@fastybird/smart-panel-backend 1.0.0-beta.3 → 1.1.0-alpha.0

package/dist/modules/mcp/services/mcp-oauth-interaction.service.js

@@ -0,0 +1,312 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthInteractionService = void 0;
+const node_events_1 = require("node:events");
+const typeorm_1 = require("typeorm");
+const common_1 = require("@nestjs/common");
+const typeorm_2 = require("@nestjs/typeorm");
+const token_utils_1 = require("../../auth/utils/token.utils");
+const config_service_1 = require("../../config/services/config.service");
+const mdns_constants_1 = require("../../mdns/mdns.constants");
+const mcp_oauth_entity_1 = require("../entities/mcp-oauth.entity");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_oauth_interaction_model_1 = require("../models/mcp-oauth-interaction.model");
+const mcp_oauth_scope_utils_1 = require("../oauth/mcp-oauth-scope.utils");
+const mcp_installation_service_1 = require("./mcp-installation.service");
+const mcp_oauth_approver_authority_service_1 = require("./mcp-oauth-approver-authority.service");
+const mcp_oauth_artifact_service_1 = require("./mcp-oauth-artifact.service");
+const mcp_oauth_client_service_1 = require("./mcp-oauth-client.service");
+const mcp_oauth_runtime_service_1 = require("./mcp-oauth-runtime.service");
+const mcp_subscription_registry_service_1 = require("./mcp-subscription-registry.service");
+const DAYS_TO_MILLISECONDS = 24 * 60 * 60 * 1_000;
+class CapturedServerResponse extends node_events_1.EventEmitter {
+    constructor() {
+        super(...arguments);
+        this.statusCode = 200;
+        this.statusMessage = '';
+        this.finished = false;
+        this.writableEnded = false;
+        this.writableFinished = false;
+        this.destroyed = false;
+        this.headers = new Map();
+    }
+    get headersSent() {
+        return this.finished;
+    }
+    setHeader(name, value) {
+        this.headers.set(name.toLowerCase(), value);
+        return this;
+    }
+    getHeader(name) {
+        return this.headers.get(name.toLowerCase());
+    }
+    getHeaders() {
+        return Object.fromEntries(this.headers);
+    }
+    getHeaderNames() {
+        return [...this.headers.keys()];
+    }
+    hasHeader(name) {
+        return this.headers.has(name.toLowerCase());
+    }
+    removeHeader(name) {
+        this.headers.delete(name.toLowerCase());
+    }
+    writeHead(statusCode, statusMessageOrHeaders, headers) {
+        this.statusCode = statusCode;
+        if (typeof statusMessageOrHeaders === 'string') {
+            this.statusMessage = statusMessageOrHeaders;
+            this.applyHeaders(headers);
+        }
+        else {
+            this.applyHeaders(statusMessageOrHeaders);
+        }
+        return this;
+    }
+    write() {
+        return true;
+    }
+    end() {
+        this.finished = true;
+        this.writableEnded = true;
+        this.writableFinished = true;
+        this.emit('finish');
+        return this;
+    }
+    applyHeaders(headers) {
+        for (const [name, value] of Object.entries(headers ?? {})) {
+            if (value !== undefined)
+                this.setHeader(name, value);
+        }
+    }
+}
+let McpOAuthInteractionService = class McpOAuthInteractionService {
+    constructor(interactions, runtimeService, clientsService, artifactService, approverAuthority, installationService, configService, subscriptions) {
+        this.interactions = interactions;
+        this.runtimeService = runtimeService;
+        this.clientsService = clientsService;
+        this.artifactService = artifactService;
+        this.approverAuthority = approverAuthority;
+        this.installationService = installationService;
+        this.configService = configService;
+        this.subscriptions = subscriptions;
+    }
+    async getInteraction(rawUid, userId, request) {
+        this.assertUid(rawUid);
+        return this.subscriptions.runOAuthMutation(() => this.getInteractionWithinGate(rawUid, userId, request));
+    }
+    async getInteractionWithinGate(rawUid, userId, request) {
+        const { provider } = this.runtimeService.getActive();
+        const details = await provider.interactionDetails(request, this.captureResponse());
+        if (details.uid !== rawUid) {
