@fastybird/smart-panel-backend 1.0.0-beta.3 → 1.1.0-alpha.1

package/dist/modules/mcp/services/mcp-oauth-readiness-registration.service.js

@@ -0,0 +1,69 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthReadinessRegistrationService = void 0;
+const common_1 = require("@nestjs/common");
+const mcp_oauth_provider_factory_1 = require("../oauth/mcp-oauth-provider.factory");
+const mcp_audit_service_1 = require("./mcp-audit.service");
+const mcp_oauth_approver_authority_service_1 = require("./mcp-oauth-approver-authority.service");
+const mcp_oauth_endpoint_rate_limit_service_1 = require("./mcp-oauth-endpoint-rate-limit.service");
+const mcp_oauth_global_invalidation_service_1 = require("./mcp-oauth-global-invalidation.service");
+const mcp_oauth_management_service_1 = require("./mcp-oauth-management.service");
+const mcp_oauth_module_config_mutation_service_1 = require("./mcp-oauth-module-config-mutation.service");
+const mcp_oauth_readiness_service_1 = require("./mcp-oauth-readiness.service");
+const mcp_oauth_switch_off_service_1 = require("./mcp-oauth-switch-off.service");
+const mcp_subscription_registry_service_1 = require("./mcp-subscription-registry.service");
+let McpOAuthReadinessRegistrationService = class McpOAuthReadinessRegistrationService {
+    constructor(readiness, subscriptions, approverAuthority, endpointRateLimit, providerFactory, globalInvalidation, moduleConfigMutation, management, audit, switchOff) {
+        this.readiness = readiness;
+        this.subscriptions = subscriptions;
+        this.approverAuthority = approverAuthority;
+        this.endpointRateLimit = endpointRateLimit;
+        this.providerFactory = providerFactory;
+        this.globalInvalidation = globalInvalidation;
+        this.moduleConfigMutation = moduleConfigMutation;
+        this.management = management;
+        this.audit = audit;
+        this.switchOff = switchOff;
+    }
+    onModuleInit() {
+        const registrations = new Map([
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.AUTHORIZATION_DEADLINE_ABORT, this.subscriptions],
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.TARGETED_SUBSCRIPTION_ABORT, this.subscriptions],
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.LIVE_SCOPE_REDUCTION_ABORT, this.moduleConfigMutation],
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.AWAITED_APPROVER_LIFECYCLE, this.approverAuthority],
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.SUBSCRIPTION_MUTATION_GATE, this.subscriptions],
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.ARTIFACT_ISSUANCE_GATE, this.providerFactory],
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.PUBLIC_IDENTITY_ROTATION, this.globalInvalidation],
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.SERVER_SECRET_ROTATION, this.globalInvalidation],
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.ADMIN_REVOCATION, this.management],
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.AUDIT_HOOKS, this.audit],
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.ENDPOINT_RATE_LIMITS, this.endpointRateLimit],
+            [mcp_oauth_readiness_service_1.McpOAuthReadinessControl.OAUTH_SWITCH_OFF_INVALIDATION, this.switchOff],
+        ]);
+        this.readiness.register(...registrations.keys());
+    }
+};
+exports.McpOAuthReadinessRegistrationService = McpOAuthReadinessRegistrationService;
+exports.McpOAuthReadinessRegistrationService = McpOAuthReadinessRegistrationService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [mcp_oauth_readiness_service_1.McpOAuthReadinessService,
+        mcp_subscription_registry_service_1.McpSubscriptionRegistryService,
+        mcp_oauth_approver_authority_service_1.McpOAuthApproverAuthorityService,
+        mcp_oauth_endpoint_rate_limit_service_1.McpOAuthEndpointRateLimitService,
+        mcp_oauth_provider_factory_1.McpOAuthProviderFactory,
+        mcp_oauth_global_invalidation_service_1.McpOAuthGlobalInvalidationService,
+        mcp_oauth_module_config_mutation_service_1.McpOAuthModuleConfigMutationService,
+        mcp_oauth_management_service_1.McpOAuthManagementService,
+        mcp_audit_service_1.McpAuditService,
+        mcp_oauth_switch_off_service_1.McpOAuthSwitchOffService])
+], McpOAuthReadinessRegistrationService);
+//# sourceMappingURL=mcp-oauth-readiness-registration.service.js.map

