@hed-hog/core 0.0.349 → 0.0.350

package/hedhog/table/mcp_api_key.yaml

@@ -0,0 +1,30 @@
+columns:
+  - type: pk
+  - name: user_id
+    type: fk
+    references:
+      table: user
+      column: id
+      onDelete: CASCADE
+  - name: name
+    type: varchar
+  - name: token_hash
+    type: varchar
+  - name: token_prefix
+    type: varchar
+  - name: last_used_at
+    type: datetime
+    isNullable: true
+  - name: expires_at
+    type: datetime
+    isNullable: true
+  - name: revoked_at
+    type: datetime
+    isNullable: true
+  - type: created_at
+  - type: updated_at
+indices:
+  - columns:
+      - user_id
+  - columns:
+      - token_hash

package/hedhog/table/notification.yaml

@@ -0,0 +1,72 @@
+columns:
+  - type: pk
+  - name: user_id
+    type: fk
+    references:
+      table: user
+      column: id
+      onDelete: CASCADE
+      onUpdate: CASCADE
+  - name: title
+    type: varchar
+    length: 255
+  - name: body
+    type: text
+    isNullable: true
+  - name: type
+    type: enum
+    values:
+      - info
+      - success
+      - warning
+      - error
+      - progress
+    default: info
+  - name: status
+    type: enum
+    values:
+      - unread
+      - read
+    default: unread
+  - name: icon
+    type: varchar
+    length: 64
+    isNullable: true
+  - name: action_type
+    type: enum
+    values:
+      - url
+      - sheet
+      - modal
+    default: url
+    isNullable: true
+  - name: action_data
+    type: json
+    isNullable: true
+  - name: action_url
+    type: varchar
+    length: 512
+    isNullable: true
+  - name: auto_remove
+    type: boolean
+    default: false
+  - name: progress
+    type: int
+    isNullable: true
+  - name: started_at
+    type: timestamptz
+    isNullable: true
+  - name: finished_at
+    type: timestamptz
+    isNullable: true
+  - type: created_at
+  - type: updated_at
+indices:
+  - columns:
+      - user_id
+  - columns:
+      - user_id
+      - status
+  - columns:
+      - user_id
+      - created_at

package/hedhog/table/webhook_action_log.yaml

@@ -0,0 +1,49 @@
+columns:
+  - type: pk
+  - type: fk
+    name: webhook_call_log_id
+    references:
+      table: webhook_call_log
+      column: id
+      onDelete: cascade
+      onUpdate: cascade
+  - type: fk
+    name: webhook_action_id
+    isNullable: true
+    references:
+      table: webhook_action
+      column: id
+      onDelete: set null
+      onUpdate: cascade
+  - name: action_name
+    type: varchar
+    length: 127
+  - name: action_type
+    type: varchar
+    length: 64
+  - name: status
+    type: varchar
+    length: 16
+  - name: duration_ms
+    type: int
+    default: 0
+  - name: request_payload
+    type: json
+    isNullable: true
+  - name: response_payload
+    type: json
+    isNullable: true
+  - name: error_message
+    type: text
+    isNullable: true
+  - type: created_at
+  - type: updated_at
+indices:
+  - columns:
+      - webhook_call_log_id
+  - columns:
+      - webhook_action_id
+  - columns:
+      - status
+  - columns:
+      - created_at

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hed-hog/core",
-  "version": "0.0.349",
+  "version": "0.0.350",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "dependencies": {
@@ -32,11 +32,11 @@
     "uuid": "^11.1.0",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "@hed-hog/api-locale": "0.0.14",
+    "@hed-hog/api-mail": "0.0.9",
+    "@hed-hog/api-types": "0.0.1",
     "@hed-hog/api-pagination": "0.0.7",
-    "@hed-hog/api-prisma": "0.0.6",
     "@hed-hog/api": "0.0.8",
-    "@hed-hog/api-mail": "0.0.9",
-    "@hed-hog/api-types": "0.0.1"
+    "@hed-hog/api-prisma": "0.0.6"
   },
   "exports": {
     ".": {

