@fastybird/smart-panel-backend 1.0.0-beta.2 → 1.1.0-alpha.0

package/dist/modules/mcp/services/mcp-installation.service.js

@@ -0,0 +1,55 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpInstallationService = void 0;
+const typeorm_1 = require("typeorm");
+const uuid_1 = require("uuid");
+const common_1 = require("@nestjs/common");
+const typeorm_2 = require("@nestjs/typeorm");
+const mcp_installation_entity_1 = require("../entities/mcp-installation.entity");
+const INSTALLATION_KEY = 'installation';
+let McpInstallationService = class McpInstallationService {
+    constructor(repository) {
+        this.repository = repository;
+    }
+    async getInstallationId() {
+        if (this.installationId) {
+            return this.installationId;
+        }
+        let installation = await this.repository.findOne({ where: { key: INSTALLATION_KEY } });
+        if (!installation) {
+            try {
+                installation = await this.repository.save(this.repository.create({ key: INSTALLATION_KEY, installationId: (0, uuid_1.v4)() }));
+            }
+            catch {
+                installation = await this.repository.findOne({ where: { key: INSTALLATION_KEY } });
+            }
+        }
+        if (!installation) {
+            throw new Error('Failed to initialize MCP installation identity');
+        }
+        this.installationId = installation.installationId;
+        return this.installationId;
+    }
+    async getAudience() {
+        return `urn:fastybird:smart-panel:${await this.getInstallationId()}:mcp`;
+    }
+};
+exports.McpInstallationService = McpInstallationService;
+exports.McpInstallationService = McpInstallationService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_2.InjectRepository)(mcp_installation_entity_1.McpInstallationEntity)),
+    __metadata("design:paramtypes", [typeorm_1.Repository])
+], McpInstallationService);
+//# sourceMappingURL=mcp-installation.service.js.map

package/dist/modules/mcp/services/mcp-installation.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-installation.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-installation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,qCAAqC;AACrC,+BAAkC;AAElC,2CAA4C;AAC5C,6CAAmD;AAEnD,iFAA4E;AAE5E,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAGjC,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAGlC,YAEkB,UAA6C;QAA7C,eAAU,GAAV,UAAU,CAAmC;IAC5D,CAAC;IAEJ,KAAK,CAAC,iBAAiB;QACtB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC5B,CAAC;QAED,IAAI,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAEvF,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,IAAI,CAAC;gBACJ,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,cAAc,EAAE,IAAA,SAAI,GAAE,EAAE,CAAC,CACzE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBAER,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;YACpF,CAAC;QACF,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;QAElD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,WAAW;QAChB,OAAO,6BAA6B,MAAM,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAC1E,CAAC;CACD,CAAA;AAtCY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAKV,WAAA,IAAA,0BAAgB,EAAC,+CAAqB,CAAC,CAAA;qCACX,oBAAU;GAL5B,sBAAsB,CAsClC"}

package/dist/modules/mcp/services/mcp-oauth-approver-authority.service.d.ts

@@ -0,0 +1,20 @@
+import { DataSource, Repository } from 'typeorm';
+import { UserEntity } from '../../users/entities/users.entity';
+import { UserLifecycleCommit, UserLifecycleMutationHandler } from '../../users/services/user-lifecycle-mutation-registry.service';
+import { McpOAuthApproverAuthorityEntity } from '../entities/mcp-oauth.entity';
+import { McpAuditService } from './mcp-audit.service';
+import { McpSubscriptionRegistryService } from './mcp-subscription-registry.service';
+export declare class McpOAuthApproverAuthorityService implements UserLifecycleMutationHandler {
+    private readonly authorities;
+    private readonly dataSource;
+    private readonly subscriptions;
+    private readonly auditService;
+    constructor(authorities: Repository<McpOAuthApproverAuthorityEntity>, dataSource: DataSource, subscriptions: McpSubscriptionRegistryService, auditService: McpAuditService);
+    getGeneration(approverId: string): Promise<number>;
+    runAuthorized<T>(approverId: string, operation: (generation: number) => Promise<T>): Promise<T>;
+    invalidateApprover(approverId: string): Promise<void>;
+    update<T>(previous: UserEntity, next: UserEntity, commit: UserLifecycleCommit<T>): Promise<T>;
+    remove<T>(user: UserEntity, commit: UserLifecycleCommit<T>): Promise<T>;
+    private mutateApprover;
+    private advanceAndRevoke;
+}