+            throw new common_1.ForbiddenException('OAuth interaction binding does not match the current browser');
+        }
+        const context = await this.resolveContext(details, rawUid, userId);
+        if (details.prompt.name === 'login') {
+            const completion = await this.finish(provider, request, {
+                login: { accountId: userId, acr: 'smart-panel-session', amr: ['pwd'] },
+            });
+            const model = Object.assign(new mcp_oauth_interaction_model_1.McpOAuthInteractionModel(), {
+                action: mcp_oauth_interaction_model_1.McpOAuthInteractionAction.REDIRECT,
+                redirectTo: completion.redirectTo,
+            });
+            model.setCookies = completion.setCookies;
+            return model;
+        }
+        if (details.prompt.name !== 'consent') {
+            throw new common_1.BadRequestException(`Unsupported OAuth interaction prompt: ${details.prompt.name}`);
+        }
+        return Object.assign(new mcp_oauth_interaction_model_1.McpOAuthInteractionModel(), {
+            action: mcp_oauth_interaction_model_1.McpOAuthInteractionAction.CONSENT,
+            installationName: this.getInstallationName(),
+            installationId: await this.installationService.getInstallationId(),
+            clientIdentifier: context.client.clientIdentifier,
+            clientName: context.client.name,
+            redirectUri: context.redirectUri,
+            requestedScopes: context.requestedScopes,
+            accessExpiresInSeconds: Math.floor(mcp_constants_1.MCP_OAUTH_ACCESS_TOKEN_LIFETIME_MS / 1_000),
+            maximumGrantExpiresInDays: Math.floor(mcp_constants_1.MCP_OAUTH_GRANT_LIFETIME_MS / DAYS_TO_MILLISECONDS),
+            physicalDeviceWarning: context.requestedScopes.includes(mcp_constants_1.McpOAuthScope.WRITE) ||
+                context.requestedScopes.includes(mcp_constants_1.McpOAuthScope.TRIGGER),
+        });
+    }
+    async approve(rawUid, userId, dto, request) {
+        this.assertUid(rawUid);
+        return this.approverAuthority.runAuthorized(userId, (approverAuthorityGeneration) => this.approveWithinGate(rawUid, userId, dto, request, approverAuthorityGeneration));
+    }
+    async approveWithinGate(rawUid, userId, dto, request, approverAuthorityGeneration) {
+        const { provider, urls } = this.runtimeService.getActive();
+        const details = await provider.interactionDetails(request, this.captureResponse());
+        if (details.uid !== rawUid || details.prompt.name !== 'consent') {
+            throw new common_1.ForbiddenException('OAuth consent interaction does not match the current browser');
+        }
+        const context = await this.resolveContext(details, rawUid, userId);
+        const moduleConfig = this.configService.getModuleConfig(mcp_constants_1.MCP_MODULE_NAME);
+        if (!moduleConfig.enabled) {
+            throw new common_1.ForbiddenException('The MCP module is disabled');
+        }
+        this.assertApprovedScopes(dto.scopes, context.requestedScopes, context.client.maximumScopes, moduleConfig.capabilities);
+        await this.consumeInteraction(context.interaction, userId);
+        const providerGrant = new provider.Grant({ accountId: userId, clientId: context.client.clientIdentifier });
+        const capabilityScopes = dto.scopes.filter((scope) => scope !== mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS);
+        if (capabilityScopes.length > 0) {
+            providerGrant.addResourceScope(urls.resource, capabilityScopes.join(' '));
+        }
+        if (dto.scopes.includes(mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS)) {
+            providerGrant.addOIDCScope(mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS);
+        }
+        providerGrant.expiresIn = dto.expiresInDays * 24 * 60 * 60;
+        const savedGrantId = await providerGrant.save();
+        await this.artifactService.createGrant({
+            providerGrantId: savedGrantId,
+            clientId: context.client.id,
+            approvedById: userId,
+            approvedScopes: dto.scopes,
+            expiresAt: new Date(Date.now() + dto.expiresInDays * DAYS_TO_MILLISECONDS),
+            approverAuthorityGeneration,
+        });
+        return this.finish(provider, request, { consent: { grantId: savedGrantId } }, true);
