@hed-hog/core 0.0.349 → 0.0.351

package/src/file/provider/provider.factory.ts

@@ -1,6 +1,7 @@
 import { JwtService } from '@nestjs/jwt';
 import { AbstractProvider } from './abstract.provider';
 import { AzureProvider } from './azure.provider';
+import { GCSProvider } from './gcs.provider';
 import { LocalProvider } from './local.provider';
 import { EnumProvider } from './provider.enum';
 import { S3Provider } from './s3.provider';
@@ -18,6 +19,8 @@ export class ProviderFactory {
         return new LocalProvider(setting, jwtService);
       case EnumProvider.AZURE:
         return new AzureProvider(setting);
+      case EnumProvider.GCS:
+        return new GCSProvider(setting);
     }
   }
 }

package/src/file/provider/s3.provider.ts

@@ -9,6 +9,8 @@ import {
 } from '@aws-sdk/client-s3';
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
 import { BadRequestException } from '@nestjs/common';
+import { createReadStream } from 'fs';
+import { basename } from 'path';
 import { Readable } from 'stream';
 import { AbstractProvider } from './abstract.provider';
 
@@ -166,6 +168,26 @@ export class S3Provider extends AbstractProvider {
     return `https://${this.setting['storage-s3-bucket']}.s3.${this.setting['storage-s3-region']}.amazonaws.com/${key}`;
   }
 
+  async uploadFromPath(
+    destination: string,
+    filePath: string,
+    options?: { filename?: string; mimetype?: string },
+  ): Promise<any> {
+    const s3 = await this.getClient();
+    const originalName = options?.filename ?? basename(filePath);
+    const storedFilename = this.getFilename(originalName);
+    const key = [destination, storedFilename].join('/');
+    const command = new PutObjectCommand({
+      Bucket: this.setting['storage-s3-bucket'],
+      Key: key,
+      Body: createReadStream(filePath),
+      ContentType: options?.mimetype,
+    });
+
+    await s3.send(command);
+    return `https://${this.setting['storage-s3-bucket']}.s3.${this.setting['storage-s3-region']}.amazonaws.com/${key}`;
+  }
+
   async delete(filepath: string): Promise<any> {
     const s3 = await this.getClient();
     const key = this.resolveS3Key(filepath);

package/src/index.ts

@@ -70,3 +70,8 @@ export * from './mcp/types/mcp-context.type';
 // Utilities
 export * from './utils/locale-context';
 
+
+// Notification Module
+export * from './notification/notification.module';
+export * from './notification/notification.service';
+export * from './notification/dto/create-notification.dto';

package/src/mcp/guards/mcp-auth.guard.ts

@@ -1,32 +1,64 @@
-import {
-  CanActivate,
-  ExecutionContext,
-  Injectable,
-  UnauthorizedException,
-} from '@nestjs/common';
-import { Request } from 'express';
-import { TokenService } from '../../token/token.service';
-
-@Injectable()
-export class McpAuthGuard implements CanActivate {
-  constructor(private readonly tokenService: TokenService) {}
-
-  async canActivate(context: ExecutionContext): Promise<boolean> {
-    const request = context.switchToHttp().getRequest<Request>();
-    const locale =
-      request.headers['accept-language']?.split(',')[0]?.split('-')[0] ?? 'en';
-
-    const token = this.extractToken(request);
-    if (!token) {
-      throw new UnauthorizedException('MCP: Bearer token required');
-    }
-
-    request['auth'] = await this.tokenService.verify(locale, token);
-    return true;
-  }
-
-  private extractToken(request: Request): string | undefined {
-    const [type, token] = request.headers.authorization?.split(' ') ?? [];
-    return type === 'Bearer' ? token : undefined;
-  }
-}
+import { PrismaService } from '@hed-hog/api-prisma';
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Request } from 'express';
+import { SecurityService } from '../../security/security.service';
+import { TokenService } from '../../token/token.service';
+
+@Injectable()
+export class McpAuthGuard implements CanActivate {
+  constructor(
+    private readonly tokenService: TokenService,
+    private readonly prisma: PrismaService,
+    private readonly security: SecurityService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest<Request>();
+    const locale =
+      request.headers['accept-language']?.split(',')[0]?.split('-')[0] ?? 'en';
+
+    const token = this.extractToken(request);
+    if (!token) {
+      throw new UnauthorizedException('MCP: Bearer token required');
+    }
+
+    if (token.startsWith('hedhog_mcp_')) {
+      return this.verifyApiKey(request, token);
+    }
+
+    request['auth'] = await this.tokenService.verify(locale, token);
+    return true;
+  }
+
+  private async verifyApiKey(request: Request, token: string): Promise<boolean> {
+    const hash = this.security.hashWithPepper(token);
+    const apiKey = await this.prisma.mcp_api_key.findFirst({
+      where: { token_hash: hash, revoked_at: null },
+    });
+
+    if (!apiKey) {
+      throw new UnauthorizedException('MCP: Invalid API key');
+    }
+    if (apiKey.expires_at && apiKey.expires_at <= new Date()) {
+      throw new UnauthorizedException('MCP: API key expired');
+    }
+
+    this.prisma.mcp_api_key.update({
+      where: { id: apiKey.id },
+      data: { last_used_at: new Date() },
+    }).catch(() => {});
+
+    request['auth'] = { sub: apiKey.user_id, sessionId: null };
+    return true;
+  }
+
+  private extractToken(request: Request): string | undefined {
+    const [type, token] = request.headers.authorization?.split(' ') ?? [];
+    return type === 'Bearer' ? token : undefined;
+  }
+}

