@fastybird/smart-panel-backend 1.0.0-beta.3 → 1.1.0-alpha.0

package/dist/modules/mcp/services/mcp-oauth-route-gate.service.js

@@ -0,0 +1,50 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthRouteGateService = void 0;
+const common_1 = require("@nestjs/common");
+const mcp_oauth_readiness_service_1 = require("./mcp-oauth-readiness.service");
+let McpOAuthRouteGateService = class McpOAuthRouteGateService {
+    constructor(readiness) {
+        this.readiness = readiness;
+        this.open = false;
+        this.generation = 0;
+    }
+    openInternal() {
+        this.readiness.assertReady();
+        this.open = true;
+    }
+    closeInternal() {
+        this.open = false;
+        this.generation += 1;
+    }
+    assertOpen() {
+        if (!this.open) {
+            throw new common_1.ServiceUnavailableException('The MCP OAuth route gate is closed');
+        }
+        this.readiness.assertReady();
+        return this.generation;
+    }
+    assertOpenGeneration(generation) {
+        if (this.assertOpen() !== generation) {
+            throw new common_1.ServiceUnavailableException('The MCP OAuth route gate changed while the request was queued');
+        }
+    }
+    get isOpen() {
+        return this.open && this.readiness.snapshot.ready;
+    }
+};
+exports.McpOAuthRouteGateService = McpOAuthRouteGateService;
+exports.McpOAuthRouteGateService = McpOAuthRouteGateService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [mcp_oauth_readiness_service_1.McpOAuthReadinessService])
+], McpOAuthRouteGateService);
+//# sourceMappingURL=mcp-oauth-route-gate.service.js.map

package/dist/modules/mcp/services/mcp-oauth-route-gate.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-route-gate.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-route-gate.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAyE;AAEzE,+EAAyE;AAGlE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAIpC,YAA6B,SAAmC;QAAnC,cAAS,GAAT,SAAS,CAA0B;QAHxD,SAAI,GAAG,KAAK,CAAC;QACb,eAAU,GAAG,CAAC,CAAC;IAE4C,CAAC;IAEpE,YAAY;QACX,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,aAAa;QACZ,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,UAAU;QACT,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,oCAA2B,CAAC,oCAAoC,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAE7B,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAED,oBAAoB,CAAC,UAAkB;QACtC,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,oCAA2B,CAAC,+DAA+D,CAAC,CAAC;QACxG,CAAC;IACF,CAAC;IAED,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;IACnD,CAAC;CACD,CAAA;AAnCY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAK4B,sDAAwB;GAJpD,wBAAwB,CAmCpC"}

package/dist/modules/mcp/services/mcp-oauth-runtime.service.d.ts

@@ -0,0 +1,15 @@
+import { McpOAuthProviderFactory, McpOAuthProviderFactoryOptions, McpOAuthProviderRuntime } from '../oauth/mcp-oauth-provider.factory';
+import { McpOAuthRouteGateService } from './mcp-oauth-route-gate.service';
+export declare class McpOAuthRuntimeService {
+    private readonly providerFactory;
+    private readonly routeGate;
+    private runtime;
+    private activation;
+    private activationGeneration;
+    private activationBlocked;
+    constructor(providerFactory: McpOAuthProviderFactory, routeGate: McpOAuthRouteGateService);
+    activateInternal(options?: McpOAuthProviderFactoryOptions): Promise<McpOAuthProviderRuntime>;
+    getActive(): McpOAuthProviderRuntime;
+    deactivateInternal(): void;
+    allowActivationInternal(): void;
+}