+    }
+    async deny(rawUid, userId, request) {
+        this.assertUid(rawUid);
+        return this.subscriptions.runOAuthMutation(() => this.denyWithinGate(rawUid, userId, request));
+    }
+    async denyWithinGate(rawUid, userId, request) {
+        const { provider } = this.runtimeService.getActive();
+        const details = await provider.interactionDetails(request, this.captureResponse());
+        if (details.uid !== rawUid) {
+            throw new common_1.ForbiddenException('OAuth interaction binding does not match the current browser');
+        }
+        const context = await this.resolveContext(details, rawUid, userId);
+        await this.consumeInteraction(context.interaction, userId);
+        const completion = await this.finish(provider, request, {
+            error: 'access_denied',
+            error_description: 'The resource owner denied the request',
+        });
+        return completion;
+    }
+    async resolveContext(details, rawUid, userId) {
+        const clientIdentifier = details.params.client_id;
+        const redirectUri = details.params.redirect_uri;
+        const scope = details.params.scope;
+        if (typeof clientIdentifier !== 'string' ||
+            typeof redirectUri !== 'string' ||
+            (scope !== undefined && typeof scope !== 'string')) {
+            throw new common_1.BadRequestException('OAuth interaction parameters are incomplete');
+        }
+        const client = await this.clientsService.findActiveByIdentifier(clientIdentifier);
+        if (!client || !this.clientsService.isRedirectUriAllowed(client, redirectUri)) {
+            throw new common_1.ForbiddenException('OAuth client or redirect URI is no longer authorized');
+        }
+        const requestedScope = typeof scope === 'string' ? scope : undefined;
+        const requestedScopes = requestedScope === undefined
+            ? client.maximumScopes.filter((scope) => scope !== mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS)
+            : requestedScope
+                .split(' ')
+                .filter((value) => Object.values(mcp_constants_1.McpOAuthScope).includes(value));
+        if (requestedScope !== undefined && requestedScopes.length !== requestedScope.split(' ').filter(Boolean).length) {
+            throw new common_1.BadRequestException('OAuth interaction contains an unsupported scope');
+        }
+        let interaction = await this.interactions.findOneBy({ uidHash: (0, token_utils_1.hashToken)(rawUid) });
+        if (!interaction) {
+            try {
+                interaction = await this.interactions.save(this.interactions.create({
+                    uidHash: (0, token_utils_1.hashToken)(rawUid),
+                    clientId: client.id,
+                    authenticatedUserId: userId,
+                    redirectUri,
+                    requestedScopes,
+                    expiresAt: new Date(Date.now() + 10 * 60 * 1_000),
+                    consumedAt: null,
+                }));
+            }
+            catch {
+                interaction = await this.interactions.findOneBy({ uidHash: (0, token_utils_1.hashToken)(rawUid) });
+            }
+        }
+        if (!interaction || interaction.authenticatedUserId !== userId) {
+            throw new common_1.ForbiddenException('OAuth interaction is bound to another authenticated account');
+        }
+        if (interaction.consumedAt || interaction.expiresAt <= new Date()) {
+            throw new common_1.ConflictException('OAuth interaction is expired or already completed');
+        }
+        return { client, redirectUri, requestedScopes, interaction };
+    }
+    assertApprovedScopes(approved, requested, clientMaximum, moduleCapabilities) {
+        const moduleMaximum = new Set(moduleCapabilities.map(mcp_oauth_scope_utils_1.toMcpOAuthScope));
+        if (approved.length === 0 ||
+            !approved.some((scope) => scope !== mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS) ||
+            approved.some((scope) => !requested.includes(scope) ||
+                !clientMaximum.includes(scope) ||
+                (scope !== mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS && !moduleMaximum.has(scope)))) {