package/src/core.module.ts

@@ -37,6 +37,7 @@ import { IsEmailWithSettingsConstraint } from './validators/is-email-with-settin
 import { IsPinCodeWithSettingConstraint } from './validators/is-pin-code-with-setting.validator';
 import { IsStrongPasswordWithSettingsConstraint } from './validators/is-strong-password-with-settings.validator';
 import { ValidatorServiceLocator } from './validators/service-locator';
+import { NotificationModule } from './notification/notification.module';
 import { WebhookIntegrationModule } from './webhook-integration/webhook-integration.module';
 
 @Global()
@@ -73,6 +74,7 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
     forwardRef(() => McpModule),
     forwardRef(() => McpChatModule),
     forwardRef(() => PdfModule),
+    forwardRef(() => NotificationModule),
   ],
   exports: [
     UserModule,
@@ -94,6 +96,7 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
     IsEmailWithSettingsConstraint,
     IsPinCodeWithSettingConstraint,
     PdfModule,
+    NotificationModule,
   ],
   providers: [
     Reflector,

package/src/index.ts

@@ -70,3 +70,8 @@ export * from './mcp/types/mcp-context.type';
 // Utilities
 export * from './utils/locale-context';
 
+
+// Notification Module
+export * from './notification/notification.module';
+export * from './notification/notification.service';
+export * from './notification/dto/create-notification.dto';

package/src/mcp/guards/mcp-auth.guard.ts

@@ -1,32 +1,64 @@
-import {
-  CanActivate,
-  ExecutionContext,
-  Injectable,
-  UnauthorizedException,
-} from '@nestjs/common';
-import { Request } from 'express';
-import { TokenService } from '../../token/token.service';
-
-@Injectable()
-export class McpAuthGuard implements CanActivate {
-  constructor(private readonly tokenService: TokenService) {}
-
-  async canActivate(context: ExecutionContext): Promise<boolean> {
-    const request = context.switchToHttp().getRequest<Request>();
-    const locale =
-      request.headers['accept-language']?.split(',')[0]?.split('-')[0] ?? 'en';
-
-    const token = this.extractToken(request);
-    if (!token) {
-      throw new UnauthorizedException('MCP: Bearer token required');
-    }
-
-    request['auth'] = await this.tokenService.verify(locale, token);
-    return true;
-  }
-
-  private extractToken(request: Request): string | undefined {
-    const [type, token] = request.headers.authorization?.split(' ') ?? [];
-    return type === 'Bearer' ? token : undefined;
-  }
-}
+import { PrismaService } from '@hed-hog/api-prisma';
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Request } from 'express';
+import { SecurityService } from '../../security/security.service';
+import { TokenService } from '../../token/token.service';
+
+@Injectable()
+export class McpAuthGuard implements CanActivate {
+  constructor(
+    private readonly tokenService: TokenService,
+    private readonly prisma: PrismaService,
+    private readonly security: SecurityService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest<Request>();
+    const locale =
+      request.headers['accept-language']?.split(',')[0]?.split('-')[0] ?? 'en';
+
+    const token = this.extractToken(request);
+    if (!token) {
+      throw new UnauthorizedException('MCP: Bearer token required');
+    }
+
+    if (token.startsWith('hedhog_mcp_')) {
+      return this.verifyApiKey(request, token);
+    }
+
+    request['auth'] = await this.tokenService.verify(locale, token);
+    return true;
+  }
+
+  private async verifyApiKey(request: Request, token: string): Promise<boolean> {
+    const hash = this.security.hashWithPepper(token);
+    const apiKey = await this.prisma.mcp_api_key.findFirst({
+      where: { token_hash: hash, revoked_at: null },
+    });
+
+    if (!apiKey) {
+      throw new UnauthorizedException('MCP: Invalid API key');
+    }
+    if (apiKey.expires_at && apiKey.expires_at <= new Date()) {
+      throw new UnauthorizedException('MCP: API key expired');
+    }
+
+    this.prisma.mcp_api_key.update({
+      where: { id: apiKey.id },
+      data: { last_used_at: new Date() },
+    }).catch(() => {});
+
+    request['auth'] = { sub: apiKey.user_id, sessionId: null };
+    return true;
+  }
+
+  private extractToken(request: Request): string | undefined {
+    const [type, token] = request.headers.authorization?.split(' ') ?? [];
+    return type === 'Bearer' ? token : undefined;
+  }
+}