package/dist/modules/mcp/services/mcp-oauth-approver-authority.service.js

@@ -0,0 +1,128 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthApproverAuthorityService = void 0;
+const typeorm_1 = require("typeorm");
+const common_1 = require("@nestjs/common");
+const typeorm_2 = require("@nestjs/typeorm");
+const users_entity_1 = require("../../users/entities/users.entity");
+const users_constants_1 = require("../../users/users.constants");
+const mcp_oauth_entity_1 = require("../entities/mcp-oauth.entity");
+const mcp_audit_service_1 = require("./mcp-audit.service");
+const mcp_subscription_registry_service_1 = require("./mcp-subscription-registry.service");
+const APPROVER_ROLES = [users_constants_1.UserRole.OWNER, users_constants_1.UserRole.ADMIN];
+let McpOAuthApproverAuthorityService = class McpOAuthApproverAuthorityService {
+    constructor(authorities, dataSource, subscriptions, auditService) {
+        this.authorities = authorities;
+        this.dataSource = dataSource;
+        this.subscriptions = subscriptions;
+        this.auditService = auditService;
+    }
+    async getGeneration(approverId) {
+        return (await this.authorities.findOneBy({ approverId }))?.generation ?? 0;
+    }
+    async runAuthorized(approverId, operation) {
+        return this.subscriptions.runOAuthMutation(async () => {
+            const user = await this.dataSource.getRepository(users_entity_1.UserEntity).findOneBy({ id: approverId });
+            if (!user || !APPROVER_ROLES.includes(user.role)) {
+                throw new common_1.ForbiddenException('The MCP OAuth grant approver is no longer authorized');
+            }
+            let authority = await this.authorities.findOneBy({ approverId });
+            if (!authority) {
+                authority = await this.authorities.save(this.authorities.create({ approverId, generation: 0 }));
+            }
+            return operation(authority.generation);
+        });
+    }
+    async invalidateApprover(approverId) {
+        await this.mutateApprover(approverId, () => Promise.resolve());
+    }
+    async update(previous, next, commit) {
+        const wasApprover = APPROVER_ROLES.includes(previous.role);
+        const remainsApprover = APPROVER_ROLES.includes(next.role);
+        return wasApprover && !remainsApprover ? this.mutateApprover(next.id, commit) : commit();
+    }
+    async remove(user, commit) {
+        return this.mutateApprover(user.id, commit);
+    }
+    async mutateApprover(approverId, commit) {
+        let invalidationError;
+        let committed = false;
+        let result;
+        await this.subscriptions.closeOAuthApprover(approverId, async () => {
+            try {
+                await this.dataSource.transaction(async (manager) => {
+                    await this.advanceAndRevoke(manager, approverId);
+                    result = await commit(manager);
+                    committed = true;
+                });
+            }
+            catch (error) {
+                invalidationError = error;
+            }
+        });
+        if (invalidationError)
+            throw invalidationError;
+        if (!committed)
+            throw new common_1.ServiceUnavailableException('MCP OAuth approver invalidation did not commit');
+        this.auditService.recordOAuthAuthorizationInvalidation({
+            reasons: ['approver_authority_changed'],
+            authorizationProfile: 'oauth',
+            outcome: mcp_audit_service_1.McpAuditOutcome.COMPLETED,
+            target: { type: 'approver', id: approverId },
+        });
+        return result;
+    }
+    async advanceAndRevoke(manager, approverId) {
+        const authorities = manager.getRepository(mcp_oauth_entity_1.McpOAuthApproverAuthorityEntity);
+        const authority = await authorities.findOneBy({ approverId });
+        if (authority) {
+            const result = await authorities.update({ approverId, generation: authority.generation }, { generation: () => 'generation + 1' });
+            if (result.affected !== 1) {
+                throw new common_1.ServiceUnavailableException('MCP OAuth approver authority could not be advanced');
+            }
+        }
+        else {
+            await authorities.insert({ approverId, generation: 1 });
+        }
+        const grants = manager.getRepository(mcp_oauth_entity_1.McpOAuthGrantEntity);
+        const activeGrants = await grants.findBy({ approvedById: approverId, revokedAt: (0, typeorm_1.IsNull)() });
+        const revokedAt = new Date();
+        if (activeGrants.length === 0)
+            return;
+        const result = await grants.update({ id: (0, typeorm_1.In)(activeGrants.map((grant) => grant.id)), revokedAt: (0, typeorm_1.IsNull)() }, { revokedAt, generation: () => 'generation + 1' });
+        if (result.affected !== activeGrants.length) {
+            throw new common_1.ServiceUnavailableException('MCP OAuth approver grants could not be revoked');
+        }
+        const grantHashes = activeGrants
+            .map((grant) => grant.providerGrantIdHash)
+            .filter((hash) => hash !== null);
+        if (grantHashes.length === 0)
+            return;
+        await manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderRevokedGrantEntity).upsert(grantHashes.map((grantIdHash) => ({ grantIdHash, revokedAt: revokedAt.getTime() })), ['grantIdHash']);
+        const artifacts = manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity);
+        await artifacts.delete({ grantIdHash: (0, typeorm_1.In)(grantHashes) });
+        await artifacts.delete({ model: 'Grant', idHash: (0, typeorm_1.In)(grantHashes) });
+    }
+};
+exports.McpOAuthApproverAuthorityService = McpOAuthApproverAuthorityService;
+exports.McpOAuthApproverAuthorityService = McpOAuthApproverAuthorityService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthApproverAuthorityEntity)),
+    __metadata("design:paramtypes", [typeorm_1.Repository,
+        typeorm_1.DataSource,
+        mcp_subscription_registry_service_1.McpSubscriptionRegistryService,
+        mcp_audit_service_1.McpAuditService])
+], McpOAuthApproverAuthorityService);
+//# sourceMappingURL=mcp-oauth-approver-authority.service.js.map

