@hed-hog/core 0.0.382 → 0.0.385

package/dist/auth/auth.controller.d.ts

@@ -81,10 +81,10 @@ export declare class AuthController {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         }[];
         id: number;
         created_at: Date;
@@ -200,10 +200,10 @@ export declare class AuthController {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         };
     }>;
 }

package/dist/auth/auth.service.d.ts

@@ -29,10 +29,10 @@ export declare class AuthService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         };
     }>;
     issueDesktopToken(locale: string, userId: number, ipAddress: string, userAgent: string): Promise<{
@@ -148,10 +148,10 @@ export declare class AuthService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         }[];
         id: number;
         created_at: Date;
@@ -173,10 +173,10 @@ export declare class AuthService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         };
     }>;
     forgotPassword(locale: string, { email, app }: ForgetDTO): Promise<{
@@ -195,10 +195,10 @@ export declare class AuthService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         };
     }>;
     verifyMfaCode(locale: string, mfaToken: string, code: string, ipAddress: string, userAgent: string, methodType?: 'totp' | 'email' | 'recovery', browserId?: string | null): Promise<{
@@ -211,10 +211,10 @@ export declare class AuthService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         };
         requiresPasswordReset: boolean;
     }>;
@@ -228,10 +228,10 @@ export declare class AuthService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         };
         requiresPasswordReset: boolean;
     }>;
@@ -250,10 +250,10 @@ export declare class AuthService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         };
         requiresPasswordReset: boolean;
     }>;

package/dist/auth/guards/auth.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.guard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/auth.guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,WAAW,EACX,gBAAgB,EAIjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,qBACa,SAAU,YAAW,WAAW;IAIzC,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,QAAQ;IANlB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;gBAG3C,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,eAAe;IAG7B,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAsEhD,YAAY;IAwB1B,OAAO,CAAC,sBAAsB;CAK/B"}
+{"version":3,"file":"auth.guard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/auth.guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,WAAW,EACX,gBAAgB,EAIjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,qBACa,SAAU,YAAW,WAAW;IAIzC,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,QAAQ;IANlB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;gBAG3C,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,eAAe;IAG7B,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAoFhD,YAAY;IAwB1B,OAAO,CAAC,sBAAsB;CAK/B"}

package/dist/auth/guards/auth.guard.js

@@ -16,6 +16,7 @@ const api_locale_1 = require("@hed-hog/api-locale");
 const api_prisma_1 = require("@hed-hog/api-prisma");
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
+const allow_mcp_token_decorator_1 = require("../../mcp/decorators/allow-mcp-token.decorator");
 const security_service_1 = require("../../security/security.service");
 const token_service_1 = require("../../token/token.service");
 let AuthGuard = AuthGuard_1 = class AuthGuard {
@@ -40,12 +41,25 @@ let AuthGuard = AuthGuard_1 = class AuthGuard {
             context.getHandler(),
             context.getClass(),
         ]);
+        const allowMcpToken = this.reflector.getAllAndOverride(allow_mcp_token_decorator_1.ALLOW_MCP_TOKEN, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
         const request = context.switchToHttp().getRequest();
         const token = this.extractTokenFromHeader(request);
         const locale = request.headers['locale'] || request.headers['accept-language'] || 'en';
         if (token === null || token === void 0 ? void 0 : token.startsWith('hedhog_api_')) {
             return this.verifyApiKey(request, token, isPublic);
         }
+        if (token === null || token === void 0 ? void 0 : token.startsWith('hedhog_mcp_')) {
+            if (allowMcpToken) {
+                // Real validation (mcp_api_key lookup) happens in McpAuthGuard on /mcp.
+                return true;
+            }
+            if (isPublic)
+                return true;
+            throw new common_1.UnauthorizedException('Invalid API key');
+        }
         // If endpoint requires role/authentication and no token provided
         if (!token) {
             if (isPublic) {