+            throw new common_1.BadRequestException('Approved scopes must be a capability-bearing subset of the request and live authorization ceilings');
+        }
+    }
+    async consumeInteraction(interaction, userId) {
+        const result = await this.interactions.update({ id: interaction.id, authenticatedUserId: userId, consumedAt: (0, typeorm_1.IsNull)() }, { consumedAt: new Date() });
+        if (!result.affected) {
+            throw new common_1.ConflictException('OAuth interaction was completed by another request');
+        }
+    }
+    async finish(provider, request, result, mergeWithLastSubmission = false) {
+        const response = new CapturedServerResponse();
+        await provider.interactionFinished(request, response, result, {
+            mergeWithLastSubmission,
+        });
+        const location = response.getHeader('location');
+        if (typeof location !== 'string') {
+            throw new common_1.BadRequestException('OAuth interaction did not produce a safe redirect');
+        }
+        const completion = new mcp_oauth_interaction_model_1.McpOAuthInteractionCompletionModel();
+        completion.redirectTo = location;
+        const setCookie = response.getHeader('set-cookie');
+        completion.setCookies = Array.isArray(setCookie)
+            ? setCookie.map(String)
+            : setCookie === undefined
+                ? []
+                : [String(setCookie)];
+        return completion;
+    }
+    captureResponse() {
+        return new CapturedServerResponse();
+    }
+    getInstallationName() {
+        try {
+            return this.configService.getModuleConfig(mdns_constants_1.MDNS_MODULE_NAME).serviceName;
+        }
+        catch {
+            return mdns_constants_1.MDNS_DEFAULT_SERVICE_NAME;
+        }
+    }
+    assertUid(rawUid) {
+        if (!/^[A-Za-z0-9_-]{20,200}$/.test(rawUid)) {
+            throw new common_1.BadRequestException('Invalid OAuth interaction identifier');
+        }
+    }
+};
+exports.McpOAuthInteractionService = McpOAuthInteractionService;
+exports.McpOAuthInteractionService = McpOAuthInteractionService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthInteractionEntity)),
+    __metadata("design:paramtypes", [typeorm_1.Repository,
+        mcp_oauth_runtime_service_1.McpOAuthRuntimeService,
+        mcp_oauth_client_service_1.McpOAuthClientService,
+        mcp_oauth_artifact_service_1.McpOAuthArtifactService,
+        mcp_oauth_approver_authority_service_1.McpOAuthApproverAuthorityService,
+        mcp_installation_service_1.McpInstallationService,
+        config_service_1.ConfigService,
+        mcp_subscription_registry_service_1.McpSubscriptionRegistryService])
+], McpOAuthInteractionService);
+//# sourceMappingURL=mcp-oauth-interaction.service.js.map

package/dist/modules/mcp/services/mcp-oauth-interaction.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-interaction.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-interaction.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAA2C;AAI3C,qCAA6C;AAE7C,2CAAwG;AACxG,6CAAmD;AAEnD,8DAAyD;AACzD,yEAAqE;AACrE,8DAAwF;AAGxF,mEAAyE;AACzE,oDAM0B;AAE1B,uFAI+C;AAC/C,0EAAiE;AAEjE,yEAAoE;AACpE,iGAA0F;AAC1F,6EAAuE;AACvE,yEAAmE;AACnE,2EAAqE;AACrE,2FAAqF;AAErF,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAElD,MAAM,sBAAuB,SAAQ,0BAAY;IAAjD;;QACC,eAAU,GAAG,GAAG,CAAC;QACjB,kBAAa,GAAG,EAAE,CAAC;QACnB,aAAQ,GAAG,KAAK,CAAC;QACjB,kBAAa,GAAG,KAAK,CAAC;QACtB,qBAAgB,GAAG,KAAK,CAAC;QACzB,cAAS,GAAG,KAAK,CAAC;QACD,YAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAiElE,CAAC;IA/DA,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,KAAyB;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,SAAS,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU;QACT,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,cAAc;QACb,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,YAAY,CAAC,IAAY;QACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,CACR,UAAkB,EAClB,sBAAqD,EACrD,OAA6B;QAE7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,IAAI,OAAO,sBAAsB,KAAK,QAAQ,EAAE,CAAC;YAChD,IAAI,CAAC,aAAa,GAAG,sBAAsB,CAAC;YAC5C,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK;QACJ,OAAO,IAAI,CAAC;IACb,CAAC;IAED,GAAG;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,YAAY,CAAC,OAA6B;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