package/dist/modules/mcp/services/mcp-oauth-readiness-registration.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-readiness-registration.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-readiness-registration.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA0D;AAE1D,oFAA8E;AAE9E,2DAAsD;AACtD,iGAA0F;AAC1F,mGAA2F;AAC3F,mGAA4F;AAC5F,iFAA2E;AAC3E,yGAAiG;AACjG,+EAAmG;AACnG,iFAA0E;AAC1E,2FAAqF;AAG9E,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAChD,YACkB,SAAmC,EACnC,aAA6C,EAC7C,iBAAmD,EACnD,iBAAmD,EACnD,eAAwC,EACxC,kBAAqD,EACrD,oBAAyD,EACzD,UAAqC,EACrC,KAAsB,EACtB,SAAmC;QATnC,cAAS,GAAT,SAAS,CAA0B;QACnC,kBAAa,GAAb,aAAa,CAAgC;QAC7C,sBAAiB,GAAjB,iBAAiB,CAAkC;QACnD,sBAAiB,GAAjB,iBAAiB,CAAkC;QACnD,oBAAe,GAAf,eAAe,CAAyB;QACxC,uBAAkB,GAAlB,kBAAkB,CAAmC;QACrD,yBAAoB,GAApB,oBAAoB,CAAqC;QACzD,eAAU,GAAV,UAAU,CAA2B;QACrC,UAAK,GAAL,KAAK,CAAiB;QACtB,cAAS,GAAT,SAAS,CAA0B;IAClD,CAAC;IAEJ,YAAY;QACX,MAAM,aAAa,GAAG,IAAI,GAAG,CAAmC;YAC/D,CAAC,sDAAwB,CAAC,4BAA4B,EAAE,IAAI,CAAC,aAAa,CAAC;YAC3E,CAAC,sDAAwB,CAAC,2BAA2B,EAAE,IAAI,CAAC,aAAa,CAAC;YAC1E,CAAC,sDAAwB,CAAC,0BAA0B,EAAE,IAAI,CAAC,oBAAoB,CAAC;YAChF,CAAC,sDAAwB,CAAC,0BAA0B,EAAE,IAAI,CAAC,iBAAiB,CAAC;YAC7E,CAAC,sDAAwB,CAAC,0BAA0B,EAAE,IAAI,CAAC,aAAa,CAAC;YACzE,CAAC,sDAAwB,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC;YACvE,CAAC,sDAAwB,CAAC,wBAAwB,EAAE,IAAI,CAAC,kBAAkB,CAAC;YAC5E,CAAC,sDAAwB,CAAC,sBAAsB,EAAE,IAAI,CAAC,kBAAkB,CAAC;YAC1E,CAAC,sDAAwB,CAAC,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC;YAC5D,CAAC,sDAAwB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC;YAClD,CAAC,sDAAwB,CAAC,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,CAAC;YACvE,CAAC,sDAAwB,CAAC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC;SACxE,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;CACD,CAAA;AAhCY,oFAAoC;+CAApC,oCAAoC;IADhD,IAAA,mBAAU,GAAE;qCAGiB,sDAAwB;QACpB,kEAA8B;QAC1B,uEAAgC;QAChC,wEAAgC;QAClC,oDAAuB;QACpB,yEAAiC;QAC/B,8EAAmC;QAC7C,wDAAyB;QAC9B,mCAAe;QACX,uDAAwB;GAXzC,oCAAoC,CAgChD"}

package/dist/modules/mcp/services/mcp-oauth-readiness.service.d.ts

@@ -0,0 +1,32 @@
+import { OnApplicationBootstrap } from '@nestjs/common';
+export declare enum McpOAuthReadinessControl {
+    AUTHORIZATION_DEADLINE_ABORT = "authorization_deadline_abort",
+    TARGETED_SUBSCRIPTION_ABORT = "targeted_subscription_abort",
+    LIVE_SCOPE_REDUCTION_ABORT = "live_scope_reduction_abort",
+    AWAITED_APPROVER_LIFECYCLE = "awaited_approver_lifecycle",
+    SUBSCRIPTION_MUTATION_GATE = "subscription_mutation_gate",
+    ARTIFACT_ISSUANCE_GATE = "artifact_issuance_gate",
+    PUBLIC_IDENTITY_ROTATION = "public_identity_rotation",
+    SERVER_SECRET_ROTATION = "server_secret_rotation",
+    OAUTH_SWITCH_OFF_INVALIDATION = "oauth_switch_off_invalidation",
+    ADMIN_REVOCATION = "admin_revocation",
+    AUDIT_HOOKS = "audit_hooks",
+    ENDPOINT_RATE_LIMITS = "endpoint_rate_limits",
+    COMPLETE_ROUTE_SET = "complete_route_set"
+}
+export declare const MCP_OAUTH_REQUIRED_READINESS_CONTROLS: readonly McpOAuthReadinessControl[];
+export interface McpOAuthReadinessSnapshot {
+    verified: boolean;
+    ready: boolean;
+    registered: readonly McpOAuthReadinessControl[];
+    missing: readonly McpOAuthReadinessControl[];
+}
+export declare class McpOAuthReadinessService implements OnApplicationBootstrap {
+    private readonly registeredControls;
+    private verified;
+    register(...controls: McpOAuthReadinessControl[]): void;
+    onApplicationBootstrap(): void;
+    verify(): McpOAuthReadinessSnapshot;
+    assertReady(): void;
+    get snapshot(): McpOAuthReadinessSnapshot;
+}

