@fastybird/smart-panel-backend 1.0.0-beta.3 → 1.1.0-alpha.1

package/dist/modules/mcp/services/mcp-oauth-bootstrap.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-bootstrap.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-bootstrap.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAGA,2CAA6F;AAE7F,oDAO0B;AAE1B,qFAA8E;AAC9E,+EAAmG;AACnG,2FAAoF;AACpF,iFAA0E;AAC1E,2EAAqE;AAU9D,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAGpC,YACkB,SAAmC,EACnC,SAAmC,EACnC,WAAuC,EACvC,cAA6C,EAC7C,OAA+B;QAJ/B,cAAS,GAAT,SAAS,CAA0B;QACnC,cAAS,GAAT,SAAS,CAA0B;QACnC,gBAAW,GAAX,WAAW,CAA4B;QACvC,mBAAc,GAAd,cAAc,CAA+B;QAC7C,YAAO,GAAP,OAAO,CAAwB;QAPzC,eAAU,GAAG,KAAK,CAAC;IAQxB,CAAC;IAEJ,QAAQ,CAAC,OAAwB;QAChC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,oCAA2B,CAAC,yDAAyD,CAAC,CAAC;QAClG,CAAC;QAED,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,sDAAwB,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC;IAEO,MAAM,CAAC,OAAuB,EAAE,KAAmB;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,KAAK,CAAC,MAAM,EAAE,CAAC;QAEf,IAAI,CAAC;YACJ,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,WAAW,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;YAExD,QAAQ,KAAK,EAAE,CAAC;gBACf,KAAK,6BAA6B;oBACjC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,4BAA4B,EAAE,CAAC,CAAC;oBACnF,OAAO;gBACR,KAAK,+BAA+B;oBACnC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,8BAA8B,EAAE,CAAC,CAAC;oBACrF,OAAO;gBACR;oBACC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxC,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,OAAuB;QACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;QAEpD,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,0DAA0C,EAAE,CAAC;YACjF,OAAO,6BAA6B,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,4DAA4C,EAAE,CAAC;YACnF,OAAO,+BAA+B,CAAC;QACxC,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,OAAO,eAAe,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,QAAQ,KAAK,oCAAoB;YAAE,OAAO,OAAO,CAAC;QACrG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,QAAQ,KAAK,yCAAyB;YAAE,OAAO,YAAY,CAAC;QAE/G,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,mBAAmB,CAAC,QAAgB;QAC3C,IAAI,QAAQ,KAAK,4CAA4B;YAAE,OAAO,IAAI,CAAC;QAE3D,MAAM,YAAY,GAAG,GAAG,4CAA4B,GAAG,CAAC;QACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAE9F,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAEO,gBAAgB,CAAC,OAAuB,EAAE,KAAmB;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,kBAAkB,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,qCAAqB,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1G,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAEO,eAAe,CAAC,QAAwB,EAAE,KAAc;QAC/D,MAAM,MAAM,GAAG,KAAK,YAAY,2BAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,YAAY,oCAA2B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpH,MAAM,IAAI,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,cAAc,CAAC;QAE5G,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAEO,SAAS,CAAC,QAAwB,EAAE,MAAc,EAAE,OAAgB;QAC3E,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,aAAa;YAAE,OAAO;QAE3D,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;QAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,CAAC;CACD,CAAA;AAnGY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAKiB,sDAAwB;QACxB,uDAAwB;QACtB,2DAA0B;QACvB,iEAA6B;QACpC,kDAAsB;GARrC,wBAAwB,CAmGpC"}

