@fastybird/smart-panel-backend 1.0.0-beta.2 → 1.1.0-alpha.0

package/dist/modules/mcp/controllers/mcp-oauth-management.controller.js

@@ -0,0 +1,271 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthManagementController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const api_documentation_decorator_1 = require("../../swagger/decorators/api-documentation.decorator");
+const roles_guard_1 = require("../../users/guards/roles.guard");
+const users_constants_1 = require("../../users/users.constants");
+const mcp_oauth_grant_dto_1 = require("../dto/mcp-oauth-grant.dto");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_oauth_management_response_model_1 = require("../models/mcp-oauth-management-response.model");
+const mcp_oauth_management_model_1 = require("../models/mcp-oauth-management.model");
+const mcp_oauth_management_service_1 = require("../services/mcp-oauth-management.service");
+let McpOAuthManagementController = class McpOAuthManagementController {
+    constructor(managementService) {
+        this.managementService = managementService;
+    }
+    async findGrants() {
+        const response = new mcp_oauth_management_response_model_1.McpOAuthGrantsResponseModel();
+        response.data = await this.managementService.findGrants();
+        return response;
+    }
+    async findGrant(id) {
+        const response = new mcp_oauth_management_response_model_1.McpOAuthGrantResponseModel();
+        response.data = await this.managementService.getGrant(id);
+        return response;
+    }
+    async updateGrant(id, body, req) {
+        const response = new mcp_oauth_management_response_model_1.McpOAuthGrantResponseModel();
+        response.data = await this.managementService.updateGrant(id, body.data, this.getActorId(req));
+        return response;
+    }
+    async revokeGrant(id, req) {
+        const response = new mcp_oauth_management_response_model_1.McpOAuthGrantResponseModel();
+        response.data = await this.managementService.revokeGrant(id, this.getActorId(req));
+        return response;
+    }
+    async findAccessTokens() {
+        const response = new mcp_oauth_management_response_model_1.McpOAuthAccessTokensResponseModel();
+        response.data = await this.managementService.findAccessTokens();
+        return response;
+    }
+    async findAccessToken(id) {
+        const response = new mcp_oauth_management_response_model_1.McpOAuthAccessTokenResponseModel();
+        response.data = await this.managementService.getAccessToken(id);
+        return response;
+    }
+    async revokeAccessToken(id, req) {
+        await this.managementService.revokeAccessToken(id, this.getActorId(req));
+    }
+    async findRefreshFamilies() {
+        const response = new mcp_oauth_management_response_model_1.McpOAuthRefreshFamiliesResponseModel();
+        response.data = await this.managementService.findRefreshFamilies();
+        return response;
+    }
+    async findRefreshFamily(id) {
+        const response = new mcp_oauth_management_response_model_1.McpOAuthRefreshFamilyResponseModel();
+        response.data = await this.managementService.getRefreshFamily(id);
+        return response;
+    }
+    async revokeRefreshFamily(id, req) {
+        await this.managementService.revokeRefreshFamily(id, this.getActorId(req));
+    }
+    async revokeAll(req) {
+        await this.managementService.revokeAll(this.getActorId(req));
+        const response = new mcp_oauth_management_response_model_1.McpOAuthGlobalRevocationResponseModel();
+        response.data = Object.assign(new mcp_oauth_management_model_1.McpOAuthGlobalRevocationModel(), { revoked: true });
+        return response;
+    }
+    getActorId(req) {
+        if (req.auth?.type === 'user')
+            return req.auth.id;
+        if (req.auth?.type === 'token' && req.auth.ownerId)
+            return req.auth.ownerId;
+        throw new common_1.ForbiddenException('The authenticated credential is not associated with a user');
+    }
+};
+exports.McpOAuthManagementController = McpOAuthManagementController;
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        tags: [mcp_constants_1.MCP_MODULE_API_TAG_NAME],
+        summary: 'Get MCP OAuth grants',
+        description: 'List OAuth consent grants without exposing provider identifiers or token material',
+        operationId: 'get-mcp-module-oauth-grants',
+    }),
+    (0, api_documentation_decorator_1.ApiSuccessResponse)(mcp_oauth_management_response_model_1.McpOAuthGrantsResponseModel, 'MCP OAuth grants retrieved successfully'),
+    (0, common_1.Get)('grants'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], McpOAuthManagementController.prototype, "findGrants", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        tags: [mcp_constants_1.MCP_MODULE_API_TAG_NAME],
+        summary: 'Get an MCP OAuth grant',
+        description: 'Inspect one OAuth consent grant without exposing provider identifiers or token material',
+        operationId: 'get-mcp-module-oauth-grant',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', description: 'OAuth grant management identifier', type: 'string', format: 'uuid' }),
+    (0, api_documentation_decorator_1.ApiSuccessResponse)(mcp_oauth_management_response_model_1.McpOAuthGrantResponseModel, 'MCP OAuth grant retrieved successfully'),
+    (0, api_documentation_decorator_1.ApiNotFoundResponse)('MCP OAuth grant not found'),
+    (0, common_1.Get)('grants/:id'),
+    __param(0, (0, common_1.Param)('id', new common_1.ParseUUIDPipe({ version: '4' }))),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], McpOAuthManagementController.prototype, "findGrant", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        tags: [mcp_constants_1.MCP_MODULE_API_TAG_NAME],
+        summary: 'Reduce MCP OAuth grant scopes',
+        description: 'Replace the approved scopes with a subset and close only subscriptions whose effective scopes contract',
+        operationId: 'update-mcp-module-oauth-grant',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', description: 'OAuth grant management identifier', type: 'string', format: 'uuid' }),
+    (0, swagger_1.ApiBody)({ type: mcp_oauth_grant_dto_1.ReqUpdateMcpOAuthGrantDto }),
+    (0, api_documentation_decorator_1.ApiSuccessResponse)(mcp_oauth_management_response_model_1.McpOAuthGrantResponseModel, 'MCP OAuth grant scopes updated successfully'),
+    (0, api_documentation_decorator_1.ApiBadRequestResponse)('Approved scopes must be a non-empty subset of the existing grant'),
+    (0, api_documentation_decorator_1.ApiNotFoundResponse)('MCP OAuth grant not found'),
+    (0, common_1.Patch)('grants/:id'),
+    __param(0, (0, common_1.Param)('id', new common_1.ParseUUIDPipe({ version: '4' }))),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, mcp_oauth_grant_dto_1.ReqUpdateMcpOAuthGrantDto, Object]),
+    __metadata("design:returntype", Promise)
+], McpOAuthManagementController.prototype, "updateGrant", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        tags: [mcp_constants_1.MCP_MODULE_API_TAG_NAME],
+        summary: 'Revoke an MCP OAuth grant',
+        description: 'Revoke the grant and its artifacts, then close only subscriptions bound to that grant',