package/dist/modules/mcp/services/mcp-oauth-readiness.service.js

@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthReadinessService = exports.MCP_OAUTH_REQUIRED_READINESS_CONTROLS = exports.McpOAuthReadinessControl = void 0;
+const common_1 = require("@nestjs/common");
+var McpOAuthReadinessControl;
+(function (McpOAuthReadinessControl) {
+    McpOAuthReadinessControl["AUTHORIZATION_DEADLINE_ABORT"] = "authorization_deadline_abort";
+    McpOAuthReadinessControl["TARGETED_SUBSCRIPTION_ABORT"] = "targeted_subscription_abort";
+    McpOAuthReadinessControl["LIVE_SCOPE_REDUCTION_ABORT"] = "live_scope_reduction_abort";
+    McpOAuthReadinessControl["AWAITED_APPROVER_LIFECYCLE"] = "awaited_approver_lifecycle";
+    McpOAuthReadinessControl["SUBSCRIPTION_MUTATION_GATE"] = "subscription_mutation_gate";
+    McpOAuthReadinessControl["ARTIFACT_ISSUANCE_GATE"] = "artifact_issuance_gate";
+    McpOAuthReadinessControl["PUBLIC_IDENTITY_ROTATION"] = "public_identity_rotation";
+    McpOAuthReadinessControl["SERVER_SECRET_ROTATION"] = "server_secret_rotation";
+    McpOAuthReadinessControl["OAUTH_SWITCH_OFF_INVALIDATION"] = "oauth_switch_off_invalidation";
+    McpOAuthReadinessControl["ADMIN_REVOCATION"] = "admin_revocation";
+    McpOAuthReadinessControl["AUDIT_HOOKS"] = "audit_hooks";
+    McpOAuthReadinessControl["ENDPOINT_RATE_LIMITS"] = "endpoint_rate_limits";
+    McpOAuthReadinessControl["COMPLETE_ROUTE_SET"] = "complete_route_set";
+})(McpOAuthReadinessControl || (exports.McpOAuthReadinessControl = McpOAuthReadinessControl = {}));
+exports.MCP_OAUTH_REQUIRED_READINESS_CONTROLS = Object.freeze(Object.values(McpOAuthReadinessControl));
+let McpOAuthReadinessService = class McpOAuthReadinessService {
+    constructor() {
+        this.registeredControls = new Set();
+        this.verified = false;
+    }
+    register(...controls) {
+        if (this.verified) {
+            throw new common_1.ServiceUnavailableException('MCP OAuth readiness registration is already sealed');
+        }
+        for (const control of controls) {
+            this.registeredControls.add(control);
+        }
+    }
+    onApplicationBootstrap() {
+        this.verified = true;
+    }
+    verify() {
+        if (!this.verified) {
+            throw new common_1.ServiceUnavailableException('MCP OAuth readiness has not completed application bootstrap');
+        }
+        return this.snapshot;
+    }
+    assertReady() {
+        const snapshot = this.verify();
+        if (!snapshot.ready) {
+            throw new common_1.ServiceUnavailableException('MCP OAuth security controls are not ready');
+        }
+    }
+    get snapshot() {
+        const registered = exports.MCP_OAUTH_REQUIRED_READINESS_CONTROLS.filter((control) => this.registeredControls.has(control));
+        const missing = exports.MCP_OAUTH_REQUIRED_READINESS_CONTROLS.filter((control) => !this.registeredControls.has(control));
+        return Object.freeze({
+            verified: this.verified,
+            ready: this.verified && missing.length === 0,
+            registered: Object.freeze(registered),
+            missing: Object.freeze(missing),
+        });
+    }
+};
+exports.McpOAuthReadinessService = McpOAuthReadinessService;
+exports.McpOAuthReadinessService = McpOAuthReadinessService = __decorate([
+    (0, common_1.Injectable)()
+], McpOAuthReadinessService);
+//# sourceMappingURL=mcp-oauth-readiness.service.js.map

package/dist/modules/mcp/services/mcp-oauth-readiness.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-readiness.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-readiness.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAiG;AAEjG,IAAY,wBAcX;AAdD,WAAY,wBAAwB;IACnC,yFAA6D,CAAA;IAC7D,uFAA2D,CAAA;IAC3D,qFAAyD,CAAA;IACzD,qFAAyD,CAAA;IACzD,qFAAyD,CAAA;IACzD,6EAAiD,CAAA;IACjD,iFAAqD,CAAA;IACrD,6EAAiD,CAAA;IACjD,2FAA+D,CAAA;IAC/D,iEAAqC,CAAA;IACrC,uDAA2B,CAAA;IAC3B,yEAA6C,CAAA;IAC7C,qEAAyC,CAAA;AAC1C,CAAC,EAdW,wBAAwB,wCAAxB,wBAAwB,QAcnC;AAEY,QAAA,qCAAqC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAUrG,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAA9B;QACW,uBAAkB,GAAG,IAAI,GAAG,EAA4B,CAAC;QAClE,aAAQ,GAAG,KAAK,CAAC;IA2C1B,CAAC;IAzCA,QAAQ,CAAC,GAAG,QAAoC;QAC/C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,oCAA2B,CAAC,oDAAoD,CAAC,CAAC;QAC7F,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;IACF,CAAC;IAED,sBAAsB;QACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,MAAM;QACL,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,oCAA2B,CAAC,6DAA6D,CAAC,CAAC;QACtG,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,WAAW;QACV,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAE/B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,oCAA2B,CAAC,2CAA2C,CAAC,CAAC;QACpF,CAAC;IACF,CAAC;IAED,IAAI,QAAQ;QACX,MAAM,UAAU,GAAG,6CAAqC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACnH,MAAM,OAAO,GAAG,6CAAqC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAEjH,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YACrC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC/B,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;AA7CY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;GACA,wBAAwB,CA6CpC"}

package/dist/modules/mcp/services/mcp-oauth-refresh-token.service.d.ts

@@ -0,0 +1,13 @@
+import { DataSource } from 'typeorm';
+import { McpOAuthRefreshTokenEntity } from '../entities/mcp-oauth.entity';
+export declare class McpOAuthRefreshTokenService {
+    private readonly dataSource;
+    private rotationQueue;
+    constructor(dataSource: DataSource);
+    rotate(rawToken: string): Promise<{
+        rawValue: string;
+        artifact: McpOAuthRefreshTokenEntity;
+    }>;
+    private rotateTransaction;
+    private revokeFamily;
+}