package/dist/modules/mcp/services/mcp-oauth-client.service.d.ts

@@ -0,0 +1,20 @@
+import { Repository } from 'typeorm';
+import { ConfigService } from '../../config/services/config.service';
+import { CreateMcpOAuthClientDto, UpdateMcpOAuthClientDto } from '../dto/mcp-oauth-client.dto';
+import { McpOAuthClientEntity } from '../entities/mcp-oauth.entity';
+import { McpOAuthScope } from '../mcp.constants';
+import { McpOAuthClientModel } from '../models/mcp-oauth-client.model';
+export declare class McpOAuthClientService {
+    private readonly repository;
+    private readonly configService;
+    constructor(repository: Repository<McpOAuthClientEntity>, configService: ConfigService);
+    findAll(): Promise<McpOAuthClientModel[]>;
+    findOneById(id: string): Promise<McpOAuthClientEntity | null>;
+    findActiveByIdentifier(clientIdentifier: string): Promise<McpOAuthClientEntity | null>;
+    getOneOrThrow(id: string): Promise<McpOAuthClientEntity>;
+    create(dto: CreateMcpOAuthClientDto, createdById: string): Promise<McpOAuthClientModel>;
+    update(id: string, dto: UpdateMcpOAuthClientDto): Promise<McpOAuthClientModel>;
+    isRedirectUriAllowed(client: McpOAuthClientEntity, requested: string): boolean;
+    assertScopesAllowed(scopes: McpOAuthScope[]): void;
+    private sameValues;
+}

package/dist/modules/mcp/services/mcp-oauth-client.service.js

@@ -0,0 +1,107 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthClientService = void 0;
+const node_crypto_1 = require("node:crypto");
+const typeorm_1 = require("typeorm");
+const common_1 = require("@nestjs/common");
+const typeorm_2 = require("@nestjs/typeorm");
+const config_service_1 = require("../../config/services/config.service");
+const mcp_oauth_entity_1 = require("../entities/mcp-oauth.entity");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_oauth_client_model_1 = require("../models/mcp-oauth-client.model");
+const mcp_oauth_scope_utils_1 = require("../oauth/mcp-oauth-scope.utils");
+const is_mcp_oauth_redirect_uri_validator_1 = require("../validators/is-mcp-oauth-redirect-uri.validator");
+let McpOAuthClientService = class McpOAuthClientService {
+    constructor(repository, configService) {
+        this.repository = repository;
+        this.configService = configService;
+    }
+    async findAll() {
+        const clients = await this.repository.find({ order: { createdAt: 'DESC' } });
+        return clients.map((client) => mcp_oauth_client_model_1.McpOAuthClientModel.fromEntity(client));
+    }
+    async findOneById(id) {
+        return this.repository.findOneBy({ id });
+    }
+    async findActiveByIdentifier(clientIdentifier) {
+        return this.repository.findOneBy({ clientIdentifier, enabled: true });
+    }
+    async getOneOrThrow(id) {
+        const client = await this.findOneById(id);
+        if (!client) {
+            throw new common_1.NotFoundException('Requested MCP OAuth client does not exist');
+        }
+        return client;
+    }
+    async create(dto, createdById) {
+        this.assertScopesAllowed(dto.maximumScopes);
+        const client = await this.repository.save(this.repository.create({
+            clientIdentifier: (0, node_crypto_1.randomUUID)(),
+            name: dto.name,
+            redirectUris: [...dto.redirectUris],
+            maximumScopes: [...dto.maximumScopes],
+            enabled: true,
+            generation: 0,
+            createdById,
+        }));
+        return mcp_oauth_client_model_1.McpOAuthClientModel.fromEntity(client);
+    }
+    async update(id, dto) {
+        const client = await this.getOneOrThrow(id);
+        if (dto.maximumScopes !== undefined) {
+            this.assertScopesAllowed(dto.maximumScopes);
+        }
+        const authorizationChanged = (dto.redirectUris !== undefined && !this.sameValues(client.redirectUris, dto.redirectUris)) ||
+            (dto.maximumScopes !== undefined && !this.sameValues(client.maximumScopes, dto.maximumScopes)) ||
+            (dto.enabled !== undefined && client.enabled !== dto.enabled);
+        if (dto.name !== undefined)
+            client.name = dto.name;
+        if (dto.redirectUris !== undefined)
+            client.redirectUris = [...dto.redirectUris];
+        if (dto.maximumScopes !== undefined)
+            client.maximumScopes = [...dto.maximumScopes];
+        if (dto.enabled !== undefined)
+            client.enabled = dto.enabled;
+        if (authorizationChanged)
+            client.generation += 1;
+        return mcp_oauth_client_model_1.McpOAuthClientModel.fromEntity(await this.repository.save(client));
+    }
+    isRedirectUriAllowed(client, requested) {
+        return client.redirectUris.some((registered) => (0, is_mcp_oauth_redirect_uri_validator_1.matchesMcpOAuthRedirectUri)(registered, requested));
+    }
+    assertScopesAllowed(scopes) {
+        const ceiling = this.configService.getModuleConfig(mcp_constants_1.MCP_MODULE_NAME).capabilities;
+        const disallowed = scopes.filter((scope) => {
+            if (scope === mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS)
+                return false;
+            const capability = (0, mcp_oauth_scope_utils_1.toMcpCapability)(scope);
+            return capability === undefined || !ceiling.includes(capability);
+        });
+        if (disallowed.length > 0) {
+            throw new common_1.BadRequestException(`OAuth scopes exceed the module ceiling: ${disallowed.join(', ')}`);
+        }
+    }
+    sameValues(left, right) {
+        return left.length === right.length && left.every((value) => right.includes(value));
+    }
+};
+exports.McpOAuthClientService = McpOAuthClientService;
+exports.McpOAuthClientService = McpOAuthClientService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthClientEntity)),
+    __metadata("design:paramtypes", [typeorm_1.Repository,
+        config_service_1.ConfigService])
+], McpOAuthClientService);
+//# sourceMappingURL=mcp-oauth-client.service.js.map

