From 4a8d74386b83724de7a57eeafbe44c020360f9b0 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Sun, 11 Oct 2026 16:07:59 +0200
Subject: [PATCH] Add missing check

---
 .../mcp-authorization.middleware.ts           | 46 ++++++++++++-------
 1 file changed, 29 insertions(+), 17 deletions(-)

diff --git a/apps/api/src/middlewares/mcp-authorization.middleware.ts b/apps/api/src/middlewares/mcp-authorization.middleware.ts
index 902b37db9c..416816f298 100644
--- a/apps/api/src/middlewares/mcp-authorization.middleware.ts
+++ b/apps/api/src/middlewares/mcp-authorization.middleware.ts
@@ -52,28 +52,16 @@ export function createMcpAuthorizationMiddleware({
     });
 
     if (!impersonation.isActive) {
-      const parameters = [`realm="${MCP_REALM}"`];
-
-      if (accessId) {
-        parameters.push(
-          'error="invalid_token"',
-          'error_description="The access cannot be resolved"'
-        );
-      }
-
-      response.setHeader('WWW-Authenticate', `Bearer ${parameters.join(', ')}`);
-
-      return response.status(StatusCodes.UNAUTHORIZED).json({
-        error: getReasonPhrase(StatusCodes.UNAUTHORIZED),
-        message: 'A valid access is required as a bearer token'
-      });
+      return sendUnauthorizedResponse({ accessId, response });
     }
 
     if (configurationService.get('ENABLE_FEATURE_SUBSCRIPTION')) {
       const user = await userService.user({ id: impersonation.userId });
 
-      // The daily requests of an inactive user are not counted, as in the
-      // strategies
+      if (!user) {
+        return sendUnauthorizedResponse({ accessId, response });
+      }
+
       const isRequestLimitExceeded =
         hasRole(user, 'INACTIVE') ||
         (await userService.isDailyRequestLimitExceeded({ user }));
@@ -99,3 +87,27 @@ export function createMcpAuthorizationMiddleware({
     return next();
   };
 }
+
+function sendUnauthorizedResponse({
+  accessId,
+  response
+}: {
+  accessId: string;
+  response: Response;
+}) {
+  const parameters = [`realm="${MCP_REALM}"`];
+
+  if (accessId) {
+    parameters.push(
+      'error="invalid_token"',
+      'error_description="The access cannot be resolved"'
+    );
+  }
+
+  response.setHeader('WWW-Authenticate', `Bearer ${parameters.join(', ')}`);
+
+  return response.status(StatusCodes.UNAUTHORIZED).json({
+    error: getReasonPhrase(StatusCodes.UNAUTHORIZED),
+    message: 'A valid access is required as a bearer token'
+  });
+}