@hexabot-ai/api 3.2.2-alpha.1 → 3.2.2-alpha.11

package/dist/mcp/repositories/mcp-token.repository.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpTokenRepository = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const base_orm_repository_1 = require("../../utils/generics/base-orm.repository");
+const mcp_token_entity_1 = require("../entities/mcp-token.entity");
+let McpTokenRepository = class McpTokenRepository extends base_orm_repository_1.BaseOrmRepository {
+    constructor(repository) {
+        super(repository, ['owner']);
+    }
+    async findOneByHash(tokenHash) {
+        return await this.repository.findOne({
+            where: { tokenHash },
+            relations: ['owner', 'owner.roles'],
+        });
+    }
+    async touchLastUsedAt(id, lastUsedAt = new Date()) {
+        await this.repository.update(id, { lastUsedAt });
+    }
+};
+exports.McpTokenRepository = McpTokenRepository;
+exports.McpTokenRepository = McpTokenRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(mcp_token_entity_1.McpTokenOrmEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository])
+], McpTokenRepository);
+//# sourceMappingURL=mcp-token.repository.js.map

package/dist/mcp/repositories/mcp-token.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-token.repository.js","sourceRoot":"","sources":["../../../src/mcp/repositories/mcp-token.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAMA,2CAA4C;AAC5C,6CAAmD;AACnD,qCAAqC;AAErC,kFAAyE;AAEzE,mEAAiE;AAG1D,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,uCAAoC;IAC1E,YAEE,UAAyC;QAEzC,KAAK,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACnC,KAAK,EAAE,EAAE,SAAS,EAAE;YACpB,SAAS,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU,EAAE,UAAU,GAAG,IAAI,IAAI,EAAE;QACvD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAlBY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,0BAAgB,EAAC,oCAAiB,CAAC,CAAA;qCACxB,oBAAU;GAHb,kBAAkB,CAkB9B"}

package/dist/mcp/services/mcp-token.service.d.ts

@@ -0,0 +1,24 @@
+import type { McpToken, User } from '@hexabot-ai/types';
+import { BaseOrmService } from "../../utils/generics/base-orm.service";
+import { McpTokenCreateDto } from '../dto/mcp-token.dto';
+import { McpTokenOrmEntity } from '../entities/mcp-token.entity';
+import { McpTokenRepository } from '../repositories/mcp-token.repository';
+export declare const MCP_PERSONAL_TOKEN_PREFIX = "hbt_mcp_";
+export declare class McpTokenService extends BaseOrmService<McpTokenOrmEntity> {
+    readonly repository: McpTokenRepository;
+    constructor(repository: McpTokenRepository);
+    createPersonalToken(ownerId: string, dto: McpTokenCreateDto): Promise<{
+        token: string;
+        record: McpToken;
+    }>;
+    findOwnedTokens(ownerId: string): Promise<McpToken[]>;
+    revokeOwnedToken(ownerId: string, id: string): Promise<McpToken>;
+    authenticateBearerToken(token: string): Promise<{
+        user: User;
+        tokenId: string;
+    }>;
+    private generateToken;
+    private hashToken;
+    private getTokenPrefix;
+    private parseOptionalExpiry;
+}

