@lenne.tech/nest-server 11.32.4 → 11.33.0

package/dist/core/common/services/core-trust-proxy.initializer.js

@@ -0,0 +1,77 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var CoreTrustProxyInitializer_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreTrustProxyInitializer = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const config_service_1 = require("./config.service");
+const TRUST_PROXY = 'trust proxy';
+let CoreTrustProxyInitializer = CoreTrustProxyInitializer_1 = class CoreTrustProxyInitializer {
+    httpAdapterHost;
+    logger = new common_1.Logger(CoreTrustProxyInitializer_1.name);
+    constructor(httpAdapterHost) {
+        this.httpAdapterHost = httpAdapterHost;
+    }
+    onModuleInit() {
+        const configured = this.getConfigured();
+        if (configured === undefined) {
+            return;
+        }
+        const app = this.getExpressApp();
+        if (!app) {
+            return;
+        }
+        app.set(TRUST_PROXY, configured);
+        this.logger.log(`Express "trust proxy" set to ${JSON.stringify(configured)} — request.ip follows X-Forwarded-For accordingly`);
+    }
+    onApplicationBootstrap() {
+        const limiters = this.enabledIpRateLimiters();
+        if (this.getConfigured() !== undefined || !limiters.length) {
+            return;
+        }
+        const app = this.getExpressApp();
+        if (!app || app.get(TRUST_PROXY)) {
+            return;
+        }
+        this.logger.warn(`Rate limiting is enabled (${limiters.join(', ')}) but Express "trust proxy" is not set. ` +
+            'Behind a reverse proxy (Caddy, nginx, a Kubernetes ingress) request.ip is then the PROXY address for every ' +
+            'request, so every client behind a reverse proxy shares one bucket and the limit throttles all of them at ' +
+            'once. Set `trustProxy` in your server options to the number of proxy hops in front of this app ' +
+            '(e.g. `trustProxy: 1`), or `trustProxy: false` if nothing proxies it — which also silences this warning.');
+    }
+    enabledIpRateLimiters() {
+        return ['auth.rateLimit', 'betterAuth.rateLimit'].filter((path) => {
+            const config = config_service_1.ConfigService.getFastButReadOnly(path);
+            if (config === undefined || config === null || config === false) {
+                return false;
+            }
+            return typeof config === 'boolean' ? config : config.enabled !== false;
+        });
+    }
+    getConfigured() {
+        return config_service_1.ConfigService.getFastButReadOnly('trustProxy');
+    }
+    getExpressApp() {
+        const instance = this.httpAdapterHost?.httpAdapter?.getInstance?.();
+        return typeof instance?.set === 'function' && typeof instance?.get === 'function' ? instance : undefined;
+    }
+};
+exports.CoreTrustProxyInitializer = CoreTrustProxyInitializer;
+exports.CoreTrustProxyInitializer = CoreTrustProxyInitializer = CoreTrustProxyInitializer_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [core_1.HttpAdapterHost])
+], CoreTrustProxyInitializer);
+//# sourceMappingURL=core-trust-proxy.initializer.js.map

package/dist/core/common/services/core-trust-proxy.initializer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-trust-proxy.initializer.js","sourceRoot":"","sources":["../../../../src/core/common/services/core-trust-proxy.initializer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoG;AACpG,uCAA+C;AAG/C,qDAAiD;AAGjD,MAAM,WAAW,GAAG,aAAa,CAAC;AAe3B,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IAGO;IAFxB,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;IAEvE,YAA2C,eAAiC;QAAjC,oBAAe,GAAf,eAAe,CAAkB;IAAG,CAAC;IAShF,YAAY;QACV,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,CAAC;YAGT,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,gCAAgC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,mDAAmD,CAC9G,CAAC;IACJ,CAAC;IAaD,sBAAsB;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,aAAa,EAAE,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C;YACxF,6GAA6G;YAC7G,2GAA2G;YAC3G,iGAAiG;YACjG,0GAA0G,CAC7G,CAAC;IACJ,CAAC;IASS,qBAAqB;QAC7B,OAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3E,MAAM,MAAM,GAAG,8BAAa,CAAC,kBAAkB,CAAkC,IAAI,CAAC,CAAC;YACvF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBAChE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;QACzE,CAAC,CAAC,CAAC;IACL,CAAC;IAGS,aAAa;QACrB,OAAO,8BAAa,CAAC,kBAAkB,CAA+B,YAAY,CAAC,CAAC;IACtF,CAAC;IAGS,aAAa;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC;QACpE,OAAO,OAAO,QAAQ,EAAE,GAAG,KAAK,UAAU,IAAI,OAAO,QAAQ,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,CAAC;CACF,CAAA;AAzFY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IAIE,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCAAsC,sBAAe;GAHjE,yBAAyB,CAyFrC"}

package/dist/core/common/services/rate-limit-store.d.ts

@@ -0,0 +1,61 @@
+import { Logger } from '@nestjs/common';
+import type { CoreRedisService } from './core-redis.service';
+export declare function rateLimitKey(...parts: string[]): string;
+export declare function rateLimitKeyPrefix(...parts: string[]): string;
+export interface RateLimitStoreHit {
+    count: number;
+    resetIn: number;
+}
+export interface RateLimitStore {
+    clear(): Promise<void>;
+    hit(key: string, windowSeconds: number): Promise<RateLimitStoreHit>;
+    resetByPrefix(prefix: string): Promise<void>;
+    size(): number;
+    destroy?(): void;
+}
+export declare class InMemoryRateLimitStore implements RateLimitStore {
+    protected readonly maxEntries: number;
+    protected readonly store: Map<string, {
+        count: number;
+        resetTime: number;
+    }>;
+    protected cleanupInterval: NodeJS.Timeout | null;
+    protected atCapacity: boolean;
+    protected capacityWarned: boolean;
+    protected readonly overflow: Map<number, {
+        count: number;
+        resetTime: number;
+    }>;
+    constructor(maxEntries?: number);
+    clear(): Promise<void>;
+    hit(key: string, windowSeconds: number): Promise<RateLimitStoreHit>;
+    resetByPrefix(prefix: string): Promise<void>;
+    protected hitOverflow(key: string, windowSeconds: number, now: number): RateLimitStoreHit;
+    size(): number;
+    destroy(): void;
+    protected removeExpired(): number;
+    protected evictOldest(): void;
+}
+export declare class RedisRateLimitStore implements RateLimitStore {
+    protected readonly redisService: CoreRedisService;
+    protected readonly namespace: string;
+    protected readonly maxKeys: number;
+    protected readonly fallback: InMemoryRateLimitStore;
+    protected degraded: boolean;
+    protected readonly logger: Logger;
+    protected capacityWarned: boolean;
+    protected readonly prepared: WeakSet<object>;
+    constructor(redisService: CoreRedisService, namespace: string, maxKeys?: number);
+    clear(): Promise<void>;
+    hit(key: string, windowSeconds: number): Promise<RateLimitStoreHit>;
+    protected runHit(key: string, windowSeconds: number): Promise<[number, number, number]>;
+    resetByPrefix(prefix: string): Promise<void>;
+    size(): number;
+    destroy(): void;
+    protected guard<T>(operation: () => Promise<T>, onFailure: (() => Promise<T> | T) | undefined): Promise<T>;
+    protected redisKey(key: string): string;
+    protected redisKeyPattern(prefix: string): string;
+    protected cardinalityKey(): string;
+    protected overflowKey(key: string): string;
+    protected deleteByPattern(pattern: string): Promise<void>;
+}

package/dist/core/common/services/rate-limit-store.js

@@ -0,0 +1,235 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisRateLimitStore = exports.InMemoryRateLimitStore = void 0;
+exports.rateLimitKey = rateLimitKey;
+exports.rateLimitKeyPrefix = rateLimitKeyPrefix;
+const common_1 = require("@nestjs/common");