package/dist/auth/guards/auth.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.guard.js","sourceRoot":"","sources":["../../../src/auth/guards/auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,sCAAsE;AACtE,oDAAoD;AACpD,oDAAoD;AACpD,2CAMwB;AACxB,uCAAyC;AAEzC,sEAAkE;AAClE,6DAAyD;AAGlD,IAAM,SAAS,iBAAf,MAAM,SAAS;IAGpB,YACU,KAAmB,EACnB,SAAoB,EACpB,MAAqB,EACrB,QAAyB;QAHzB,UAAK,GAAL,KAAK,CAAc;QACnB,cAAS,GAAT,SAAS,CAAW;QACpB,WAAM,GAAN,MAAM,CAAe;QACrB,aAAQ,GAAR,QAAQ,CAAiB;QANlB,WAAM,GAAG,IAAI,eAAM,CAAC,WAAS,CAAC,IAAI,CAAC,CAAC;IAOjD,CAAC;IAEL,KAAK,CAAC,WAAW,CAAC,OAAyB;;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,mBAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,eAAS,EAAE;YACpE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,kBAAY,EAAE;YACzE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QAEvF,IAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;QAED,iEAAiE;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,IAAI,UAAU,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,8EAA8E;gBAC9E,MAAM,IAAI,8BAAqB,CAC7B,IAAA,0BAAa,EAAC,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC,CACxD,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,4CAA4C;gBAC5C,MAAM,IAAI,8BAAqB,CAC7B,IAAA,0BAAa,EAAC,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC,CACxD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,iDAAiD;gBACjD,MAAM,IAAI,8BAAqB,CAC7B,IAAA,0BAAa,EAAC,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAEvD,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,MAAC,KAAa,aAAb,KAAK,uBAAL,KAAK,CAAU,IAAI,mCAAI,cAAc,CAAC;gBACvD,MAAM,OAAO,GAAG,CAAC,KAAa,aAAb,KAAK,uBAAL,KAAK,CAAU,OAAO,KAAI,OAAO,IAAI,cAAc,CAAC;gBACrE,kFAAkF;gBAClF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,UAAU,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC;gBAC/G,CAAC;gBACD,MAAM,IAAI,8BAAqB,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAgB,EAAE,KAAa,EAAE,QAAiB;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;YACrD,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;SAC3D,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACzD,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;YAC7B,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;YACxB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,EAAE;SACnC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEnB,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,OAAgB;;QAC7C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAA,MAAA,OAAO,CAAC,OAAO,CAAC,aAAa,0CAAE,KAAK,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC;QAEtE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AA7GY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;qCAKM,4BAAY;QACR,gBAAS;QACZ,0BAAa;QACX,kCAAe;GAPxB,SAAS,CA6GrB"}
+{"version":3,"file":"auth.guard.js","sourceRoot":"","sources":["../../../src/auth/guards/auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,sCAAsE;AACtE,oDAAoD;AACpD,oDAAoD;AACpD,2CAMwB;AACxB,uCAAyC;AAEzC,8FAAiF;AACjF,sEAAkE;AAClE,6DAAyD;AAGlD,IAAM,SAAS,iBAAf,MAAM,SAAS;IAGpB,YACU,KAAmB,EACnB,SAAoB,EACpB,MAAqB,EACrB,QAAyB;QAHzB,UAAK,GAAL,KAAK,CAAc;QACnB,cAAS,GAAT,SAAS,CAAW;QACpB,WAAM,GAAN,MAAM,CAAe;QACrB,aAAQ,GAAR,QAAQ,CAAiB;QANlB,WAAM,GAAG,IAAI,eAAM,CAAC,WAAS,CAAC,IAAI,CAAC,CAAC;IAOjD,CAAC;IAEL,KAAK,CAAC,WAAW,CAAC,OAAyB;;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,mBAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,eAAS,EAAE;YACpE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,kBAAY,EAAE;YACzE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,2CAAe,EAAE;YAC/E,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QAEvF,IAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,IAAI,aAAa,EAAE,CAAC;gBAClB,wEAAwE;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QAED,iEAAiE;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,IAAI,UAAU,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,8EAA8E;gBAC9E,MAAM,IAAI,8BAAqB,CAC7B,IAAA,0BAAa,EAAC,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC,CACxD,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,4CAA4C;gBAC5C,MAAM,IAAI,8BAAqB,CAC7B,IAAA,0BAAa,EAAC,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC,CACxD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,iDAAiD;gBACjD,MAAM,IAAI,8BAAqB,CAC7B,IAAA,0BAAa,EAAC,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAEvD,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,MAAC,KAAa,aAAb,KAAK,uBAAL,KAAK,CAAU,IAAI,mCAAI,cAAc,CAAC;gBACvD,MAAM,OAAO,GAAG,CAAC,KAAa,aAAb,KAAK,uBAAL,KAAK,CAAU,OAAO,KAAI,OAAO,IAAI,cAAc,CAAC;gBACrE,kFAAkF;gBAClF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,UAAU,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC;gBAC/G,CAAC;gBACD,MAAM,IAAI,8BAAqB,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAgB,EAAE,KAAa,EAAE,QAAiB;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;YACrD,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;SAC3D,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACzD,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;YAC7B,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;YACxB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,EAAE;SACnC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEnB,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,OAAgB;;QAC7C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAA,MAAA,OAAO,CAAC,OAAO,CAAC,aAAa,0CAAE,KAAK,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC;QAEtE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AA3HY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;qCAKM,4BAAY;QACR,gBAAS;QACZ,0BAAa;QACX,kCAAe;GAPxB,SAAS,CA2HrB"}