package/src/mcp/mcp-api-key.controller.ts

@@ -0,0 +1,42 @@
+import { Role, User } from '@hed-hog/api';
+import { Pagination, PaginationDTO } from '@hed-hog/api-pagination';
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Param,
+  ParseIntPipe,
+  Post,
+} from '@nestjs/common';
+import { McpApiKeyService } from './mcp-api-key.service';
+
+@Role()
+@Controller('mcp/api-keys')
+export class McpApiKeyController {
+  constructor(private readonly mcpApiKeyService: McpApiKeyService) {}
+
+  @Get()
+  list(
+    @Pagination() paginationParams: PaginationDTO,
+    @User() { id }: { id: number },
+  ) {
+    return this.mcpApiKeyService.list(id, paginationParams);
+  }
+
+  @Post()
+  create(
+    @User() { id }: { id: number },
+    @Body() body: { name: string },
+  ) {
+    return this.mcpApiKeyService.create(id, body.name);
+  }
+
+  @Delete(':id')
+  revoke(
+    @User() { id: userId }: { id: number },
+    @Param('id', ParseIntPipe) id: number,
+  ) {
+    return this.mcpApiKeyService.revoke(userId, id);
+  }
+}

package/src/mcp/mcp-api-key.service.ts

@@ -0,0 +1,66 @@
+import { PaginationDTO, PaginationService } from '@hed-hog/api-pagination';
+import { PrismaService } from '@hed-hog/api-prisma';
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { SecurityService } from '../security/security.service';
+
+@Injectable()
+export class McpApiKeyService {
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly security: SecurityService,
+    private readonly pagination: PaginationService,
+  ) {}
+
+  async list(userId: number, paginationParams: PaginationDTO) {
+    return this.pagination.paginatePrismaModel(this.prisma.mcp_api_key, {
+      ...paginationParams,
+      where: { user_id: userId, revoked_at: null },
+      select: {
+        id: true,
+        name: true,
+        token_prefix: true,
+        last_used_at: true,
+        expires_at: true,
+        created_at: true,
+      },
+      orderBy: { created_at: 'desc' },
+    });
+  }
+
+  async create(userId: number, name: string) {
+    const rawToken = 'hedhog_mcp_' + this.security.randomOpaque(36);
+    const tokenHash = this.security.hashWithPepper(rawToken);
+    const tokenPrefix = rawToken.substring(0, 16);
+
+    const record = await this.prisma.mcp_api_key.create({
+      data: {
+        user_id: userId,
+        name,
+        token_hash: tokenHash,
+        token_prefix: tokenPrefix,
+      },
+      select: {
+        id: true,
+        name: true,
+        token_prefix: true,
+        created_at: true,
+      },
+    });
+
+    return { ...record, rawToken };
+  }
+
+  async revoke(userId: number, id: number) {
+    const key = await this.prisma.mcp_api_key.findFirst({
+      where: { id, user_id: userId },
+    });
+    if (!key) {
+      throw new NotFoundException(`MCP API key ${id} not found`);
+    }
+    await this.prisma.mcp_api_key.update({
+      where: { id },
+      data: { revoked_at: new Date() },
+    });
+    return { success: true };
+  }
+}

