feat: mcp and backfill fixes

backend/src/api/auth.py

@@ -1,3 +1,6 @@
+from secrets import compare_digest
+from urllib.parse import parse_qs
+
 from starlette.types import ASGIApp, Receive, Scope, Send
 
 PROTECTED_PREFIXES = ("/api", "/mcp")
@@ -9,6 +12,15 @@ class BearerAuthMiddleware:
         self.app = app
         self.token = token
 
+    def _authorized(self, scope: Scope) -> bool:
+        headers = dict(scope["headers"])
+        bearer = headers.get(b"authorization", b"").decode()
+        if bearer.startswith("Bearer ") and compare_digest(bearer[7:], self.token):
+            return True
+        query = parse_qs(scope["query_string"].decode())
+        token = query.get("token", [""])[0]
+        return bool(token) and compare_digest(token, self.token)
+
     async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
         if scope["type"] != "http":
             await self.app(scope, receive, send)
@@ -18,9 +30,7 @@ class BearerAuthMiddleware:
         ):
             await self.app(scope, receive, send)
             return
-        headers = dict(scope["headers"])
-        authorization = headers.get(b"authorization", b"").decode()
-        if authorization == f"Bearer {self.token}":
+        if self._authorized(scope):
             await self.app(scope, receive, send)
             return
         await send(