package/dist/modules/mcp/services/mcp-oauth-runtime.service.js

@@ -0,0 +1,70 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthRuntimeService = void 0;
+const common_1 = require("@nestjs/common");
+const mcp_oauth_provider_factory_1 = require("../oauth/mcp-oauth-provider.factory");
+const mcp_oauth_route_gate_service_1 = require("./mcp-oauth-route-gate.service");
+let McpOAuthRuntimeService = class McpOAuthRuntimeService {
+    constructor(providerFactory, routeGate) {
+        this.providerFactory = providerFactory;
+        this.routeGate = routeGate;
+        this.runtime = null;
+        this.activation = null;
+        this.activationGeneration = 0;
+        this.activationBlocked = false;
+    }
+    async activateInternal(options = {}) {
+        if (this.activationBlocked) {
+            throw new common_1.ServiceUnavailableException('MCP OAuth provider activation is disabled');
+        }
+        if (this.runtime)
+            return this.runtime;
+        const activation = this.activation?.generation === this.activationGeneration
+            ? this.activation
+            : { generation: this.activationGeneration, promise: this.providerFactory.create(options) };
+        this.activation = activation;
+        try {
+            const runtime = await activation.promise;
+            if (activation.generation !== this.activationGeneration) {
+                throw new common_1.ServiceUnavailableException('MCP OAuth provider activation was cancelled');
+            }
+            this.runtime = runtime;
+            return runtime;
+        }
+        finally {
+            if (this.activation === activation)
+                this.activation = null;
+        }
+    }
+    getActive() {
+        this.routeGate.assertOpen();
+        if (!this.runtime) {
+            throw new common_1.ServiceUnavailableException('The internal MCP OAuth route gate is closed');
+        }
+        return this.runtime;
+    }
+    deactivateInternal() {
+        this.activationBlocked = true;
+        this.activationGeneration += 1;
+        this.runtime = null;
+    }
+    allowActivationInternal() {
+        this.activationBlocked = false;
+    }
+};
+exports.McpOAuthRuntimeService = McpOAuthRuntimeService;
+exports.McpOAuthRuntimeService = McpOAuthRuntimeService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [mcp_oauth_provider_factory_1.McpOAuthProviderFactory,
+        mcp_oauth_route_gate_service_1.McpOAuthRouteGateService])
+], McpOAuthRuntimeService);
+//# sourceMappingURL=mcp-oauth-runtime.service.js.map

package/dist/modules/mcp/services/mcp-oauth-runtime.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-runtime.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-runtime.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAyE;AAEzE,oFAI6C;AAE7C,iFAA0E;AAGnE,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAMlC,YACkB,eAAwC,EACxC,SAAmC;QADnC,oBAAe,GAAf,eAAe,CAAyB;QACxC,cAAS,GAAT,SAAS,CAA0B;QAP7C,YAAO,GAAmC,IAAI,CAAC;QAC/C,eAAU,GAA6E,IAAI,CAAC;QAC5F,yBAAoB,GAAG,CAAC,CAAC;QACzB,sBAAiB,GAAG,KAAK,CAAC;IAK/B,CAAC;IAEJ,KAAK,CAAC,gBAAgB,CAAC,UAA0C,EAAE;QAClE,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,oCAA2B,CAAC,2CAA2C,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,MAAM,UAAU,GACf,IAAI,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC,oBAAoB;YACxD,CAAC,CAAC,IAAI,CAAC,UAAU;YACjB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7F,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAEzC,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACzD,MAAM,IAAI,oCAA2B,CAAC,6CAA6C,CAAC,CAAC;YACtF,CAAC;YAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;YACvB,OAAO,OAAO,CAAC;QAChB,CAAC;gBAAS,CAAC;YACV,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;gBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAC5D,CAAC;IACF,CAAC;IAED,SAAS;QACR,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QAE5B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,oCAA2B,CAAC,6CAA6C,CAAC,CAAC;QACtF,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,kBAAkB;QACjB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC,oBAAoB,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,uBAAuB;QACtB,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;IAChC,CAAC;CACD,CAAA;AAxDY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;qCAQuB,oDAAuB;QAC7B,uDAAwB;GARzC,sBAAsB,CAwDlC"}

package/dist/modules/mcp/services/mcp-oauth-switch-off.service.d.ts

@@ -0,0 +1,18 @@
+import { McpAuditService, McpOAuthAuthorizationProfile, McpOAuthInvalidationReason } from './mcp-audit.service';
+import { McpOAuthGlobalGeneration, McpOAuthGlobalInvalidationService } from './mcp-oauth-global-invalidation.service';
+import { McpOAuthRouteGateService } from './mcp-oauth-route-gate.service';
+import { McpOAuthRuntimeService } from './mcp-oauth-runtime.service';
+export type McpOAuthSwitchOffCommit = () => Promise<void> | void;
+export interface McpOAuthSwitchOffOptions {
+    generations?: McpOAuthGlobalGeneration[];
+    reasons?: McpOAuthInvalidationReason[];
+    authorizationProfile?: McpOAuthAuthorizationProfile;
+}
+export declare class McpOAuthSwitchOffService {
+    private readonly routeGate;
+    private readonly runtime;
+    private readonly globalInvalidation;
+    private readonly auditService;
+    constructor(routeGate: McpOAuthRouteGateService, runtime: McpOAuthRuntimeService, globalInvalidation: McpOAuthGlobalInvalidationService, auditService: McpAuditService);
+    disableInternal(commit: McpOAuthSwitchOffCommit, options?: McpOAuthSwitchOffOptions): Promise<void>;
+}