package/dist/modules/mcp/services/mcp-oauth-approver-authority.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-approver-authority.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-approver-authority.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,qCAA4E;AAE5E,2CAA6F;AAC7F,6CAAmD;AAEnD,oEAA+D;AAK/D,iEAAuD;AACvD,mEAKsC;AAEtC,2DAAuE;AACvE,2FAAqF;AAErF,MAAM,cAAc,GAAG,CAAC,0BAAQ,CAAC,KAAK,EAAE,0BAAQ,CAAC,KAAK,CAAC,CAAC;AAGjD,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAC5C,YAEkB,WAAwD,EACxD,UAAsB,EACtB,aAA6C,EAC7C,YAA6B;QAH7B,gBAAW,GAAX,WAAW,CAA6C;QACxD,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAgC;QAC7C,iBAAY,GAAZ,YAAY,CAAiB;IAC5C,CAAC;IAEJ,KAAK,CAAC,aAAa,CAAC,UAAkB;QACrC,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,UAAU,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CAAI,UAAkB,EAAE,SAA6C;QACvF,OAAO,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAU,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAE3F,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,2BAAkB,CAAC,sDAAsD,CAAC,CAAC;YACtF,CAAC;YAED,IAAI,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YAEjE,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACjG,CAAC;YAED,OAAO,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,UAAkB;QAC1C,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,MAAM,CAAI,QAAoB,EAAE,IAAgB,EAAE,MAA8B;QACrF,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE3D,OAAO,WAAW,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,MAAM,CAAI,IAAgB,EAAE,MAA8B;QAC/D,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,cAAc,CAAI,UAAkB,EAAE,MAA8B;QACjF,IAAI,iBAA0B,CAAC;QAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,MAAU,CAAC;QAEf,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;YAClE,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;oBACnD,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;oBACjD,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC/B,SAAS,GAAG,IAAI,CAAC;gBAClB,CAAC,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,iBAAiB,GAAG,KAAK,CAAC;YAC3B,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,IAAI,iBAAiB;YAAE,MAAM,iBAAiB,CAAC;QAC/C,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,oCAA2B,CAAC,gDAAgD,CAAC,CAAC;QAExG,IAAI,CAAC,YAAY,CAAC,oCAAoC,CAAC;YACtD,OAAO,EAAE,CAAC,4BAA4B,CAAC;YACvC,oBAAoB,EAAE,OAAO;YAC7B,OAAO,EAAE,mCAAe,CAAC,SAAS;YAClC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE;SAC5C,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAAsB,EAAE,UAAkB;QACxE,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,kDAA+B,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAE9D,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CACtC,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,EAChD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,CACtC,CAAC;YAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,oCAA2B,CAAC,oDAAoD,CAAC,CAAC;YAC7F,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,sCAAmB,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAE7B,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CACjC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EACtE,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,CACjD,CAAC;QAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,oCAA2B,CAAC,gDAAgD,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,WAAW,GAAG,YAAY;aAC9B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAElD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAErC,MAAM,OAAO,CAAC,aAAa,CAAC,qDAAkC,CAAC,CAAC,MAAM,CACrE,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EACnF,CAAC,aAAa,CAAC,CACf,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,iDAA8B,CAAC,CAAC;QACxE,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAA,YAAE,EAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAA,YAAE,EAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;CACD,CAAA;AA1HY,4EAAgC;2CAAhC,gCAAgC;IAD5C,IAAA,mBAAU,GAAE;IAGV,WAAA,IAAA,0BAAgB,EAAC,kDAA+B,CAAC,CAAA;qCACpB,oBAAU;QACX,oBAAU;QACP,kEAA8B;QAC/B,mCAAe;GANnC,gCAAgC,CA0H5C"}