+        operationId: 'revoke-mcp-module-oauth-grant',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', description: 'OAuth grant management identifier', type: 'string', format: 'uuid' }),
+    (0, api_documentation_decorator_1.ApiSuccessResponse)(mcp_oauth_management_response_model_1.McpOAuthGrantResponseModel, 'MCP OAuth grant revoked successfully'),
+    (0, api_documentation_decorator_1.ApiNotFoundResponse)('MCP OAuth grant not found'),
+    (0, common_1.Post)('grants/:id/revoke'),
+    __param(0, (0, common_1.Param)('id', new common_1.ParseUUIDPipe({ version: '4' }))),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], McpOAuthManagementController.prototype, "revokeGrant", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        tags: [mcp_constants_1.MCP_MODULE_API_TAG_NAME],
+        summary: 'Get active MCP OAuth access tokens',
+        description: 'List active access tokens by non-secret management identifier',
+        operationId: 'get-mcp-module-oauth-access-tokens',
+    }),
+    (0, api_documentation_decorator_1.ApiSuccessResponse)(mcp_oauth_management_response_model_1.McpOAuthAccessTokensResponseModel, 'MCP OAuth access tokens retrieved successfully'),
+    (0, common_1.Get)('access-tokens'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], McpOAuthManagementController.prototype, "findAccessTokens", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        tags: [mcp_constants_1.MCP_MODULE_API_TAG_NAME],
+        summary: 'Get an active MCP OAuth access token',
+        description: 'Inspect one active access token by its non-secret management identifier',
+        operationId: 'get-mcp-module-oauth-access-token',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', description: 'Access-token management identifier', type: 'string', format: 'uuid' }),
+    (0, api_documentation_decorator_1.ApiSuccessResponse)(mcp_oauth_management_response_model_1.McpOAuthAccessTokenResponseModel, 'MCP OAuth access token retrieved successfully'),
+    (0, api_documentation_decorator_1.ApiNotFoundResponse)('MCP OAuth access token not found'),
+    (0, common_1.Get)('access-tokens/:id'),
+    __param(0, (0, common_1.Param)('id', new common_1.ParseUUIDPipe({ version: '4' }))),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], McpOAuthManagementController.prototype, "findAccessToken", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        tags: [mcp_constants_1.MCP_MODULE_API_TAG_NAME],
+        summary: 'Revoke an MCP OAuth access token',
+        description: 'Revoke one access token and close only the subscription bound to that token',
+        operationId: 'revoke-mcp-module-oauth-access-token',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', description: 'Access-token management identifier', type: 'string', format: 'uuid' }),
+    (0, swagger_1.ApiNoContentResponse)({ description: 'MCP OAuth access token revoked successfully' }),
+    (0, api_documentation_decorator_1.ApiNotFoundResponse)('MCP OAuth access token not found'),
+    (0, common_1.HttpCode)(204),
+    (0, common_1.Post)('access-tokens/:id/revoke'),
+    __param(0, (0, common_1.Param)('id', new common_1.ParseUUIDPipe({ version: '4' }))),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], McpOAuthManagementController.prototype, "revokeAccessToken", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        tags: [mcp_constants_1.MCP_MODULE_API_TAG_NAME],
+        summary: 'Get active MCP OAuth refresh families',
+        description: 'List active refresh-token families by non-secret management identifier',
+        operationId: 'get-mcp-module-oauth-refresh-families',
+    }),
+    (0, api_documentation_decorator_1.ApiSuccessResponse)(mcp_oauth_management_response_model_1.McpOAuthRefreshFamiliesResponseModel, 'MCP OAuth refresh families retrieved successfully'),
+    (0, common_1.Get)('refresh-families'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], McpOAuthManagementController.prototype, "findRefreshFamilies", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        tags: [mcp_constants_1.MCP_MODULE_API_TAG_NAME],
+        summary: 'Get an active MCP OAuth refresh family',
+        description: 'Inspect one active refresh-token family by its non-secret management identifier',
+        operationId: 'get-mcp-module-oauth-refresh-family',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', description: 'Refresh-family management identifier', type: 'string', format: 'uuid' }),
+    (0, api_documentation_decorator_1.ApiSuccessResponse)(mcp_oauth_management_response_model_1.McpOAuthRefreshFamilyResponseModel, 'MCP OAuth refresh family retrieved successfully'),
+    (0, api_documentation_decorator_1.ApiNotFoundResponse)('MCP OAuth refresh family not found'),
+    (0, common_1.Get)('refresh-families/:id'),
+    __param(0, (0, common_1.Param)('id', new common_1.ParseUUIDPipe({ version: '4' }))),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], McpOAuthManagementController.prototype, "findRefreshFamily", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        tags: [mcp_constants_1.MCP_MODULE_API_TAG_NAME],
+        summary: 'Revoke an MCP OAuth refresh family',
+        description: 'Revoke a refresh family and its access tokens, then close only subscriptions bound to that family',
+        operationId: 'revoke-mcp-module-oauth-refresh-family',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', description: 'Refresh-family management identifier', type: 'string', format: 'uuid' }),
+    (0, swagger_1.ApiNoContentResponse)({ description: 'MCP OAuth refresh family revoked successfully' }),
+    (0, api_documentation_decorator_1.ApiNotFoundResponse)('MCP OAuth refresh family not found'),
+    (0, common_1.HttpCode)(204),
+    (0, common_1.Post)('refresh-families/:id/revoke'),
+    __param(0, (0, common_1.Param)('id', new common_1.ParseUUIDPipe({ version: '4' }))),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], McpOAuthManagementController.prototype, "revokeRefreshFamily", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        tags: [mcp_constants_1.MCP_MODULE_API_TAG_NAME],
+        summary: 'Revoke all MCP OAuth authorization',
+        description: 'Advance the authorization-server security epoch, revoke every OAuth grant and artifact, and close every OAuth subscription while preserving static MCP access',
+        operationId: 'revoke-all-mcp-module-oauth-authorization',
+    }),
+    (0, api_documentation_decorator_1.ApiSuccessResponse)(mcp_oauth_management_response_model_1.McpOAuthGlobalRevocationResponseModel, 'All MCP OAuth authorization revoked successfully'),
+    (0, common_1.Post)('revoke-all'),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], McpOAuthManagementController.prototype, "revokeAll", null);
+exports.McpOAuthManagementController = McpOAuthManagementController = __decorate([
+    (0, swagger_1.ApiTags)(mcp_constants_1.MCP_MODULE_API_TAG_NAME),
+    (0, common_1.Controller)('oauth'),
+    (0, roles_guard_1.Roles)(users_constants_1.UserRole.OWNER, users_constants_1.UserRole.ADMIN),
+    __metadata("design:paramtypes", [mcp_oauth_management_service_1.McpOAuthManagementService])
+], McpOAuthManagementController);
+//# sourceMappingURL=mcp-oauth-management.controller.js.map