package/dist/mcp/decorators/allow-mcp-token.decorator.d.ts

@@ -0,0 +1,3 @@
+export declare const ALLOW_MCP_TOKEN = "allowMcpToken";
+export declare function AllowMcpToken(): import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=allow-mcp-token.decorator.d.ts.map

package/dist/mcp/decorators/allow-mcp-token.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-mcp-token.decorator.d.ts","sourceRoot":"","sources":["../../../src/mcp/decorators/allow-mcp-token.decorator.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,wBAAgB,aAAa,qDAE5B"}

package/dist/mcp/decorators/allow-mcp-token.decorator.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALLOW_MCP_TOKEN = void 0;
+exports.AllowMcpToken = AllowMcpToken;
+const common_1 = require("@nestjs/common");
+exports.ALLOW_MCP_TOKEN = 'allowMcpToken';
+function AllowMcpToken() {
+    return (0, common_1.SetMetadata)(exports.ALLOW_MCP_TOKEN, true);
+}
+//# sourceMappingURL=allow-mcp-token.decorator.js.map

package/dist/mcp/decorators/allow-mcp-token.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-mcp-token.decorator.js","sourceRoot":"","sources":["../../../src/mcp/decorators/allow-mcp-token.decorator.ts"],"names":[],"mappings":";;;AAIA,sCAEC;AAND,2CAA6C;AAEhC,QAAA,eAAe,GAAG,eAAe,CAAC;AAE/C,SAAgB,aAAa;IAC3B,OAAO,IAAA,oBAAW,EAAC,uBAAe,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/dist/mcp/mcp.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.controller.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAG5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,qBAGa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc;IAIpC,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAqBvE"}
+{"version":3,"file":"mcp.controller.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,qBAIa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc;IAIpC,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAqBvE"}

package/dist/mcp/mcp.controller.js

@@ -16,6 +16,7 @@ exports.McpController = void 0;
 const api_1 = require("@hed-hog/api");
 const common_1 = require("@nestjs/common");
 const setting_service_1 = require("../setting/setting.service");
+const allow_mcp_token_decorator_1 = require("./decorators/allow-mcp-token.decorator");
 const mcp_auth_guard_1 = require("./guards/mcp-auth.guard");
 const mcp_permission_guard_1 = require("./guards/mcp-permission.guard");
 const mcp_server_service_1 = require("./mcp-server.service");
@@ -54,6 +55,7 @@ __decorate([
 ], McpController.prototype, "handle", null);
 exports.McpController = McpController = __decorate([
     (0, api_1.NoRole)(),
+    (0, allow_mcp_token_decorator_1.AllowMcpToken)(),
     (0, common_1.UseGuards)(mcp_auth_guard_1.McpAuthGuard, mcp_permission_guard_1.McpPermissionGuard),
     (0, common_1.Controller)('mcp'),
     __metadata("design:paramtypes", [mcp_server_service_1.McpServerService,