+function escapeGlob(value) {
+    return value.replace(/[?[\]*\\^]/g, (char) => `\\${char}`);
+}
+function rateLimitKey(...parts) {
+    return parts.map((part) => part.replace(/\\/g, '\\\\').replace(/:/g, '\\:')).join(':');
+}
+function rateLimitKeyPrefix(...parts) {
+    return `${rateLimitKey(...parts)}:`;
+}
+function namespaceLabel(namespace) {
+    return `namespace ${namespace}`;
+}
+const OVERFLOW_BUCKETS = 64;
+function overflowSlot(key) {
+    let hash = 0;
+    for (let i = 0; i < key.length; i++) {
+        hash = (hash * 31 + key.charCodeAt(i)) | 0;
+    }
+    return Math.abs(hash) % OVERFLOW_BUCKETS;
+}
+class InMemoryRateLimitStore {
+    maxEntries;
+    store = new Map();
+    cleanupInterval = null;
+    atCapacity = false;
+    capacityWarned = false;
+    overflow = new Map();
+    constructor(maxEntries = 10000) {
+        this.maxEntries = maxEntries;
+        this.cleanupInterval = setInterval(() => this.removeExpired(), 5 * 60 * 1000);
+        this.cleanupInterval.unref?.();
+    }
+    async clear() {
+        this.store.clear();
+        this.overflow.clear();
+        this.atCapacity = false;
+        this.capacityWarned = false;
+    }
+    async hit(key, windowSeconds) {
+        const now = Date.now();
+        let entry = this.store.get(key);
+        if (!entry || now >= entry.resetTime) {
+            if (!entry && this.store.size >= this.maxEntries) {
+                this.atCapacity = false;
+                this.evictOldest();
+                if (this.atCapacity) {
+                    if (!this.capacityWarned) {
+                        this.capacityWarned = true;
+                        console.warn(`Rate limit store is at capacity (${this.maxEntries} live counters). New clients now share ` +
+                            `${OVERFLOW_BUCKETS} coarse counters until entries expire, so they may be limited earlier than ` +
+                            'their own traffic warrants. Existing limits are unaffected.');
+                    }
+                    return this.hitOverflow(key, windowSeconds, now);
+                }
+            }
+            entry = { count: 1, resetTime: now + windowSeconds * 1000 };
+            this.store.set(key, entry);
+            return { count: 1, resetIn: windowSeconds };
+        }
+        entry.count++;
+        return { count: entry.count, resetIn: Math.ceil((entry.resetTime - now) / 1000) };
+    }
+    async resetByPrefix(prefix) {
+        for (const key of this.store.keys()) {
+            if (key.startsWith(prefix)) {
+                this.store.delete(key);
+            }
+        }
+    }
+    hitOverflow(key, windowSeconds, now) {
+        const slot = overflowSlot(key);
+        const entry = this.overflow.get(slot);
+        if (!entry || now >= entry.resetTime) {
+            this.overflow.set(slot, { count: 1, resetTime: now + windowSeconds * 1000 });
+            return { count: 1, resetIn: windowSeconds };
+        }
+        entry.count++;
+        return { count: entry.count, resetIn: Math.ceil((entry.resetTime - now) / 1000) };
+    }
+    size() {
+        return this.store.size;
+    }
+    destroy() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = null;
+        }
+    }
+    removeExpired() {
+        const now = Date.now();
+        let removed = 0;
+        for (const [key, entry] of this.store.entries()) {
+            if (now >= entry.resetTime) {
+                this.store.delete(key);
+                removed++;
+            }
+        }
+        return removed;
+    }
+    evictOldest() {
+        const removed = this.removeExpired();
+        if (removed > 0 || this.store.size < this.maxEntries) {
+            return;
+        }
+        this.atCapacity = true;
+    }
+}
+exports.InMemoryRateLimitStore = InMemoryRateLimitStore;
+const HIT_SCRIPT = `
+local window = tonumber(ARGV[1])