package/dist/modules/mcp/controllers/mcp-oauth-management.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-management.controller.js","sourceRoot":"","sources":["../../../../src/modules/mcp/controllers/mcp-oauth-management.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAAiG;AAGjG,sGAI8D;AAC9D,gEAAuD;AACvD,iEAAuD;AACvD,oEAAuE;AACvE,oDAA2D;AAC3D,uGAQuD;AACvD,qFAAqF;AACrF,2FAAqF;AAK9E,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IACxC,YAA6B,iBAA4C;QAA5C,sBAAiB,GAAjB,iBAAiB,CAA2B;IAAG,CAAC;IAUvE,AAAN,KAAK,CAAC,UAAU;QACf,MAAM,QAAQ,GAAG,IAAI,iEAA2B,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;QAE1D,OAAO,QAAQ,CAAC;IACjB,CAAC;IAYK,AAAN,KAAK,CAAC,SAAS,CAAmD,EAAU;QAC3E,MAAM,QAAQ,GAAG,IAAI,gEAA0B,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE1D,OAAO,QAAQ,CAAC;IACjB,CAAC;IAeK,AAAN,KAAK,CAAC,WAAW,CACkC,EAAU,EACpD,IAA+B,EAChC,GAAyB;QAEhC,MAAM,QAAQ,GAAG,IAAI,gEAA0B,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9F,OAAO,QAAQ,CAAC;IACjB,CAAC;IAYK,AAAN,KAAK,CAAC,WAAW,CACkC,EAAU,EACrD,GAAyB;QAEhC,MAAM,QAAQ,GAAG,IAAI,gEAA0B,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAEnF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAUK,AAAN,KAAK,CAAC,gBAAgB;QACrB,MAAM,QAAQ,GAAG,IAAI,uEAAiC,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QAEhE,OAAO,QAAQ,CAAC;IACjB,CAAC;IAYK,AAAN,KAAK,CAAC,eAAe,CAC8B,EAAU;QAE5D,MAAM,QAAQ,GAAG,IAAI,sEAAgC,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAEhE,OAAO,QAAQ,CAAC;IACjB,CAAC;IAaK,AAAN,KAAK,CAAC,iBAAiB,CAC4B,EAAU,EACrD,GAAyB;QAEhC,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,CAAC;IAUK,AAAN,KAAK,CAAC,mBAAmB;QACxB,MAAM,QAAQ,GAAG,IAAI,0EAAoC,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,CAAC;QAEnE,OAAO,QAAQ,CAAC;IACjB,CAAC;IAYK,AAAN,KAAK,CAAC,iBAAiB,CAC4B,EAAU;QAE5D,MAAM,QAAQ,GAAG,IAAI,wEAAkC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAElE,OAAO,QAAQ,CAAC;IACjB,CAAC;IAaK,AAAN,KAAK,CAAC,mBAAmB,CAC0B,EAAU,EACrD,GAAyB;QAEhC,MAAM,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAWK,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAyB;QAC/C,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAE7D,MAAM,QAAQ,GAAG,IAAI,2EAAqC,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,0DAA6B,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAEO,UAAU,CAAC,GAAyB;QAC3C,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QAE5E,MAAM,IAAI,2BAAkB,CAAC,4DAA4D,CAAC,CAAC;IAC5F,CAAC;CACD,CAAA;AA/MY,oEAA4B;AAWlC;IARL,IAAA,sBAAY,EAAC;QACb,IAAI,EAAE,CAAC,uCAAuB,CAAC;QAC/B,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EAAE,mFAAmF;QAChG,WAAW,EAAE,6BAA6B;KAC1C,CAAC;IACD,IAAA,gDAAkB,EAAC,iEAA2B,EAAE,yCAAyC,CAAC;IAC1F,IAAA,YAAG,EAAC,QAAQ,CAAC;;;;8DAMb;AAYK;IAVL,IAAA,sBAAY,EAAC;QACb,IAAI,EAAE,CAAC,uCAAuB,CAAC;QAC/B,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,yFAAyF;QACtG,WAAW,EAAE,4BAA4B;KACzC,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,mCAAmC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1G,IAAA,gDAAkB,EAAC,gEAA0B,EAAE,wCAAwC,CAAC;IACxF,IAAA,iDAAmB,EAAC,2BAA2B,CAAC;IAChD,IAAA,YAAG,EAAC,YAAY,CAAC;IACD,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,IAAI,sBAAa,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;;;;6DAKhE;AAeK;IAbL,IAAA,sBAAY,EAAC;QACb,IAAI,EAAE,CAAC,uCAAuB,CAAC;QAC/B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EACV,wGAAwG;QACzG,WAAW,EAAE,+BAA+B;KAC5C,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,mCAAmC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1G,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,+CAAyB,EAAE,CAAC;IAC5C,IAAA,gDAAkB,EAAC,gEAA0B,EAAE,6CAA6C,CAAC;IAC7F,IAAA,mDAAqB,EAAC,kEAAkE,CAAC;IACzF,IAAA,iDAAmB,EAAC,2BAA2B,CAAC;IAChD,IAAA,cAAK,EAAC,YAAY,CAAC;IAElB,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,IAAI,sBAAa,