package/dist/mcp/mcp.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.controller.js","sourceRoot":"","sources":["../../src/mcp/mcp.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAAsC;AACtC,2CAAsE;AAEtE,gEAA4D;AAC5D,4DAAuD;AACvD,wEAAmE;AACnE,6DAAwD;AAKjD,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YACmB,SAA2B,EAC3B,OAAuB;QADvB,cAAS,GAAT,SAAS,CAAkB;QAC3B,YAAO,GAAP,OAAO,CAAgB;IACvC,CAAC;IAGE,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAY,EAAS,GAAa;;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,aAAa,CAAC,KAAK,KAAK,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAI,GAAW,CAAC,IAAI,CAAC;QAC/B,MAAM,MAAM,GACV,MAAA,MAAA,MAAA,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,mCAAI,IAAI,CAAC;QACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAW,CAAC;QAC7B,MAAM,QAAQ,GACZ,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,MAAK,YAAY,CAAC,CAAC,CAAC,CAAC,MAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,IAAI,mCAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAElE,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE;YAC3C,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACjC,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA5BY,sCAAa;AAOlB;IADL,IAAA,YAAG,GAAE;IACQ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2CAoBvC;wBA3BU,aAAa;IAHzB,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,6BAAY,EAAE,yCAAkB,CAAC;IAC3C,IAAA,mBAAU,EAAC,KAAK,CAAC;qCAGc,qCAAgB;QAClB,gCAAc;GAH/B,aAAa,CA4BzB"}
+{"version":3,"file":"mcp.controller.js","sourceRoot":"","sources":["../../src/mcp/mcp.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAAsC;AACtC,2CAAsE;AAEtE,gEAA4D;AAC5D,sFAAuE;AACvE,4DAAuD;AACvD,wEAAmE;AACnE,6DAAwD;AAMjD,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YACmB,SAA2B,EAC3B,OAAuB;QADvB,cAAS,GAAT,SAAS,CAAkB;QAC3B,YAAO,GAAP,OAAO,CAAgB;IACvC,CAAC;IAGE,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAY,EAAS,GAAa;;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,aAAa,CAAC,KAAK,KAAK,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAI,GAAW,CAAC,IAAI,CAAC;QAC/B,MAAM,MAAM,GACV,MAAA,MAAA,MAAA,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,mCAAI,IAAI,CAAC;QACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAW,CAAC;QAC7B,MAAM,QAAQ,GACZ,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,MAAK,YAAY,CAAC,CAAC,CAAC,CAAC,MAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,IAAI,mCAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAElE,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE;YAC3C,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACjC,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA5BY,sCAAa;AAOlB;IADL,IAAA,YAAG,GAAE;IACQ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2CAoBvC;wBA3BU,aAAa;IAJzB,IAAA,YAAM,GAAE;IACR,IAAA,yCAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAY,EAAE,yCAAkB,CAAC;IAC3C,IAAA,mBAAU,EAAC,KAAK,CAAC;qCAGc,qCAAgB;QAClB,gCAAc;GAH/B,aAAa,CA4BzB"}

package/dist/notification/notification.controller.d.ts

@@ -34,13 +34,13 @@ export declare class NotificationController {
         user_id: number;
         created_at: Date;
         updated_at: Date;
-        type: import("@prisma/client").$Enums.notification_type_934e7a71cc_enum;
+        type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_3a7944cf59_enum;
+        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
-        action_type: import("@prisma/client").$Enums.notification_action_type_f5ed983546_enum | null;
+        action_type: import("@prisma/client").$Enums.notification_action_type_enum | null;
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
@@ -54,13 +54,13 @@ export declare class NotificationController {
         user_id: number;
         created_at: Date;
         updated_at: Date;
-        type: import("@prisma/client").$Enums.notification_type_934e7a71cc_enum;
+        type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_3a7944cf59_enum;
+        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
-        action_type: import("@prisma/client").$Enums.notification_action_type_f5ed983546_enum | null;
+        action_type: import("@prisma/client").$Enums.notification_action_type_enum | null;
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
@@ -77,13 +77,13 @@ export declare class NotificationController {
         user_id: number;
         created_at: Date;
         updated_at: Date;
-        type: import("@prisma/client").$Enums.notification_type_934e7a71cc_enum;
+        type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_3a7944cf59_enum;
+        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
-        action_type: import("@prisma/client").$Enums.notification_action_type_f5ed983546_enum | null;
+        action_type: import("@prisma/client").$Enums.notification_action_type_enum | null;
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
@@ -95,13 +95,13 @@ export declare class NotificationController {
         user_id: number;
         created_at: Date;
         updated_at: Date;
-        type: import("@prisma/client").$Enums.notification_type_934e7a71cc_enum;
+        type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_3a7944cf59_enum;
+        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
-        action_type: import("@prisma/client").$Enums.notification_action_type_f5ed983546_enum | null;
+        action_type: import("@prisma/client").$Enums.notification_action_type_enum | null;
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;