+local target = KEYS[1]
+local overflow = 0
+if redis.call('EXISTS', KEYS[1]) == 0 then
+  local seen = redis.call('INCR', KEYS[2])
+  if seen == 1 then
+    redis.call('EXPIRE', KEYS[2], window)
+  end
+  if seen > tonumber(ARGV[2]) then
+    target = KEYS[3]
+    overflow = 1
+  end
+end
+local c = redis.call('INCR', target)
+if c == 1 then
+  redis.call('EXPIRE', target, window)
+end
+local ttl = redis.call('TTL', target)
+if ttl < 0 then
+  redis.call('EXPIRE', target, window)
+  ttl = window
+end
+return {c, ttl, overflow}
+`;
+const HIT_COMMAND = 'ltRateLimitHit';
+class RedisRateLimitStore {
+    redisService;
+    namespace;
+    maxKeys;
+    fallback = new InMemoryRateLimitStore();
+    degraded = false;
+    logger = new common_1.Logger(RedisRateLimitStore.name);
+    capacityWarned = false;
+    prepared = new WeakSet();
+    constructor(redisService, namespace, maxKeys = 10000) {
+        this.redisService = redisService;
+        this.namespace = namespace;
+        this.maxKeys = maxKeys;
+    }
+    async clear() {
+        await this.fallback.clear();
+        this.capacityWarned = false;
+        await this.guard(() => this.deleteByPattern(this.redisKeyPattern('')), undefined);
+    }
+    async hit(key, windowSeconds) {
+        return this.guard(async () => {
+            const [count, ttl, overflow] = await this.runHit(key, windowSeconds);
+            if (this.degraded) {
+                this.degraded = false;
+                this.logger.log('Redis rate limiting recovered — limits are shared across replicas again');
+            }
+            if (overflow && !this.capacityWarned) {
+                this.capacityWarned = true;
+                this.logger.warn(`Rate limit keyspace for ${namespaceLabel(this.namespace)} reached ${this.maxKeys} distinct counters ` +
+                    `within one window. New clients now share ${OVERFLOW_BUCKETS} coarse counters until the window rolls ` +
+                    'over, so they may be limited earlier than their own traffic warrants. Existing limits are unaffected.');
+            }
+            return { count, resetIn: ttl };
+        }, () => this.fallback.hit(key, windowSeconds));
+    }
+    async runHit(key, windowSeconds) {
+        const client = this.redisService.getClient();
+        const args = [this.redisKey(key), this.cardinalityKey(), this.overflowKey(key), windowSeconds, this.maxKeys];
+        if (typeof client.defineCommand === 'function') {
+            if (!this.prepared.has(client)) {
+                client.defineCommand(HIT_COMMAND, { lua: HIT_SCRIPT, numberOfKeys: 3 });
+                this.prepared.add(client);
+            }
+            return (await client[HIT_COMMAND](...args));
+        }
+        return (await client.eval(HIT_SCRIPT, 3, ...args));
+    }
+    async resetByPrefix(prefix) {
+        await this.fallback.resetByPrefix(prefix);
+        await this.guard(() => this.deleteByPattern(this.redisKeyPattern(prefix)), undefined);
+    }
+    size() {
+        return -1;
+    }
+    destroy() {
+        this.fallback.destroy();
+    }
+    async guard(operation, onFailure) {
+        try {
+            return await operation();
+        }
+        catch (error) {
+            if (!this.degraded) {
+                this.degraded = true;
+                this.logger.error(`Redis rate limiting unavailable (${namespaceLabel(this.namespace)}): ${error instanceof Error ? error.message : 'Unknown error'}. Falling back to per-replica in-memory limits until Redis recovers.`);
+            }
+            return onFailure ? await onFailure() : undefined;
+        }
+    }
+    redisKey(key) {
+        return this.redisService.key('rate-limit', this.namespace, key);
+    }
+    redisKeyPattern(prefix) {
+        return `${escapeGlob(this.redisKey(prefix))}*`;
+    }
+    cardinalityKey() {