,IAAI,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;CACD;AAGM,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACtC,YAEkB,YAAmD,EACnD,cAAsC,EACtC,cAAqC,EACrC,eAAwC,EACxC,iBAAmD,EACnD,mBAA2C,EAC3C,aAA4B,EAC5B,aAA6C;QAP7C,iBAAY,GAAZ,YAAY,CAAuC;QACnD,mBAAc,GAAd,cAAc,CAAwB;QACtC,mBAAc,GAAd,cAAc,CAAuB;QACrC,oBAAe,GAAf,eAAe,CAAyB;QACxC,sBAAiB,GAAjB,iBAAiB,CAAkC;QACnD,wBAAmB,GAAnB,mBAAmB,CAAwB;QAC3C,kBAAa,GAAb,aAAa,CAAe;QAC5B,kBAAa,GAAb,aAAa,CAAgC;IAC5D,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,OAAwB;QAC5E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEvB,OAAO,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1G,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACrC,MAAc,EACd,MAAc,EACd,OAAwB;QAExB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAEnF,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,2BAAkB,CAAC,8DAA8D,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAEnE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE;gBACvD,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE;aACtE,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,sDAAwB,EAAE,EAAE;gBAC3D,MAAM,EAAE,uDAAyB,CAAC,QAAQ;gBAC1C,UAAU,EAAE,UAAU,CAAC,UAAU;aACjC,CAAC,CAAC;YACH,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;YAEzC,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,4BAAmB,CAAC,yCAAyC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,sDAAwB,EAAE,EAAE;YACpD,MAAM,EAAE,uDAAyB,CAAC,OAAO;YACzC,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,EAAE;YAC5C,cAAc,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE;YAClE,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB;YACjD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;YAC/B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,kDAAkC,GAAG,KAAK,CAAC;YAC9E,yBAAyB,EAAE,IAAI,CAAC,KAAK,CAAC,2CAA2B,GAAG,oBAAoB,CAAC;YACzF,qBAAqB,EACpB,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,6BAAa,CAAC,KAAK,CAAC;gBACrD,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,6BAAa,CAAC,OAAO,CAAC;SACxD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACZ,MAAc,EACd,MAAc,EACd,GAAkC,EAClC,OAAwB;QAExB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEvB,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,2BAA2B,EAAE,EAAE,CACnF,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,2BAA2B,CAAC,CACjF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC9B,MAAc,EACd,MAAc,EACd,GAAkC,EAClC,OAAwB,EACxB,2BAAmC;QAEnC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAEnF,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACjE,MAAM,IAAI,2BAAkB,CAAC,8DAA8D,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAiB,+BAAe,CAAC,CAAC;QAEzF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,2BAAkB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,oBAAoB,CACxB,GAAG,CAAC,MAAM,EACV,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,MAAM,CAAC,aAAa,EAC5B,YAAY,CAAC,YAAY,CACzB,CAAC;QACF,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE3D,MAAM,aAAa,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC3G,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,6BAAa,CAAC,cAAc,CAAC,CAAC;QAE9F,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,aAAa,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAAa,CAAC,cAAc,CAAC,EAAE,CAAC;YACvD,aAAa,CAAC,YAAY,CAAC,6BAAa,CAAC,cAAc,CAAC,CAAC;QAC1D,CAAC;QAEA,aAAkD,CAAC,SAAS,GAAG,GAAG,CAAC,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACjG,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC;YACtC,eAAe,EAAE,YAAY;YAC7B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;YAC3B,YAAY,EAAE,MAAM;YACpB,cAAc,EAAE,GAAG,CAAC,MAAM;YAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,aAAa,GAAG,oBAAoB,CAAC;YAC1E,2BAA2B;SAC3B,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,MAAc,EAAE,OAAwB;QAClE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEvB,OAAO,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChG,CAAC;IAEO,KAAK,CAAC,cAAc,CAC3B,MAAc,EACd,MAAc,EACd,OAAwB;QAExB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAEnF,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,2BAAkB,CAAC,8DAA8D,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE;YACvD,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,uCAAuC;SAC1D,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA6C,EAAE,MAAc,EAAE,MAAc