@hexabot-ai/api 3.2.2-alpha.1 → 3.2.2-alpha.11

package/dist/mcp/controllers/mcp-token.controller.d.ts

@@ -0,0 +1,47 @@
+import { Request } from 'express';
+import { McpTokenCreateDto } from '../dto/mcp-token.dto';
+import { McpTokenService } from '../services/mcp-token.service';
+type AuthenticatedRequest = Request & {
+    user?: {
+        id?: string;
+    };
+    session?: Request['session'] & {
+        passport?: {
+            user?: {
+                id?: string;
+            };
+        };
+    };
+};
+export declare class McpTokenController {
+    private readonly mcpTokenService;
+    constructor(mcpTokenService: McpTokenService);
+    list(req: AuthenticatedRequest): Promise<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        name: string;
+        tokenPrefix: string;
+        expiresAt: Date | null;
+        lastUsedAt: Date | null;
+        revokedAt: Date | null;
+        owner: string;
+    }[]>;
+    create(dto: McpTokenCreateDto, req: AuthenticatedRequest): Promise<{
+        token: string;
+        record: import("@hexabot-ai/types").McpToken;
+    }>;
+    revoke(id: string, req: AuthenticatedRequest): Promise<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        name: string;
+        tokenPrefix: string;
+        expiresAt: Date | null;
+        lastUsedAt: Date | null;
+        revokedAt: Date | null;
+        owner: string;
+    }>;
+    private getUserId;
+}
+export {};

package/dist/mcp/controllers/mcp-token.controller.js

@@ -0,0 +1,70 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpTokenController = void 0;
+const common_1 = require("@nestjs/common");
+const utils_1 = require("../../utils");
+const mcp_token_dto_1 = require("../dto/mcp-token.dto");
+const mcp_token_service_1 = require("../services/mcp-token.service");
+let McpTokenController = class McpTokenController {
+    constructor(mcpTokenService) {
+        this.mcpTokenService = mcpTokenService;
+    }
+    async list(req) {
+        return await this.mcpTokenService.findOwnedTokens(this.getUserId(req));
+    }
+    async create(dto, req) {
+        return await this.mcpTokenService.createPersonalToken(this.getUserId(req), dto);
+    }
+    async revoke(id, req) {
+        return await this.mcpTokenService.revokeOwnedToken(this.getUserId(req), id);
+    }
+    getUserId(req) {
+        const userId = req.user?.id ?? req.session?.passport?.user?.id;
+        if (!userId) {
+            throw new common_1.UnauthorizedException('Authenticated user is required');
+        }
+        return userId;
+    }
+};
+exports.McpTokenController = McpTokenController;
+__decorate([
+    (0, common_1.Get)(),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], McpTokenController.prototype, "list", null);
+__decorate([
+    (0, common_1.Post)(),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [mcp_token_dto_1.McpTokenCreateDto, Object]),
+    __metadata("design:returntype", Promise)
+], McpTokenController.prototype, "create", null);
+__decorate([
+    (0, common_1.Post)(':id/revoke'),
+    (0, common_1.HttpCode)(200),
+    __param(0, (0, utils_1.UuidParam)('id')),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], McpTokenController.prototype, "revoke", null);
+exports.McpTokenController = McpTokenController = __decorate([
+    (0, common_1.Controller)('mcp-token'),
+    __metadata("design:paramtypes", [mcp_token_service_1.McpTokenService])
+], McpTokenController);
+//# sourceMappingURL=mcp-token.controller.js.map

