ts
index 0558527..604c217 100644
--- a/packages/backend/src/routes/agents/publish.ts
+++ b/packages/backend/src/routes/agents/publish.ts
@@ -21,7 +21,15 @@ export const publishAgentHandler = (serviceProvider: ServiceProvider<AppServiceM
         });
       }
 
-      const userId = (req.user as { id: string }).id;
+      // Support both JWT auth (userId) and OAuth callback (id/_id)
+      const userId = req.user.userId || req.user.id || req.user._id?.toString();
+      if (!userId) {
+        return res.status(401).json({
+          success: false,
+          error: 'Unauthorized',
+          message: 'User ID not found in token',
+        });
+      }
 
       logger.info('Publish agent requested', { userId, name: req.body.name });
 
diff --git a/packages/backend/src/routes/agents/search.ts b/packages/backend/src/routes/agents/search.ts
index c810b53..0f686e3 100644
--- a/packages/backend/src/routes/agents/search.ts
+++ b/packages/backend/src/routes/agents/search.ts
@@ -21,7 +21,8 @@ export const searchAgentsHandler = (serviceProvider: ServiceProvider<AppServiceM
         visibility: req.query.visibility as 'public' | 'private' | 'all' | undefined,
       };
 
-      const userId = (req.user as { id: string } | undefined)?.id;
+      // Support both JWT auth (userId) and OAuth callback (id/_id)
+      const userId = req.user?.userId || req.user?.id || req.user?._id?.toString();
 
       logger.info('Search agents requested', { query, filters, userId });
 
diff --git a/packages/backend/src/routes/agents/update-metadata.ts b/packages/backend/src/routes/agents/update-metadata.ts
index fd9f0f8..5f16635 100644
--- a/packages/backend/src/routes/agents/update-metadata.ts
+++ b/packages/backend/src/routes/agents/update-metadata.ts
@@ -27,7 +27,15 @@ export const updateAgentMetadataHandler = (serviceProvider: ServiceProvider<AppS
       }
 
       const { owner, name } = req.params;
-      const userId = (req.user as { id: string }).id;
+      // Support both JWT auth (userId) and OAuth callback (id/_id)
+      const userId = req.user.userId || req.user.id || req.user._id?.toString();
+      if (!userId) {
+        return res.status(401).json({
+          success: false,
+          error: 'Unauthorized',
+          message: 'User ID not found in token',
+        });
+      }
 
       logger.info('Update agent metadata requested', { owner, name, userId });
 
diff --git a/packages/backend/src/routes/agents/versions.ts b/packages/backend/src/routes/agents/versions.ts
index a6814ba..51b6cc5 100644
--- a/packages/backend/src/routes/agents/versions.ts
+++ b/packages/backend/src/routes/agents/versions.ts
@@ -18,7 +18,8 @@ export const getAgentVersionsHandler = (serviceProvider: ServiceProvider<AppServ
       const agentService = await serviceProvider.get('agent');
 
       const { owner, name } = req.params;
-      const userId = (req.user as { id: string } | undefined)?.id;
+      // Support both JWT auth (userId) and OAuth callback (id/_id)
+      const userId = req.user?.userId || req.user?.id || req.user?._id?.toString();
 
       logger.info('Get agent versions requested', { owner, name, userId });