package/dist/modules/mcp/services/mcp-oauth-refresh-token.service.js

@@ -0,0 +1,91 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthRefreshTokenService = void 0;
+const node_crypto_1 = require("node:crypto");
+const typeorm_1 = require("typeorm");
+const common_1 = require("@nestjs/common");
+const token_utils_1 = require("../../auth/utils/token.utils");
+const mcp_oauth_entity_1 = require("../entities/mcp-oauth.entity");
+let McpOAuthRefreshTokenService = class McpOAuthRefreshTokenService {
+    constructor(dataSource) {
+        this.dataSource = dataSource;
+        this.rotationQueue = Promise.resolve();
+    }
+    async rotate(rawToken) {
+        let release;
+        const previous = this.rotationQueue;
+        this.rotationQueue = new Promise((resolve) => {
+            release = resolve;
+        });
+        await previous;
+        try {
+            return await this.rotateTransaction(rawToken);
+        }
+        finally {
+            release();
+        }
+    }
+    async rotateTransaction(rawToken) {
+        const result = await this.dataSource.transaction(async (manager) => {
+            const now = new Date();
+            const tokenRepository = manager.getRepository(mcp_oauth_entity_1.McpOAuthRefreshTokenEntity);
+            const familyRepository = manager.getRepository(mcp_oauth_entity_1.McpOAuthRefreshTokenFamilyEntity);
+            const token = await tokenRepository.findOne({ where: { tokenHash: (0, token_utils_1.hashToken)(rawToken) } });
+            if (!token) {
+                return { status: 'invalid' };
+            }
+            const family = await familyRepository.findOne({ where: { id: token.familyId } });
+            if (!family || family.revokedAt || family.expiresAt <= now || token.revokedAt || token.expiresAt <= now) {
+                return { status: 'invalid' };
+            }
+            const consumed = await tokenRepository.update({
+                id: token.id,
+                consumedAt: (0, typeorm_1.IsNull)(),
+                revokedAt: (0, typeorm_1.IsNull)(),
+                expiresAt: (0, typeorm_1.MoreThan)(now),
+            }, { consumedAt: now });
+            if (!consumed.affected) {
+                await this.revokeFamily(manager, family.id, now, 'refresh_token_reuse');
+                return { status: 'reused' };
+            }
+            const rawValue = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+            const artifact = await tokenRepository.save(tokenRepository.create({
+                tokenHash: (0, token_utils_1.hashToken)(rawValue),
+                familyId: family.id,
+                predecessorId: token.id,
+                expiresAt: family.expiresAt,
+                consumedAt: null,
+                revokedAt: null,
+            }));
+            return { status: 'rotated', rawValue, artifact };
+        });
+        if (result.status !== 'rotated') {
+            throw new common_1.UnauthorizedException(result.status === 'reused' ? 'Refresh token reuse revoked the token family' : 'Invalid refresh token');
+        }
+        return result;
+    }
+    async revokeFamily(manager, familyId, revokedAt, reason) {
+        await manager
+            .getRepository(mcp_oauth_entity_1.McpOAuthRefreshTokenFamilyEntity)
+            .update({ id: familyId }, { revokedAt, revocationReason: reason, generation: () => 'generation + 1' });
+        await manager.getRepository(mcp_oauth_entity_1.McpOAuthRefreshTokenEntity).update({ familyId, revokedAt: (0, typeorm_1.IsNull)() }, { revokedAt });
+        await manager
+            .getRepository(mcp_oauth_entity_1.McpOAuthAccessTokenEntity)
+            .update({ refreshFamilyId: familyId, revokedAt: (0, typeorm_1.IsNull)() }, { revokedAt });
+    }
+};
+exports.McpOAuthRefreshTokenService = McpOAuthRefreshTokenService;
+exports.McpOAuthRefreshTokenService = McpOAuthRefreshTokenService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource])
+], McpOAuthRefreshTokenService);
+//# sourceMappingURL=mcp-oauth-refresh-token.service.js.map

package/dist/modules/mcp/services/mcp-oauth-refresh-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-refresh-token.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-refresh-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA0C;AAC1C,qCAAsE;AAEtE,2CAAmE;AAEnE,8DAAyD;AACzD,mEAIsC;AAO/B,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IAGvC,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;QAF3C,kBAAa,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEH,CAAC;IAEvD,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC5B,IAAI,OAAmB,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClD,OAAO,GAAG,OAAO,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC;QAEf,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACV,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC9B,QAAgB;QAEhB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAiB,KAAK,EAAE,OAAO,EAAE,EAAE;YAClF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,6CAA0B,CAAC,CAAC;YAC1E,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,mDAAgC,CAAC,CAAC;YACjF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAA,uBAAS,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAE3F,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAEjF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBACzG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAC5C;gBACC,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,UAAU,EAAE,IAAA,gBAAM,GAAE;gBACpB,SAAS,EAAE,IAAA,gBAAM,GAAE;gBACnB,SAAS,EAAE,IAAA,kBAAQ,EAAC,GAAG,CAAC;aACxB,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,CACnB,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;gBACxE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAC1C,eAAe,CAAC,MAAM,CAAC;gBACtB,SAAS,EAAE,IAAA,uBAAS,EAAC,QAAQ,CAAC;gBAC9B,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,aAAa,EAAE,KAAK,CAAC,EAAE;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;aACf,CAAC,CACF,CAAC;YAEF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,8BAAqB,CAC9B,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,uBAAuB,CACrG,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAsB,EAAE,QAAgB,EAAE,SAAe,EAAE,MAAc;QACnG,MAAM,OAAO;aACX,aAAa,CAAC,mDAAgC,CAAC;aAC/C,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACxG,MAAM,OAAO,CAAC,aAAa,CAAC,6CAA0B,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACjH,MAAM,OAAO;aACX,aAAa,CAAC,4CAAyB,CAAC;aACxC,MAAM,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;CACD,CAAA;AAvFY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;qCAI6B,oBAAU;GAHvC,2BAA2B,CAuFvC"}