package/dist/modules/mcp/services/mcp-oauth-artifact.service.d.ts

@@ -0,0 +1,69 @@
+import { Repository } from 'typeorm';
+import { McpOAuthAccessTokenEntity, McpOAuthAuthorizationCodeEntity, McpOAuthClientEntity, McpOAuthGrantEntity, McpOAuthInteractionEntity, McpOAuthRefreshTokenEntity, McpOAuthRefreshTokenFamilyEntity, McpOAuthServerStateEntity } from '../entities/mcp-oauth.entity';
+import { McpOAuthScope } from '../mcp.constants';
+import { McpInstallationService } from './mcp-installation.service';
+import { McpOAuthPublicUrlService } from './mcp-oauth-public-url.service';
+export interface McpOAuthRawArtifact<TEntity> {
+    rawValue: string;
+    artifact: TEntity;
+}
+export declare class McpOAuthArtifactService {
+    private readonly clients;
+    private readonly grants;
+    private readonly interactions;
+    private readonly authorizationCodes;
+    private readonly accessTokens;
+    private readonly refreshFamilies;
+    private readonly serverState;
+    private readonly installationService;
+    private readonly publicUrlService;
+    constructor(clients: Repository<McpOAuthClientEntity>, grants: Repository<McpOAuthGrantEntity>, interactions: Repository<McpOAuthInteractionEntity>, authorizationCodes: Repository<McpOAuthAuthorizationCodeEntity>, accessTokens: Repository<McpOAuthAccessTokenEntity>, refreshFamilies: Repository<McpOAuthRefreshTokenFamilyEntity>, serverState: Repository<McpOAuthServerStateEntity>, installationService: McpInstallationService, publicUrlService: McpOAuthPublicUrlService);
+    createClient(input: {
+        name: string;
+        redirectUris: string[];
+        maximumScopes: McpOAuthScope[];
+        createdById: string;
+    }): Promise<McpOAuthClientEntity>;
+    createGrant(input: {
+        providerGrantId: string;
+        clientId: string;
+        approvedById: string;
+        approvedScopes: McpOAuthScope[];
+        expiresAt?: Date;
+        approverAuthorityGeneration?: number;
+    }): Promise<McpOAuthGrantEntity>;
+    createInteraction(input: {
+        clientId: string;
+        redirectUri: string;
+        requestedScopes: McpOAuthScope[];
+        expiresAt: Date;
+    }): Promise<McpOAuthRawArtifact<McpOAuthInteractionEntity>>;
+    issueAuthorizationCode(input: {
+        clientId: string;
+        grant: McpOAuthGrantEntity;
+        interactionId: string;
+        redirectUri: string;
+        scopes: McpOAuthScope[];
+        codeChallenge: string;
+        expiresAt: Date;
+    }): Promise<McpOAuthRawArtifact<McpOAuthAuthorizationCodeEntity>>;
+    issueAccessToken(input: {
+        clientId: string;
+        grant: McpOAuthGrantEntity;
+        scopes: McpOAuthScope[];
+        refreshFamilyId?: string;
+        expiresAt?: Date;
+    }): Promise<McpOAuthRawArtifact<McpOAuthAccessTokenEntity>>;
+    issueRefreshFamily(input: {
+        clientId: string;
+        grant: McpOAuthGrantEntity;
+        expiresAt?: Date;
+    }): Promise<{
+        family: McpOAuthRefreshTokenFamilyEntity;
+        refreshToken: McpOAuthRawArtifact<McpOAuthRefreshTokenEntity>;
+    }>;
+    private requirePublicUrls;
+    private generateOpaqueValue;
+    private earliest;
+    private assertGrantActive;
+}