package/dist/mcp/controllers/mcp-token.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-token.controller.js","sourceRoot":"","sources":["../../../src/mcp/controllers/mcp-token.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAMA,2CAQwB;AAGxB,uCAAoC;AAEpC,wDAAyD;AACzD,qEAAgE;AAUzD,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,YAA6B,eAAgC;QAAhC,oBAAe,GAAf,eAAe,CAAiB;IAAG,CAAC;IAG3D,AAAN,KAAK,CAAC,IAAI,CAAQ,GAAyB;QACzC,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CACF,GAAsB,EACvB,GAAyB;QAEhC,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CACnD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EACnB,GAAG,CACJ,CAAC;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,MAAM,CAAkB,EAAU,EAAS,GAAyB;QACxE,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAEO,SAAS,CAAC,GAAyB;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAjCY,gDAAkB;AAIvB;IADL,IAAA,YAAG,GAAE;IACM,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8CAEhB;AAGK;IADL,IAAA,aAAI,GAAE;IAEJ,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,iCAAiB;;gDAO/B;AAIK;IAFL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,iBAAQ,EAAC,GAAG,CAAC;IACA,WAAA,IAAA,iBAAS,EAAC,IAAI,CAAC,CAAA;IAAc,WAAA,IAAA,YAAG,GAAE,CAAA;;;;gDAE/C;6BAvBU,kBAAkB;IAD9B,IAAA,mBAAU,EAAC,WAAW,CAAC;qCAEwB,mCAAe;GADlD,kBAAkB,CAiC9B"}

package/dist/mcp/decorators/mcp-permission.decorator.d.ts

@@ -0,0 +1,8 @@
+import { Action } from "../../user/types/action.type";
+import { TModel } from "../../user/types/model.type";
+export declare const MCP_PERMISSION_METADATA_KEY = "mcp:hexabot-permission";
+export type McpPermissionMetadata = {
+    model: TModel;
+    action: Action;
+};
+export declare const McpPermission: (model: TModel, action: Action) => MethodDecorator;

package/dist/mcp/decorators/mcp-permission.decorator.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpPermission = exports.MCP_PERMISSION_METADATA_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.MCP_PERMISSION_METADATA_KEY = 'mcp:hexabot-permission';
+const McpPermission = (model, action) => (0, common_1.SetMetadata)(exports.MCP_PERMISSION_METADATA_KEY, {
+    model,
+    action,
+});
+exports.McpPermission = McpPermission;
+//# sourceMappingURL=mcp-permission.decorator.js.map

package/dist/mcp/decorators/mcp-permission.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-permission.decorator.js","sourceRoot":"","sources":["../../../src/mcp/decorators/mcp-permission.decorator.ts"],"names":[],"mappings":";;;AAMA,2CAA6C;AAKhC,QAAA,2BAA2B,GAAG,wBAAwB,CAAC;AAO7D,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,MAAc,EAAmB,EAAE,CAC9E,IAAA,oBAAW,EAAC,mCAA2B,EAAE;IACvC,KAAK;IACL,MAAM;CACyB,CAAC,CAAC;AAJxB,QAAA,aAAa,iBAIW"}

package/dist/mcp/dto/mcp-token.dto.d.ts

@@ -0,0 +1,17 @@
+import { mcpTokenFullSchema, mcpTokenSchema } from '@hexabot-ai/types';
+import { TDto } from "../../utils/types/dto.types";
+export declare class McpTokenCreateDto {
+    name: string;
+    expiresAt?: string | null;
+}
+declare const McpTokenUpdateDto_base: import("@nestjs/common").Type<Partial<McpTokenCreateDto>>;
+export declare class McpTokenUpdateDto extends McpTokenUpdateDto_base {
+}
+export type McpTokenDto = TDto<{
+    plain: typeof mcpTokenSchema;
+    full: typeof mcpTokenFullSchema;
+}, {
+    create: McpTokenCreateDto;
+    update: McpTokenUpdateDto;
+}>;
+export {};

package/dist/mcp/dto/mcp-token.dto.js

@@ -0,0 +1,40 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpTokenUpdateDto = exports.McpTokenCreateDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class McpTokenCreateDto {
+}
+exports.McpTokenCreateDto = McpTokenCreateDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Human-readable MCP token name',
+        type: String,
+    }),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], McpTokenCreateDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Optional token expiry date',
+        type: String,
+        format: 'date-time',
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsDateString)(),
+    __metadata("design:type", Object)
+], McpTokenCreateDto.prototype, "expiresAt", void 0);
+class McpTokenUpdateDto extends (0, swagger_1.PartialType)(McpTokenCreateDto) {
+}
+exports.McpTokenUpdateDto = McpTokenUpdateDto;
+//# sourceMappingURL=mcp-token.dto.js.map