+        return this.redisService.key('rate-limit', this.namespace, '#meta', 'cardinality');
+    }
+    overflowKey(key) {
+        return this.redisService.key('rate-limit', this.namespace, '#overflow', String(overflowSlot(key)));
+    }
+    async deleteByPattern(pattern) {
+        const client = this.redisService.getClient();
+        let cursor = '0';
+        do {
+            const [nextCursor, keys] = await client.scan(cursor, 'MATCH', pattern, 'COUNT', 200);
+            if (keys.length) {
+                await client.del(...keys);
+            }
+            cursor = nextCursor;
+        } while (cursor !== '0');
+    }
+}
+exports.RedisRateLimitStore = RedisRateLimitStore;
+//# sourceMappingURL=rate-limit-store.js.map

package/dist/core/common/services/rate-limit-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-store.js","sourceRoot":"","sources":["../../../../src/core/common/services/rate-limit-store.ts"],"names":[],"mappings":";;;AAiCA,oCAEC;AAOD,gDAEC;AA5CD,2CAAwC;AAgBxC,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAeD,SAAgB,YAAY,CAAC,GAAG,KAAe;IAC7C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzF,CAAC;AAOD,SAAgB,kBAAkB,CAAC,GAAG,KAAe;IACnD,OAAO,GAAG,YAAY,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;AACtC,CAAC;AAKD,SAAS,cAAc,CAAC,SAAiB;IACvC,OAAO,aAAa,SAAS,EAAE,CAAC;AAClC,CAAC;AA2CD,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAG5B,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC;AAC3C,CAAC;AAMD,MAAa,sBAAsB;IA0BF;IAzBZ,KAAK,GAAG,IAAI,GAAG,EAAgD,CAAC;IACzE,eAAe,GAA0B,IAAI,CAAC;IAG9C,UAAU,GAAG,KAAK,CAAC;IAGnB,cAAc,GAAG,KAAK,CAAC;IAgBd,QAAQ,GAAG,IAAI,GAAG,EAAgD,CAAC;IAEtF,YAA+B,aAAa,KAAK;QAAlB,eAAU,GAAV,UAAU,CAAQ;QAE/C,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9E,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAInB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,aAAqB;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;gBACxB,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;wBACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;wBAC3B,OAAO,CAAC,IAAI,CACV,oCAAoC,IAAI,CAAC,UAAU,yCAAyC;4BAC1F,GAAG,gBAAgB,6EAA6E;4BAChG,6DAA6D,CAChE,CAAC;oBACJ,CAAC;oBACD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;YACD,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,aAAa,GAAG,IAAI,EAAE,CAAC;YAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAOS,WAAW,CAAC,GAAW,EAAE,aAAqB,EAAE,GAAW;QACnE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEtC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,aAAa,GAAG,IAAI,EAAE,CAAC,CAAC;YAC7E,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACpF,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAGD,OAAO;QACL,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAES,aAAa;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACvB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAMS,WAAW;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACrD,OAAO;QACT,CAAC;QAMD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;CACF;AAvID,wDAuIC;AAkBD,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBlB,CAAC;AAGF,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAWrC,MAAa,mBAAmB;IAmCT;IACA;IACA;IA1BF,QAAQ,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAGjD,QAAQ,GAAG,KAAK,CAAC;IAER,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAGvD,cAAc,GAAG,KAAK,CAAC;IASd,QAAQ,GAAG,IAAI,OAAO,EAAU,CAAC;IAMpD,YACqB,YAA8B,EAC9B,SAAiB,EACjB,UAAU,KAAK;QAFf,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,cAAS,GAAT,SAAS,CAAQ;QACjB,YAAO,GAAP,OAAO,CAAQ;IACjC,CAAC;IAEJ,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAI5B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACpF,CAAC;IAkBD,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,aAAqB;QAC1C,OAAO,IAAI,CAAC,KAAK,CACf,KAAK,IAAI,EAAE;YACT,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YACrE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2BAA2B,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