package/dist/notification/notification.service.d.ts

@@ -36,13 +36,13 @@ export declare class NotificationService implements OnModuleInit, OnModuleDestro
         user_id: number;
         created_at: Date;
         updated_at: Date;
-        type: import("@prisma/client").$Enums.notification_type_934e7a71cc_enum;
+        type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_3a7944cf59_enum;
+        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
-        action_type: import("@prisma/client").$Enums.notification_action_type_f5ed983546_enum | null;
+        action_type: import("@prisma/client").$Enums.notification_action_type_enum | null;
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
@@ -55,13 +55,13 @@ export declare class NotificationService implements OnModuleInit, OnModuleDestro
         user_id: number;
         created_at: Date;
         updated_at: Date;
-        type: import("@prisma/client").$Enums.notification_type_934e7a71cc_enum;
+        type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_3a7944cf59_enum;
+        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
-        action_type: import("@prisma/client").$Enums.notification_action_type_f5ed983546_enum | null;
+        action_type: import("@prisma/client").$Enums.notification_action_type_enum | null;
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
@@ -74,13 +74,13 @@ export declare class NotificationService implements OnModuleInit, OnModuleDestro
         user_id: number;
         created_at: Date;
         updated_at: Date;
-        type: import("@prisma/client").$Enums.notification_type_934e7a71cc_enum;
+        type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_3a7944cf59_enum;
+        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
-        action_type: import("@prisma/client").$Enums.notification_action_type_f5ed983546_enum | null;
+        action_type: import("@prisma/client").$Enums.notification_action_type_enum | null;
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
@@ -92,13 +92,13 @@ export declare class NotificationService implements OnModuleInit, OnModuleDestro
         user_id: number;
         created_at: Date;
         updated_at: Date;
-        type: import("@prisma/client").$Enums.notification_type_934e7a71cc_enum;
+        type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_3a7944cf59_enum;
+        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
-        action_type: import("@prisma/client").$Enums.notification_action_type_f5ed983546_enum | null;
+        action_type: import("@prisma/client").$Enums.notification_action_type_enum | null;
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;

package/dist/session/session.controller.d.ts

@@ -36,10 +36,10 @@ export declare class SessionController {
         created_at: Date;
         updated_at: Date;
         hash: string;
-        browser_id: string | null;
         ip_address: string;
         revoked_at: Date | null;
         expires_at: Date;
+        browser_id: string | null;
     }>;
 }
 //# sourceMappingURL=session.controller.d.ts.map

package/dist/session/session.service.d.ts

@@ -24,10 +24,10 @@ export declare class SessionService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         };
     }>;
     refresh(locale: string, refreshToken: string, ipAddress: string, userAgent: string, browserId?: string | null): Promise<{
@@ -39,10 +39,10 @@ export declare class SessionService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         };
     }>;
     deleteRefreshTokenCookie(res: any, refreshToken: string): Promise<{
@@ -74,10 +74,10 @@ export declare class SessionService {
         created_at: Date;
         updated_at: Date;
         hash: string;
-        browser_id: string | null;
         ip_address: string;
         revoked_at: Date | null;
         expires_at: Date;
+        browser_id: string | null;
     }>;
     /**
      * Enforce maximum concurrent sessions limit for a user.

package/dist/user/user.controller.d.ts

@@ -83,10 +83,10 @@ export declare class UserController {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         }[];
     } & {
         id: number;

package/dist/user/user.service.d.ts

@@ -108,10 +108,10 @@ export declare class UserService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         }[];
     } & {
         id: number;
@@ -223,10 +223,10 @@ export declare class UserService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         }[];
     } & {
         id: number;
@@ -268,10 +268,10 @@ export declare class UserService {
             created_at: Date;
             updated_at: Date;
             hash: string;
-            browser_id: string | null;
             ip_address: string;
             revoked_at: Date | null;
             expires_at: Date;
+            browser_id: string | null;
         }[];
     } & {
         id: number;

package/hedhog/frontend/app/roles/page.tsx.ejs

@@ -6,7 +6,6 @@ import {
   PageHeader,
   PaginationFooter,
   SearchBar,
-  StatsCards,
 } from '@/components/entity-list';
 import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert';
 import {
@@ -36,6 +35,7 @@ import {
   FormMessage,
 } from '@/components/ui/form';
 import { Input } from '@/components/ui/input';
+import { KpiCardsGrid, type KpiCardItem } from '@/components/ui/kpi-cards-grid';
 import {
   Select,
   SelectContent,
@@ -594,17 +594,18 @@ export default function RolePage() {
         description={t('description')}
       />
 
