Enable FlowFuse User Authentication for Programmatic MCP Clients

[dimitrieh]

Problem

FlowFuse User Authentication for HTTP endpoints uses OAuth browser redirects, which works for Dashboard and browser-based HTTP access but does not work for programmatic MCP clients.

Currently, MCP clients can only authenticate using Bearer Tokens, which:

• Are instance-scoped, not user-scoped
• Don't carry FlowFuse user identity
• Can't be used for per-user access control

Technical Context

The code path exists - MCP endpoints do apply httpNodeMiddleware (mcp-server.js:836-841). However, the FlowFuse User Auth middleware (httpAuthMiddleware.js) uses OAuth browser redirects when no Bearer token is provided:

// httpAuthMiddleware.js line 53-55
req.session.redirectTo = req.originalUrl
passport.authenticate('FlowFuse', { session: false })(req, res, next)  // ← Redirects to browser login

Auth Method	Browser Client	Programmatic MCP Client
Session (ffSession)	Works	N/A (no browser session)
Bearer Token	Works	Works (but no user identity)
OAuth Redirect	Works	Doesn't work (requires browser)

Opportunity

Enable user-aware authentication for MCP endpoints without requiring browser interaction:

• User identity context - MCP server knows which FlowFuse user is making requests
• Per-user access control - Enable RBAC at the MCP level
• Audit trail - Log which user accessed which MCP tools
• Integration with existing auth - Leverage FlowFuse's auth infrastructure

Possible Approaches (Experiment Scope: 1-4 days)

1. OAuth 2.0 Device Authorization Flow (RFC 8628) - Headless OAuth for programmatic clients

   • User visits URL on separate device to authorize
   • Client polls for token

2. User-scoped Bearer Tokens - PATs that carry user identity

   • User creates PAT in FlowFuse UI
   • PAT carries user identity (not just instance access)
   • MCP server receives user context

3. Token exchange - Client exchanges API key for session token

Acceptance Criteria

• Programmatic MCP clients can authenticate without browser interaction
• Authenticated user identity available in MCP server context
• Integrates with SSO-configured teams

Related Issues

• Inject FlowFuse User information into NR Http-in node messgae when FF Auth is used #6165 - Inject FlowFuse User info into HTTP-in nodes (pattern to follow)
• Application-level RBAC for MCP Servers in FlowFuse Expert #6477 - Application-level RBAC for MCP Servers
• Separate Dashboard and HTTP Endpoint authentication #4953 - Separate Dashboard and HTTP Endpoint authentication
• FlowFuse/node-red#133 - FlowFuse expert/MCP planning
• FlowFuse/nr-mcp-server-nodes#28 - Bearer token auth (implemented)

[dimitrieh]

Steve indicated he might need 1-4 days for this

[dimitrieh]

@Steve-Mcl can you give this a review? Take it with a grain of salt. Might need some assumption checking. This should be in line with your intentions as we discussed in the meeting regarding security for MCPs

[Steve-Mcl]

Looks ok on quick read (didnt fact check) - enough info to work against.