package/dist/modules/mcp/services/mcp-oauth-switch-off.service.js

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthSwitchOffService = void 0;
+const common_1 = require("@nestjs/common");
+const mcp_audit_service_1 = require("./mcp-audit.service");
+const mcp_oauth_global_invalidation_service_1 = require("./mcp-oauth-global-invalidation.service");
+const mcp_oauth_route_gate_service_1 = require("./mcp-oauth-route-gate.service");
+const mcp_oauth_runtime_service_1 = require("./mcp-oauth-runtime.service");
+let McpOAuthSwitchOffService = class McpOAuthSwitchOffService {
+    constructor(routeGate, runtime, globalInvalidation, auditService) {
+        this.routeGate = routeGate;
+        this.runtime = runtime;
+        this.globalInvalidation = globalInvalidation;
+        this.auditService = auditService;
+    }
+    async disableInternal(commit, options = {}) {
+        this.routeGate.closeInternal();
+        this.runtime.deactivateInternal();
+        const generations = options.generations ?? ['oauthEnabledGeneration'];
+        const reasons = options.reasons ?? ['oauth_disabled'];
+        const authorizationProfile = options.authorizationProfile ?? 'oauth';
+        let commitFailed = false;
+        const persist = async () => {
+            try {
+                await commit();
+            }
+            catch (error) {
+                commitFailed = true;
+                throw error;
+            }
+        };
+        try {
+            if (authorizationProfile === 'all') {
+                await this.globalInvalidation.invalidateAll(generations, persist);
+            }
+            else {
+                await this.globalInvalidation.invalidate(generations, persist);
+            }
+        }
+        catch (error) {
+            if (commitFailed) {
+                this.auditService.recordOAuthAuthorizationInvalidation({
+                    reasons,
+                    authorizationProfile,
+                    outcome: mcp_audit_service_1.McpAuditOutcome.PARTIAL,
+                });
+            }
+            throw error;
+        }
+        this.auditService.recordOAuthAuthorizationInvalidation({
+            reasons,
+            authorizationProfile,
+            outcome: mcp_audit_service_1.McpAuditOutcome.COMPLETED,
+        });
+    }
+};
+exports.McpOAuthSwitchOffService = McpOAuthSwitchOffService;
+exports.McpOAuthSwitchOffService = McpOAuthSwitchOffService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [mcp_oauth_route_gate_service_1.McpOAuthRouteGateService,
+        mcp_oauth_runtime_service_1.McpOAuthRuntimeService,
+        mcp_oauth_global_invalidation_service_1.McpOAuthGlobalInvalidationService,
+        mcp_audit_service_1.McpAuditService])
+], McpOAuthSwitchOffService);
+//# sourceMappingURL=mcp-oauth-switch-off.service.js.map