package/dist/modules/mcp/services/mcp-oauth-resource-server.service.d.ts

@@ -0,0 +1,40 @@
+import { Repository } from 'typeorm';
+import { AuthInfo, OAuthProtectedResourceMetadata, OAuthTokenVerifier } from '@modelcontextprotocol/server';
+import { ConfigService } from '../../config/services/config.service';
+import { McpOAuthApproverAuthorityEntity, McpOAuthGrantEntity, McpOAuthProviderArtifactEntity, McpOAuthProviderRevokedGrantEntity, McpOAuthServerStateEntity } from '../entities/mcp-oauth.entity';
+import { McpCapability } from '../mcp.constants';
+import { McpOAuthAuthorizationServerMetadata } from '../oauth/mcp-oauth-metadata';
+import { McpInstallationService } from './mcp-installation.service';
+import { McpOAuthPublicUrlService } from './mcp-oauth-public-url.service';
+export interface McpOAuthAuthorizationContext {
+    client: {
+        id: string;
+    };
+    effectiveCapabilities: McpCapability[];
+    installationId: string;
+    tokenId: string;
+}
+export declare class McpOAuthResourceServerService implements OAuthTokenVerifier {
+    private readonly artifactRepository;
+    private readonly revokedGrantRepository;
+    private readonly grantRepository;
+    private readonly approverAuthorities;
+    private readonly serverStateRepository;
+    private readonly configService;
+    private readonly installationService;
+    private readonly publicUrlService;
+    constructor(artifactRepository: Repository<McpOAuthProviderArtifactEntity>, revokedGrantRepository: Repository<McpOAuthProviderRevokedGrantEntity>, grantRepository: Repository<McpOAuthGrantEntity>, approverAuthorities: Repository<McpOAuthApproverAuthorityEntity>, serverStateRepository: Repository<McpOAuthServerStateEntity>, configService: ConfigService, installationService: McpInstallationService, publicUrlService: McpOAuthPublicUrlService);
+    getAuthorizationServerMetadata(): McpOAuthAuthorizationServerMetadata;
+    getProtectedResourceMetadata(): OAuthProtectedResourceMetadata;
+    getResourceMetadataUrl(): string;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    verifyMcpBearerToken(authorizationHeader: string | null | undefined, requiredCapabilities?: McpCapability[]): Promise<AuthInfo>;
+    getBearerChallenge(error: unknown, requiredCapabilities?: McpCapability[]): Response;
+    authorizeAccessToken(token: string, capability: McpCapability): Promise<McpOAuthAuthorizationContext>;
+    private getPrincipal;
+    private intersectCapabilities;
+    private parsePayload;
+    private parseScopes;
+    private requireUrls;
+    private invalidToken;
+}