-      <StatsCards
-        className="sm:grid-cols-1 md:grid-cols-1 lg:grid-cols-1"
-        stats={[
-          {
-            title: t('totalRoles'),
-            value: String(stats.totalRoles),
-            icon: <ShieldCheck className="h-5 w-5" />,
-            iconBgColor: 'bg-purple-50',
-            iconColor: 'text-purple-600',
-          },
-        ]}
+      <KpiCardsGrid
+        className="grid-cols-1 md:grid-cols-1 xl:grid-cols-1"
+        items={
+          [
+            {
+              key: 'totalRoles',
+              title: t('totalRoles'),
+              value: stats.totalRoles,
+              icon: ShieldCheck,
+            },
+          ] satisfies KpiCardItem[]
+        }
       />
 
       <SearchBar

package/hedhog/frontend/messages/en.json

@@ -2138,7 +2138,8 @@
     "breadcrumbDashboard": "Dashboard",
     "breadcrumbManagement": "Management",
     "breadcrumbCurrent": "MCP Chat",
-    "mcpDisabled": "MCP Server is disabled. Enable it in Settings → MCP."
+    "mcpDisabled": "MCP Server is disabled. Enable it in Settings → MCP.",
+    "resizePanel": "Resize panel"
   },
   "McpTokens": {
     "title": "MCP API Keys",

package/hedhog/frontend/messages/pt.json

@@ -2193,7 +2193,8 @@
     "breadcrumbDashboard": "Painel",
     "breadcrumbManagement": "Gerenciamento",
     "breadcrumbCurrent": "Chat MCP",
-    "mcpDisabled": "O Servidor MCP está desabilitado. Habilite-o em Configurações → MCP."
+    "mcpDisabled": "O Servidor MCP está desabilitado. Habilite-o em Configurações → MCP.",
+    "resizePanel": "Redimensionar painel"
   },
   "McpTokens": {
     "title": "Chaves de API MCP",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hed-hog/core",
-  "version": "0.0.382",
+  "version": "0.0.385",
   "license": "MIT",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -42,11 +42,11 @@
     "ua-parser-js": "^2.0.10",
     "uuid": "^11.1.0",
     "@hed-hog/api-prisma": "0.0.6",
-    "@hed-hog/api-mail": "0.0.9",
-    "@hed-hog/api": "0.0.8",
+    "@hed-hog/api-locale": "0.0.14",
     "@hed-hog/api-types": "0.0.1",
-    "@hed-hog/api-pagination": "0.0.7",
-    "@hed-hog/api-locale": "0.0.14"
+    "@hed-hog/api": "0.0.8",
+    "@hed-hog/api-mail": "0.0.9",
+    "@hed-hog/api-pagination": "0.0.7"
   },
   "exports": {
     ".": {

package/src/auth/guards/auth.guard.spec.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect, beforeEach, afterEach, jest } from '@jest/globals';
 import { UnauthorizedException } from '@nestjs/common';
 import { IS_PUBLIC_KEY, WITH_NO_ROLE, WITH_ROLE } from '@hed-hog/api';
+import { ALLOW_MCP_TOKEN } from '../../mcp/decorators/allow-mcp-token.decorator';
 import { AuthGuard } from './auth.guard';
 
 const makeContext = (request: any) => ({
@@ -29,12 +30,18 @@ const makeService = (deps = makeDeps()) => ({
 