package/dist/modules/mcp/services/mcp-oauth-client.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-client.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-client.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAAyC;AACzC,qCAAqC;AAErC,2CAAoF;AACpF,6CAAmD;AAEnD,yEAAqE;AAErE,mEAAoE;AACpE,oDAAkE;AAElE,6EAAuE;AACvE,0EAAiE;AACjE,2GAA+F;AAGxF,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACjC,YAEkB,UAA4C,EAC5C,aAA4B;QAD5B,eAAU,GAAV,UAAU,CAAkC;QAC5C,kBAAa,GAAb,aAAa,CAAe;IAC3C,CAAC;IAEJ,KAAK,CAAC,OAAO;QACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAE7E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,4CAAmB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,gBAAwB;QACpD,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,0BAAiB,CAAC,2CAA2C,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAA4B,EAAE,WAAmB;QAC7D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YACtB,gBAAgB,EAAE,IAAA,wBAAU,GAAE;YAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;YACnC,aAAa,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC;YACrC,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,CAAC;YACb,WAAW;SACX,CAAC,CACF,CAAC;QAEF,OAAO,4CAAmB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,GAA4B;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAE5C,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,oBAAoB,GACzB,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3F,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;YAC9F,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC;QAE/D,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACnD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;YAAE,MAAM,CAAC,YAAY,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,CAAC,aAAa,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;QACnF,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5D,IAAI,oBAAoB;YAAE,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;QAEjD,OAAO,4CAAmB,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,oBAAoB,CAAC,MAA4B,EAAE,SAAiB;QACnE,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAA,gEAA0B,EAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IACpG,CAAC;IAED,mBAAmB,CAAC,MAAuB;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAiB,+BAAe,CAAC,CAAC,YAAY,CAAC;QACjG,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1C,IAAI,KAAK,KAAK,6BAAa,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YAEzD,MAAM,UAAU,GAAG,IAAA,uCAAe,EAAC,KAAK,CAAC,CAAC;YAE1C,OAAO,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAAmB,CAAC,2CAA2C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;IACF,CAAC;IAEO,UAAU,CAAC,IAAgC,EAAE,KAAiC;QACrF,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAc,CAAC,CAAC,CAAC;IAC9F,CAAC;CACD,CAAA;AA5FY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAGV,WAAA,IAAA,0BAAgB,EAAC,uCAAoB,CAAC,CAAA;qCACV,oBAAU;QACP,8BAAa;GAJlC,qBAAqB,CA4FjC"}