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IAChD,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,+CAAyB;;+DAOvC;AAYK;IAVL,IAAA,sBAAY,EAAC;QACb,IAAI,EAAE,CAAC,uCAAuB,CAAC;QAC/B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EAAE,uFAAuF;QACpG,WAAW,EAAE,+BAA+B;KAC5C,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,mCAAmC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1G,IAAA,gDAAkB,EAAC,gEAA0B,EAAE,sCAAsC,CAAC;IACtF,IAAA,iDAAmB,EAAC,2BAA2B,CAAC;IAChD,IAAA,aAAI,EAAC,mBAAmB,CAAC;IAExB,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,IAAI,sBAAa,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IAChD,WAAA,IAAA,YAAG,GAAE,CAAA;;;;+DAMN;AAUK;IARL,IAAA,sBAAY,EAAC;QACb,IAAI,EAAE,CAAC,uCAAuB,CAAC;QAC/B,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EAAE,+DAA+D;QAC5E,WAAW,EAAE,oCAAoC;KACjD,CAAC;IACD,IAAA,gDAAkB,EAAC,uEAAiC,EAAE,gDAAgD,CAAC;IACvG,IAAA,YAAG,EAAC,eAAe,CAAC;;;;oEAMpB;AAYK;IAVL,IAAA,sBAAY,EAAC;QACb,IAAI,EAAE,CAAC,uCAAuB,CAAC;QAC/B,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EAAE,yEAAyE;QACtF,WAAW,EAAE,mCAAmC;KAChD,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,oCAAoC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3G,IAAA,gDAAkB,EAAC,sEAAgC,EAAE,+CAA+C,CAAC;IACrG,IAAA,iDAAmB,EAAC,kCAAkC,CAAC;IACvD,IAAA,YAAG,EAAC,mBAAmB,CAAC;IAEvB,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,IAAI,sBAAa,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;;;;mEAMjD;AAaK;IAXL,IAAA,sBAAY,EAAC;QACb,IAAI,EAAE,CAAC,uCAAuB,CAAC;QAC/B,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,6EAA6E;QAC1F,WAAW,EAAE,sCAAsC;KACnD,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,oCAAoC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3G,IAAA,8BAAoB,EAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;IACpF,IAAA,iDAAmB,EAAC,kCAAkC,CAAC;IACvD,IAAA,iBAAQ,EAAC,GAAG,CAAC;IACb,IAAA,aAAI,EAAC,0BAA0B,CAAC;IAE/B,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,IAAI,sBAAa,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IAChD,WAAA,IAAA,YAAG,GAAE,CAAA;;;;qEAGN;AAUK;IARL,IAAA,sBAAY,EAAC;QACb,IAAI,EAAE,CAAC,uCAAuB,CAAC;QAC/B,OAAO,EAAE,uCAAuC;QAChD,WAAW,EAAE,wEAAwE;QACrF,WAAW,EAAE,uCAAuC;KACpD,CAAC;IACD,IAAA,gDAAkB,EAAC,0EAAoC,EAAE,mDAAmD,CAAC;IAC7G,IAAA,YAAG,EAAC,kBAAkB,CAAC;;;;uEAMvB;AAYK;IAVL,IAAA,sBAAY,EAAC;QACb,IAAI,EAAE,CAAC,uCAAuB,CAAC;QAC/B,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,iFAAiF;QAC9F,WAAW,EAAE,qCAAqC;KAClD,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC7G,IAAA,gDAAkB,EAAC,wEAAkC,EAAE,iDAAiD,CAAC;IACzG,IAAA,iDAAmB,EAAC,oCAAoC,CAAC;IACzD,IAAA,YAAG,EAAC,sBAAsB,CAAC;IAE1B,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,IAAI,sBAAa,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;;;;qEAMjD;AAaK;IAXL,IAAA,sBAAY,EAAC;QACb,IAAI,EAAE,CAAC,uCAAuB,CAAC;QAC/B,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EAAE,mGAAmG;QAChH,WAAW,EAAE,wCAAwC;KACrD,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC7G,IAAA,8BAAoB,EAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IACtF,IAAA,iDAAmB,EAAC,oCAAoC,CAAC;IACzD,IAAA,iBAAQ,EAAC,GAAG,CAAC;IACb,IAAA,aAAI,EAAC,6BAA6B,CAAC;IAElC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,IAAI,sBAAa,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IAChD,WAAA,IAAA,YAAG,GAAE,CAAA;;;;uEAGN;AAWK;IATL,IAAA,sBAAY,EAAC;QACb,IAAI,EAAE,CAAC,uCAAuB,CAAC;QAC/B,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EACV,+JAA+J;QAChK,WAAW,EAAE,2CAA2C;KACxD,CAAC;IACD,IAAA,gDAAkB,EAAC,2EAAqC,EAAE,kDAAkD,CAAC;IAC7G,IAAA,aAAI,EAAC,YAAY,CAAC;IACF,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAOrB;uCAvMW,4BAA4B;IAHxC,IAAA,iBAAO,EAAC,uCAAuB,CAAC;IAChC,IAAA,mBAAU,EAAC,OAAO,CAAC;IACnB,IAAA,mBAAK,EAAC,0BAAQ,CAAC,KAAK,EAAE,0BAAQ,CAAC,KAAK,CAAC;qCAEW,wDAAyB;GAD7D,4BAA4B,CA+MxC"}