;QACzG,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAEnC,IACC,OAAO,gBAAgB,KAAK,QAAQ;YACpC,OAAO,WAAW,KAAK,QAAQ;YAC/B,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,EACjD,CAAC;YACF,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;QAElF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,2BAAkB,CAAC,sDAAsD,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,MAAM,eAAe,GACpB,cAAc,KAAK,SAAS;YAC3B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,6BAAa,CAAC,cAAc,CAAC;YAChF,CAAC,CAAC,cAAc;iBACb,KAAK,CAAC,GAAG,CAAC;iBACV,MAAM,CAAC,CAAC,KAAK,EAA0B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,6BAAa,CAAC,CAAC,QAAQ,CAAC,KAAsB,CAAC,CAAC,CAAC;QAE9G,IAAI,cAAc,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,KAAK,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;YACjH,MAAM,IAAI,4BAAmB,CAAC,iDAAiD,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAA,uBAAS,EAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEpF,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,IAAI,CAAC;gBACJ,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CACzC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;oBACxB,OAAO,EAAE,IAAA,uBAAS,EAAC,MAAM,CAAC;oBAC1B,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,mBAAmB,EAAE,MAAM;oBAC3B,WAAW;oBACX,eAAe;oBACf,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;oBACjD,UAAU,EAAE,IAAI;iBAChB,CAAC,CACF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACR,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAA,uBAAS,EAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjF,CAAC;QACF,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAChE,MAAM,IAAI,2BAAkB,CAAC,6DAA6D,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,WAAW,CAAC,UAAU,IAAI,WAAW,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACnE,MAAM,IAAI,0BAAiB,CAAC,mDAAmD,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;IAC9D,CAAC;IAEO,oBAAoB,CAC3B,QAAyB,EACzB,SAA0B,EAC1B,aAA8B,EAC9B,kBAAmC;QAEnC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,uCAAe,CAAC,CAAC,CAAC;QAEvE,IACC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,6BAAa,CAAC,cAAc,CAAC;YACjE,QAAQ,CAAC,IAAI,CACZ,CAAC,KAAK,EAAE,EAAE,CACT,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC1B,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC9B,CAAC,KAAK,KAAK,6BAAa,CAAC,cAAc,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACtE,EACA,CAAC;YACF,MAAM,IAAI,4BAAmB,CAC5B,oGAAoG,CACpG,CAAC;QACH,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,WAAsC,EAAE,MAAc;QACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAC5C,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EACzE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAC1B,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,0BAAiB,CAAC,oDAAoD,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,MAAM,CACnB,QAAkB,EAClB,OAAwB,EACxB,MAAsD,EACtD,uBAAuB,GAAG,KAAK;QAE/B,MAAM,QAAQ,GAAG,IAAI,sBAAsB,EAAE,CAAC;QAE9C,MAAM,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAqC,EAAE,MAAM,EAAE;YAC1F,uBAAuB;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAEhD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAAC,mDAAmD,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,gEAAkC,EAAE,CAAC;QAC5D,UAAU,CAAC,UAAU,GAAG,QAAQ,CAAC;QACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACnD,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;YACvB,CAAC,CAAC,SAAS,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAExB,OAAO,UAAU,CAAC;IACnB,CAAC;IAEO,eAAe;QACtB,OAAO,IAAI,sBAAsB,EAA+B,CAAC;IAClE,CAAC;IAEO,mBAAmB;QAC1B,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAkB,iCAAgB,CAAC,CAAC,WAAW,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,0CAAyB,CAAC;QAClC,CAAC;IACF,CAAC;IAEO,SAAS,CAAC,MAAc;QAC/B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;CACD,CAAA;AA9SY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;IAGV,WAAA,IAAA,0BAAgB,EAAC,4CAAyB,CAAC,CAAA;qCACb,oBAAU;QACR,kDAAsB;QACtB,gDAAqB;QACpB,oDAAuB;QACrB,uEAAgC;QAC9B,iDAAsB;QAC5B,8BAAa;QACb,kEAA8B;GAVnD,0BAA0B,CA8StC"}

package/dist/modules/mcp/services/mcp-oauth-lifecycle.service.d.ts

@@ -0,0 +1,18 @@
+import { OnApplicationBootstrap } from '@nestjs/common';
+import { ConfigService } from '../../config/services/config.service';
+import { McpOAuthReadinessService } from './mcp-oauth-readiness.service';