package/dist/modules/mcp/services/mcp-oauth-endpoint-rate-limit.service.d.ts

@@ -0,0 +1,15 @@
+import { ThrottlerStorage } from '@nestjs/throttler';
+export declare enum McpOAuthRateLimitedEndpoint {
+    AUTHORIZE = "authorize",
+    TOKEN = "token",
+    REVOCATION = "revocation"
+}
+export interface McpOAuthRateLimitDecision {
+    allowed: boolean;
+    retryAfterSeconds: number;
+}
+export declare class McpOAuthEndpointRateLimitService {
+    private readonly storage;
+    constructor(storage: ThrottlerStorage);
+    consume(endpoint: McpOAuthRateLimitedEndpoint, immediateAddress?: string): Promise<McpOAuthRateLimitDecision>;
+}

package/dist/modules/mcp/services/mcp-oauth-endpoint-rate-limit.service.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthEndpointRateLimitService = exports.McpOAuthRateLimitedEndpoint = void 0;
+const common_1 = require("@nestjs/common");
+const throttler_1 = require("@nestjs/throttler");
+const mcp_constants_1 = require("../mcp.constants");
+var McpOAuthRateLimitedEndpoint;
+(function (McpOAuthRateLimitedEndpoint) {
+    McpOAuthRateLimitedEndpoint["AUTHORIZE"] = "authorize";
+    McpOAuthRateLimitedEndpoint["TOKEN"] = "token";
+    McpOAuthRateLimitedEndpoint["REVOCATION"] = "revocation";
+})(McpOAuthRateLimitedEndpoint || (exports.McpOAuthRateLimitedEndpoint = McpOAuthRateLimitedEndpoint = {}));
+const ENDPOINT_LIMITS = Object.freeze({
+    [McpOAuthRateLimitedEndpoint.AUTHORIZE]: mcp_constants_1.MCP_OAUTH_AUTHORIZE_RATE_LIMIT,
+    [McpOAuthRateLimitedEndpoint.TOKEN]: mcp_constants_1.MCP_OAUTH_TOKEN_RATE_LIMIT,
+    [McpOAuthRateLimitedEndpoint.REVOCATION]: mcp_constants_1.MCP_OAUTH_REVOCATION_RATE_LIMIT,
+});
+let McpOAuthEndpointRateLimitService = class McpOAuthEndpointRateLimitService {
+    constructor(storage) {
+        this.storage = storage;
+    }
+    async consume(endpoint, immediateAddress) {
+        const address = immediateAddress?.trim() || 'unknown';
+        const limit = ENDPOINT_LIMITS[endpoint];
+        const storageKey = `mcp-oauth:${endpoint}:${address}`;
+        const result = await this.storage.increment(storageKey, mcp_constants_1.MCP_OAUTH_RATE_LIMIT_TTL_MS, limit, mcp_constants_1.MCP_OAUTH_RATE_LIMIT_TTL_MS, storageKey);
+        const retryAfterSeconds = result.timeToBlockExpire || result.timeToExpire;
+        return {
+            allowed: !result.isBlocked,
+            retryAfterSeconds: Math.max(1, Math.ceil(retryAfterSeconds)),
+        };
+    }
+};
+exports.McpOAuthEndpointRateLimitService = McpOAuthEndpointRateLimitService;
+exports.McpOAuthEndpointRateLimitService = McpOAuthEndpointRateLimitService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, throttler_1.InjectThrottlerStorage)()),
+    __metadata("design:paramtypes", [Object])
+], McpOAuthEndpointRateLimitService);
+//# sourceMappingURL=mcp-oauth-endpoint-rate-limit.service.js.map