package/dist/modules/mcp/controllers/mcp.controller.d.ts

@@ -0,0 +1,17 @@
+import { FastifyReply } from 'fastify';
+import { McpOAuthProxyPolicyService } from '../services/mcp-oauth-proxy-policy.service';
+import { McpOAuthResourceServerService } from '../services/mcp-oauth-resource-server.service';
+import { McpOAuthRouteGateService } from '../services/mcp-oauth-route-gate.service';
+import { McpPolicyRequest } from '../services/mcp-policy.service';
+import { McpPolicyService } from '../services/mcp-policy.service';
+import { McpServerService } from '../services/mcp-server.service';
+export declare class McpController {
+    private readonly serverService;
+    private readonly oauthRouteGate;
+    private readonly oauthProxyPolicy;
+    private readonly oauthResourceServer;
+    private readonly policyService;
+    constructor(serverService: McpServerService, oauthRouteGate: McpOAuthRouteGateService, oauthProxyPolicy: McpOAuthProxyPolicyService, oauthResourceServer: McpOAuthResourceServerService, policyService: McpPolicyService);
+    handle(request: McpPolicyRequest, reply: FastifyReply): Promise<void>;
+    private writeOAuthResponse;
+}

package/dist/modules/mcp/controllers/mcp.controller.js

@@ -0,0 +1,87 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpController = void 0;
+const server_1 = require("@modelcontextprotocol/server");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const throttler_1 = require("@nestjs/throttler");
+const raw_route_decorator_1 = require("../../api/decorators/raw-route.decorator");
+const mcp_endpoint_decorator_1 = require("../decorators/mcp-endpoint.decorator");
+const mcp_client_guard_1 = require("../guards/mcp-client.guard");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_oauth_proxy_policy_service_1 = require("../services/mcp-oauth-proxy-policy.service");
+const mcp_oauth_resource_server_service_1 = require("../services/mcp-oauth-resource-server.service");
+const mcp_oauth_route_gate_service_1 = require("../services/mcp-oauth-route-gate.service");
+const mcp_policy_service_1 = require("../services/mcp-policy.service");
+const mcp_server_service_1 = require("../services/mcp-server.service");
+let McpController = class McpController {
+    constructor(serverService, oauthRouteGate, oauthProxyPolicy, oauthResourceServer, policyService) {
+        this.serverService = serverService;
+        this.oauthRouteGate = oauthRouteGate;
+        this.oauthProxyPolicy = oauthProxyPolicy;
+        this.oauthResourceServer = oauthResourceServer;
+        this.policyService = policyService;
+    }
+    async handle(request, reply) {
+        if (request.mcpPolicy) {
+            await this.serverService.handle(request, reply);
+            return;
+        }
+        this.oauthRouteGate.assertOpen();
+        this.oauthProxyPolicy.assertForwardedHeadersTrusted(request);
+        this.policyService.validateOAuthRequestOrigin(request);
+        try {
+            const authInfo = await this.oauthResourceServer.verifyMcpBearerToken(request.headers.authorization, [
+                mcp_constants_1.McpCapability.READ,
+            ]);
+            await this.serverService.handleOAuth(request, reply, authInfo);
+        }
+        catch (error) {
+            if (!server_1.OAuthError.isInstance(error))
+                throw error;
+            await this.writeOAuthResponse(reply, this.oauthResourceServer.getBearerChallenge(error, [mcp_constants_1.McpCapability.READ]));
+        }
+    }
+    async writeOAuthResponse(reply, response) {
+        reply.hijack();
+        reply.raw.statusCode = response.status;
+        response.headers.forEach((value, name) => reply.raw.setHeader(name, value));
+        reply.raw.end(Buffer.from(await response.arrayBuffer()));
+    }
+};
+exports.McpController = McpController;
+__decorate([
+    (0, raw_route_decorator_1.RawRoute)(),
+    (0, common_1.All)(),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], McpController.prototype, "handle", null);
+exports.McpController = McpController = __decorate([
+    (0, swagger_1.ApiExcludeController)(),
+    (0, swagger_1.ApiTags)(mcp_constants_1.MCP_MODULE_API_TAG_NAME),
+    (0, mcp_endpoint_decorator_1.McpEndpoint)(),
+    (0, throttler_1.SkipThrottle)(),
+    (0, common_1.UseGuards)(mcp_client_guard_1.McpClientGuard),
+    (0, common_1.Controller)(),
+    __metadata("design:paramtypes", [mcp_server_service_1.McpServerService,
+        mcp_oauth_route_gate_service_1.McpOAuthRouteGateService,
+        mcp_oauth_proxy_policy_service_1.McpOAuthProxyPolicyService,
+        mcp_oauth_resource_server_service_1.McpOAuthResourceServerService,
+        mcp_policy_service_1.McpPolicyService])
+], McpController);
+//# sourceMappingURL=mcp.controller.js.map