package/dist/mcp/dto/mcp-token.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-token.dto.js","sourceRoot":"","sources":["../../../src/mcp/dto/mcp-token.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAOA,6CAAgF;AAChF,qDAKyB;AAIzB,MAAa,iBAAiB;CAiB7B;AAjBD,8CAiBC;AAVC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;+CACG;AASd;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,4BAA4B;QACzC,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,WAAW;KACpB,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,8BAAY,GAAE;;oDACW;AAG5B,MAAa,iBAAkB,SAAQ,IAAA,qBAAW,EAAC,iBAAiB,CAAC;CAAG;AAAxE,8CAAwE"}

package/dist/mcp/entities/mcp-token.entity.d.ts

@@ -0,0 +1,111 @@
+import { BaseOrmEntity } from "../../database/entities/base.entity";
+import { UserOrmEntity } from "../../user/entities/user.entity";
+import { McpTokenDto } from '../dto/mcp-token.dto';
+export declare class McpTokenOrmEntity extends BaseOrmEntity<McpTokenDto> {
+    plainCls: import("zod").ZodType<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        name: string;
+        tokenPrefix: string;
+        expiresAt: Date | null;
+        lastUsedAt: Date | null;
+        revokedAt: Date | null;
+        owner: string;
+    }, unknown, import("zod/v4/core").$ZodTypeInternals<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        name: string;
+        tokenPrefix: string;
+        expiresAt: Date | null;
+        lastUsedAt: Date | null;
+        revokedAt: Date | null;
+        owner: string;
+    }, unknown>>;
+    fullCls: import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        createdAt: import("zod").ZodCoercedDate<unknown>;
+        updatedAt: import("zod").ZodCoercedDate<unknown>;
+        name: import("zod").ZodString;
+        tokenPrefix: import("zod").ZodString;
+        expiresAt: import("zod").ZodType<Date | null, unknown, import("zod/v4/core").$ZodTypeInternals<Date | null, unknown>>;
+        lastUsedAt: import("zod").ZodType<Date | null, unknown, import("zod/v4/core").$ZodTypeInternals<Date | null, unknown>>;
+        revokedAt: import("zod").ZodType<Date | null, unknown, import("zod/v4/core").$ZodTypeInternals<Date | null, unknown>>;
+        owner: import("zod").ZodType<{
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            firstName: string;
+            lastName: string;
+            language: string | null;
+            timezone: number;
+            locale: string | null;
+            gender: string | null;
+            country: string | null;
+            foreignId: string | null;
+            assignedAt: Date | null;
+            lastvisit: Date | null;
+            retainedFrom: Date | null;
+            channel: {
+                name: string | null;
+                data?: Record<string, any> | null | undefined;
+            };
+            username: string;
+            email: string;
+            sendEmail: boolean;
+            state: boolean;
+            resetCount: number;
+            resetToken: string | null;
+            labels: string[];
+            assignedTo: string | null;
+            roles: string[];
+            avatar: string | null;
+            provider?: {
+                strategy: "local";
+                sub?: string | undefined;
+            } | undefined;
+        } | null, unknown, import("zod/v4/core").$ZodTypeInternals<{
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            firstName: string;
+            lastName: string;
+            language: string | null;
+            timezone: number;
+            locale: string | null;
+            gender: string | null;
+            country: string | null;
+            foreignId: string | null;
+            assignedAt: Date | null;
+            lastvisit: Date | null;
+            retainedFrom: Date | null;
+            channel: {
+                name: string | null;
+                data?: Record<string, any> | null | undefined;
+            };
+            username: string;
+            email: string;
+            sendEmail: boolean;
+            state: boolean;
+            resetCount: number;
+            resetToken: string | null;
+            labels: string[];
+            assignedTo: string | null;
+            roles: string[];
+            avatar: string | null;
+            provider?: {
+                strategy: "local";
+                sub?: string | undefined;
+            } | undefined;
+        } | null, unknown>>;
+    }, import("zod/v4/core").$strip>;
+    name: string;
+    tokenHash: string;
+    tokenPrefix: string;
+    owner: UserOrmEntity;
+    private readonly ownerId;
+    expiresAt: Date | null;
+    lastUsedAt: Date | null;
+    revokedAt: Date | null;
+}