package/dist/modules/mcp/services/mcp-oauth-artifact.service.js

@@ -0,0 +1,200 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthArtifactService = void 0;
+const node_crypto_1 = require("node:crypto");
+const typeorm_1 = require("typeorm");
+const common_1 = require("@nestjs/common");
+const typeorm_2 = require("@nestjs/typeorm");
+const token_utils_1 = require("../../auth/utils/token.utils");
+const mcp_oauth_entity_1 = require("../entities/mcp-oauth.entity");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_installation_service_1 = require("./mcp-installation.service");
+const mcp_oauth_public_url_service_1 = require("./mcp-oauth-public-url.service");
+let McpOAuthArtifactService = class McpOAuthArtifactService {
+    constructor(clients, grants, interactions, authorizationCodes, accessTokens, refreshFamilies, serverState, installationService, publicUrlService) {
+        this.clients = clients;
+        this.grants = grants;
+        this.interactions = interactions;
+        this.authorizationCodes = authorizationCodes;
+        this.accessTokens = accessTokens;
+        this.refreshFamilies = refreshFamilies;
+        this.serverState = serverState;
+        this.installationService = installationService;
+        this.publicUrlService = publicUrlService;
+    }
+    async createClient(input) {
+        return this.clients.save(this.clients.create({
+            clientIdentifier: this.generateOpaqueValue(16),
+            name: input.name,
+            redirectUris: [...input.redirectUris],
+            maximumScopes: [...input.maximumScopes],
+            enabled: true,
+            generation: 0,
+            createdById: input.createdById,
+        }));
+    }
+    async createGrant(input) {
+        const urls = this.requirePublicUrls();
+        const maximumExpiry = new Date(Date.now() + mcp_constants_1.MCP_OAUTH_GRANT_LIFETIME_MS);
+        const expiresAt = this.earliest(input.expiresAt, maximumExpiry);
+        const [client, serverState] = await Promise.all([
+            this.clients.findOneBy({ id: input.clientId, enabled: true }),
+            this.serverState.findOneBy({ key: mcp_constants_1.MCP_OAUTH_SERVER_STATE_KEY }),
+        ]);
+        if (expiresAt <= new Date()) {
+            throw new common_1.BadRequestException('OAuth grant expiry must be in the future');
+        }
+        if (!client) {
+            throw new common_1.BadRequestException('OAuth grant client is no longer active');
+        }
+        if (!serverState) {
+            throw new common_1.ServiceUnavailableException('MCP OAuth authorization generation state is unavailable');
+        }
+        return this.grants.save(this.grants.create({
+            providerGrantIdHash: (0, token_utils_1.hashToken)(input.providerGrantId),
+            clientId: input.clientId,
+            approvedById: input.approvedById,
+            installationId: await this.installationService.getInstallationId(),
+            issuer: urls.issuer,
+            resource: urls.resource,
+            approvedScopes: [...input.approvedScopes],
+            expiresAt,
+            revokedAt: null,
+            generation: 0,
+            approverAuthorityGeneration: input.approverAuthorityGeneration ?? 0,
+            oauthEnabledGeneration: serverState.oauthEnabledGeneration,
+            serverSecretVersion: serverState.serverSecretVersion,
+            publicIdentityGeneration: serverState.publicIdentityGeneration,
+            clientGeneration: client.generation,
+            modulePolicyGeneration: serverState.modulePolicyGeneration,
+        }));
+    }
+    async createInteraction(input) {
+        const rawValue = this.generateOpaqueValue();
+        const artifact = await this.interactions.save(this.interactions.create({
+            uidHash: (0, token_utils_1.hashToken)(rawValue),
+            clientId: input.clientId,
+            authenticatedUserId: null,
+            redirectUri: input.redirectUri,
+            requestedScopes: [...input.requestedScopes],
+            expiresAt: input.expiresAt,
+            consumedAt: null,
+        }));
+        return { rawValue, artifact };
+    }
+    async issueAuthorizationCode(input) {
+        const rawValue = this.generateOpaqueValue();
+        const artifact = await this.authorizationCodes.save(this.authorizationCodes.create({
+            codeHash: (0, token_utils_1.hashToken)(rawValue),
+            clientId: input.clientId,
+            grantId: input.grant.id,
+            interactionId: input.interactionId,
+            installationId: input.grant.installationId,
+            issuer: input.grant.issuer,