package/dist/modules/mcp/controllers/mcp.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.controller.js","sourceRoot":"","sources":["../../../../src/modules/mcp/controllers/mcp.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAEA,yDAA0D;AAC1D,2CAAsE;AACtE,6CAAgE;AAChE,iDAAiD;AAEjD,kFAAoE;AACpE,iFAAmE;AACnE,iEAA4D;AAC5D,oDAA0E;AAC1E,+FAAwF;AACxF,qGAA8F;AAC9F,2FAAoF;AAEpF,uEAAkE;AAClE,uEAAkE;AAQ3D,IAAM,aAAa,GAAnB,MAAM,aAAa;IACzB,YACkB,aAA+B,EAC/B,cAAwC,EACxC,gBAA4C,EAC5C,mBAAkD,EAClD,aAA+B;QAJ/B,kBAAa,GAAb,aAAa,CAAkB;QAC/B,mBAAc,GAAd,cAAc,CAA0B;QACxC,qBAAgB,GAAhB,gBAAgB,CAA4B;QAC5C,wBAAmB,GAAnB,mBAAmB,CAA+B;QAClD,kBAAa,GAAb,aAAa,CAAkB;IAC9C,CAAC;IAIE,AAAN,KAAK,CAAC,MAAM,CAAQ,OAAyB,EAAS,KAAmB;QACxE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAChD,OAAO;QACR,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,aAAa,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE;gBACnG,6BAAa,CAAC,IAAI;aAClB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,mBAAU,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAE/C,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,6BAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChH,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAmB,EAAE,QAAkB;QACvE,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;QACvC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5E,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;CACD,CAAA;AAvCY,sCAAa;AAWnB;IAFL,IAAA,8BAAQ,GAAE;IACV,IAAA,YAAG,GAAE;IACQ,WAAA,IAAA,YAAG,GAAE,CAAA;IAA6B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2CAoBpD;wBA/BW,aAAa;IANzB,IAAA,8BAAoB,GAAE;IACtB,IAAA,iBAAO,EAAC,uCAAuB,CAAC;IAChC,IAAA,oCAAW,GAAE;IACb,IAAA,wBAAY,GAAE;IACd,IAAA,kBAAS,EAAC,iCAAc,CAAC;IACzB,IAAA,mBAAU,GAAE;qCAGqB,qCAAgB;QACf,uDAAwB;QACtB,2DAA0B;QACvB,iEAA6B;QACnC,qCAAgB;GANrC,aAAa,CAuCzB"}

package/dist/modules/mcp/decorators/mcp-endpoint.decorator.d.ts

@@ -0,0 +1 @@
+export declare const McpEndpoint: () => import("@nestjs/common").CustomDecorator<string>;

package/dist/modules/mcp/decorators/mcp-endpoint.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpEndpoint = void 0;
+const common_1 = require("@nestjs/common");
+const mcp_constants_1 = require("../mcp.constants");
+const McpEndpoint = () => (0, common_1.SetMetadata)(mcp_constants_1.IS_MCP_ENDPOINT_KEY, true);
+exports.McpEndpoint = McpEndpoint;
+//# sourceMappingURL=mcp-endpoint.decorator.js.map

package/dist/modules/mcp/decorators/mcp-endpoint.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-endpoint.decorator.js","sourceRoot":"","sources":["../../../../src/modules/mcp/decorators/mcp-endpoint.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAE7C,oDAAuD;AAGhD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,mCAAmB,EAAE,IAAI,CAAC,CAAC;AAA3D,QAAA,WAAW,eAAgD"}

package/dist/modules/mcp/dto/mcp-client.dto.d.ts

@@ -0,0 +1,25 @@
+import { McpCapability } from '../mcp.constants';
+export declare class CreateMcpClientDto {
+    name: string;
+    description?: string | null;
+    capabilities: McpCapability[];
+    expiresInDays: number;
+}
+export declare class UpdateMcpClientDto {
+    name?: string;
+    description?: string | null;
+    enabled?: boolean;
+    capabilities?: McpCapability[];
+}
+export declare class RotateMcpClientTokenDto {
+    expiresInDays: number;
+}
+export declare class ReqCreateMcpClientDto {
+    data: CreateMcpClientDto;
+}
+export declare class ReqUpdateMcpClientDto {
+    data: UpdateMcpClientDto;
+}
+export declare class ReqRotateMcpClientTokenDto {
+    data: RotateMcpClientTokenDto;
+}