,OAAO,qBAAqB;oBACpG,4CAA4C,gBAAgB,0CAA0C;oBACtG,uGAAuG,CAC1G,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QACjC,CAAC,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAC5C,CAAC;IACJ,CAAC;IAUS,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,aAAqB;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAS,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAE7G,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;gBACxE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,CAA6B,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAA6B,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,IAAI;QACF,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAGD,OAAO;QACL,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IAKS,KAAK,CAAC,KAAK,CAAI,SAA2B,EAAE,SAA6C;QACjG,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,oCAAoC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,MAChE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAC3C,sEAAsE,CACvE,CAAC;YACJ,CAAC;YACD,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAE,SAAe,CAAC;QAC1D,CAAC;IACH,CAAC;IAGS,QAAQ,CAAC,GAAW;QAC5B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IASS,eAAe,CAAC,MAAc;QACtC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC;IACjD,CAAC;IAeS,cAAc;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACrF,CAAC;IAGS,WAAW,CAAC,GAAW;QAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,OAAe;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAC7C,IAAI,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC;YACF,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACrF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAC5B,CAAC;YACD,MAAM,GAAG,UAAU,CAAC;QACtB,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAE;IAC3B,CAAC;CACF;AA/LD,kDA+LC"}

package/dist/core/modules/ai/core-ai-mcp.controller.d.ts

@@ -1,21 +1,37 @@
-import { Logger } from '@nestjs/common';
+import { Logger, OnModuleDestroy } from '@nestjs/common';
 import { Request, Response } from 'express';
+import { CoreRedisService } from '../../common/services/core-redis.service';
 import { CoreAiMcpOAuthService } from './services/core-ai-mcp-oauth.service';
 import { CoreAiMcpService } from './services/core-ai-mcp.service';
-export declare class CoreAiMcpController {
+export declare class CoreAiMcpController implements OnModuleDestroy {
     private readonly mcpService;
     private readonly oauthService;
+    protected readonly redisService?: CoreRedisService;
     protected readonly logger: Logger;
     private readonly transports;
+    private readonly maxSessionsPerUser;
     private readonly maxSessions;
-    constructor(mcpService: CoreAiMcpService, oauthService: CoreAiMcpOAuthService);
+    protected readonly instanceId: string;
+    protected readonly sessionTtlSeconds = 3600;
+    constructor(mcpService: CoreAiMcpService, oauthService: CoreAiMcpOAuthService, redisService?: CoreRedisService);
     handlePost(req: Request, res: Response): Promise<void>;
     handleGet(req: Request, res: Response): Promise<void>;
     handleDelete(req: Request, res: Response): Promise<void>;
     protected resolveUser(req: Request): Promise<any | null>;
     protected oauthEnabled(): boolean;
     private handleSessionRequest;
+    protected foreignSessionOwner(sessionId: string, userId: string): Promise<string | undefined>;
+    protected parseSessionEntry(raw: null | string): undefined | {
+        instanceId: string;
+        userId: string;
+    };
+    protected registerSession(sessionId: string, userId: string): void;
+    protected releaseSession(sessionId: string): Promise<void>;
+    onModuleDestroy(): Promise<void>;
+    protected sessionKey(sessionId: string): string;
+    protected foreignSession(res: Response, owner: string): void;
     private mcpUnavailable;
     private unauthorized;
     private evictIfNeeded;
+    private evictOldestOf;
 }