+            resource: input.grant.resource,
+            redirectUri: input.redirectUri,
+            scopes: [...input.scopes],
+            codeChallenge: input.codeChallenge,
+            expiresAt: input.expiresAt,
+            consumedAt: null,
+        }));
+        return { rawValue, artifact };
+    }
+    async issueAccessToken(input) {
+        this.assertGrantActive(input.grant);
+        const rawValue = this.generateOpaqueValue();
+        const maximumExpiry = new Date(Date.now() + mcp_constants_1.MCP_OAUTH_ACCESS_TOKEN_LIFETIME_MS);
+        const artifact = await this.accessTokens.save(this.accessTokens.create({
+            tokenHash: (0, token_utils_1.hashToken)(rawValue),
+            clientId: input.clientId,
+            grantId: input.grant.id,
+            refreshFamilyId: input.refreshFamilyId ?? null,
+            installationId: input.grant.installationId,
+            issuer: input.grant.issuer,
+            resource: input.grant.resource,
+            scopes: [...input.scopes],
+            expiresAt: this.earliest(input.expiresAt, maximumExpiry, input.grant.expiresAt),
+            revokedAt: null,
+        }));
+        return { rawValue, artifact };
+    }
+    async issueRefreshFamily(input) {
+        this.assertGrantActive(input.grant);
+        const maximumExpiry = new Date(Date.now() + mcp_constants_1.MCP_OAUTH_REFRESH_FAMILY_LIFETIME_MS);
+        const expiresAt = this.earliest(input.expiresAt, maximumExpiry, input.grant.expiresAt);
+        return this.refreshFamilies.manager.transaction(async (manager) => {
+            const familyRepository = manager.getRepository(mcp_oauth_entity_1.McpOAuthRefreshTokenFamilyEntity);
+            const tokenRepository = manager.getRepository(mcp_oauth_entity_1.McpOAuthRefreshTokenEntity);
+            const family = await familyRepository.save(familyRepository.create({
+                clientId: input.clientId,
+                grantId: input.grant.id,
+                installationId: input.grant.installationId,
+                expiresAt,
+                revokedAt: null,
+                revocationReason: null,
+                generation: 0,
+            }));
+            const rawValue = this.generateOpaqueValue();
+            const artifact = await tokenRepository.save(tokenRepository.create({
+                tokenHash: (0, token_utils_1.hashToken)(rawValue),
+                familyId: family.id,
+                predecessorId: null,
+                expiresAt,
+                consumedAt: null,
+                revokedAt: null,
+            }));
+            return { family, refreshToken: { rawValue, artifact } };
+        });
+    }
+    requirePublicUrls() {
+        const urls = this.publicUrlService.getUrls();
+        if (!urls) {
+            throw new common_1.ServiceUnavailableException('MCP OAuth public URL is not configured');
+        }
+        return urls;
+    }
+    generateOpaqueValue(bytes = 32) {
+        return (0, node_crypto_1.randomBytes)(bytes).toString('base64url');
+    }
+    earliest(...values) {
+        return new Date(Math.min(...values.filter((value) => value !== undefined).map((value) => value.getTime())));
+    }
+    assertGrantActive(grant) {
+        if (grant.revokedAt || grant.expiresAt <= new Date()) {
+            throw new common_1.BadRequestException('OAuth grant is revoked or expired');
+        }
+    }
+};
+exports.McpOAuthArtifactService = McpOAuthArtifactService;
+exports.McpOAuthArtifactService = McpOAuthArtifactService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthClientEntity)),
+    __param(1, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthGrantEntity)),
+    __param(2, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthInteractionEntity)),
+    __param(3, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthAuthorizationCodeEntity)),
+    __param(4, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthAccessTokenEntity)),
+    __param(5, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthRefreshTokenFamilyEntity)),
+    __param(6, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthServerStateEntity)),
+    __metadata("design:paramtypes", [typeorm_1.Repository,
+        typeorm_1.Repository,
+        typeorm_1.Repository,
+        typeorm_1.Repository,
+        typeorm_1.Repository,
+        typeorm_1.Repository,
+        typeorm_1.Repository,
+        mcp_installation_service_1.McpInstallationService,
+        mcp_oauth_public_url_service_1.McpOAuthPublicUrlService])
+], McpOAuthArtifactService);
+//# sourceMappingURL=mcp-oauth-artifact.service.js.map