package/dist/modules/mcp/dto/mcp-client.dto.js

@@ -0,0 +1,185 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReqRotateMcpClientTokenDto = exports.ReqUpdateMcpClientDto = exports.ReqCreateMcpClientDto = exports.RotateMcpClientTokenDto = exports.UpdateMcpClientDto = exports.CreateMcpClientDto = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+const mcp_constants_1 = require("../mcp.constants");
+let CreateMcpClientDto = class CreateMcpClientDto {
+    constructor() {
+        this.expiresInDays = mcp_constants_1.MCP_DEFAULT_TOKEN_EXPIRATION_DAYS;
+    }
+};
+exports.CreateMcpClientDto = CreateMcpClientDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Human-readable client name', type: 'string', example: 'Home assistant agent' }),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(100),
+    __metadata("design:type", String)
+], CreateMcpClientDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Optional client description', type: 'string', nullable: true }),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(500),
+    (0, class_validator_1.ValidateIf)((_, value) => value !== null),
+    __metadata("design:type", String)
+], CreateMcpClientDto.prototype, "description", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Capability subset granted to this client',
+        type: 'array',
+        items: { type: 'string', enum: Object.values(mcp_constants_1.McpCapability) },
+        example: [mcp_constants_1.McpCapability.READ],
+    }),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayUnique)(),
+    (0, class_validator_1.IsEnum)(mcp_constants_1.McpCapability, { each: true }),
+    __metadata("design:type", Array)
+], CreateMcpClientDto.prototype, "capabilities", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        name: 'expires_in_days',
+        description: 'Finite credential lifetime in days',
+        type: 'integer',
+        minimum: 1,
+        maximum: mcp_constants_1.MCP_MAX_TOKEN_EXPIRATION_DAYS,
+        default: mcp_constants_1.MCP_DEFAULT_TOKEN_EXPIRATION_DAYS,
+    }),
+    (0, class_transformer_1.Expose)({ name: 'expires_in_days' }),
+    (0, class_transformer_1.Transform)(({ obj }) => obj.expires_in_days ?? obj.expiresInDays ?? mcp_constants_1.MCP_DEFAULT_TOKEN_EXPIRATION_DAYS),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    (0, class_validator_1.Max)(mcp_constants_1.MCP_MAX_TOKEN_EXPIRATION_DAYS),
+    __metadata("design:type", Number)
+], CreateMcpClientDto.prototype, "expiresInDays", void 0);
+exports.CreateMcpClientDto = CreateMcpClientDto = __decorate([
+    (0, swagger_1.ApiSchema)({ name: 'McpModuleCreateClient' })
+], CreateMcpClientDto);
+let UpdateMcpClientDto = class UpdateMcpClientDto {
+};
+exports.UpdateMcpClientDto = UpdateMcpClientDto;
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Human-readable client name', type: 'string' }),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(100),
+    __metadata("design:type", String)
+], UpdateMcpClientDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Optional client description', type: 'string', nullable: true }),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(500),
+    (0, class_validator_1.ValidateIf)((_, value) => value !== null),
+    __metadata("design:type", String)
+], UpdateMcpClientDto.prototype, "description", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Whether the client may authenticate', type: 'boolean' }),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], UpdateMcpClientDto.prototype, "enabled", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Capability subset granted to this client',
+        type: 'array',
+        items: { type: 'string', enum: Object.values(mcp_constants_1.McpCapability) },
+    }),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayUnique)(),
+    (0, class_validator_1.IsEnum)(mcp_constants_1.McpCapability, { each: true }),
+    __metadata("design:type", Array)
+], UpdateMcpClientDto.prototype, "capabilities", void 0);
+exports.UpdateMcpClientDto = UpdateMcpClientDto = __decorate([
+    (0, swagger_1.ApiSchema)({ name: 'McpModuleUpdateClient' })
+], UpdateMcpClientDto);
+let RotateMcpClientTokenDto = class RotateMcpClientTokenDto {
+    constructor() {
+        this.expiresInDays = mcp_constants_1.MCP_DEFAULT_TOKEN_EXPIRATION_DAYS;
+    }
+};
+exports.RotateMcpClientTokenDto = RotateMcpClientTokenDto;
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        name: 'expires_in_days',
+        description: 'Finite lifetime of the replacement credential in days',
+        type: 'integer',
+        minimum: 1,
+        maximum: mcp_constants_1.MCP_MAX_TOKEN_EXPIRATION_DAYS,
+        default: mcp_constants_1.MCP_DEFAULT_TOKEN_EXPIRATION_DAYS,
+    }),
+    (0, class_transformer_1.Expose)({ name: 'expires_in_days' }),
+    (0, class_transformer_1.Transform)(({ obj }) => obj.expires_in_days ?? obj.expiresInDays ?? mcp_constants_1.MCP_DEFAULT_TOKEN_EXPIRATION_DAYS),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    (0, class_validator_1.Max)(mcp_constants_1.MCP_MAX_TOKEN_EXPIRATION_DAYS),
+    __metadata("design:type", Number)
+], RotateMcpClientTokenDto.prototype, "expiresInDays", void 0);
+exports.RotateMcpClientTokenDto = RotateMcpClientTokenDto = __decorate([
+    (0, swagger_1.ApiSchema)({ name: 'McpModuleRotateClientToken' })
+], RotateMcpClientTokenDto);
+let ReqCreateMcpClientDto = class ReqCreateMcpClientDto {
+};
+exports.ReqCreateMcpClientDto = ReqCreateMcpClientDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: () => CreateMcpClientDto }),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsDefined)(),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => CreateMcpClientDto),
+    __metadata("design:type", CreateMcpClientDto)
+], ReqCreateMcpClientDto.prototype, "data", void 0);
+exports.ReqCreateMcpClientDto = ReqCreateMcpClientDto = __decorate([
+    (0, swagger_1.ApiSchema)({ name: 'McpModuleReqCreateClient' })
+], ReqCreateMcpClientDto);
+let ReqUpdateMcpClientDto = class ReqUpdateMcpClientDto {
+};
+exports.ReqUpdateMcpClientDto = ReqUpdateMcpClientDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: () => UpdateMcpClientDto }),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsDefined)(),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => UpdateMcpClientDto),
+    __metadata("design:type", UpdateMcpClientDto)
+], ReqUpdateMcpClientDto.prototype, "data", void 0);
+exports.ReqUpdateMcpClientDto = ReqUpdateMcpClientDto = __decorate([
+    (0, swagger_1.ApiSchema)({ name: 'McpModuleReqUpdateClient' })
+], ReqUpdateMcpClientDto);
+let ReqRotateMcpClientTokenDto = class ReqRotateMcpClientTokenDto {
+};
+exports.ReqRotateMcpClientTokenDto = ReqRotateMcpClientTokenDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: () => RotateMcpClientTokenDto }),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsDefined)(),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => RotateMcpClientTokenDto),
+    __metadata("design:type", RotateMcpClientTokenDto)
+], ReqRotateMcpClientTokenDto.prototype, "data", void 0);
+exports.ReqRotateMcpClientTokenDto = ReqRotateMcpClientTokenDto = __decorate([
+    (0, swagger_1.ApiSchema)({ name: 'McpModuleReqRotateClientToken' })
+], ReqRotateMcpClientTokenDto);
+//# sourceMappingURL=mcp-client.dto.js.map