+import { McpOAuthRouteGateService } from './mcp-oauth-route-gate.service';
+import { McpOAuthRuntimeService } from './mcp-oauth-runtime.service';
+export type McpOAuthLifecycleMutation = () => Promise<void> | void;
+export declare class McpOAuthLifecycleService implements OnApplicationBootstrap {
+    private readonly configService;
+    private readonly readiness;
+    private readonly routeGate;
+    private readonly runtime;
+    private readonly logger;
+    constructor(configService: ConfigService, readiness: McpOAuthReadinessService, routeGate: McpOAuthRouteGateService, runtime: McpOAuthRuntimeService);
+    onApplicationBootstrap(): Promise<void>;
+    onConfigReset(): void;
+    activateInternal(): Promise<void>;
+    reconfigureInternal(mutation: McpOAuthLifecycleMutation): Promise<void>;
+}

package/dist/modules/mcp/services/mcp-oauth-lifecycle.service.js

@@ -0,0 +1,88 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthLifecycleService = void 0;
+const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const logger_1 = require("../../../common/logger");
+const config_constants_1 = require("../../config/config.constants");
+const config_service_1 = require("../../config/services/config.service");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_oauth_readiness_service_1 = require("./mcp-oauth-readiness.service");
+const mcp_oauth_route_gate_service_1 = require("./mcp-oauth-route-gate.service");
+const mcp_oauth_runtime_service_1 = require("./mcp-oauth-runtime.service");
+let McpOAuthLifecycleService = class McpOAuthLifecycleService {
+    constructor(configService, readiness, routeGate, runtime) {
+        this.configService = configService;
+        this.readiness = readiness;
+        this.routeGate = routeGate;
+        this.runtime = runtime;
+        this.logger = (0, logger_1.createExtensionLogger)(mcp_constants_1.MCP_MODULE_NAME, 'McpOAuthLifecycleService');
+    }
+    async onApplicationBootstrap() {
+        const config = this.configService.getModuleConfig(mcp_constants_1.MCP_MODULE_NAME);
+        if (!config.enabled || !config.oauthEnabled) {
+            this.routeGate.closeInternal();
+            this.runtime.deactivateInternal();
+            return;
+        }
+        try {
+            await this.activateInternal();
+        }
+        catch (error) {
+            const err = error instanceof Error ? error : new Error('Unknown MCP OAuth startup activation error');
+            this.logger.error('MCP OAuth startup activation failed; the OAuth route gate remains closed', {
+                message: err.message,
+                stack: err.stack,
+            });
+        }
+    }
+    onConfigReset() {
+        this.routeGate.closeInternal();
+        this.runtime.deactivateInternal();
+    }
+    async activateInternal() {
+        this.routeGate.closeInternal();
+        this.readiness.assertReady();
+        this.runtime.allowActivationInternal();
+        try {
+            await this.runtime.activateInternal();
+            this.readiness.assertReady();
+            this.routeGate.openInternal();
+        }
+        catch (error) {
+            this.routeGate.closeInternal();
+            this.runtime.deactivateInternal();
+            throw error;
+        }
+    }
+    async reconfigureInternal(mutation) {
+        this.routeGate.closeInternal();
+        this.runtime.deactivateInternal();
+        await mutation();
+        await this.activateInternal();
+    }
+};
+exports.McpOAuthLifecycleService = McpOAuthLifecycleService;
+__decorate([
+    (0, event_emitter_1.OnEvent)(config_constants_1.EventType.CONFIG_RESET),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], McpOAuthLifecycleService.prototype, "onConfigReset", null);
+exports.McpOAuthLifecycleService = McpOAuthLifecycleService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_service_1.ConfigService,
+        mcp_oauth_readiness_service_1.McpOAuthReadinessService,
+        mcp_oauth_route_gate_service_1.McpOAuthRouteGateService,
+        mcp_oauth_runtime_service_1.McpOAuthRuntimeService])
+], McpOAuthLifecycleService);
+//# sourceMappingURL=mcp-oauth-lifecycle.service.js.map