package/dist/modules/mcp/services/mcp-oauth-switch-off.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-switch-off.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-switch-off.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAE5C,2DAK6B;AAC7B,mGAAsH;AACtH,iFAA0E;AAC1E,2EAAqE;AAW9D,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACpC,YACkB,SAAmC,EACnC,OAA+B,EAC/B,kBAAqD,EACrD,YAA6B;QAH7B,cAAS,GAAT,SAAS,CAA0B;QACnC,YAAO,GAAP,OAAO,CAAwB;QAC/B,uBAAkB,GAAlB,kBAAkB,CAAmC;QACrD,iBAAY,GAAZ,YAAY,CAAiB;IAC5C,CAAC;IAEJ,KAAK,CAAC,eAAe,CAAC,MAA+B,EAAE,UAAoC,EAAE;QAC5F,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC;QAErE,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;YACzC,IAAI,CAAC;gBACJ,MAAM,MAAM,EAAE,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC,CAAC;QAEF,IAAI,CAAC;YACJ,IAAI,oBAAoB,KAAK,KAAK,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAChE,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,YAAY,EAAE,CAAC;gBAClB,IAAI,CAAC,YAAY,CAAC,oCAAoC,CAAC;oBACtD,OAAO;oBACP,oBAAoB;oBACpB,OAAO,EAAE,mCAAe,CAAC,OAAO;iBAChC,CAAC,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,CAAC;QACb,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,oCAAoC,CAAC;YACtD,OAAO;YACP,oBAAoB;YACpB,OAAO,EAAE,mCAAe,CAAC,SAAS;SAClC,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;AAjDY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAGiB,uDAAwB;QAC1B,kDAAsB;QACX,yEAAiC;QACvC,mCAAe;GALnC,wBAAwB,CAiDpC"}

package/dist/modules/mcp/services/mcp-policy.service.d.ts

@@ -0,0 +1,51 @@
+import { FastifyRequest } from 'fastify';
+import { AuthInfo } from '@modelcontextprotocol/server';
+import { ConfigService as NestConfigService } from '@nestjs/config';
+import { AuthenticatedRequest } from '../../auth/guards/auth.guard';
+import { ConfigService } from '../../config/services/config.service';
+import { McpClientEntity } from '../entities/mcp-client.entity';
+import { McpCapability } from '../mcp.constants';
+import { McpConfigModel } from '../models/config.model';
+import { McpClientService } from './mcp-client.service';
+import { McpInstallationService } from './mcp-installation.service';
+import { McpOAuthResourceServerService } from './mcp-oauth-resource-server.service';
+export interface McpPolicyContext {
+    client: McpClientEntity;
+    config: McpConfigModel;
+    effectiveCapabilities: McpCapability[];
+    installationId: string;
+    clientPolicyRevision?: number;
+    policyRevision?: number;
+    tokenId: string;
+}
+export interface McpAuthorizationContext {
+    client: {
+        id: string;
+    };
+    effectiveCapabilities: McpCapability[];
+    installationId: string;
+    tokenId: string;
+}
+export interface McpPolicyRequest extends AuthenticatedRequest {
+    mcpPolicy?: McpPolicyContext;
+}
+export declare class McpPolicyService {
+    private readonly configService;
+    private readonly nestConfigService;
+    private readonly clientService;
+    private readonly installationService;
+    private readonly oauthResourceServerService;
+    constructor(configService: ConfigService, nestConfigService: NestConfigService, clientService: McpClientService, installationService: McpInstallationService, oauthResourceServerService: McpOAuthResourceServerService);
+    resolve(auth: AuthenticatedRequest['auth']): Promise<McpPolicyContext>;
+    resolveClient(tokenId: string, clientId: string): Promise<McpPolicyContext>;
+    authorize(auth: AuthenticatedRequest['auth'], capability: McpCapability): Promise<McpPolicyContext>;
+    authorizeClient(tokenId: string, clientId: string, capability: McpCapability): Promise<McpPolicyContext>;
+    authorizeAuthInfo(authInfo: AuthInfo, capability: McpCapability): Promise<McpAuthorizationContext>;
+    validateRequestOrigin(request: FastifyRequest, policy: McpPolicyContext): void;
+    validateOAuthRequestOrigin(request: FastifyRequest): void;
+    private validateOrigin;
+    private getAppOrigin;
+    private getHeader;
+    private getExtraString;
+    private isOAuthPrincipal;
+}