package/dist/mcp/entities/mcp-token.entity.js

@@ -0,0 +1,69 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpTokenOrmEntity = void 0;
+const types_1 = require("@hexabot-ai/types");
+const typeorm_1 = require("typeorm");
+const database_1 = require("../../database");
+const base_entity_1 = require("../../database/entities/base.entity");
+const user_entity_1 = require("../../user/entities/user.entity");
+const relation_ref_decorator_1 = require("../../utils/decorators/relation-ref.decorator");
+let McpTokenOrmEntity = class McpTokenOrmEntity extends base_entity_1.BaseOrmEntity {
+    constructor() {
+        super(...arguments);
+        this.plainCls = types_1.mcpTokenSchema;
+        this.fullCls = types_1.mcpTokenFullSchema;
+    }
+};
+exports.McpTokenOrmEntity = McpTokenOrmEntity;
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpTokenOrmEntity.prototype, "name", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'token_hash', type: 'text' }),
+    __metadata("design:type", String)
+], McpTokenOrmEntity.prototype, "tokenHash", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'token_prefix', length: 32 }),
+    __metadata("design:type", String)
+], McpTokenOrmEntity.prototype, "tokenPrefix", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => user_entity_1.UserOrmEntity, {
+        nullable: false,
+        onDelete: 'CASCADE',
+    }),
+    (0, typeorm_1.JoinColumn)({ name: 'owner_id' }),
+    (0, relation_ref_decorator_1.AsRelation)(),
+    __metadata("design:type", user_entity_1.UserOrmEntity)
+], McpTokenOrmEntity.prototype, "owner", void 0);
+__decorate([
+    (0, typeorm_1.RelationId)((token) => token.owner),
+    __metadata("design:type", String)
+], McpTokenOrmEntity.prototype, "ownerId", void 0);
+__decorate([
+    (0, database_1.DatetimeColumn)({ name: 'expires_at', nullable: true }),
+    __metadata("design:type", Object)
+], McpTokenOrmEntity.prototype, "expiresAt", void 0);
+__decorate([
+    (0, database_1.DatetimeColumn)({ name: 'last_used_at', nullable: true }),
+    __metadata("design:type", Object)
+], McpTokenOrmEntity.prototype, "lastUsedAt", void 0);
+__decorate([
+    (0, database_1.DatetimeColumn)({ name: 'revoked_at', nullable: true }),
+    __metadata("design:type", Object)
+], McpTokenOrmEntity.prototype, "revokedAt", void 0);
+exports.McpTokenOrmEntity = McpTokenOrmEntity = __decorate([
+    (0, typeorm_1.Entity)({ name: 'mcp_tokens' }),
+    (0, typeorm_1.Index)(['tokenHash'], { unique: true }),
+    (0, typeorm_1.Index)(['owner'])
+], McpTokenOrmEntity);
+//# sourceMappingURL=mcp-token.entity.js.map

