@hexabot-ai/api 3.2.2-alpha.1 → 3.2.2-alpha.10

package/dist/mcp/guards/hexabot-mcp-token.guard.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HexabotMcpTokenGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const mcp_token_service_1 = require("../services/mcp-token.service");
+let HexabotMcpTokenGuard = class HexabotMcpTokenGuard {
+    constructor(moduleRef) {
+        this.moduleRef = moduleRef;
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const token = this.extractTokenFromHeader(request);
+        if (!token) {
+            throw new common_1.UnauthorizedException('MCP bearer token is required');
+        }
+        const { user, tokenId } = await this.getMcpTokenService().authenticateBearerToken(token);
+        request.hexabotUser = user;
+        request.user = user;
+        request.mcpTokenId = tokenId;
+        return true;
+    }
+    extractTokenFromHeader(request) {
+        const authHeader = request.headers.authorization;
+        if (!authHeader) {
+            return undefined;
+        }
+        const [type, token] = authHeader.split(' ');
+        return type === 'Bearer' ? token : undefined;
+    }
+    getMcpTokenService() {
+        return this.moduleRef.get(mcp_token_service_1.McpTokenService, { strict: false });
+    }
+};
+exports.HexabotMcpTokenGuard = HexabotMcpTokenGuard;
+exports.HexabotMcpTokenGuard = HexabotMcpTokenGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.ModuleRef])
+], HexabotMcpTokenGuard);
+//# sourceMappingURL=hexabot-mcp-token.guard.js.map

package/dist/mcp/guards/hexabot-mcp-token.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hexabot-mcp-token.guard.js","sourceRoot":"","sources":["../../../src/mcp/guards/hexabot-mcp-token.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAMA,2CAKwB;AACxB,uCAAyC;AAGzC,qEAAgE;AAIzD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAqB,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GACrB,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAEjE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;QAC3B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;QAE7B,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,OAAgB;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE5C,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IAEO,kBAAkB;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,mCAAe,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;CACF,CAAA;AAnCY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAE6B,gBAAS;GADtC,oBAAoB,CAmChC"}

package/dist/mcp/guards/mcp-permission.guard.d.ts

@@ -0,0 +1,9 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { PermissionService } from "../../user/services/permission.service";
+export declare class McpPermissionGuard implements CanActivate {
+    private readonly reflector;
+    private readonly permissionService;
+    constructor(reflector: Reflector, permissionService: PermissionService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/mcp/guards/mcp-permission.guard.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpPermissionGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const mcp_permission_decorator_1 = require("../decorators/mcp-permission.decorator");
+const permission_service_1 = require("../../user/services/permission.service");
+let McpPermissionGuard = class McpPermissionGuard {
+    constructor(reflector, permissionService) {
+        this.reflector = reflector;
+        this.permissionService = permissionService;
+    }
+    async canActivate(context) {
+        const permission = this.reflector.getAllAndOverride(mcp_permission_decorator_1.MCP_PERMISSION_METADATA_KEY, [context.getHandler(), context.getClass()]);
+        if (!permission) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const user = request.hexabotUser ?? request.user;
+        const roleIds = Array.isArray(user?.roles) ? user.roles : [];
+        if (roleIds.length === 0) {
+            throw new common_1.ForbiddenException('MCP tool requires a Hexabot role');
+        }
+        const permissions = await this.permissionService.getPermissions();
+        const hasPermission = roleIds.some((roleId) => permissions[roleId]?.[permission.model]?.includes(permission.action));
+        if (!hasPermission) {
+            throw new common_1.ForbiddenException(`MCP tool requires ${permission.action} permission on ${permission.model}`);
+        }
+        return true;
+    }
+};
+exports.McpPermissionGuard = McpPermissionGuard;
+exports.McpPermissionGuard = McpPermissionGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        permission_service_1.PermissionService])
+], McpPermissionGuard);
+//# sourceMappingURL=mcp-permission.guard.js.map

package/dist/mcp/guards/mcp-permission.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-permission.guard.js","sourceRoot":"","sources":["../../../src/mcp/guards/mcp-permission.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAMA,2CAKwB;AACxB,uCAAyC;AAEzC,qFAGmD;AACnD,+EAAuE;AAKhE,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,YACmB,SAAoB,EACpB,iBAAoC;QADpC,cAAS,GAAT,SAAS,CAAW;QACpB,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACjD,sDAA2B,EAC3B,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAqB,CAAC;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,2BAAkB,CAAC,kCAAkC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC;QAClE,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CACrE,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,2BAAkB,CAC1B,qBAAqB,UAAU,CAAC,MAAM,kBAAkB,UAAU,CAAC,KAAK,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AArCY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAGmB,gBAAS;QACD,sCAAiB;GAH5C,kBAAkB,CAqC9B"}