package/dist/modules/mcp/services/mcp-oauth-resource-server.service.js

@@ -0,0 +1,233 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthResourceServerService = void 0;
+const typeorm_1 = require("typeorm");
+const server_1 = require("@modelcontextprotocol/server");
+const common_1 = require("@nestjs/common");
+const typeorm_2 = require("@nestjs/typeorm");
+const token_utils_1 = require("../../auth/utils/token.utils");
+const config_service_1 = require("../../config/services/config.service");
+const users_constants_1 = require("../../users/users.constants");
+const mcp_oauth_entity_1 = require("../entities/mcp-oauth.entity");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_oauth_metadata_1 = require("../oauth/mcp-oauth-metadata");
+const mcp_oauth_scope_utils_1 = require("../oauth/mcp-oauth-scope.utils");
+const mcp_installation_service_1 = require("./mcp-installation.service");
+const mcp_oauth_public_url_service_1 = require("./mcp-oauth-public-url.service");
+let McpOAuthResourceServerService = class McpOAuthResourceServerService {
+    constructor(artifactRepository, revokedGrantRepository, grantRepository, approverAuthorities, serverStateRepository, configService, installationService, publicUrlService) {
+        this.artifactRepository = artifactRepository;
+        this.revokedGrantRepository = revokedGrantRepository;
+        this.grantRepository = grantRepository;
+        this.approverAuthorities = approverAuthorities;
+        this.serverStateRepository = serverStateRepository;
+        this.configService = configService;
+        this.installationService = installationService;
+        this.publicUrlService = publicUrlService;
+    }
+    getAuthorizationServerMetadata() {
+        return (0, mcp_oauth_metadata_1.buildMcpOAuthAuthorizationServerMetadata)(this.requireUrls());
+    }
+    getProtectedResourceMetadata() {
+        const urls = this.requireUrls();
+        return (0, server_1.buildOAuthProtectedResourceMetadata)({
+            oauthMetadata: this.getAuthorizationServerMetadata(),
+            resourceServerUrl: new URL(urls.resource),
+            resourceName: 'FastyBird Smart Panel MCP',
+            scopesSupported: Object.values(mcp_constants_1.McpOAuthScope).filter((scope) => scope !== mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS),
+        });
+    }
+    getResourceMetadataUrl() {
+        return this.requireUrls().protectedResourceMetadata;
+    }
+    async verifyAccessToken(token) {
+        const tokenId = (0, token_utils_1.hashToken)(token);
+        const artifact = await this.artifactRepository.findOneBy({ model: 'AccessToken', idHash: tokenId });
+        if (!artifact || artifact.expiresAt === null || artifact.expiresAt <= Date.now() || !artifact.grantIdHash) {
+            this.invalidToken();
+        }
+        const payload = this.parsePayload(artifact.payload);
+        if (typeof payload.grantId !== 'string' || (0, token_utils_1.hashToken)(payload.grantId) !== artifact.grantIdHash) {
+            this.invalidToken();
+        }
+        const [revokedGrant, grant, serverState] = await Promise.all([
+            this.revokedGrantRepository.findOneBy({ grantIdHash: artifact.grantIdHash }),
+            this.grantRepository.findOne({
+                where: { providerGrantIdHash: artifact.grantIdHash },
+                relations: { approvedBy: true, client: true },
+            }),
+            this.serverStateRepository.findOneBy({ key: mcp_constants_1.MCP_OAUTH_SERVER_STATE_KEY }),
+        ]);
+        const approverAuthority = grant?.approvedById
+            ? await this.approverAuthorities.findOneBy({ approverId: grant.approvedById })
+            : null;
+        const urls = this.requireUrls();
+        const installationId = await this.installationService.getInstallationId();
+        const config = this.configService.getModuleConfig(mcp_constants_1.MCP_MODULE_NAME);
+        if (revokedGrant ||
+            !grant ||
+            !grant.client ||
+            !serverState ||
+            artifact.oauthEnabledGeneration !== serverState?.oauthEnabledGeneration ||
+            artifact.serverSecretVersion !== serverState?.serverSecretVersion ||
+            artifact.publicIdentityGeneration !== serverState?.publicIdentityGeneration ||
+            artifact.modulePolicyGeneration !== serverState?.modulePolicyGeneration ||
+            artifact.clientGeneration !== grant?.client?.generation ||
+            artifact.grantGeneration !== grant?.generation ||
+            artifact.approverAuthorityGeneration !== (approverAuthority?.generation ?? 0) ||
+            grant.oauthEnabledGeneration !== serverState?.oauthEnabledGeneration ||
+            grant.serverSecretVersion !== serverState?.serverSecretVersion ||
+            grant.publicIdentityGeneration !== serverState?.publicIdentityGeneration ||
+            grant.clientGeneration !== grant.client.generation ||
+            grant.modulePolicyGeneration !== serverState?.modulePolicyGeneration ||
+            !grant.client.enabled ||
+            !grant.approvedBy ||
+            !grant.approvedById ||
+            grant.approverAuthorityGeneration !== (approverAuthority?.generation ?? 0) ||
+            ![users_constants_1.UserRole.OWNER, users_constants_1.UserRole.ADMIN].includes(grant.approvedBy.role) ||
+            grant.revokedAt !== null ||
+            grant.expiresAt <= new Date() ||
+            grant.issuer !== urls.issuer ||
+            grant.resource !== urls.resource ||
+            grant.installationId !== installationId ||
+            payload.aud !== urls.resource ||
+            payload.clientId !== grant.client.clientIdentifier ||
+            payload.accountId !== grant.approvedById ||
+            !config.enabled) {
+            this.invalidToken();
+        }
+        const tokenScopes = this.parseScopes(payload.scope);
+        const effectiveCapabilities = this.intersectCapabilities(config.capabilities, grant.client.maximumScopes, grant.approvedScopes, tokenScopes);