package/dist/mcp/entities/mcp-token.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-token.entity.js","sourceRoot":"","sources":["../../../src/mcp/entities/mcp-token.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAMA,6CAAuE;AACvE,qCAOiB;AAEjB,6CAA4C;AAC5C,qEAAgE;AAChE,iEAA4D;AAC5D,0FAAuE;AAOhE,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,2BAA0B;IAA1D;;QACL,aAAQ,GAAG,sBAAc,CAAC;QAE1B,YAAO,GAAG,0BAAkB,CAAC;IA8B/B,CAAC;CAAA,CAAA;AAjCY,8CAAiB;AAM5B;IADC,IAAA,gBAAM,GAAE;;+CACK;AAGd;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;oDAC1B;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;sDACxB;AAQrB;IANC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,2BAAa,EAAE;QAC9B,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,SAAS;KACpB,CAAC;IACD,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAChC,IAAA,mCAAU,GAAE;8BACL,2BAAa;gDAAC;AAGL;IADhB,IAAA,oBAAU,EAAC,CAAC,KAAwB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;;kDACpB;AAGlC;IADC,IAAA,yBAAc,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oDAC/B;AAGxB;IADC,IAAA,yBAAc,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDAChC;AAGzB;IADC,IAAA,yBAAc,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oDAC/B;4BAhCb,iBAAiB;IAH7B,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9B,IAAA,eAAK,EAAC,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,IAAA,eAAK,EAAC,CAAC,OAAO,CAAC,CAAC;GACJ,iBAAiB,CAiC7B"}

package/dist/mcp/guards/hexabot-mcp-token.guard.d.ts

@@ -0,0 +1,9 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
+export declare class HexabotMcpTokenGuard implements CanActivate {
+    private readonly moduleRef;
+    constructor(moduleRef: ModuleRef);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private extractTokenFromHeader;
+    private getMcpTokenService;
+}

package/dist/mcp/guards/hexabot-mcp-token.guard.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HexabotMcpTokenGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const mcp_token_service_1 = require("../services/mcp-token.service");
+let HexabotMcpTokenGuard = class HexabotMcpTokenGuard {
+    constructor(moduleRef) {
+        this.moduleRef = moduleRef;
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const token = this.extractTokenFromHeader(request);
+        if (!token) {
+            throw new common_1.UnauthorizedException('MCP bearer token is required');
+        }
+        const { user, tokenId } = await this.getMcpTokenService().authenticateBearerToken(token);
+        request.hexabotUser = user;
+        request.user = user;
+        request.mcpTokenId = tokenId;
+        return true;
+    }
+    extractTokenFromHeader(request) {
+        const authHeader = request.headers.authorization;
+        if (!authHeader) {
+            return undefined;
+        }
+        const [type, token] = authHeader.split(' ');
+        return type === 'Bearer' ? token : undefined;
+    }
+    getMcpTokenService() {
+        return this.moduleRef.get(mcp_token_service_1.McpTokenService, { strict: false });
+    }
+};
+exports.HexabotMcpTokenGuard = HexabotMcpTokenGuard;
+exports.HexabotMcpTokenGuard = HexabotMcpTokenGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.ModuleRef])
+], HexabotMcpTokenGuard);
+//# sourceMappingURL=hexabot-mcp-token.guard.js.map

package/dist/mcp/guards/hexabot-mcp-token.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hexabot-mcp-token.guard.js","sourceRoot":"","sources":["../../../src/mcp/guards/hexabot-mcp-token.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAMA,2CAKwB;AACxB,uCAAyC;AAGzC,qEAAgE;AAIzD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAqB,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GACrB,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAEjE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;QAC3B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;QAE7B,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,OAAgB;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE5C,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IAEO,kBAAkB;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,mCAAe,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;CACF,CAAA;AAnCY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAE6B,gBAAS;GADtC,oBAAoB,CAmChC"}