package/dist/modules/mcp/services/mcp-policy.service.js

@@ -0,0 +1,162 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpPolicyService = void 0;
+const server_1 = require("@modelcontextprotocol/server");
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const config_utils_1 = require("../../../common/utils/config.utils");
+const auth_constants_1 = require("../../auth/auth.constants");
+const config_service_1 = require("../../config/services/config.service");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_exceptions_1 = require("../mcp.exceptions");
+const mcp_client_service_1 = require("./mcp-client.service");
+const mcp_installation_service_1 = require("./mcp-installation.service");
+const mcp_oauth_resource_server_service_1 = require("./mcp-oauth-resource-server.service");
+let McpPolicyService = class McpPolicyService {
+    constructor(configService, nestConfigService, clientService, installationService, oauthResourceServerService) {
+        this.configService = configService;
+        this.nestConfigService = nestConfigService;
+        this.clientService = clientService;
+        this.installationService = installationService;
+        this.oauthResourceServerService = oauthResourceServerService;
+    }
+    async resolve(auth) {
+        if (!auth || auth.type !== 'token' || auth.ownerType !== auth_constants_1.TokenOwnerType.MCP || !auth.ownerId) {
+            throw new common_1.UnauthorizedException('An MCP credential is required');
+        }
+        return this.resolveClient(auth.tokenId, auth.ownerId);
+    }
+    async resolveClient(tokenId, clientId) {
+        const config = this.configService.getModuleConfig(mcp_constants_1.MCP_MODULE_NAME);
+        if (!config.enabled) {
+            throw new mcp_exceptions_1.McpEndpointDisabledException();
+        }
+        const client = await this.clientService.findActiveByToken(tokenId, clientId);
+        if (!client || !client.enabled || !client.token || client.token.revoked) {
+            throw new common_1.UnauthorizedException('MCP client is disabled or its credential is no longer active');
+        }
+        if (client.token.expiresAt && client.token.expiresAt <= new Date()) {
+            throw new common_1.UnauthorizedException('MCP credential has expired');
+        }
+        return {
+            client,
+            config,
+            effectiveCapabilities: client.capabilities.filter((capability) => config.capabilities.includes(capability)),
+            installationId: await this.installationService.getInstallationId(),
+            tokenId,
+        };
+    }
+    async authorize(auth, capability) {
+        const policy = await this.resolve(auth);
+        if (!policy.effectiveCapabilities.includes(capability)) {
+            throw new common_1.ForbiddenException(`MCP capability '${capability}' is not granted`);
+        }
+        return policy;
+    }
+    async authorizeClient(tokenId, clientId, capability) {
+        const policy = await this.resolveClient(tokenId, clientId);
+        if (!policy.effectiveCapabilities.includes(capability)) {
+            throw new common_1.ForbiddenException(`MCP capability '${capability}' is not granted`);
+        }
+        return policy;
+    }
+    async authorizeAuthInfo(authInfo, capability) {
+        if (authInfo.extra?.principal && this.isOAuthPrincipal(authInfo.extra.principal)) {
+            try {
+                return await this.oauthResourceServerService.authorizeAccessToken(authInfo.token, capability);
+            }
+            catch (error) {
+                if (server_1.OAuthError.isInstance(error) && String(error.code) === 'insufficient_scope') {
+                    throw new common_1.ForbiddenException(`MCP capability '${capability}' is not granted`);
+                }
+                if (server_1.OAuthError.isInstance(error)) {
+                    throw new common_1.UnauthorizedException('MCP OAuth credential is no longer active');
+                }
+                throw error;
+            }
+        }
+        const tokenId = this.getExtraString(authInfo.extra?.tokenId);
+        if (!authInfo.clientId || !tokenId) {
+            throw new common_1.UnauthorizedException('MCP request identity is unavailable');
+        }
+        return this.authorizeClient(tokenId, authInfo.clientId, capability);
+    }
+    validateRequestOrigin(request, policy) {
+        this.validateOrigin(request, policy.config);
+    }
+    validateOAuthRequestOrigin(request) {
+        const config = this.configService.getModuleConfig(mcp_constants_1.MCP_MODULE_NAME);
+        if (!config.enabled)
+            throw new mcp_exceptions_1.McpEndpointDisabledException();
+        this.validateOrigin(request, config, config.oauthPublicBaseUrl ? new URL(config.oauthPublicBaseUrl) : undefined);
+    }
+    validateOrigin(request, config, additionalOrigin) {
+        const host = this.getHeader(request.headers.host);
+        const allowedOrigins = new Set(config.allowedOrigins);
+        const appOrigin = this.getAppOrigin();
+        const allowedHostnames = new Set(['localhost', '127.0.0.1', '[::1]', appOrigin.hostname]);
+        if (additionalOrigin)
+            allowedHostnames.add(additionalOrigin.hostname);
+        for (const origin of allowedOrigins) {
+            allowedHostnames.add(new URL(origin).hostname);
+        }
+        let requestHostname;
+        try {
+            requestHostname = new URL(`http://${host}`).hostname;
+        }
+        catch {
+            throw new common_1.ForbiddenException('Invalid Host header');
+        }
+        if (!allowedHostnames.has(requestHostname)) {
+            throw new common_1.ForbiddenException('Host is not allowed for the MCP endpoint');
+        }
+        const origin = this.getHeader(request.headers.origin);
+        if (!origin) {
+            return;
+        }
+        const sameOrigin = `${request.protocol}://${host}`;
+        if (origin !== sameOrigin &&
+            origin !== appOrigin.origin &&
+            origin !== additionalOrigin?.origin &&
+            !allowedOrigins.has(origin)) {
+            throw new common_1.ForbiddenException('Origin is not allowed for the MCP endpoint');
+        }
+    }
+    getAppOrigin() {
+        const value = (0, config_utils_1.getEnvValue)(this.nestConfigService, 'FB_APP_HOST', 'http://localhost');
+        try {
+            return new URL(value);
+        }
+        catch {
+            return new URL('http://localhost');
+        }
+    }
+    getHeader(value) {
+        return Array.isArray(value) ? (value[0] ?? '') : (value ?? '');
+    }
+    getExtraString(value) {
+        return typeof value === 'string' ? value : undefined;
+    }
+    isOAuthPrincipal(value) {
+        return typeof value === 'object' && value !== null && 'type' in value && value.type === mcp_constants_1.MCP_OAUTH_PRINCIPAL_TYPE;
+    }
+};
+exports.McpPolicyService = McpPolicyService;
+exports.McpPolicyService = McpPolicyService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_service_1.ConfigService,
+        config_1.ConfigService,
+        mcp_client_service_1.McpClientService,
+        mcp_installation_service_1.McpInstallationService,
+        mcp_oauth_resource_server_service_1.McpOAuthResourceServerService])
+], McpPolicyService);
+//# sourceMappingURL=mcp-policy.service.js.map