package/dist/modules/mcp/services/mcp-oauth-lifecycle.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-lifecycle.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-lifecycle.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAoE;AACpE,yDAAgD;AAEhD,mDAA+D;AAC/D,oEAA0D;AAC1D,yEAAqE;AACrE,oDAAmD;AAGnD,+EAAyE;AACzE,iFAA0E;AAC1E,2EAAqE;AAK9D,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAGpC,YACkB,aAA4B,EAC5B,SAAmC,EACnC,SAAmC,EACnC,OAA+B;QAH/B,kBAAa,GAAb,aAAa,CAAe;QAC5B,cAAS,GAAT,SAAS,CAA0B;QACnC,cAAS,GAAT,SAAS,CAA0B;QACnC,YAAO,GAAP,OAAO,CAAwB;QANhC,WAAM,GAAG,IAAA,8BAAqB,EAAC,+BAAe,EAAE,0BAA0B,CAAC,CAAC;IAO1F,CAAC;IAEJ,KAAK,CAAC,sBAAsB;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAiB,+BAAe,CAAC,CAAC;QAEnF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7C,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAClC,OAAO;QACR,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0EAA0E,EAAE;gBAC7F,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAGD,aAAa;QACZ,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,gBAAgB;QACrB,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;QAEvC,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,QAAmC;QAC5D,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAElC,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC/B,CAAC;CACD,CAAA;AA3DY,4DAAwB;AA+BpC;IADC,IAAA,uBAAO,EAAC,4BAAS,CAAC,YAAY,CAAC;;;;6DAI/B;mCAlCW,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAKqB,8BAAa;QACjB,sDAAwB;QACxB,uDAAwB;QAC1B,kDAAsB;GAPrC,wBAAwB,CA2DpC"}

package/dist/modules/mcp/services/mcp-oauth-management.service.d.ts

@@ -0,0 +1,45 @@
+import { DataSource, Repository } from 'typeorm';
+import { ConfigService } from '../../config/services/config.service';
+import { UpdateMcpOAuthClientDto } from '../dto/mcp-oauth-client.dto';
+import { UpdateMcpOAuthGrantDto } from '../dto/mcp-oauth-grant.dto';
+import { McpOAuthGrantEntity, McpOAuthProviderArtifactEntity } from '../entities/mcp-oauth.entity';
+import { McpOAuthClientModel } from '../models/mcp-oauth-client.model';
+import { McpOAuthAccessTokenModel, McpOAuthGrantModel, McpOAuthRefreshFamilyModel } from '../models/mcp-oauth-management.model';
+import { McpAuditService } from './mcp-audit.service';
+import { McpOAuthClientService } from './mcp-oauth-client.service';
+import { McpOAuthGlobalInvalidationService } from './mcp-oauth-global-invalidation.service';
+import { McpSubscriptionRegistryService } from './mcp-subscription-registry.service';
+export declare class McpOAuthManagementService {
+    private readonly grants;
+    private readonly artifacts;
+    private readonly dataSource;
+    private readonly configService;
+    private readonly clientsService;
+    private readonly subscriptions;
+    private readonly globalInvalidation;
+    private readonly auditService;
+    constructor(grants: Repository<McpOAuthGrantEntity>, artifacts: Repository<McpOAuthProviderArtifactEntity>, dataSource: DataSource, configService: ConfigService, clientsService: McpOAuthClientService, subscriptions: McpSubscriptionRegistryService, globalInvalidation: McpOAuthGlobalInvalidationService, auditService: McpAuditService);
+    findGrants(): Promise<McpOAuthGrantModel[]>;
+    getGrant(id: string): Promise<McpOAuthGrantModel>;
+    findAccessTokens(): Promise<McpOAuthAccessTokenModel[]>;
+    getAccessToken(id: string): Promise<McpOAuthAccessTokenModel>;
+    findRefreshFamilies(): Promise<McpOAuthRefreshFamilyModel[]>;
+    getRefreshFamily(id: string): Promise<McpOAuthRefreshFamilyModel>;
+    updateClient(id: string, dto: UpdateMcpOAuthClientDto, actorId: string): Promise<McpOAuthClientModel>;
+    disableClient(id: string, actorId: string, dto?: UpdateMcpOAuthClientDto): Promise<McpOAuthClientModel>;
+    updateGrant(id: string, dto: UpdateMcpOAuthGrantDto, actorId: string): Promise<McpOAuthGrantModel>;
+    revokeGrant(id: string, actorId: string): Promise<McpOAuthGrantModel>;
+    revokeAccessToken(id: string, actorId: string): Promise<void>;
+    revokeRefreshFamily(id: string, actorId: string): Promise<void>;
+    revokeAll(actorId: string): Promise<void>;
+    private getGrantEntity;
+    private mapGrant;
+    private sameScopes;
+    private mapAccessTokens;
+    private mapRefreshFamilies;
+    private getGrantsByProviderHash;
+    private getProviderRevocations;
+    private getRevokedRefreshFamilies;
+    private isModuleEnabled;
+    private parseScopes;
+}