package/dist/mcp/guards/mcp-permission.guard.d.ts

@@ -0,0 +1,9 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { PermissionService } from "../../user/services/permission.service";
+export declare class McpPermissionGuard implements CanActivate {
+    private readonly reflector;
+    private readonly permissionService;
+    constructor(reflector: Reflector, permissionService: PermissionService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/mcp/guards/mcp-permission.guard.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpPermissionGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const mcp_permission_decorator_1 = require("../decorators/mcp-permission.decorator");
+const permission_service_1 = require("../../user/services/permission.service");
+let McpPermissionGuard = class McpPermissionGuard {
+    constructor(reflector, permissionService) {
+        this.reflector = reflector;
+        this.permissionService = permissionService;
+    }
+    async canActivate(context) {
+        const permission = this.reflector.getAllAndOverride(mcp_permission_decorator_1.MCP_PERMISSION_METADATA_KEY, [context.getHandler(), context.getClass()]);
+        if (!permission) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const user = request.hexabotUser ?? request.user;
+        const roleIds = Array.isArray(user?.roles) ? user.roles : [];
+        if (roleIds.length === 0) {
+            throw new common_1.ForbiddenException('MCP tool requires a Hexabot role');
+        }
+        const permissions = await this.permissionService.getPermissions();
+        const hasPermission = roleIds.some((roleId) => permissions[roleId]?.[permission.model]?.includes(permission.action));
+        if (!hasPermission) {
+            throw new common_1.ForbiddenException(`MCP tool requires ${permission.action} permission on ${permission.model}`);
+        }
+        return true;
+    }
+};
+exports.McpPermissionGuard = McpPermissionGuard;
+exports.McpPermissionGuard = McpPermissionGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        permission_service_1.PermissionService])
+], McpPermissionGuard);
+//# sourceMappingURL=mcp-permission.guard.js.map

package/dist/mcp/guards/mcp-permission.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-permission.guard.js","sourceRoot":"","sources":["../../../src/mcp/guards/mcp-permission.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAMA,2CAKwB;AACxB,uCAAyC;AAEzC,qFAGmD;AACnD,+EAAuE;AAKhE,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,YACmB,SAAoB,EACpB,iBAAoC;QADpC,cAAS,GAAT,SAAS,CAAW;QACpB,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACjD,sDAA2B,EAC3B,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAqB,CAAC;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,2BAAkB,CAAC,kCAAkC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC;QAClE,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CACrE,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,2BAAkB,CAC1B,qBAAqB,UAAU,CAAC,MAAM,kBAAkB,UAAU,CAAC,KAAK,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AArCY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAGmB,gBAAS;QACD,sCAAiB;GAH5C,kBAAkB,CAqC9B"}

package/dist/mcp/mcp-api.module.d.ts

@@ -0,0 +1,2 @@
+export declare class McpApiModule {
+}

package/dist/mcp/mcp-api.module.js

@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpApiModule = void 0;
+const crypto_1 = require("crypto");
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const mcp_nest_1 = require("@rekog/mcp-nest");
+const actions_module_1 = require("../actions/actions.module");
+const bindings_module_1 = require("../bindings/bindings.module");
+const cms_module_1 = require("../cms/cms.module");
+const config_1 = require("../config");
+const user_module_1 = require("../user/user.module");
+const workflow_module_1 = require("../workflow/workflow.module");
+const mcp_token_controller_1 = require("./controllers/mcp-token.controller");
+const mcp_token_entity_1 = require("./entities/mcp-token.entity");
+const hexabot_mcp_token_guard_1 = require("./guards/hexabot-mcp-token.guard");
+const mcp_permission_guard_1 = require("./guards/mcp-permission.guard");
+const mcp_token_repository_1 = require("./repositories/mcp-token.repository");
+const mcp_token_service_1 = require("./services/mcp-token.service");
+const hexabot_mcp_tools_1 = require("./tools/hexabot-mcp.tools");
+let McpApiModule = class McpApiModule {
+};
+exports.McpApiModule = McpApiModule;
+exports.McpApiModule = McpApiModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            typeorm_1.TypeOrmModule.forFeature([mcp_token_entity_1.McpTokenOrmEntity]),
+            mcp_nest_1.McpModule.forRoot({
+                name: config_1.config.mcp.serverName,
+                title: config_1.config.mcp.serverTitle,
+                version: config_1.config.mcp.serverVersion,
+                description: config_1.config.mcp.serverDescription,
+                instructions: config_1.config.mcp.serverInstructions,
+                transport: mcp_nest_1.McpTransportType.STREAMABLE_HTTP,
+                mcpEndpoint: 'mcp',
+                guards: [hexabot_mcp_token_guard_1.HexabotMcpTokenGuard],
+                streamableHttp: {
+                    enableJsonResponse: false,
+                    sessionIdGenerator: () => (0, crypto_1.randomUUID)(),
+                    statelessMode: false,
+                },
+            }),
+            actions_module_1.ActionsModule,
+            bindings_module_1.BindingsModule,
+            cms_module_1.CmsModule,
+            user_module_1.UserModule,
+            workflow_module_1.WorkflowModule,
+        ],
+        providers: [
+            hexabot_mcp_token_guard_1.HexabotMcpTokenGuard,
+            mcp_permission_guard_1.McpPermissionGuard,
+            mcp_token_repository_1.McpTokenRepository,
+            mcp_token_service_1.McpTokenService,
+            hexabot_mcp_tools_1.HexabotMcpTools,
+        ],
+        controllers: [mcp_token_controller_1.McpTokenController],
+    })
+], McpApiModule);
+//# sourceMappingURL=mcp-api.module.js.map