package/src/mcp/mcp-api-key.controller.ts

@@ -0,0 +1,42 @@
+import { Role, User } from '@hed-hog/api';
+import { Pagination, PaginationDTO } from '@hed-hog/api-pagination';
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Param,
+  ParseIntPipe,
+  Post,
+} from '@nestjs/common';
+import { McpApiKeyService } from './mcp-api-key.service';
+
+@Role()
+@Controller('mcp/api-keys')
+export class McpApiKeyController {
+  constructor(private readonly mcpApiKeyService: McpApiKeyService) {}
+
+  @Get()
+  list(
+    @Pagination() paginationParams: PaginationDTO,
+    @User() { id }: { id: number },
+  ) {
+    return this.mcpApiKeyService.list(id, paginationParams);
+  }
+
+  @Post()
+  create(
+    @User() { id }: { id: number },
+    @Body() body: { name: string },
+  ) {
+    return this.mcpApiKeyService.create(id, body.name);
+  }
+
+  @Delete(':id')
+  revoke(
+    @User() { id: userId }: { id: number },
+    @Param('id', ParseIntPipe) id: number,
+  ) {
+    return this.mcpApiKeyService.revoke(userId, id);
+  }
+}

package/src/mcp/mcp-api-key.service.ts

@@ -0,0 +1,66 @@
+import { PaginationDTO, PaginationService } from '@hed-hog/api-pagination';
+import { PrismaService } from '@hed-hog/api-prisma';
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { SecurityService } from '../security/security.service';
+
+@Injectable()
+export class McpApiKeyService {
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly security: SecurityService,
+    private readonly pagination: PaginationService,
+  ) {}
+
+  async list(userId: number, paginationParams: PaginationDTO) {
+    return this.pagination.paginatePrismaModel(this.prisma.mcp_api_key, {
+      ...paginationParams,
+      where: { user_id: userId, revoked_at: null },
+      select: {
+        id: true,
+        name: true,
+        token_prefix: true,
+        last_used_at: true,
+        expires_at: true,
+        created_at: true,
+      },
+      orderBy: { created_at: 'desc' },
+    });
+  }
+
+  async create(userId: number, name: string) {
+    const rawToken = 'hedhog_mcp_' + this.security.randomOpaque(36);
+    const tokenHash = this.security.hashWithPepper(rawToken);
+    const tokenPrefix = rawToken.substring(0, 16);
+
+    const record = await this.prisma.mcp_api_key.create({
+      data: {
+        user_id: userId,
+        name,
+        token_hash: tokenHash,
+        token_prefix: tokenPrefix,
+      },
+      select: {
+        id: true,
+        name: true,
+        token_prefix: true,
+        created_at: true,
+      },
+    });
+
+    return { ...record, rawToken };
+  }
+
+  async revoke(userId: number, id: number) {
+    const key = await this.prisma.mcp_api_key.findFirst({
+      where: { id, user_id: userId },
+    });
+    if (!key) {
+      throw new NotFoundException(`MCP API key ${id} not found`);
+    }
+    await this.prisma.mcp_api_key.update({
+      where: { id },
+      data: { revoked_at: new Date() },
+    });
+    return { success: true };
+  }
+}