package/dist/mcp/mcp-api.module.d.ts

@@ -0,0 +1,2 @@
+export declare class McpApiModule {
+}

package/dist/mcp/mcp-api.module.js

@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpApiModule = void 0;
+const crypto_1 = require("crypto");
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const mcp_nest_1 = require("@rekog/mcp-nest");
+const actions_module_1 = require("../actions/actions.module");
+const bindings_module_1 = require("../bindings/bindings.module");
+const cms_module_1 = require("../cms/cms.module");
+const config_1 = require("../config");
+const user_module_1 = require("../user/user.module");
+const workflow_module_1 = require("../workflow/workflow.module");
+const mcp_token_controller_1 = require("./controllers/mcp-token.controller");
+const mcp_token_entity_1 = require("./entities/mcp-token.entity");
+const hexabot_mcp_token_guard_1 = require("./guards/hexabot-mcp-token.guard");
+const mcp_permission_guard_1 = require("./guards/mcp-permission.guard");
+const mcp_token_repository_1 = require("./repositories/mcp-token.repository");
+const mcp_token_service_1 = require("./services/mcp-token.service");
+const hexabot_mcp_tools_1 = require("./tools/hexabot-mcp.tools");
+let McpApiModule = class McpApiModule {
+};
+exports.McpApiModule = McpApiModule;
+exports.McpApiModule = McpApiModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            typeorm_1.TypeOrmModule.forFeature([mcp_token_entity_1.McpTokenOrmEntity]),
+            mcp_nest_1.McpModule.forRoot({
+                name: config_1.config.mcp.serverName,
+                title: config_1.config.mcp.serverTitle,
+                version: config_1.config.mcp.serverVersion,
+                description: config_1.config.mcp.serverDescription,
+                instructions: config_1.config.mcp.serverInstructions,
+                transport: mcp_nest_1.McpTransportType.STREAMABLE_HTTP,
+                mcpEndpoint: 'mcp',
+                guards: [hexabot_mcp_token_guard_1.HexabotMcpTokenGuard],
+                streamableHttp: {
+                    enableJsonResponse: false,
+                    sessionIdGenerator: () => (0, crypto_1.randomUUID)(),
+                    statelessMode: false,
+                },
+            }),
+            actions_module_1.ActionsModule,
+            bindings_module_1.BindingsModule,
+            cms_module_1.CmsModule,
+            user_module_1.UserModule,
+            workflow_module_1.WorkflowModule,
+        ],
+        providers: [
+            hexabot_mcp_token_guard_1.HexabotMcpTokenGuard,
+            mcp_permission_guard_1.McpPermissionGuard,
+            mcp_token_repository_1.McpTokenRepository,
+            mcp_token_service_1.McpTokenService,
+            hexabot_mcp_tools_1.HexabotMcpTools,
+        ],
+        controllers: [mcp_token_controller_1.McpTokenController],
+    })
+], McpApiModule);
+//# sourceMappingURL=mcp-api.module.js.map

package/dist/mcp/mcp-api.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-api.module.js","sourceRoot":"","sources":["../../src/mcp/mcp-api.module.ts"],"names":[],"mappings":";;;;;;;;;AAMA,mCAAoC;AAEpC,2CAAwC;AACxC,6CAAgD;AAChD,8CAA8D;AAE9D,8DAAyD;AACzD,iEAA4D;AAC5D,kDAA6C;AAC7C,sCAAkC;AAClC,qDAAgD;AAChD,iEAA4D;AAE5D,6EAAwE;AACxE,kEAAgE;AAChE,8EAAwE;AACxE,wEAAmE;AACnE,8EAAyE;AACzE,oEAA+D;AAC/D,iEAA4D;AAmCrD,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IAjCxB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,uBAAa,CAAC,UAAU,CAAC,CAAC,oCAAiB,CAAC,CAAC;YAC7C,oBAAS,CAAC,OAAO,CAAC;gBAChB,IAAI,EAAE,eAAM,CAAC,GAAG,CAAC,UAAU;gBAC3B,KAAK,EAAE,eAAM,CAAC,GAAG,CAAC,WAAW;gBAC7B,OAAO,EAAE,eAAM,CAAC,GAAG,CAAC,aAAa;gBACjC,WAAW,EAAE,eAAM,CAAC,GAAG,CAAC,iBAAiB;gBACzC,YAAY,EAAE,eAAM,CAAC,GAAG,CAAC,kBAAkB;gBAC3C,SAAS,EAAE,2BAAgB,CAAC,eAAe;gBAC3C,WAAW,EAAE,KAAK;gBAClB,MAAM,EAAE,CAAC,8CAAoB,CAAC;gBAC9B,cAAc,EAAE;oBACd,kBAAkB,EAAE,KAAK;oBACzB,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAA,mBAAU,GAAE;oBACtC,aAAa,EAAE,KAAK;iBACrB;aACF,CAAC;YACF,8BAAa;YACb,gCAAc;YACd,sBAAS;YACT,wBAAU;YACV,gCAAc;SACf;QACD,SAAS,EAAE;YACT,8CAAoB;YACpB,yCAAkB;YAClB,yCAAkB;YAClB,mCAAe;YACf,mCAAe;SAChB;QACD,WAAW,EAAE,CAAC,yCAAkB,CAAC;KAClC,CAAC;GACW,YAAY,CAAG"}

