Merge test to main

[sweetmantech]

Merge test branch changes to main

Summary by CodeRabbit

• New Features

  • Added authentication token support for improved tool access control

• Improvements

  • Enhanced CORS header configuration to support API key authentication in requests

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
recoup-api	Ready	Preview	Jan 20, 2026 6:32pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

This PR refactors the MCP tool retrieval mechanism from in-process to HTTP-based, adds optional authentication token support throughout the chat request pipeline, and enhances streaming responses with CORS headers. The changes include new utility functions for base URL resolution and updated CORS header handling.

Changes

Cohort / File(s)	Summary
Streaming Response CORS Enhancement lib/chat/__tests__/handleChatStream.test.ts, lib/chat/handleChatStream.ts	Updated createUIMessageStreamResponse signature to accept object with stream and optional headers fields; integrated CORS headers via getCorsHeaders() call in streaming response
Authentication Token Pipeline lib/chat/validateChatRequest.ts, lib/chat/__tests__/setupToolsForRequest.test.ts, lib/chat/setupToolsForRequest.ts	Added optional authToken?: string field to ChatRequestBody type; extracted token from request headers; updated setupToolsForRequest to gate MCP tool retrieval on token presence
MCP Tool Retrieval via HTTP lib/mcp/getMcpTools.ts, lib/mcp/__tests__/getMcpTools.test.ts	New module introducing getMcpTools(authToken) function that fetches tools over HTTP with Bearer token authentication; includes unit tests validating HTTP transport configuration and token header propagation
Networking Utilities lib/networking/getBaseUrl.ts, lib/networking/__tests__/getBaseUrl.test.ts, lib/networking/getCorsHeaders.ts	Introduced getBaseUrl() utility returning Vercel or localhost URLs; added test coverage for VERCEL_URL conditions; updated CORS headers to include "x-api-key" in allowed headers

Sequence Diagram

sequenceDiagram
    participant Client
    participant ChatHandler as Chat Request Handler
    participant Validator as Validator
    participant MCP as MCP Service (HTTP)
    participant Sheets as Google Sheets Service
    participant Aggregator as Tool Aggregator

    Client->>ChatHandler: POST /chat with request body
    ChatHandler->>Validator: validateChatRequest(body)
    Validator->>Validator: Extract authToken from headers
    Validator-->>ChatHandler: Return ChatRequestBody + authToken
    
    ChatHandler->>Aggregator: setupToolsForRequest(body + authToken)
    
    alt authToken present
        Aggregator->>MCP: getMcpTools(authToken)
        MCP-->>Aggregator: ToolSet from HTTP endpoint
    else authToken absent
        Aggregator->>Aggregator: Skip MCP tools (empty set)
    end
    
    Aggregator->>Sheets: getGoogleSheetsTools()
    Sheets-->>Aggregator: Google Sheets ToolSet
    
    Aggregator->>Aggregator: Merge tools (Sheets takes precedence)
    Aggregator-->>ChatHandler: Combined ToolSet
    
    ChatHandler->>ChatHandler: Create streaming response
    ChatHandler->>ChatHandler: Add CORS headers via getCorsHeaders()
    ChatHandler-->>Client: UIMessageStream with CORS headers

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• Release: Chat API migration progress #113: Introduces identical changes to handleChatStream for CORS headers and parallel refactor to setupToolsForRequest with getMcpTools authentication flow
• Sweetmantech/myc 3783 email pass input text html to recoup agent call #74: Originally implemented HTTP-based MCP client and tool retrieval patterns that this PR builds upon with authentication token integration

Poem

🐰 Hops through the MCP tunnel with a token in paw,
HTTP brings tools from afar without flaw,
CORS headers flow like carrots in spring,
Authentication's the key to everything! 🔑

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}