package/dist/modules/mcp/services/mcp-oauth-endpoint-rate-limit.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-endpoint-rate-limit.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-endpoint-rate-limit.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4C;AAC5C,iDAA6E;AAE7E,oDAK0B;AAE1B,IAAY,2BAIX;AAJD,WAAY,2BAA2B;IACtC,sDAAuB,CAAA;IACvB,8CAAe,CAAA;IACf,wDAAyB,CAAA;AAC1B,CAAC,EAJW,2BAA2B,2CAA3B,2BAA2B,QAItC;AAOD,MAAM,eAAe,GAA0D,MAAM,CAAC,MAAM,CAAC;IAC5F,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAAE,8CAA8B;IACvE,CAAC,2BAA2B,CAAC,KAAK,CAAC,EAAE,0CAA0B;IAC/D,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,+CAA+B;CACzE,CAAC,CAAC;AAGI,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAC5C,YAEkB,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;IACxC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,QAAqC,EAAE,gBAAyB;QAC7E,MAAM,OAAO,GAAG,gBAAgB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QACtD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,aAAa,QAAQ,IAAI,OAAO,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAC1C,UAAU,EACV,2CAA2B,EAC3B,KAAK,EACL,2CAA2B,EAC3B,UAAU,CACV,CAAC;QACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,YAAY,CAAC;QAE1E,OAAO;YACN,OAAO,EAAE,CAAC,MAAM,CAAC,SAAS;YAC1B,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;SAC5D,CAAC;IACH,CAAC;CACD,CAAA;AAxBY,4EAAgC;2CAAhC,gCAAgC;IAD5C,IAAA,mBAAU,GAAE;IAGV,WAAA,IAAA,kCAAsB,GAAE,CAAA;;GAFd,gCAAgC,CAwB5C"}

package/dist/modules/mcp/services/mcp-oauth-global-invalidation.service.d.ts

@@ -0,0 +1,12 @@
+import { DataSource } from 'typeorm';
+import { McpSubscriptionRegistryService } from './mcp-subscription-registry.service';
+export type McpOAuthGlobalGeneration = 'oauthEnabledGeneration' | 'serverSecretVersion' | 'publicIdentityGeneration' | 'modulePolicyGeneration';
+export declare class McpOAuthGlobalInvalidationService {
+    private readonly dataSource;
+    private readonly subscriptions;
+    constructor(dataSource: DataSource, subscriptions: McpSubscriptionRegistryService);
+    invalidate(generations: McpOAuthGlobalGeneration[], commit: () => Promise<void> | void): Promise<void>;
+    invalidateAll(generations: McpOAuthGlobalGeneration[], commit: () => Promise<void> | void): Promise<void>;
+    private runInvalidation;
+    private advanceAndRevoke;
+}