package/src/mcp/mcp-audit.service.ts

@@ -1,36 +1,47 @@
-import { PrismaService } from '@hed-hog/api-prisma';
-import { Injectable, Logger } from '@nestjs/common';
-
-interface AuditRecord {
-  userId: number;
-  toolName: string;
-  input: Record<string, any>;
-  success: boolean;
-  error?: string;
-  durationMs: number;
-}
-
-@Injectable()
-export class McpAuditService {
-  private readonly logger = new Logger(McpAuditService.name);
-
-  constructor(private readonly prisma: PrismaService) {}
-
-  async record(data: AuditRecord): Promise<void> {
-    const sanitized = JSON.stringify(data.input).slice(0, 1000);
-    try {
-      await this.prisma.mcp_tool_call_log.create({
-        data: {
-          user_id: data.userId || null,
-          tool_name: data.toolName,
-          input: sanitized,
-          success: data.success,
-          error: data.error ?? null,
-          duration_ms: data.durationMs,
-        },
-      });
-    } catch (e: any) {
-      this.logger.warn(`Failed to persist MCP audit record: ${e.message}`);
-    }
-  }
-}
+import { PrismaService } from '@hed-hog/api-prisma';
+import { forwardRef, Inject, Injectable, Logger } from '@nestjs/common';
+import { AccessLogService } from '../access-log/access-log.service';
+
+interface AuditRecord {
+  userId: number;
+  toolName: string;
+  input: Record<string, any>;
+  success: boolean;
+  error?: string;
+  durationMs: number;
+}
+
+@Injectable()
+export class McpAuditService {
+  private readonly logger = new Logger(McpAuditService.name);
+
+  constructor(
+    private readonly prisma: PrismaService,
+    @Inject(forwardRef(() => AccessLogService))
+    private readonly accessLogService: AccessLogService,
+  ) {}
+
+  async record(data: AuditRecord): Promise<void> {
+    const sanitized = JSON.stringify(data.input).slice(0, 1000);
+    try {
+      await this.prisma.mcp_tool_call_log.create({
+        data: {
+          user_id: data.userId || null,
+          tool_name: data.toolName,
+          input: sanitized,
+          success: data.success,
+          error: data.error ?? null,
+          duration_ms: data.durationMs,
+        },
+      });
+    } catch (e: any) {
+      this.logger.warn(`Failed to persist MCP audit record: ${e.message}`);
+    }
+
+    this.accessLogService.recordMcp({
+      userId: data.userId || undefined,
+      mcpTool: data.toolName,
+      mcpPrompt: sanitized,
+    });
+  }
+}

package/src/mcp/mcp-registry.service.ts

@@ -1,69 +1,75 @@
-import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
-import { DiscoveryService } from '@nestjs/core';
-import { Reflector } from '@nestjs/core';
-import { MCP_TOOL_METADATA } from './decorators/mcp-tool.decorator';
-import { McpToolDefinition } from './interfaces/mcp-tool-definition.interface';
-import { McpContext } from './types/mcp-context.type';
-
-export interface McpToolEntry {
-  definition: McpToolDefinition;
-  handler: (args: Record<string, any>, context: McpContext) => Promise<any>;
-}
-
-@Injectable()
-export class McpRegistryService implements OnModuleInit {
-  private readonly logger = new Logger(McpRegistryService.name);
-  private readonly tools = new Map<string, McpToolEntry>();
-
-  constructor(
-    private readonly discovery: DiscoveryService,
-    private readonly reflector: Reflector,
-  ) {}
-
-  onModuleInit(): void {
-    const providers = this.discovery.getProviders();
-
-    for (const wrapper of providers) {
-      const { instance } = wrapper;
-      if (!instance || typeof instance !== 'object') continue;
-
-      const prototype = Object.getPrototypeOf(instance);
-      if (!prototype) continue;
-
-      const methodNames = Object.getOwnPropertyNames(prototype).filter((key) => {
-        if (key === 'constructor') return false;
-        const descriptor = Object.getOwnPropertyDescriptor(prototype, key);
-        return descriptor !== undefined && typeof descriptor.value === 'function';
-      });
-
-      for (const methodName of methodNames) {
-        const definition = this.reflector.get<McpToolDefinition>(
-          MCP_TOOL_METADATA,
-          prototype[methodName],
-        );
-
-        if (!definition) continue;
-
-        this.logger.log(`Registered MCP tool: ${definition.name}`);
-        this.tools.set(definition.name, {
-          definition,
-          handler: (instance as any)[methodName].bind(instance),
-        });
-      }
-    }
-
-    this.logger.log(`McpRegistryService: ${this.tools.size} tools registered`);
-  }
-
-  getAll(): McpToolEntry[] {
-    return Array.from(this.tools.values());
-  }
-
-  get(toolName: string): McpToolEntry | undefined {
-    return this.tools.get(toolName);
-  }
-
-  has(toolName: string): boolean {
-    return this.tools.has(toolName);
-  }
-}
+import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+import { DiscoveryService, Reflector } from '@nestjs/core';
+import { MCP_TOOL_METADATA } from './decorators/mcp-tool.decorator';
+import { McpToolDefinition } from './interfaces/mcp-tool-definition.interface';
+import { McpContext } from './types/mcp-context.type';
+
+export interface McpToolEntry {
+  definition: McpToolDefinition;
+  handler: (args: Record<string, any>, context: McpContext) => Promise<any>;
+}
+
+@Injectable()
+export class McpRegistryService implements OnModuleInit {
+  private readonly logger = new Logger(McpRegistryService.name);
+  private readonly tools = new Map<string, McpToolEntry>();
+
+  constructor(
+    private readonly discovery: DiscoveryService,
+    private readonly reflector: Reflector,
+  ) {}
+
+  onModuleInit(): void {
+    const providers = this.discovery.getProviders();
+
+    for (const wrapper of providers) {
+      const { instance } = wrapper;
+      if (!instance || typeof instance !== 'object') continue;
+
+      const prototype = Object.getPrototypeOf(instance);
+      if (!prototype) continue;
+
+      const methodNames = Object.getOwnPropertyNames(prototype).filter((key) => {
+        if (key === 'constructor') return false;
+        const descriptor = Object.getOwnPropertyDescriptor(prototype, key);
+        return descriptor !== undefined && typeof descriptor.value === 'function';
+      });
+
+      for (const methodName of methodNames) {
+        const definition = this.reflector.get<McpToolDefinition>(
+          MCP_TOOL_METADATA,
+          prototype[methodName],
+        );
+
+        if (!definition) continue;
+
+        if (this.tools.has(definition.name)) {
+          this.logger.warn(
+            `Duplicate MCP tool ignored: ${definition.name} from ${prototype.constructor?.name}.${methodName}`,
+          );
+          continue;
+        }
+
+        this.logger.log(`Registered MCP tool: ${definition.name}`);
+        this.tools.set(definition.name, {
+          definition,
+          handler: (instance as any)[methodName].bind(instance),
+        });
+      }
+    }
+
+    this.logger.log(`McpRegistryService: ${this.tools.size} tools registered`);
+  }
+
+  getAll(): McpToolEntry[] {
+    return Array.from(this.tools.values());
+  }
+
+  get(toolName: string): McpToolEntry | undefined {
+    return this.tools.get(toolName);
+  }
+
+  has(toolName: string): boolean {
+    return this.tools.has(toolName);
+  }
+}