package/src/mcp/mcp-registry.service.ts

@@ -1,69 +1,75 @@
-import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
-import { DiscoveryService } from '@nestjs/core';
-import { Reflector } from '@nestjs/core';
-import { MCP_TOOL_METADATA } from './decorators/mcp-tool.decorator';
-import { McpToolDefinition } from './interfaces/mcp-tool-definition.interface';
-import { McpContext } from './types/mcp-context.type';
-
-export interface McpToolEntry {
-  definition: McpToolDefinition;
-  handler: (args: Record<string, any>, context: McpContext) => Promise<any>;
-}
-
-@Injectable()
-export class McpRegistryService implements OnModuleInit {
-  private readonly logger = new Logger(McpRegistryService.name);
-  private readonly tools = new Map<string, McpToolEntry>();
-
-  constructor(
-    private readonly discovery: DiscoveryService,
-    private readonly reflector: Reflector,
-  ) {}
-
-  onModuleInit(): void {
-    const providers = this.discovery.getProviders();
-
-    for (const wrapper of providers) {
-      const { instance } = wrapper;
-      if (!instance || typeof instance !== 'object') continue;
-
-      const prototype = Object.getPrototypeOf(instance);
-      if (!prototype) continue;
-
-      const methodNames = Object.getOwnPropertyNames(prototype).filter((key) => {
-        if (key === 'constructor') return false;
-        const descriptor = Object.getOwnPropertyDescriptor(prototype, key);
-        return descriptor !== undefined && typeof descriptor.value === 'function';
-      });
-
-      for (const methodName of methodNames) {
-        const definition = this.reflector.get<McpToolDefinition>(
-          MCP_TOOL_METADATA,
-          prototype[methodName],
-        );
-
-        if (!definition) continue;
-
-        this.logger.log(`Registered MCP tool: ${definition.name}`);
-        this.tools.set(definition.name, {
-          definition,
-          handler: (instance as any)[methodName].bind(instance),
-        });
-      }
-    }
-
-    this.logger.log(`McpRegistryService: ${this.tools.size} tools registered`);
-  }
-
-  getAll(): McpToolEntry[] {
-    return Array.from(this.tools.values());
-  }
-
-  get(toolName: string): McpToolEntry | undefined {
-    return this.tools.get(toolName);
-  }
-
-  has(toolName: string): boolean {
-    return this.tools.has(toolName);
-  }
-}
+import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+import { DiscoveryService, Reflector } from '@nestjs/core';
+import { MCP_TOOL_METADATA } from './decorators/mcp-tool.decorator';
+import { McpToolDefinition } from './interfaces/mcp-tool-definition.interface';
+import { McpContext } from './types/mcp-context.type';
+
+export interface McpToolEntry {
+  definition: McpToolDefinition;
+  handler: (args: Record<string, any>, context: McpContext) => Promise<any>;
+}
+
+@Injectable()
+export class McpRegistryService implements OnModuleInit {
+  private readonly logger = new Logger(McpRegistryService.name);
+  private readonly tools = new Map<string, McpToolEntry>();
+
+  constructor(
+    private readonly discovery: DiscoveryService,
+    private readonly reflector: Reflector,
+  ) {}
+
+  onModuleInit(): void {
+    const providers = this.discovery.getProviders();
+
+    for (const wrapper of providers) {
+      const { instance } = wrapper;
+      if (!instance || typeof instance !== 'object') continue;
+
+      const prototype = Object.getPrototypeOf(instance);
+      if (!prototype) continue;
+
+      const methodNames = Object.getOwnPropertyNames(prototype).filter((key) => {
+        if (key === 'constructor') return false;
+        const descriptor = Object.getOwnPropertyDescriptor(prototype, key);
+        return descriptor !== undefined && typeof descriptor.value === 'function';
+      });
+
+      for (const methodName of methodNames) {
+        const definition = this.reflector.get<McpToolDefinition>(
+          MCP_TOOL_METADATA,
+          prototype[methodName],
+        );
+
+        if (!definition) continue;
+
+        if (this.tools.has(definition.name)) {
+          this.logger.warn(
+            `Duplicate MCP tool ignored: ${definition.name} from ${prototype.constructor?.name}.${methodName}`,
+          );
+          continue;
+        }
+
+        this.logger.log(`Registered MCP tool: ${definition.name}`);
+        this.tools.set(definition.name, {
+          definition,
+          handler: (instance as any)[methodName].bind(instance),
+        });
+      }
+    }
+
+    this.logger.log(`McpRegistryService: ${this.tools.size} tools registered`);
+  }
+
+  getAll(): McpToolEntry[] {
+    return Array.from(this.tools.values());
+  }
+
+  get(toolName: string): McpToolEntry | undefined {
+    return this.tools.get(toolName);
+  }
+
+  has(toolName: string): boolean {
+    return this.tools.has(toolName);
+  }
+}