package/dist/modules/mcp/services/mcp-oauth-global-invalidation.service.js

@@ -0,0 +1,82 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthGlobalInvalidationService = void 0;
+const typeorm_1 = require("typeorm");
+const common_1 = require("@nestjs/common");
+const mcp_oauth_entity_1 = require("../entities/mcp-oauth.entity");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_subscription_registry_service_1 = require("./mcp-subscription-registry.service");
+let McpOAuthGlobalInvalidationService = class McpOAuthGlobalInvalidationService {
+    constructor(dataSource, subscriptions) {
+        this.dataSource = dataSource;
+        this.subscriptions = subscriptions;
+    }
+    async invalidate(generations, commit) {
+        await this.runInvalidation(generations, commit, (advanceGeneration) => this.subscriptions.closeAllOAuth(advanceGeneration));
+    }
+    async invalidateAll(generations, commit) {
+        await this.runInvalidation(generations, commit, (advanceGeneration) => this.subscriptions.closeAll(advanceGeneration));
+    }
+    async runInvalidation(generations, commit, closeSubscriptions) {
+        let commitError;
+        let commitFailed = false;
+        await closeSubscriptions(async () => {
+            await this.dataSource.transaction((manager) => this.advanceAndRevoke(manager, generations));
+            try {
+                await commit();
+            }
+            catch (error) {
+                commitFailed = true;
+                commitError = error;
+            }
+        });
+        if (commitFailed)
+            throw commitError;
+    }
+    async advanceAndRevoke(manager, generations) {
+        const serverState = manager.getRepository(mcp_oauth_entity_1.McpOAuthServerStateEntity);
+        for (const generation of new Set(generations)) {
+            const result = await serverState.increment({ key: mcp_constants_1.MCP_OAUTH_SERVER_STATE_KEY }, generation, 1);
+            if (result.affected !== 1) {
+                throw new common_1.ServiceUnavailableException(`MCP OAuth ${generation} state is unavailable`);
+            }
+        }
+        const grants = manager.getRepository(mcp_oauth_entity_1.McpOAuthGrantEntity);
+        const activeGrants = await grants.findBy({ revokedAt: (0, typeorm_1.IsNull)() });
+        const revokedAt = new Date();
+        if (activeGrants.length > 0) {
+            const result = await grants.update({ id: (0, typeorm_1.In)(activeGrants.map((grant) => grant.id)), revokedAt: (0, typeorm_1.IsNull)() }, { revokedAt, generation: () => 'generation + 1' });
+            if (result.affected !== activeGrants.length) {
+                throw new common_1.ServiceUnavailableException('MCP OAuth grants changed during global invalidation');
+            }
+            const grantHashes = activeGrants
+                .map((grant) => grant.providerGrantIdHash)
+                .filter((hash) => hash !== null);
+            if (grantHashes.length > 0) {
+                await manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderRevokedGrantEntity).upsert(grantHashes.map((grantIdHash) => ({ grantIdHash, revokedAt: revokedAt.getTime() })), ['grantIdHash']);
+            }
+        }
+        await manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity).deleteAll();
+        await manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderRefreshFamilyLineageEntity).deleteAll();
+        await manager.getRepository(mcp_oauth_entity_1.McpOAuthAuthorizationCodeEntity).deleteAll();
+        await manager.getRepository(mcp_oauth_entity_1.McpOAuthAccessTokenEntity).deleteAll();
+        await manager.getRepository(mcp_oauth_entity_1.McpOAuthRefreshTokenFamilyEntity).deleteAll();
+        await manager.getRepository(mcp_oauth_entity_1.McpOAuthInteractionEntity).deleteAll();
+    }
+};
+exports.McpOAuthGlobalInvalidationService = McpOAuthGlobalInvalidationService;
+exports.McpOAuthGlobalInvalidationService = McpOAuthGlobalInvalidationService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource,
+        mcp_subscription_registry_service_1.McpSubscriptionRegistryService])
+], McpOAuthGlobalInvalidationService);
+//# sourceMappingURL=mcp-oauth-global-invalidation.service.js.map