package/dist/mcp/repositories/mcp-token.repository.d.ts

@@ -0,0 +1,8 @@
+import { Repository } from 'typeorm';
+import { BaseOrmRepository } from "../../utils/generics/base-orm.repository";
+import { McpTokenOrmEntity } from '../entities/mcp-token.entity';
+export declare class McpTokenRepository extends BaseOrmRepository<McpTokenOrmEntity> {
+    constructor(repository: Repository<McpTokenOrmEntity>);
+    findOneByHash(tokenHash: string): Promise<McpTokenOrmEntity | null>;
+    touchLastUsedAt(id: string, lastUsedAt?: Date): Promise<void>;
+}

package/dist/mcp/repositories/mcp-token.repository.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpTokenRepository = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const base_orm_repository_1 = require("../../utils/generics/base-orm.repository");
+const mcp_token_entity_1 = require("../entities/mcp-token.entity");
+let McpTokenRepository = class McpTokenRepository extends base_orm_repository_1.BaseOrmRepository {
+    constructor(repository) {
+        super(repository, ['owner']);
+    }
+    async findOneByHash(tokenHash) {
+        return await this.repository.findOne({
+            where: { tokenHash },
+            relations: ['owner', 'owner.roles'],
+        });
+    }
+    async touchLastUsedAt(id, lastUsedAt = new Date()) {
+        await this.repository.update(id, { lastUsedAt });
+    }
+};
+exports.McpTokenRepository = McpTokenRepository;
+exports.McpTokenRepository = McpTokenRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(mcp_token_entity_1.McpTokenOrmEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository])
+], McpTokenRepository);
+//# sourceMappingURL=mcp-token.repository.js.map

package/dist/mcp/repositories/mcp-token.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-token.repository.js","sourceRoot":"","sources":["../../../src/mcp/repositories/mcp-token.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAMA,2CAA4C;AAC5C,6CAAmD;AACnD,qCAAqC;AAErC,kFAAyE;AAEzE,mEAAiE;AAG1D,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,uCAAoC;IAC1E,YAEE,UAAyC;QAEzC,KAAK,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACnC,KAAK,EAAE,EAAE,SAAS,EAAE;YACpB,SAAS,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU,EAAE,UAAU,GAAG,IAAI,IAAI,EAAE;QACvD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAlBY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,0BAAgB,EAAC,oCAAiB,CAAC,CAAA;qCACxB,oBAAU;GAHb,kBAAkB,CAkB9B"}

package/dist/mcp/services/mcp-token.service.d.ts

@@ -0,0 +1,24 @@
+import type { McpToken, User } from '@hexabot-ai/types';
+import { BaseOrmService } from "../../utils/generics/base-orm.service";
+import { McpTokenCreateDto } from '../dto/mcp-token.dto';
+import { McpTokenOrmEntity } from '../entities/mcp-token.entity';
+import { McpTokenRepository } from '../repositories/mcp-token.repository';
+export declare const MCP_PERSONAL_TOKEN_PREFIX = "hbt_mcp_";
+export declare class McpTokenService extends BaseOrmService<McpTokenOrmEntity> {
+    readonly repository: McpTokenRepository;
+    constructor(repository: McpTokenRepository);
+    createPersonalToken(ownerId: string, dto: McpTokenCreateDto): Promise<{
+        token: string;
+        record: McpToken;
+    }>;
+    findOwnedTokens(ownerId: string): Promise<McpToken[]>;
+    revokeOwnedToken(ownerId: string, id: string): Promise<McpToken>;
+    authenticateBearerToken(token: string): Promise<{
+        user: User;
+        tokenId: string;
+    }>;
+    private generateToken;
+    private hashToken;
+    private getTokenPrefix;
+    private parseOptionalExpiry;
+}