 const setMeta = (
   reflector: any,
-  meta: { public?: boolean; withRole?: boolean; withNoRole?: boolean },
+  meta: {
+    public?: boolean;
+    withRole?: boolean;
+    withNoRole?: boolean;
+    allowMcpToken?: boolean;
+  },
 ) => {
   reflector.getAllAndOverride.mockImplementation((key: any) => {
     if (key === IS_PUBLIC_KEY) return meta.public;
     if (key === WITH_ROLE) return meta.withRole;
     if (key === WITH_NO_ROLE) return meta.withNoRole;
+    if (key === ALLOW_MCP_TOKEN) return meta.allowMcpToken;
     return undefined;
   });
 };
@@ -174,4 +181,45 @@ describe('AuthGuard', () => {
       );
     });
   });
+
+  describe('mcp token (hedhog_mcp_)', () => {
+    it('defere para o McpAuthGuard quando a rota permite (allowMcpToken)', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, { allowMcpToken: true });
+      const request: any = {
+        headers: { authorization: 'Bearer hedhog_mcp_x' },
+      };
+      await expect(guard.canActivate(makeContext(request) as any)).resolves.toBe(
+        true,
+      );
+      expect(deps.token.verify).not.toHaveBeenCalled();
+      expect(deps.prisma.mcp_api_key.findFirst).not.toHaveBeenCalled();
+      expect(request.auth).toBeUndefined();
+    });
+
+    it('nega em rota sem allowMcpToken, sem tentar validar como JWT', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, {});
+      const request: any = {
+        headers: { authorization: 'Bearer hedhog_mcp_x' },
+        method: 'GET',
+        url: '/profile',
+      };
+      await expect(guard.canActivate(makeContext(request) as any)).rejects.toThrow(
+        UnauthorizedException,
+      );
+      expect(deps.token.verify).not.toHaveBeenCalled();
+    });
+
+    it('permite em rota pública sem allowMcpToken', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, { public: true });
+      const request: any = {
+        headers: { authorization: 'Bearer hedhog_mcp_x' },
+      };
+      await expect(guard.canActivate(makeContext(request) as any)).resolves.toBe(
+        true,
+      );
+    });
+  });
 });

package/src/auth/guards/auth.guard.ts

@@ -10,6 +10,7 @@ import {
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { Request } from 'express';
+import { ALLOW_MCP_TOKEN } from '../../mcp/decorators/allow-mcp-token.decorator';
 import { SecurityService } from '../../security/security.service';
 import { TokenService } from '../../token/token.service';
 
@@ -40,6 +41,11 @@ export class AuthGuard implements CanActivate {
       context.getClass(),
     ]);
 
+    const allowMcpToken = this.reflector.getAllAndOverride<boolean>(ALLOW_MCP_TOKEN, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
     const request = context.switchToHttp().getRequest();
     const token = this.extractTokenFromHeader(request);
     const locale = request.headers['locale'] || request.headers['accept-language'] || 'en';
@@ -48,6 +54,15 @@ export class AuthGuard implements CanActivate {
       return this.verifyApiKey(request, token, isPublic);
     }
 
+    if (token?.startsWith('hedhog_mcp_')) {
+      if (allowMcpToken) {
+        // Real validation (mcp_api_key lookup) happens in McpAuthGuard on /mcp.
+        return true;
+      }
+      if (isPublic) return true;
+      throw new UnauthorizedException('Invalid API key');
+    }
+
     // If endpoint requires role/authentication and no token provided
     if (!token) {
       if (isPublic) {

package/src/mcp/decorators/allow-mcp-token.decorator.ts

@@ -0,0 +1,7 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const ALLOW_MCP_TOKEN = 'allowMcpToken';
+
+export function AllowMcpToken() {
+  return SetMetadata(ALLOW_MCP_TOKEN, true);
+}

package/src/mcp/mcp.controller.ts

@@ -2,11 +2,13 @@ import { NoRole } from '@hed-hog/api';
 import { All, Controller, Req, Res, UseGuards } from '@nestjs/common';
 import { Request, Response } from 'express';
 import { SettingService } from '../setting/setting.service';
+import { AllowMcpToken } from './decorators/allow-mcp-token.decorator';
 import { McpAuthGuard } from './guards/mcp-auth.guard';
 import { McpPermissionGuard } from './guards/mcp-permission.guard';
 import { McpServerService } from './mcp-server.service';
 
 @NoRole()
+@AllowMcpToken()
 @UseGuards(McpAuthGuard, McpPermissionGuard)
 @Controller('mcp')
 export class McpController {