package/src/mcp/mcp.controller.ts

@@ -1,30 +1,40 @@
-import { NoRole } from '@hed-hog/api';
-import { All, Controller, Req, Res, UseGuards } from '@nestjs/common';
-import { Request, Response } from 'express';
-import { McpAuthGuard } from './guards/mcp-auth.guard';
-import { McpPermissionGuard } from './guards/mcp-permission.guard';
-import { McpServerService } from './mcp-server.service';
-
-@NoRole()
-@UseGuards(McpAuthGuard, McpPermissionGuard)
-@Controller('mcp')
-export class McpController {
-  constructor(private readonly mcpServer: McpServerService) {}
-
-  @All()
-  async handle(@Req() req: Request, @Res() res: Response): Promise<void> {
-    const auth = (req as any).auth;
-    const locale =
-      req.headers['accept-language']?.split(',')[0]?.split('-')[0] ?? 'en';
-    const body = req.body as any;
-    const toolName: string =
-      body?.method === 'tools/call' ? (body?.params?.name ?? '') : '';
-
-    await this.mcpServer.handleRequest(req, res, {
-      userId: auth.sub,
-      sessionId: String(auth.sessionId),
-      locale,
-      toolName,
-    });
-  }
-}
+import { NoRole } from '@hed-hog/api';
+import { All, Controller, Req, Res, UseGuards } from '@nestjs/common';
+import { Request, Response } from 'express';
+import { SettingService } from '../setting/setting.service';
+import { McpAuthGuard } from './guards/mcp-auth.guard';
+import { McpPermissionGuard } from './guards/mcp-permission.guard';
+import { McpServerService } from './mcp-server.service';
+
+@NoRole()
+@UseGuards(McpAuthGuard, McpPermissionGuard)
+@Controller('mcp')
+export class McpController {
+  constructor(
+    private readonly mcpServer: McpServerService,
+    private readonly setting: SettingService,
+  ) {}
+
+  @All()
+  async handle(@Req() req: Request, @Res() res: Response): Promise<void> {
+    const settings = await this.setting.getSettingValues(['mcp-enabled']);
+    if (settings['mcp-enabled'] === false) {
+      res.status(503).json({ message: 'MCP server is disabled.' });
+      return;
+    }
+
+    const auth = (req as any).auth;
+    const locale =
+      req.headers['accept-language']?.split(',')[0]?.split('-')[0] ?? 'en';
+    const body = req.body as any;
+    const toolName: string =
+      body?.method === 'tools/call' ? (body?.params?.name ?? '') : '';
+
+    await this.mcpServer.handleRequest(req, res, {
+      userId: auth.sub,
+      sessionId: String(auth.sessionId),
+      locale,
+      toolName,
+    });
+  }
+}