feat: MCP SDK client, PKCE fix, attribute persistence, skills assignment UI, registry browsing

- Add MCP SDK client helper (mcp-client.ts) using @modelcontextprotocol/sdk
- Refactor mcp-servers health check and tools to use SDK client
- Fix PKCE double-login: detect OAuth callback in authStore.initialize()
- Fix Keycloak attribute reading (string vs array) with getAttr() helper
- Add MCP/skills attribute persistence in all SMART app CRUD handlers
- Add client_type=agent filter so AI agents appear in SMART apps list
- Extract shared AssignAppsDialog component for MCP/skills assignment
- Add skills assignment UI to Skills tab with badges
- Add MCP registry browsing, consent monitoring, FHIR monitoring routes
- Add skills.sh client, runtime config, consent/IAL settings UI
- Gate console.logs behind import.meta.env.DEV
- Remove deprecated Fly.io configs

[skip northflank]

Author: quotentiroler

.env.example

@@ -0,0 +1,58 @@
+# ╔═══════════════════════════════════════════════════════════╗
+# ║  Proxy Smart — Environment Variables                     ║
+# ╚═══════════════════════════════════════════════════════════╝
+# Copy this file to .env and fill in the values for your environment.
+
+# ── Core ──────────────────────────────────────────────────
+NODE_ENV=development          # development | production
+PORT=8445                     # HTTP listen port
+BASE_URL=http://localhost:8445
+
+# ── CORS ──────────────────────────────────────────────────
+# Comma-separated list of allowed origins.
+# In development mode, localhost origins are allowed by default.
+# In production, only these origins (or BASE_URL) are permitted.
+# CORS_ORIGINS=https://app.example.com,https://admin.example.com
+
+# ── Keycloak / Auth ──────────────────────────────────────
+KEYCLOAK_BASE_URL=http://localhost:8080
+KEYCLOAK_REALM=proxy-smart
+# KEYCLOAK_DOMAIN=               # Public hostname (if different from KEYCLOAK_BASE_URL)
+# KEYCLOAK_ADMIN_CLIENT_ID=admin-service
+# KEYCLOAK_ADMIN_CLIENT_SECRET=  # Required in production
+
+# Dev-only: set both to bypass admin role checks (never in production)
+# ALLOW_DEV_AUTH_BYPASS=true
+
+# ── FHIR ─────────────────────────────────────────────────
+FHIR_SERVER_BASE=http://localhost:8081/fhir
+# FHIR_SUPPORTED_VERSIONS=R4    # Comma-separated: R4,R5
+
+# ── SMART on FHIR ───────────────────────────────────────
+# SMART_CONFIG_CACHE_TTL=300000  # ms (default 5 min)
+# SMART_SCOPES_SUPPORTED=        # Comma-separated override
+# SMART_CAPABILITIES=            # Comma-separated override
+
+# ── AI Assistant ─────────────────────────────────────────
+# OPENAI_API_KEY=                # Enables built-in AI assistant
+# AI_TIMEOUT_MS=30000            # Request timeout for AI calls
+
+# ── Consent & IAL ────────────────────────────────────────
+# Managed via Admin UI → Consent & IAL tab (persisted in Keycloak).
+# Env vars below serve as initial defaults before first admin save.
+# CONSENT_ENABLED=false
+# CONSENT_MODE=disabled          # enforce | audit-only | disabled
+# IAL_ENABLED=false
+
+# ── Kisi (Physical Access Control) ──────────────────────
+# KISI_API_KEY=
+# KISI_BASE_URL=https://api.kisi.io
+# KISI_TIMEOUT_MS=10000
+
+# ── UniFi Access (Physical Access Control) ──────────────
+# UNIFI_ACCESS_HOST=
+# UNIFI_ACCESS_USERNAME=
+# UNIFI_ACCESS_PASSWORD=
+
+# ── Docker ───────────────────────────────────────────────
+# DOCKER=true                    # Set automatically in containers

.github/instructions/instructions.md

@@ -4,4 +4,6 @@ Never write fetch functions in the frontend, always generate from openapi backen
 
 check in package.json how to generate client apis in doubt
 
-follow the concept of DRY! and use existing code patterns
+follow the concept of DRY! and use existing code patterns
+
+mind that we use ui\src\i18n\translations

.github/workflows/ai-build-test-backend.yml

@@ -255,7 +255,7 @@ jobs:
         run: |
           echo "Running backend tests..."
           cd backend
-          # bun test 2>&1 | tee ../backend-test.log
+          bun test 2>&1 | tee ../backend-test.log
 
       - name: Check Test Results
         if: ${{ inputs.run_tests }}

.github/workflows/deploy-alpha.yml

@@ -92,12 +92,12 @@ jobs:
           cat > backend/.env << ENVEOF
           NODE_ENV=beta
           VERSION=${{ inputs.app_version }}
-          BASE_URL=https://beta.proxy-smart.your-domain.com
+          BASE_URL=${BASE_URL:?Set BASE_URL}
           PORT=3002
-          FHIR_SERVER_BASE=https://hapi.fhir.org/baseR4
-          KEYCLOAK_BASE_URL=https://auth-beta.proxy-smart.your-domain.com
+          FHIR_SERVER_BASE=${FHIR_SERVER_BASE:-https://hapi.fhir.org/baseR4}
+          KEYCLOAK_BASE_URL=${KEYCLOAK_BASE_URL:?Set KEYCLOAK_BASE_URL}
           KEYCLOAK_REALM=proxy-smart
-          DATABASE_URL=postgresql://proxyuser:secure_password@localhost:5432/proxy_smart_beta
+          DATABASE_URL=${DATABASE_URL:?Set DATABASE_URL}
           ENVEOF
           