package/dist/mcp/services/mcp-token.service.js

@@ -0,0 +1,106 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpTokenService = exports.MCP_PERSONAL_TOKEN_PREFIX = void 0;
+const crypto_1 = require("crypto");
+const common_1 = require("@nestjs/common");
+const base_orm_service_1 = require("../../utils/generics/base-orm.service");
+const mcp_token_repository_1 = require("../repositories/mcp-token.repository");
+exports.MCP_PERSONAL_TOKEN_PREFIX = 'hbt_mcp_';
+let McpTokenService = class McpTokenService extends base_orm_service_1.BaseOrmService {
+    constructor(repository) {
+        super(repository);
+        this.repository = repository;
+    }
+    async createPersonalToken(ownerId, dto) {
+        const token = this.generateToken();
+        const expiresAt = this.parseOptionalExpiry(dto.expiresAt);
+        const record = await this.repository.create({
+            name: dto.name,
+            owner: ownerId,
+            tokenHash: this.hashToken(token),
+            tokenPrefix: this.getTokenPrefix(token),
+            expiresAt,
+            lastUsedAt: null,
+            revokedAt: null,
+        });
+        return { token, record };
+    }
+    async findOwnedTokens(ownerId) {
+        return await this.repository.find({
+            where: { owner: { id: ownerId } },
+            order: { createdAt: 'DESC' },
+        });
+    }
+    async revokeOwnedToken(ownerId, id) {
+        const token = await this.repository.findOne({
+            where: { id, owner: { id: ownerId } },
+        });
+        if (!token) {
+            throw new common_1.NotFoundException(`MCP token ${id} not found`);
+        }
+        return await this.repository.updateOne({
+            where: { id, owner: { id: ownerId } },
+        }, { revokedAt: new Date() });
+    }
+    async authenticateBearerToken(token) {
+        if (!token.startsWith(exports.MCP_PERSONAL_TOKEN_PREFIX)) {
+            throw new common_1.UnauthorizedException('Invalid MCP token');
+        }
+        const record = await this.repository.findOneByHash(this.hashToken(token));
+        if (!record) {
+            throw new common_1.UnauthorizedException('Invalid MCP token');
+        }
+        if (record.revokedAt) {
+            throw new common_1.UnauthorizedException('MCP token has been revoked');
+        }
+        if (record.expiresAt && record.expiresAt <= new Date()) {
+            throw new common_1.UnauthorizedException('MCP token has expired');
+        }
+        const owner = record.owner;
+        if (!owner?.state) {
+            throw new common_1.UnauthorizedException('MCP token owner is inactive');
+        }
+        await this.repository.touchLastUsedAt(record.id);
+        return {
+            user: owner.toPlainCls(),
+            tokenId: record.id,
+        };
+    }
+    generateToken() {
+        return `${exports.MCP_PERSONAL_TOKEN_PREFIX}${(0, crypto_1.randomBytes)(32).toString('base64url')}`;
+    }
+    hashToken(token) {
+        return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+    }
+    getTokenPrefix(token) {
+        return token.slice(0, exports.MCP_PERSONAL_TOKEN_PREFIX.length + 8);
+    }
+    parseOptionalExpiry(value) {
+        if (!value) {
+            return null;
+        }
+        const expiresAt = new Date(value);
+        if (Number.isNaN(expiresAt.getTime())) {
+            throw new common_1.BadRequestException('Invalid MCP token expiry date');
+        }
+        if (expiresAt <= new Date()) {
+            throw new common_1.BadRequestException('MCP token expiry must be in the future');
+        }
+        return expiresAt;
+    }
+};
+exports.McpTokenService = McpTokenService;
+exports.McpTokenService = McpTokenService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [mcp_token_repository_1.McpTokenRepository])
+], McpTokenService);
+//# sourceMappingURL=mcp-token.service.js.map

package/dist/mcp/services/mcp-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-token.service.js","sourceRoot":"","sources":["../../../src/mcp/services/mcp-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAMA,mCAAiD;AAGjD,2CAKwB;AAIxB,4EAAmE;AAInE,+EAA0E;AAE7D,QAAA,yBAAyB,GAAG,UAAU,CAAC;AAG7C,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,iCAAiC;IACpE,YAAqB,UAA8B;QACjD,KAAK,CAAC,UAAU,CAAC,CAAC;QADC,eAAU,GAAV,UAAU,CAAoB;IAEnD,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,OAAe,EACf,GAAsB;QAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1C,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAChC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YACvC,SAAS;YACT,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SACT,CAAC,CAAC;QAEV,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAChC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;YACjC,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SACS,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,EAAU;QAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAC1C,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;SAC/B,CAAC,CAAC;QAEV,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,0BAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CACpC;YACE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;SAC/B,EACR,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAS,CACjC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,KAAa;QAEb,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,iCAAyB,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAE1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACvD,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAkC,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEjD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,UAAU,EAAU;YAChC,OAAO,EAAE,MAAM,CAAC,EAAE;SACnB,CAAC;IACJ,CAAC;IAEO,aAAa;QACnB,OAAO,GAAG,iCAAyB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAChF,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,cAAc,CAAC,KAAa;QAClC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAyB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAEO,mBAAmB,CAAC,KAAqB;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AA9GY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAEsB,yCAAkB;GADxC,eAAe,CA8G3B"}