package/dist/mcp/services/mcp-token.service.js

@@ -0,0 +1,106 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpTokenService = exports.MCP_PERSONAL_TOKEN_PREFIX = void 0;
+const crypto_1 = require("crypto");
+const common_1 = require("@nestjs/common");
+const base_orm_service_1 = require("../../utils/generics/base-orm.service");
+const mcp_token_repository_1 = require("../repositories/mcp-token.repository");
+exports.MCP_PERSONAL_TOKEN_PREFIX = 'hbt_mcp_';
+let McpTokenService = class McpTokenService extends base_orm_service_1.BaseOrmService {
+    constructor(repository) {
+        super(repository);
+        this.repository = repository;
+    }
+    async createPersonalToken(ownerId, dto) {
+        const token = this.generateToken();
+        const expiresAt = this.parseOptionalExpiry(dto.expiresAt);
+        const record = await this.repository.create({
+            name: dto.name,
+            owner: ownerId,
+            tokenHash: this.hashToken(token),
+            tokenPrefix: this.getTokenPrefix(token),
+            expiresAt,
+            lastUsedAt: null,
+            revokedAt: null,
+        });
+        return { token, record };
+    }
+    async findOwnedTokens(ownerId) {
+        return await this.repository.find({
+            where: { owner: { id: ownerId } },
+            order: { createdAt: 'DESC' },
+        });
+    }
+    async revokeOwnedToken(ownerId, id) {
+        const token = await this.repository.findOne({
+            where: { id, owner: { id: ownerId } },
+        });
+        if (!token) {
+            throw new common_1.NotFoundException(`MCP token ${id} not found`);
+        }
+        return await this.repository.updateOne({
+            where: { id, owner: { id: ownerId } },
+        }, { revokedAt: new Date() });
+    }
+    async authenticateBearerToken(token) {
+        if (!token.startsWith(exports.MCP_PERSONAL_TOKEN_PREFIX)) {
+            throw new common_1.UnauthorizedException('Invalid MCP token');
+        }
+        const record = await this.repository.findOneByHash(this.hashToken(token));
+        if (!record) {
+            throw new common_1.UnauthorizedException('Invalid MCP token');
+        }
+        if (record.revokedAt) {
+            throw new common_1.UnauthorizedException('MCP token has been revoked');
+        }
+        if (record.expiresAt && record.expiresAt <= new Date()) {
+            throw new common_1.UnauthorizedException('MCP token has expired');
+        }
+        const owner = record.owner;
+        if (!owner?.state) {
+            throw new common_1.UnauthorizedException('MCP token owner is inactive');
+        }
+        await this.repository.touchLastUsedAt(record.id);
+        return {
+            user: owner.toPlainCls(),
+            tokenId: record.id,
+        };
+    }
+    generateToken() {
+        return `${exports.MCP_PERSONAL_TOKEN_PREFIX}${(0, crypto_1.randomBytes)(32).toString('base64url')}`;
+    }
+    hashToken(token) {
+        return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+    }
+    getTokenPrefix(token) {
+        return token.slice(0, exports.MCP_PERSONAL_TOKEN_PREFIX.length + 8);
+    }
+    parseOptionalExpiry(value) {
+        if (!value) {
+            return null;
+        }
+        const expiresAt = new Date(value);
+        if (Number.isNaN(expiresAt.getTime())) {
+            throw new common_1.BadRequestException('Invalid MCP token expiry date');
+        }
+        if (expiresAt <= new Date()) {
+            throw new common_1.BadRequestException('MCP token expiry must be in the future');
+        }
+        return expiresAt;
+    }
+};
+exports.McpTokenService = McpTokenService;
+exports.McpTokenService = McpTokenService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [mcp_token_repository_1.McpTokenRepository])
+], McpTokenService);
+//# sourceMappingURL=mcp-token.service.js.map

package/dist/mcp/services/mcp-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-token.service.js","sourceRoot":"","sources":["../../../src/mcp/services/mcp-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAMA,mCAAiD;AAGjD,2CAKwB;AAIxB,4EAAmE;AAInE,+EAA0E;AAE7D,QAAA,yBAAyB,GAAG,UAAU,CAAC;AAG7C,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,iCAAiC;IACpE,YAAqB,UAA8B;QACjD,KAAK,CAAC,UAAU,CAAC,CAAC;QADC,eAAU,GAAV,UAAU,CAAoB;IAEnD,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,OAAe,EACf,GAAsB;QAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1C,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAChC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YACvC,SAAS;YACT,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SACT,CAAC,CAAC;QAEV,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAChC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;YACjC,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SACS,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,EAAU;QAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAC1C,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;SAC/B,CAAC,CAAC;QAEV,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,0BAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CACpC;YACE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;SAC/B,EACR,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAS,CACjC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,KAAa;QAEb,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,iCAAyB,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAE1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACvD,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAkC,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEjD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,UAAU,EAAU;YAChC,OAAO,EAAE,MAAM,CAAC,EAAE;SACnB,CAAC;IACJ,CAAC;IAEO,aAAa;QACnB,OAAO,GAAG,iCAAyB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAChF,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,cAAc,CAAC,KAAa;QAClC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAyB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAEO,mBAAmB,CAAC,KAAqB;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AA9GY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAEsB,yCAAkB;GADxC,eAAe,CA8G3B"}