bugfix

internal/mcp/queries/mcp_tokens.sql

@@ -8,11 +8,15 @@ RETURNING id, token_hash, user_id, name, issuer, scope,
           created_by, created_at;
 
 -- name: GetMcpTokenByHash :one
-SELECT id, token_hash, user_id, name, issuer, scope,
-       acp_session_id, expires_at, last_used_at, revoked_at,
-       created_by, created_at
-FROM mcp_tokens
-WHERE token_hash = $1;
+-- 鉴权用：仅返回属于 enabled 用户的 token，禁用用户的 MCP token 立即失效
+-- （与 web session 解析 GetSessionByTokenHash 的 enabled=true 约束一致）。
+SELECT t.id, t.token_hash, t.user_id, t.name, t.issuer, t.scope,
+       t.acp_session_id, t.expires_at, t.last_used_at, t.revoked_at,
+       t.created_by, t.created_at
+FROM mcp_tokens t
+JOIN users u ON u.id = t.user_id
+WHERE t.token_hash = $1
+  AND u.enabled = true;
 
 -- name: GetMcpTokenByID :one
 SELECT id, token_hash, user_id, name, issuer, scope,