package/src/mcp/mcp.module.ts

@@ -1,36 +1,43 @@
-import { PrismaModule } from '@hed-hog/api-prisma';
-import { Module, forwardRef } from '@nestjs/common';
-import { DiscoveryModule } from '@nestjs/core';
-import { SettingModule } from '../setting/setting.module';
-import { TokenModule } from '../token/token.module';
-import { UserModule } from '../user/user.module';
-import { McpAuthGuard } from './guards/mcp-auth.guard';
-import { McpPermissionGuard } from './guards/mcp-permission.guard';
-import { McpAuditService } from './mcp-audit.service';
-import { McpRegistryService } from './mcp-registry.service';
-import { McpServerService } from './mcp-server.service';
-import { McpController } from './mcp.controller';
-import { CoreSettingsMcpTools } from './tools/core-settings.mcp-tools';
-import { CoreUsersMcpTools } from './tools/core-users.mcp-tools';
-
-@Module({
-  imports: [
-    DiscoveryModule,
-    forwardRef(() => PrismaModule),
-    forwardRef(() => TokenModule),
-    forwardRef(() => SettingModule),
-    forwardRef(() => UserModule),
-  ],
-  controllers: [McpController],
-  providers: [
-    McpRegistryService,
-    McpServerService,
-    McpAuditService,
-    McpAuthGuard,
-    McpPermissionGuard,
-    CoreSettingsMcpTools,
-    CoreUsersMcpTools,
-  ],
-  exports: [McpRegistryService, McpServerService],
-})
-export class McpModule {}
+import { PaginationModule } from '@hed-hog/api-pagination';
+import { PrismaModule } from '@hed-hog/api-prisma';
+import { Module, forwardRef } from '@nestjs/common';
+import { DiscoveryModule } from '@nestjs/core';
+import { SecurityModule } from '../security/security.module';
+import { SettingModule } from '../setting/setting.module';
+import { TokenModule } from '../token/token.module';
+import { UserModule } from '../user/user.module';
+import { McpAuthGuard } from './guards/mcp-auth.guard';
+import { McpPermissionGuard } from './guards/mcp-permission.guard';
+import { McpApiKeyController } from './mcp-api-key.controller';
+import { McpApiKeyService } from './mcp-api-key.service';
+import { McpAuditService } from './mcp-audit.service';
+import { McpRegistryService } from './mcp-registry.service';
+import { McpServerService } from './mcp-server.service';
+import { McpController } from './mcp.controller';
+import { CoreSettingsMcpTools } from './tools/core-settings.mcp-tools';
+import { CoreUsersMcpTools } from './tools/core-users.mcp-tools';
+
+@Module({
+  imports: [
+    DiscoveryModule,
+    forwardRef(() => PrismaModule),
+    forwardRef(() => PaginationModule),
+    forwardRef(() => TokenModule),
+    forwardRef(() => SettingModule),
+    forwardRef(() => UserModule),
+    forwardRef(() => SecurityModule),
+  ],
+  controllers: [McpController, McpApiKeyController],
+  providers: [
+    McpRegistryService,
+    McpServerService,
+    McpAuditService,
+    McpAuthGuard,
+    McpPermissionGuard,
+    McpApiKeyService,
+    CoreSettingsMcpTools,
+    CoreUsersMcpTools,
+  ],
+  exports: [McpRegistryService, McpServerService],
+})
+export class McpModule {}