package/dist/modules/mcp/services/mcp-oauth-artifact.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-artifact.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-artifact.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAA0C;AAC1C,qCAAqC;AAErC,2CAA8F;AAC9F,6CAAmD;AAEnD,8DAAyD;AACzD,mEASsC;AACtC,oDAM0B;AAE1B,yEAAoE;AACpE,iFAA0E;AAQnE,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACnC,YAEkB,OAAyC,EAEzC,MAAuC,EAEvC,YAAmD,EAEnD,kBAA+D,EAE/D,YAAmD,EAEnD,eAA6D,EAE7D,WAAkD,EAClD,mBAA2C,EAC3C,gBAA0C;QAd1C,YAAO,GAAP,OAAO,CAAkC;QAEzC,WAAM,GAAN,MAAM,CAAiC;QAEvC,iBAAY,GAAZ,YAAY,CAAuC;QAEnD,uBAAkB,GAAlB,kBAAkB,CAA6C;QAE/D,iBAAY,GAAZ,YAAY,CAAuC;QAEnD,oBAAe,GAAf,eAAe,CAA8C;QAE7D,gBAAW,GAAX,WAAW,CAAuC;QAClD,wBAAmB,GAAnB,mBAAmB,CAAwB;QAC3C,qBAAgB,GAAhB,gBAAgB,CAA0B;IACzD,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,KAKlB;QACA,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACnB,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC9C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;YACrC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC;YACvC,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,KAAK,CAAC,WAAW;SAC9B,CAAC,CACF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAOjB;QACA,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,2CAA2B,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC7D,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,0CAA0B,EAAE,CAAC;SAC/D,CAAC,CAAC;QAEH,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,oCAA2B,CAAC,yDAAyD,CAAC,CAAC;QAClG,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAClB,mBAAmB,EAAE,IAAA,uBAAS,EAAC,KAAK,CAAC,eAAe,CAAC;YACrD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE;YAClE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;YACzC,SAAS;YACT,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,CAAC;YACb,2BAA2B,EAAE,KAAK,CAAC,2BAA2B,IAAI,CAAC;YACnE,sBAAsB,EAAE,WAAW,CAAC,sBAAsB;YAC1D,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;YACpD,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;YAC9D,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,sBAAsB,EAAE,WAAW,CAAC,sBAAsB;SAC1D,CAAC,CACF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAKvB;QACA,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAC5C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YACxB,OAAO,EAAE,IAAA,uBAAS,EAAC,QAAQ,CAAC;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,mBAAmB,EAAE,IAAI;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC;YAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,IAAI;SAChB,CAAC,CACF,CAAC;QAEF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAQ5B;QACA,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAClD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC9B,QAAQ,EAAE,IAAA,uBAAS,EAAC,QAAQ,CAAC;YAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YACvB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;YAC1C,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;YAC1B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,IAAI;SAChB,CAAC,CACF,CAAC;QAEF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAMtB;QACA,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kDAAkC,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAC5C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YACxB,SAAS,EAAE,IAAA,uBAAS,EAAC,QAAQ,CAAC;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YACvB,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC9C,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;YAC1C,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;YAC1B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/E,SAAS,EAAE,IAAI;SACf,CAAC,CACF,CAAC;QAEF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAyE;QAIjG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oDAAoC,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEvF,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACjE,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,mDAAgC,CAAC,CAAC;YACjF,MAAM,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,6CAA0B,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CACzC,gBAAgB,CAAC,MAAM,CAAC;gBACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;gBAC1C,SAAS;gBACT,SAAS,EAAE,IAAI;gBACf,gBAAgB,EAAE,IAAI;gBACtB,UAAU,EAAE,CAAC;aACb,CAAC,CACF,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAC1C,eAAe,CAAC,MAAM,CAAC;gBACtB,SAAS,EAAE,IAAA,uBAAS,EAAC,QAAQ,CAAC;gBAC9B,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,aAAa,EAAE,IAAI;gBACnB,SAAS;gBACT,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;aACf,CAAC,CACF,CAAC;YAEF,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,iBAAiB;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAE7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,MAAM,IAAI,oCAA2B,CAAC,wCAAwC,CAAC,CAAC;QACjF,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,mBAAmB,CAAC,KAAK,GAAG,EAAE;QACrC,OAAO,IAAA,yBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAEO,QAAQ,CAAC,GAAG,MAA+B;QAClD,OAAO,IAAI,IAAI,CACd,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAiB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CACzG,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,KAA0B;QACnD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,4BAAmB,CAAC,mCAAmC,CAAC,CAAC;QACpE,CAAC;IACF,CAAC;CACD,CAAA;AAtOY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAGV,WAAA,IAAA,0BAAgB,EAAC,uCAAoB,CAAC,CAAA;IAEtC,WAAA,IAAA,0BAAgB,EAAC,sCAAmB,CAAC,CAAA;IAErC,WAAA,IAAA,0BAAgB,EAAC,4CAAyB,CAAC,CAAA;IAE3C,WAAA,IAAA,0BAAgB,EAAC,kDAA+B,CAAC,CAAA;IAEjD,WAAA,IAAA,0BAAgB,EAAC,4CAAyB,CAAC,CAAA;IAE3C,WAAA,IAAA,0BAAgB,EAAC,mDAAgC,CAAC,CAAA;IAElD,WAAA,IAAA,0BAAgB,EAAC,4CAAyB,CAAC,CAAA;qCAXlB,oBAAU;QAEX,oBAAU;QAEJ,oBAAU;QAEJ,oBAAU;QAEhB,oBAAU;QAEP,oBAAU;QAEd,oBAAU;QACF,iDAAsB;QACzB,uDAAwB;GAjBhD,uBAAuB,CAsOnC"}

