mcp connection

go-api/internal/domain/definitions_schema_test.go

@@ -724,6 +724,15 @@ func TestMigrationPairsAreComplete(t *testing.T) {
 		"000009_confirmation_replay.up.sql",
 		"000010_definition_versions.up.sql",
 		"000011_employee_roles.up.sql",
+		// Phase 3: the OAuth 2.1 authorization server behind the MCP surface.
+		// Three tables, added together because they are one feature: a client
+		// registers, is issued a code, and exchanges it for tokens.
+		"000012_oauth_clients.up.sql",
+		"000013_oauth_grants.up.sql",
+		"000014_oauth_tokens.up.sql",
+		// Phase 5: shared rate limit counters, so a limit means the same thing
+		// behind one instance and behind ten.
+		"000015_rate_limits.up.sql",
 	}
 	if len(ups) != len(want) {
 		t.Fatalf("%d migrations, want %d — update this list deliberately", len(ups), len(want))
@@ -753,11 +762,28 @@ func TestMigrationsAddOnlyTheTablesWeDecidedOn(t *testing.T) {
 	// 17 from 000001, + auth_sessions (000004), + agent_definitions and
 	// skill_definitions (000005), + agent_runs (000006), + agent_confirmations
 	// (000007), + knowledge_documents and knowledge_chunks (000008),
-	// + definition_versions (000010), + employee_roles (000011).
+	// + definition_versions (000010), + employee_roles (000011),
+	// + oauth_clients (000012), + oauth_grants (000013), + oauth_tokens
+	// (000014), + rate_limits (000015).
 	// schema_migrations is golang-migrate's and is absent when the files are
 	// applied directly.
-	if n != 26 {
-		t.Errorf("%d base tables after every migration, want 26", n)
+	if n != 30 {
+		t.Errorf("%d base tables after every migration, want 30", n)
+	}
+
+	// The three OAuth tables, named rather than merely counted. The count
+	// above catches a table arriving without a decision; this catches one of
+	// these three going missing, which the count alone would not if another
+	// arrived in the same change.
+	for _, required := range []string{"oauth_clients", "oauth_grants", "oauth_tokens", "rate_limits"} {
+		var reg *string
+		if err := f.pool.QueryRow(f.ctx,
+			`SELECT to_regclass('public.' || $1)::text`, required).Scan(&reg); err != nil {
+			t.Fatalf("check %s: %v", required, err)
+		}
+		if reg == nil {
+			t.Errorf("%s is missing; the MCP OAuth surface cannot work without it", required)
+		}
 	}
 
 	// `definition_versions` was on this list, deferred by the Phase 4B decision.