package/dist/modules/mcp/services/mcp-policy.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-policy.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-policy.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,yDAAoE;AACpE,2CAAuF;AACvF,2CAAoE;AAEpE,qEAAiE;AACjE,8DAA2D;AAE3D,yEAAqE;AAErE,oDAA4F;AAC5F,sDAAiE;AAGjE,6DAAwD;AACxD,yEAAoE;AACpE,2FAAoF;AAwB7E,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC5B,YACkB,aAA4B,EAC5B,iBAAoC,EACpC,aAA+B,EAC/B,mBAA2C,EAC3C,0BAAyD;QAJzD,kBAAa,GAAb,aAAa,CAAe;QAC5B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,kBAAa,GAAb,aAAa,CAAkB;QAC/B,wBAAmB,GAAnB,mBAAmB,CAAwB;QAC3C,+BAA0B,GAA1B,0BAA0B,CAA+B;IACxE,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,IAAkC;QAC/C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,SAAS,KAAK,+BAAc,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9F,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,QAAgB;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAiB,+BAAe,CAAC,CAAC;QAEnF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,6CAA4B,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE7E,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACzE,MAAM,IAAI,8BAAqB,CAAC,8DAA8D,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACpE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO;YACN,MAAM;YACN,MAAM;YACN,qBAAqB,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3G,cAAc,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE;YAClE,OAAO;SACP,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAkC,EAAE,UAAyB;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAExC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,2BAAkB,CAAC,mBAAmB,UAAU,kBAAkB,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,QAAgB,EAAE,UAAyB;QACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,2BAAkB,CAAC,mBAAmB,UAAU,kBAAkB,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,QAAkB,EAAE,UAAyB;QACpE,IAAI,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC;gBACJ,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC/F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,mBAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,oBAAoB,EAAE,CAAC;oBACjF,MAAM,IAAI,2BAAkB,CAAC,mBAAmB,UAAU,kBAAkB,CAAC,CAAC;gBAC/E,CAAC;gBACD,IAAI,mBAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,8BAAqB,CAAC,0CAA0C,CAAC,CAAC;gBAC7E,CAAC;gBAED,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE7D,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,8BAAqB,CAAC,qCAAqC,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;IAED,qBAAqB,CAAC,OAAuB,EAAE,MAAwB;QACtE,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,0BAA0B,CAAC,OAAuB;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAiB,+BAAe,CAAC,CAAC;QAEnF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,6CAA4B,EAAE,CAAC;QAE9D,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClH,CAAC;IAEO,cAAc,CAAC,OAAuB,EAAE,MAAsB,EAAE,gBAAsB;QAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE1F,IAAI,gBAAgB;YAAE,gBAAgB,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAEtE,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACrC,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,eAAuB,CAAC;QAE5B,IAAI,CAAC;YACJ,eAAe,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,2BAAkB,CAAC,qBAAqB,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,2BAAkB,CAAC,0CAA0C,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO;QACR,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,OAAO,CAAC,QAAQ,MAAM,IAAI,EAAE,CAAC;QAEnD,IACC,MAAM,KAAK,UAAU;YACrB,MAAM,KAAK,SAAS,CAAC,MAAM;YAC3B,MAAM,KAAK,gBAAgB,EAAE,MAAM;YACnC,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAC1B,CAAC;YACF,MAAM,IAAI,2BAAkB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,CAAC;IACF,CAAC;IAEO,YAAY;QACnB,MAAM,KAAK,GAAG,IAAA,0BAAW,EAAS,IAAI,CAAC,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;QAE7F,IAAI,CAAC;YACJ,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpC,CAAC;IACF,CAAC;IAEO,SAAS,CAAC,KAAoC;QACrD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAEO,cAAc,CAAC,KAAc;QACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAEO,gBAAgB,CAAC,KAAc;QACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,wCAAwB,CAAC;IAClH,CAAC;CACD,CAAA;AAnKY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAGqB,8BAAa;QACT,sBAAiB;QACrB,qCAAgB;QACV,iDAAsB;QACf,iEAA6B;GAN/D,gBAAgB,CAmK5B"}