+        const effectiveScopes = effectiveCapabilities.map(mcp_oauth_scope_utils_1.toMcpOAuthScope);
+        const authorizationDeadline = Math.min(artifact.expiresAt, grant.expiresAt.getTime());
+        const principal = {
+            type: mcp_constants_1.MCP_OAUTH_PRINCIPAL_TYPE,
+            accessTokenId: artifact.managementId,
+            approverAuthorityGeneration: grant.approverAuthorityGeneration,
+            approverId: grant.approvedById,
+            authorizationDeadline,
+            clientId: grant.client.id,
+            clientGeneration: grant.client.generation,
+            effectiveScopes,
+            grantId: grant.id,
+            grantGeneration: grant.generation,
+            installationId,
+            modulePolicyGeneration: serverState.modulePolicyGeneration,
+            oauthEnabledGeneration: serverState.oauthEnabledGeneration,
+            publicIdentityGeneration: serverState.publicIdentityGeneration,
+            ...(artifact.refreshFamilyId ? { refreshFamilyId: artifact.refreshFamilyId } : {}),
+            serverSecretVersion: serverState.serverSecretVersion,
+            scopes: tokenScopes,
+            effectiveCapabilities,
+        };
+        return {
+            token,
+            clientId: grant.client.clientIdentifier,
+            scopes: effectiveScopes,
+            expiresAt: Math.floor(authorizationDeadline / 1_000),
+            resource: new URL(urls.resource),
+            extra: { principal, installationId, tokenId },
+        };
+    }
+    async verifyMcpBearerToken(authorizationHeader, requiredCapabilities = []) {
+        const authInfo = await (0, server_1.verifyBearerToken)(authorizationHeader, {
+            verifier: this,
+            requiredScopes: requiredCapabilities.map(mcp_oauth_scope_utils_1.toMcpOAuthScope),
+            resourceMetadataUrl: this.getResourceMetadataUrl(),
+        });
+        const principal = this.getPrincipal(authInfo);
+        return { ...authInfo, scopes: [...principal.effectiveCapabilities] };
+    }
+    getBearerChallenge(error, requiredCapabilities = []) {
+        return (0, server_1.bearerAuthChallengeResponse)(error, {
+            requiredScopes: requiredCapabilities.map(mcp_oauth_scope_utils_1.toMcpOAuthScope),
+            resourceMetadataUrl: this.getResourceMetadataUrl(),
+        });
+    }
+    async authorizeAccessToken(token, capability) {
+        const authInfo = await this.verifyAccessToken(token);
+        const principal = this.getPrincipal(authInfo);
+        if (!principal.effectiveCapabilities.includes(capability)) {
+            throw new server_1.OAuthError(server_1.OAuthErrorCode.InsufficientScope, `MCP scope '${(0, mcp_oauth_scope_utils_1.toMcpOAuthScope)(capability)}' is required`);
+        }
+        return {
+            client: { id: principal.clientId },
+            effectiveCapabilities: principal.effectiveCapabilities,
+            installationId: principal.installationId,
+            tokenId: principal.accessTokenId,
+        };
+    }
+    getPrincipal(authInfo) {
+        const principal = authInfo.extra?.principal;
+        if (principal?.type !== mcp_constants_1.MCP_OAUTH_PRINCIPAL_TYPE)
+            this.invalidToken();
+        return principal;
+    }
+    intersectCapabilities(moduleCapabilities, clientScopes, grantScopes, tokenScopes) {
+        return moduleCapabilities.filter((capability) => {
+            const scope = (0, mcp_oauth_scope_utils_1.toMcpOAuthScope)(capability);
+            return clientScopes.includes(scope) && grantScopes.includes(scope) && tokenScopes.includes(scope);
+        });
+    }
+    parsePayload(value) {
+        try {
+            const payload = JSON.parse(value);
+            if (typeof payload !== 'object' || payload === null || Array.isArray(payload))
+                this.invalidToken();
+            return payload;
+        }
+        catch (error) {
+            if (server_1.OAuthError.isInstance(error))
+                throw error;
+            this.invalidToken();
+        }
+    }
+    parseScopes(value) {
+        if (typeof value !== 'string')
+            this.invalidToken();
+        const scopes = [...new Set(value.split(' ').filter(Boolean))];
+        const knownScopes = new Set(Object.values(mcp_constants_1.McpOAuthScope));
+        if (scopes.length === 0 || scopes.some((scope) => !knownScopes.has(scope)))
+            this.invalidToken();
+        return scopes;
+    }
+    requireUrls() {
+        const urls = this.publicUrlService.getUrls();
+        if (!urls)
+            throw new common_1.ServiceUnavailableException('MCP OAuth public URL is not configured');
+        return urls;
+    }
+    invalidToken() {
+        throw new server_1.OAuthError(server_1.OAuthErrorCode.InvalidToken, 'The MCP OAuth access token is invalid or no longer active');
+    }
+};
+exports.McpOAuthResourceServerService = McpOAuthResourceServerService;
+exports.McpOAuthResourceServerService = McpOAuthResourceServerService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity)),
+    __param(1, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthProviderRevokedGrantEntity)),
+    __param(2, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthGrantEntity)),
+    __param(3, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthApproverAuthorityEntity)),
+    __param(4, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthServerStateEntity)),
+    __metadata("design:paramtypes", [typeorm_1.Repository,
+        typeorm_1.Repository,
+        typeorm_1.Repository,
+        typeorm_1.Repository,
+        typeorm_1.Repository,
+        config_service_1.ConfigService,
+        mcp_installation_service_1.McpInstallationService,
+        mcp_oauth_public_url_service_1.McpOAuthPublicUrlService])
+], McpOAuthResourceServerService);
+//# sourceMappingURL=mcp-oauth-resource-server.service.js.map