           # Restart services

.github/workflows/deploy-beta.yml

@@ -32,10 +32,6 @@ on:
         description: "Target platform where app was deployed"
         value: ${{ jobs.output-deployment-urls.outputs.deployment_target }}
     secrets:
-      FLY_API_TOKEN:
-        required: false
-      ALPHA_DB_PASSWORD:
-        required: false
       VPS_SSH_KEY:
         required: false
       VPS_HOST:
@@ -56,19 +52,6 @@ on:
         required: false
 
 jobs:
-  # DEPRECATED: Alpha deployment is now handled automatically by Northflank CD
-  # This job is kept as reference but should not be called
-  deploy-alpha:
-    name: Deploy Alpha (DEPRECATED - Northflank handles this automatically)
-    if: inputs.deployment_stage == 'alpha' && false  # Disabled - Northflank CD handles alpha deployment
-    uses: ./.github/workflows/deploy-alpha.yml
-    with:
-      app_version: ${{ inputs.app_version }}
-      source_branch: ${{ inputs.source_branch }}
-    secrets:
-      FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
-      ALPHA_DB_PASSWORD: ${{ secrets.ALPHA_DB_PASSWORD }}
-
   deploy-beta:
     name: Deploy Beta (VPS)
     if: inputs.deployment_stage == 'beta'
@@ -98,7 +81,7 @@ jobs:
   output-deployment-urls:
     name: Output Deployment URLs
     runs-on: ubuntu-latest
-    needs: [deploy-alpha, deploy-beta, deploy-production]
+    needs: [deploy-beta, deploy-production]
     if: always()
     outputs:
       fhir_server_url: ${{ steps.set-outputs.outputs.fhir_server_url }}
@@ -118,22 +101,7 @@ jobs:
           echo "deployment_target=unknown" >> $GITHUB_OUTPUT
           
           # Determine the job result and set appropriate values
-          if [ "${{ inputs.deployment_stage }}" = "alpha" ]; then
-            ALPHA_RESULT="${{ needs.deploy-alpha.result }}"
-            echo "Alpha deployment result: $ALPHA_RESULT"
-            
-            if [ "$ALPHA_RESULT" = "success" ]; then
-              echo "fhir_server_url=${{ needs.deploy-alpha.outputs.fhir_server_url }}" >> $GITHUB_OUTPUT
-              echo "keycloak_url=${{ needs.deploy-alpha.outputs.keycloak_url }}" >> $GITHUB_OUTPUT
-              echo "app_url=${{ needs.deploy-alpha.outputs.app_url }}" >> $GITHUB_OUTPUT
-              echo "deployment_status=${{ needs.deploy-alpha.outputs.deployment_status }}" >> $GITHUB_OUTPUT
-              echo "deployment_target=${{ needs.deploy-alpha.outputs.deployment_target }}" >> $GITHUB_OUTPUT
-            else
-              echo "deployment_status=$ALPHA_RESULT" >> $GITHUB_OUTPUT
-              echo "deployment_target=northflank" >> $GITHUB_OUTPUT
-            fi
-            
-          elif [ "${{ inputs.deployment_stage }}" = "beta" ]; then
+          if [ "${{ inputs.deployment_stage }}" = "beta" ]; then
             BETA_RESULT="${{ needs.deploy-beta.result }}"
             echo "Beta deployment result: $BETA_RESULT"
             

.github/workflows/deployment-strategy.yml

@@ -51,8 +51,6 @@ on:
         required: false
       DISCORD_WEBHOOK_URL:
         required: false
-      FLY_API_TOKEN:
-        required: false
       VPS_SSH_KEY:
         required: false
       VPS_HOST:
@@ -150,7 +148,7 @@ jobs:
     uses: ./.github/workflows/build-and-test.yml
     with:
       run_tests: true
-      fail_on_test_failure: false
+      fail_on_test_failure: true
 
   # Create GitHub release
   release:

.github/workflows/release-orchestrator.yml

@@ -61,8 +61,8 @@ Then open:
 | Service | URL |
 |---|---|
 | Admin UI | http://localhost:3000 |
-| Backend API | http://localhost:8080 |
-| Keycloak | http://localhost:8090 |
+| Backend API | http://localhost:8445 |
+| Keycloak | http://localhost:8080 |
 
 See the [Getting Started Guide](docs/tutorials/getting-started.md) for initial configuration.
 

README.md

@@ -40,4 +40,7 @@ yarn-error.log*
 **/*.tgz
 **/*.log
 package-lock.json
-**/*.bun
+**/*.bun
+
+# Runtime MCP server config (managed via UI)
+mcp.json

backend/.gitignore

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 export default tseslint.config(
-  { ignores: ["dist/**", "node_modules/**", "**/lib/api-client/**", "public/**"] },
+  { ignores: ["dist/**", "node_modules/**", "**/lib/api-client/**", "**/lib/mcp-registry-client/**", "public/**"] },
   {
     files: ["**/*.{js,ts}"],
     extends: [js.configs.recommended, ...tseslint.configs.recommended],