package/dist/mcp/mcp-api.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-api.module.js","sourceRoot":"","sources":["../../src/mcp/mcp-api.module.ts"],"names":[],"mappings":";;;;;;;;;AAMA,mCAAoC;AAEpC,2CAAwC;AACxC,6CAAgD;AAChD,8CAA8D;AAE9D,8DAAyD;AACzD,iEAA4D;AAC5D,kDAA6C;AAC7C,sCAAkC;AAClC,qDAAgD;AAChD,iEAA4D;AAE5D,6EAAwE;AACxE,kEAAgE;AAChE,8EAAwE;AACxE,wEAAmE;AACnE,8EAAyE;AACzE,oEAA+D;AAC/D,iEAA4D;AAmCrD,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IAjCxB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,uBAAa,CAAC,UAAU,CAAC,CAAC,oCAAiB,CAAC,CAAC;YAC7C,oBAAS,CAAC,OAAO,CAAC;gBAChB,IAAI,EAAE,eAAM,CAAC,GAAG,CAAC,UAAU;gBAC3B,KAAK,EAAE,eAAM,CAAC,GAAG,CAAC,WAAW;gBAC7B,OAAO,EAAE,eAAM,CAAC,GAAG,CAAC,aAAa;gBACjC,WAAW,EAAE,eAAM,CAAC,GAAG,CAAC,iBAAiB;gBACzC,YAAY,EAAE,eAAM,CAAC,GAAG,CAAC,kBAAkB;gBAC3C,SAAS,EAAE,2BAAgB,CAAC,eAAe;gBAC3C,WAAW,EAAE,KAAK;gBAClB,MAAM,EAAE,CAAC,8CAAoB,CAAC;gBAC9B,cAAc,EAAE;oBACd,kBAAkB,EAAE,KAAK;oBACzB,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAA,mBAAU,GAAE;oBACtC,aAAa,EAAE,KAAK;iBACrB;aACF,CAAC;YACF,8BAAa;YACb,gCAAc;YACd,sBAAS;YACT,wBAAU;YACV,gCAAc;SACf;QACD,SAAS,EAAE;YACT,8CAAoB;YACpB,yCAAkB;YAClB,yCAAkB;YAClB,mCAAe;YACf,mCAAe;SAChB;QACD,WAAW,EAAE,CAAC,yCAAkB,CAAC;KAClC,CAAC;GACW,YAAY,CAAG"}

package/dist/mcp/repositories/mcp-token.repository.d.ts

@@ -0,0 +1,8 @@
+import { Repository } from 'typeorm';
+import { BaseOrmRepository } from "../../utils/generics/base-orm.repository";
+import { McpTokenOrmEntity } from '../entities/mcp-token.entity';
+export declare class McpTokenRepository extends BaseOrmRepository<McpTokenOrmEntity> {
+    constructor(repository: Repository<McpTokenOrmEntity>);
+    findOneByHash(tokenHash: string): Promise<McpTokenOrmEntity | null>;
+    touchLastUsedAt(id: string, lastUsedAt?: Date): Promise<void>;
+}