package/dist/modules/mcp/services/mcp-oauth-resource-server.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-resource-server.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-resource-server.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,qCAAqC;AAErC,yDASsC;AACtC,2CAAyE;AACzE,6CAAmD;AAEnD,8DAAyD;AACzD,yEAAqE;AACrE,iEAAuD;AACvD,mEAMsC;AACtC,oDAM0B;AAE1B,oEAGqC;AACrC,0EAAiE;AAGjE,yEAAoE;AACpE,iFAA0E;AAkBnE,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACzC,YAEkB,kBAA8D,EAE9D,sBAAsE,EAEtE,eAAgD,EAEhD,mBAAgE,EAEhE,qBAA4D,EAC5D,aAA4B,EAC5B,mBAA2C,EAC3C,gBAA0C;QAX1C,uBAAkB,GAAlB,kBAAkB,CAA4C;QAE9D,2BAAsB,GAAtB,sBAAsB,CAAgD;QAEtE,oBAAe,GAAf,eAAe,CAAiC;QAEhD,wBAAmB,GAAnB,mBAAmB,CAA6C;QAEhE,0BAAqB,GAArB,qBAAqB,CAAuC;QAC5D,kBAAa,GAAb,aAAa,CAAe;QAC5B,wBAAmB,GAAnB,mBAAmB,CAAwB;QAC3C,qBAAgB,GAAhB,gBAAgB,CAA0B;IACzD,CAAC;IAEJ,8BAA8B;QAC7B,OAAO,IAAA,6DAAwC,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,4BAA4B;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEhC,OAAO,IAAA,4CAAmC,EAAC;YAC1C,aAAa,EAAE,IAAI,CAAC,8BAA8B,EAAE;YACpD,iBAAiB,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzC,YAAY,EAAE,2BAA2B;YACzC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,6BAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,6BAAa,CAAC,cAAc,CAAC;SACvG,CAAC,CAAC;IACJ,CAAC;IAED,sBAAsB;QACrB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,yBAAyB,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACpC,MAAM,OAAO,GAAG,IAAA,uBAAS,EAAC,KAAK,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC3G,IAAI,CAAC,YAAY,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAA,uBAAS,EAAC,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YAChG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5D,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC5E,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;gBAC5B,KAAK,EAAE,EAAE,mBAAmB,EAAE,QAAQ,CAAC,WAAW,EAAE;gBACpD,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;aAC7C,CAAC;YACF,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,0CAA0B,EAAE,CAAC;SACzE,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,KAAK,EAAE,YAAY;YAC5C,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAC9E,CAAC,CAAC,IAAI,CAAC;QACR,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAiB,+BAAe,CAAC,CAAC;QAEnF,IACC,YAAY;YACZ,CAAC,KAAK;YACN,CAAC,KAAK,CAAC,MAAM;YACb,CAAC,WAAW;YACZ,QAAQ,CAAC,sBAAsB,KAAK,WAAW,EAAE,sBAAsB;YACvE,QAAQ,CAAC,mBAAmB,KAAK,WAAW,EAAE,mBAAmB;YACjE,QAAQ,CAAC,wBAAwB,KAAK,WAAW,EAAE,wBAAwB;YAC3E,QAAQ,CAAC,sBAAsB,KAAK,WAAW,EAAE,sBAAsB;YACvE,QAAQ,CAAC,gBAAgB,KAAK,KAAK,EAAE,MAAM,EAAE,UAAU;YACvD,QAAQ,CAAC,eAAe,KAAK,KAAK,EAAE,UAAU;YAC9C,QAAQ,CAAC,2BAA2B,KAAK,CAAC,iBAAiB,EAAE,UAAU,IAAI,CAAC,CAAC;YAC7E,KAAK,CAAC,sBAAsB,KAAK,WAAW,EAAE,sBAAsB;YACpE,KAAK,CAAC,mBAAmB,KAAK,WAAW,EAAE,mBAAmB;YAC9D,KAAK,CAAC,wBAAwB,KAAK,WAAW,EAAE,wBAAwB;YACxE,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU;YAClD,KAAK,CAAC,sBAAsB,KAAK,WAAW,EAAE,sBAAsB;YACpE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;YACrB,CAAC,KAAK,CAAC,UAAU;YACjB,CAAC,KAAK,CAAC,YAAY;YACnB,KAAK,CAAC,2BAA2B,KAAK,CAAC,iBAAiB,EAAE,UAAU,IAAI,CAAC,CAAC;YAC1E,CAAC,CAAC,0BAAQ,CAAC,KAAK,EAAE,0BAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YACjE,KAAK,CAAC,SAAS,KAAK,IAAI;YACxB,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE;YAC7B,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAC5B,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAChC,KAAK,CAAC,cAAc,KAAK,cAAc;YACvC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ;YAC7B,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,gBAAgB;YAClD,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,YAAY;YACxC,CAAC,MAAM,CAAC,OAAO,EACd,CAAC;YACF,IAAI,CAAC,YAAY,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,CACvD,MAAM,CAAC,YAAY,EACnB,KAAK,CAAC,MAAM,CAAC,aAAa,EAC1B,KAAK,CAAC,cAAc,EACpB,WAAW,CACX,CAAC;QACF,MAAM,eAAe,GAAG,qBAAqB,CAAC,GAAG,CAAC,uCAAe,CAAC,CAAC;QACnE,MAAM,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,MAAM,SAAS,GAAsB;YACpC,IAAI,EAAE,wCAAwB;YAC9B,aAAa,EAAE,QAAQ,CAAC,YAAY;YACpC,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;YAC9D,UAAU,EAAE,KAAK,CAAC,YAAY;YAC9B,qBAAqB;YACrB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;YACzB,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACzC,eAAe;YACf,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,eAAe,EAAE,KAAK,CAAC,UAAU;YACjC,cAAc;YACd,sBAAsB,EAAE,WAAW,CAAC,sBAAsB;YAC1D,sBAAsB,EAAE,WAAW,CAAC,sBAAsB;YAC1D,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;YAC9D,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;YACpD,MAAM,EAAE,WAAW;YACnB,qBAAqB;SACrB,CAAC;QAEF,OAAO;YACN,KAAK;YACL,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB;YACvC,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,KAAK,CAAC;YACpD,QAAQ,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YAChC,KAAK,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE;SAC7C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACzB,mBAA8C,EAC9C,uBAAwC,EAAE;QAE1C,MAAM,QAAQ,GAAG,MAAM,IAAA,0BAAiB,EAAC,mBAAmB,EAAE;YAC7D,QAAQ,EAAE,IAAI;YACd,cAAc,EAAE,oBAAoB,CAAC,GAAG,CAAC,uCAAe,CAAC;YACzD,mBAAmB,EAAE,IAAI,CAAC,sBAAsB,EAAE;SAClD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE9C,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC,qBAAqB,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,kBAAkB,CAAC,KAAc,EAAE,uBAAwC,EAAE;QAC5E,OAAO,IAAA,oCAA2B,EAAC,KAAK,EAAE;YACzC,cAAc,EAAE,oBAAoB,CAAC,GAAG,CAAC,uCAAe,CAAC;YACzD,mBAAmB,EAAE,IAAI,CAAC,sBAAsB,EAAE;SAClD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAa,EAAE,UAAyB;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE9C,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,mBAAU,CAAC,uBAAc,CAAC,iBAAiB,EAAE,cAAc,IAAA,uCAAe,EAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAClH,CAAC;QAED,OAAO;YACN,MAAM,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE;YAClC,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;YACtD,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,OAAO,EAAE,SAAS,CAAC,aAAa;SAChC,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,QAAkB;QACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,EAAE,SAA0C,CAAC;QAE7E,IAAI,SAAS,EAAE,IAAI,KAAK,wCAAwB;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAEtE,OAAO,SAAS,CAAC;IAClB,CAAC;IAEO,qBAAqB,CAC5B,kBAAmC,EACnC,YAA6B,EAC7B,WAA4B,EAC5B,WAA4B;QAE5B,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;YAC/C,MAAM,KAAK,GAAG,IAAA,uCAAe,EAAC,UAAU,CAAC,CAAC;YAE1C,OAAO,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnG,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,KAAa;QACjC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;YAE7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAEnG,OAAO,OAAqC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,mBAAU,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAE9C,IAAI,CAAC,YAAY,EAAE,CAAC;QACrB,CAAC;IACF,CAAC;IAEO,WAAW,CAAC,KAAc;QACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAEnD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,6BAAa,CAAC,CAAC,CAAC;QAElE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAEhG,OAAO,MAAyB,CAAC;IAClC,CAAC;IAEO,WAAW;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAE7C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,oCAA2B,CAAC,wCAAwC,CAAC,CAAC;QAE3F,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,YAAY;QACnB,MAAM,IAAI,mBAAU,CAAC,uBAAc,CAAC,YAAY,EAAE,2DAA2D,CAAC,CAAC;IAChH,CAAC;CACD,CAAA;AA1OY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAGV,WAAA,IAAA,0BAAgB,EAAC,iDAA8B,CAAC,CAAA;IAEhD,WAAA,IAAA,0BAAgB,EAAC,qDAAkC,CAAC,CAAA;IAEpD,WAAA,IAAA,0BAAgB,EAAC,sCAAmB,CAAC,CAAA;IAErC,WAAA,IAAA,0BAAgB,EAAC,kDAA+B,CAAC,CAAA;IAEjD,WAAA,IAAA,0BAAgB,EAAC,4CAAyB,CAAC,CAAA;qCAPP,oBAAU;QAEN,oBAAU;QAEjB,oBAAU;QAEN,oBAAU;QAER,oBAAU;QAClB,8BAAa;QACP,iDAAsB;QACzB,uDAAwB;GAdhD,6BAA6B,CA0OzC"}

package/dist/modules/mcp/services/mcp-oauth-route-gate.service.d.ts

@@ -0,0 +1,12 @@
+import { McpOAuthReadinessService } from './mcp-oauth-readiness.service';
+export declare class McpOAuthRouteGateService {
+    private readonly readiness;
+    private open;
+    private generation;
+    constructor(readiness: McpOAuthReadinessService);
+    openInternal(): void;
+    closeInternal(): void;
+    assertOpen(): number;
+    assertOpenGeneration(generation: number): void;
+    get isOpen(): boolean;
+}