package/dist/modules/mcp/services/mcp-oauth-global-invalidation.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-global-invalidation.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-global-invalidation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAAgE;AAEhE,2CAAyE;AAEzE,mEAUsC;AACtC,oDAA8D;AAE9D,2FAAqF;AAS9E,IAAM,iCAAiC,GAAvC,MAAM,iCAAiC;IAC7C,YACkB,UAAsB,EACtB,aAA6C;QAD7C,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAgC;IAC5D,CAAC;IAEJ,KAAK,CAAC,UAAU,CAAC,WAAuC,EAAE,MAAkC;QAC3F,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,CACrE,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC,CACnD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,WAAuC,EAAE,MAAkC;QAC9F,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,CACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAC9C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAC5B,WAAuC,EACvC,MAAkC,EAClC,kBAA6E;QAE7E,IAAI,WAAoB,CAAC;QACzB,IAAI,YAAY,GAAG,KAAK,CAAC;QAEzB,MAAM,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;YAE5F,IAAI,CAAC;gBACJ,MAAM,MAAM,EAAE,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,YAAY,GAAG,IAAI,CAAC;gBACpB,WAAW,GAAG,KAAK,CAAC;YACrB,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,IAAI,YAAY;YAAE,MAAM,WAAW,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAAsB,EAAE,WAAuC;QAC7F,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,4CAAyB,CAAC,CAAC;QAErE,KAAK,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,0CAA0B,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAE/F,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,oCAA2B,CAAC,aAAa,UAAU,uBAAuB,CAAC,CAAC;YACvF,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,sCAAmB,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAE7B,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CACjC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EACtE,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,CACjD,CAAC;YAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,oCAA2B,CAAC,qDAAqD,CAAC,CAAC;YAC9F,CAAC;YAED,MAAM,WAAW,GAAG,YAAY;iBAC9B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;iBACzC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAElD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,OAAO,CAAC,aAAa,CAAC,qDAAkC,CAAC,CAAC,MAAM,CACrE,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EACnF,CAAC,aAAa,CAAC,CACf,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,OAAO,CAAC,aAAa,CAAC,iDAA8B,CAAC,CAAC,SAAS,EAAE,CAAC;QACxE,MAAM,OAAO,CAAC,aAAa,CAAC,6DAA0C,CAAC,CAAC,SAAS,EAAE,CAAC;QACpF,MAAM,OAAO,CAAC,aAAa,CAAC,kDAA+B,CAAC,CAAC,SAAS,EAAE,CAAC;QACzE,MAAM,OAAO,CAAC,aAAa,CAAC,4CAAyB,CAAC,CAAC,SAAS,EAAE,CAAC;QACnE,MAAM,OAAO,CAAC,aAAa,CAAC,mDAAgC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC1E,MAAM,OAAO,CAAC,aAAa,CAAC,4CAAyB,CAAC,CAAC,SAAS,EAAE,CAAC;IACpE,CAAC;CACD,CAAA;AApFY,8EAAiC;4CAAjC,iCAAiC;IAD7C,IAAA,mBAAU,GAAE;qCAGkB,oBAAU;QACP,kEAA8B;GAHnD,iCAAiC,CAoF7C"}

package/dist/modules/mcp/services/mcp-oauth-interaction.service.d.ts

@@ -0,0 +1,36 @@
+import { IncomingMessage } from 'node:http';
+import { Repository } from 'typeorm';
+import { ConfigService } from '../../config/services/config.service';
+import { ApproveMcpOAuthInteractionDto } from '../dto/mcp-oauth-interaction.dto';
+import { McpOAuthInteractionEntity } from '../entities/mcp-oauth.entity';
+import { McpOAuthInteractionCompletionModel, McpOAuthInteractionModel } from '../models/mcp-oauth-interaction.model';
+import { McpInstallationService } from './mcp-installation.service';
+import { McpOAuthApproverAuthorityService } from './mcp-oauth-approver-authority.service';
+import { McpOAuthArtifactService } from './mcp-oauth-artifact.service';
+import { McpOAuthClientService } from './mcp-oauth-client.service';
+import { McpOAuthRuntimeService } from './mcp-oauth-runtime.service';
+import { McpSubscriptionRegistryService } from './mcp-subscription-registry.service';
+export declare class McpOAuthInteractionService {
+    private readonly interactions;
+    private readonly runtimeService;
+    private readonly clientsService;
+    private readonly artifactService;
+    private readonly approverAuthority;
+    private readonly installationService;
+    private readonly configService;
+    private readonly subscriptions;
+    constructor(interactions: Repository<McpOAuthInteractionEntity>, runtimeService: McpOAuthRuntimeService, clientsService: McpOAuthClientService, artifactService: McpOAuthArtifactService, approverAuthority: McpOAuthApproverAuthorityService, installationService: McpInstallationService, configService: ConfigService, subscriptions: McpSubscriptionRegistryService);
+    getInteraction(rawUid: string, userId: string, request: IncomingMessage): Promise<McpOAuthInteractionModel>;
+    private getInteractionWithinGate;
+    approve(rawUid: string, userId: string, dto: ApproveMcpOAuthInteractionDto, request: IncomingMessage): Promise<McpOAuthInteractionCompletionModel>;
+    private approveWithinGate;
+    deny(rawUid: string, userId: string, request: IncomingMessage): Promise<McpOAuthInteractionCompletionModel>;
+    private denyWithinGate;
+    private resolveContext;
+    private assertApprovedScopes;
+    private consumeInteraction;
+    private finish;
+    private captureResponse;
+    private getInstallationName;
+    private assertUid;
+}