package/dist/modules/mcp/dto/mcp-client.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-client.dto.js","sourceRoot":"","sources":["../../../../src/modules/mcp/dto/mcp-client.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,yDAA4D;AAC5D,qDAeyB;AAEzB,6CAA8E;AAE9E,oDAAmH;AAG5G,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAAxB;QA6CN,kBAAa,GAAW,iDAAiC,CAAC;IAC3D,CAAC;CAAA,CAAA;AA9CY,gDAAkB;AAM9B;IALC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC3G,IAAA,0BAAM,GAAE;IACR,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,GAAG,CAAC;;gDACF;AAQb;IANC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACnG,IAAA,0BAAM,GAAE;IACR,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,GAAG,CAAC;IACd,IAAA,4BAAU,EAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;;uDACb;AAY5B;IAVC,IAAA,qBAAW,EAAC;QACZ,WAAW,EAAE,0CAA0C;QACvD,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,6BAAa,CAAC,EAAE;QAC7D,OAAO,EAAE,CAAC,6BAAa,CAAC,IAAI,CAAC;KAC7B,CAAC;IACD,IAAA,0BAAM,GAAE;IACR,IAAA,yBAAO,GAAE;IACT,IAAA,6BAAW,GAAE;IACb,IAAA,wBAAM,EAAC,6BAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;wDACR;AAmB9B;IAjBC,IAAA,6BAAmB,EAAC;QACpB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,oCAAoC;QACjD,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,6CAA6B;QACtC,OAAO,EAAE,iDAAiC;KAC1C,CAAC;IACD,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACnC,IAAA,6BAAS,EACT,CAAC,EAAE,GAAG,EAAiE,EAAE,EAAE,CAC1E,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,aAAa,IAAI,iDAAiC,CAC9E;IACA,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;IACN,IAAA,qBAAG,EAAC,6CAA6B,CAAC;;yDACuB;6BA7C9C,kBAAkB;IAD9B,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;GAChC,kBAAkB,CA8C9B;AAGM,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;CAkC9B,CAAA;AAlCY,gDAAkB;AAO9B;IANC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClF,IAAA,0BAAM,GAAE;IACR,IAAA,4BAAU,GAAE;IACZ,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,GAAG,CAAC;;gDACD;AAQd;IANC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACnG,IAAA,0BAAM,GAAE;IACR,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,GAAG,CAAC;IACd,IAAA,4BAAU,EAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;;uDACb;AAM5B;IAJC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,qCAAqC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5F,IAAA,0BAAM,GAAE;IACR,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;;mDACM;AAYlB;IAVC,IAAA,6BAAmB,EAAC;QACpB,WAAW,EAAE,0CAA0C;QACvD,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,6BAAa,CAAC,EAAE;KAC7D,CAAC;IACD,IAAA,0BAAM,GAAE;IACR,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,GAAE;IACT,IAAA,6BAAW,GAAE;IACb,IAAA,wBAAM,EAAC,6BAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;wDACP;6BAjCnB,kBAAkB;IAD9B,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;GAChC,kBAAkB,CAkC9B;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAA7B;QAkBN,kBAAa,GAAW,iDAAiC,CAAC;IAC3D,CAAC;CAAA,CAAA;AAnBY,0DAAuB;AAkBnC;IAjBC,IAAA,6BAAmB,EAAC;QACpB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,uDAAuD;QACpE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,6CAA6B;QACtC,OAAO,EAAE,iDAAiC;KAC1C,CAAC;IACD,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACnC,IAAA,6BAAS,EACT,CAAC,EAAE,GAAG,EAAiE,EAAE,EAAE,CAC1E,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,aAAa,IAAI,iDAAiC,CAC9E;IACA,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;IACN,IAAA,qBAAG,EAAC,6CAA6B,CAAC;;8DACuB;kCAlB9C,uBAAuB;IADnC,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC;GACrC,uBAAuB,CAmBnC;AAGM,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;CAOjC,CAAA;AAPY,sDAAqB;AAMjC;IALC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;IAC/C,IAAA,0BAAM,GAAE;IACR,IAAA,2BAAS,GAAE;IACX,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;8BACzB,kBAAkB;mDAAC;gCANb,qBAAqB;IADjC,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;GACnC,qBAAqB,CAOjC;AAGM,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;CAOjC,CAAA;AAPY,sDAAqB;AAMjC;IALC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;IAC/C,IAAA,0BAAM,GAAE;IACR,IAAA,2BAAS,GAAE;IACX,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;8BACzB,kBAAkB;mDAAC;gCANb,qBAAqB;IADjC,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;GACnC,qBAAqB,CAOjC;AAGM,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;CAOtC,CAAA;AAPY,gEAA0B;AAMtC;IALC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,uBAAuB,EAAE,CAAC;IACpD,IAAA,0BAAM,GAAE;IACR,IAAA,2BAAS,GAAE;IACX,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC;8BAC9B,uBAAuB;wDAAC;qCANlB,0BAA0B;IADtC,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC;GACxC,0BAA0B,CAOtC"}