package/dist/modules/mcp/services/mcp-oauth-bootstrap.service.d.ts

@@ -0,0 +1,22 @@
+import { FastifyInstance } from 'fastify';
+import { McpOAuthProxyPolicyService } from './mcp-oauth-proxy-policy.service';
+import { McpOAuthReadinessService } from './mcp-oauth-readiness.service';
+import { McpOAuthResourceServerService } from './mcp-oauth-resource-server.service';
+import { McpOAuthRouteGateService } from './mcp-oauth-route-gate.service';
+import { McpOAuthRuntimeService } from './mcp-oauth-runtime.service';
+export declare class McpOAuthBootstrapService {
+    private readonly readiness;
+    private readonly routeGate;
+    private readonly proxyPolicy;
+    private readonly resourceServer;
+    private readonly runtime;
+    private registered;
+    constructor(readiness: McpOAuthReadinessService, routeGate: McpOAuthRouteGateService, proxyPolicy: McpOAuthProxyPolicyService, resourceServer: McpOAuthResourceServerService, runtime: McpOAuthRuntimeService);
+    register(fastify: FastifyInstance): void;
+    private handle;
+    private match;
+    private isAuthorizationPath;
+    private dispatchProvider;
+    private writeRouteError;
+    private writeJson;
+}

package/dist/modules/mcp/services/mcp-oauth-bootstrap.service.js

@@ -0,0 +1,116 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthBootstrapService = void 0;
+const common_1 = require("@nestjs/common");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_oauth_proxy_policy_service_1 = require("./mcp-oauth-proxy-policy.service");
+const mcp_oauth_readiness_service_1 = require("./mcp-oauth-readiness.service");
+const mcp_oauth_resource_server_service_1 = require("./mcp-oauth-resource-server.service");
+const mcp_oauth_route_gate_service_1 = require("./mcp-oauth-route-gate.service");
+const mcp_oauth_runtime_service_1 = require("./mcp-oauth-runtime.service");
+let McpOAuthBootstrapService = class McpOAuthBootstrapService {
+    constructor(readiness, routeGate, proxyPolicy, resourceServer, runtime) {
+        this.readiness = readiness;
+        this.routeGate = routeGate;
+        this.proxyPolicy = proxyPolicy;
+        this.resourceServer = resourceServer;
+        this.runtime = runtime;
+        this.registered = false;
+    }
+    register(fastify) {
+        if (this.registered) {
+            throw new common_1.ServiceUnavailableException('The MCP OAuth bootstrap route set is already registered');
+        }
+        fastify.addHook('onRequest', async (request, reply) => this.handle(request, reply));
+        this.registered = true;
+        this.readiness.register(mcp_oauth_readiness_service_1.McpOAuthReadinessControl.COMPLETE_ROUTE_SET);
+    }
+    handle(request, reply) {
+        const route = this.match(request);
+        if (!route)
+            return;
+        reply.hijack();
+        try {
+            this.routeGate.assertOpen();
+            this.proxyPolicy.assertForwardedHeadersTrusted(request);
+            switch (route) {
+                case 'protected_resource_metadata':
+                    this.writeJson(reply.raw, 200, this.resourceServer.getProtectedResourceMetadata());
+                    return;
+                case 'authorization_server_metadata':
+                    this.writeJson(reply.raw, 200, this.resourceServer.getAuthorizationServerMetadata());
+                    return;
+                default:
+                    this.dispatchProvider(request, reply);
+            }
+        }
+        catch (error) {
+            this.writeRouteError(reply.raw, error);
+        }
+    }
+    match(request) {
+        const pathname = new URL(request.raw.url ?? '/', 'http://localhost').pathname;
+        const method = request.raw.method ?? request.method;
+        if (method === 'GET' && pathname === mcp_constants_1.MCP_OAUTH_PROTECTED_RESOURCE_METADATA_PATH) {
+            return 'protected_resource_metadata';
+        }
+        if (method === 'GET' && pathname === mcp_constants_1.MCP_OAUTH_AUTHORIZATION_SERVER_METADATA_PATH) {
+            return 'authorization_server_metadata';
+        }
+        if (method === 'GET' && this.isAuthorizationPath(pathname)) {
+            return 'authorization';
+        }
+        if ((method === 'POST' || method === 'OPTIONS') && pathname === mcp_constants_1.MCP_OAUTH_TOKEN_PATH)
+            return 'token';
+        if ((method === 'POST' || method === 'OPTIONS') && pathname === mcp_constants_1.MCP_OAUTH_REVOCATION_PATH)
+            return 'revocation';
+        return null;
+    }
+    isAuthorizationPath(pathname) {
+        if (pathname === mcp_constants_1.MCP_OAUTH_AUTHORIZATION_PATH)
+            return true;
+        const resumePrefix = `${mcp_constants_1.MCP_OAUTH_AUTHORIZATION_PATH}/`;
+        const resumeId = pathname.startsWith(resumePrefix) ? pathname.slice(resumePrefix.length) : '';
+        return resumeId.length > 0 && !resumeId.includes('/');
+    }
+    dispatchProvider(request, reply) {
+        const runtime = this.runtime.getActive();
+        const url = new URL(request.raw.url ?? '/', 'http://localhost');
+        const providerIssuerPath = new URL(runtime.urls.issuer).pathname;
+        request.raw.url = `${providerIssuerPath}${url.pathname.slice(mcp_constants_1.MCP_OAUTH_ISSUER_PATH.length)}${url.search}`;
+        runtime.callback(request.raw, reply.raw);
+    }
+    writeRouteError(response, error) {
+        const status = error instanceof common_1.ForbiddenException ? 403 : error instanceof common_1.ServiceUnavailableException ? 503 : 500;
+        const code = status === 403 ? 'access_denied' : status === 503 ? 'temporarily_unavailable' : 'server_error';
+        this.writeJson(response, status, { error: code });
+    }
+    writeJson(response, status, payload) {
+        if (response.headersSent || response.writableEnded)
+            return;
+        response.statusCode = status;
+        response.setHeader('content-type', 'application/json');
+        response.setHeader('cache-control', 'no-store');
+        response.setHeader('pragma', 'no-cache');
+        response.end(JSON.stringify(payload));
+    }
+};
+exports.McpOAuthBootstrapService = McpOAuthBootstrapService;
+exports.McpOAuthBootstrapService = McpOAuthBootstrapService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [mcp_oauth_readiness_service_1.McpOAuthReadinessService,
+        mcp_oauth_route_gate_service_1.McpOAuthRouteGateService,
+        mcp_oauth_proxy_policy_service_1.McpOAuthProxyPolicyService,
+        mcp_oauth_resource_server_service_1.McpOAuthResourceServerService,
+        mcp_oauth_runtime_service_1.McpOAuthRuntimeService])
+], McpOAuthBootstrapService);
+//# sourceMappingURL=mcp-oauth-bootstrap.service.js.map