package/dist/modules/mcp/services/mcp-server.service.d.ts

@@ -0,0 +1,50 @@
+import { FastifyReply } from 'fastify';
+import { AuthInfo } from '@modelcontextprotocol/server';
+import { OnApplicationShutdown } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
+import { McpAuditService } from './mcp-audit.service';
+import { McpOAuthResourceServerService } from './mcp-oauth-resource-server.service';
+import { McpPolicyRequest } from './mcp-policy.service';
+import { McpSubscriptionRegistryService } from './mcp-subscription-registry.service';
+export declare class McpServerService implements OnApplicationShutdown {
+    private readonly subscriptions;
+    private readonly auditService;
+    private readonly oauthResourceServerService;
+    private readonly moduleRef?;
+    private readonly logger;
+    private readonly handlers;
+    private readonly clientPolicyRevisions;
+    private policyRevision;
+    constructor(subscriptions: McpSubscriptionRegistryService, auditService: McpAuditService, oauthResourceServerService: McpOAuthResourceServerService, moduleRef?: ModuleRef);
+    handle(request: McpPolicyRequest, reply: FastifyReply): Promise<void>;
+    handleOAuth(request: McpPolicyRequest, reply: FastifyReply, authInfo: AuthInfo): Promise<void>;
+    notifyToolsChanged(clientId?: string): void;
+    notifyResourcesChanged(clientId?: string): void;
+    getPolicyRevision(): number;
+    getClientPolicyRevision(clientId: string): number;
+    invalidatePolicies(): void;
+    invalidateClientPolicy(clientId: string): void;
+    closeClient(clientId: string): Promise<void>;
+    closeAll(): Promise<void>;
+    onApplicationShutdown(): Promise<void>;
+    private getOrCreateHandler;
+    private buildInstructions;
+    private getStringExtra;
+    private isSubscriptionListen;
+    private subscriptionUnavailableResponse;
+    private getSubscriptionErrorResponse;
+    private getRequestBody;
+    private getSubscriptionRegistration;
+    private openSubscription;
+    private isOAuthPrincipal;
+    private isNonEmptyString;
+    private trackSubscriptionResponse;
+    private closeSubscriptionBeforeTransport;
+    private subscriptionCancellationEvent;
+    private getWireRequestId;
+    private handleNodeRequest;
+    private waitForResponseCompletion;
+    private auditProtocolRequest;
+    private getProtocolVersion;
+    private notify;
+}