@lenne.tech/nest-server 12.1.1 → 12.3.0

package/dist/core/modules/ai/helpers/ai-mcp-oauth-consent.helper.js

@@ -73,8 +73,8 @@ export function mcpOAuthConsentHeaders(nonce) {
         'X-Frame-Options': 'DENY',
     };
 }
-export function renderMcpOAuthConsentPage(view) {
-    const t = TEXTS[view.locale];
+export function renderMcpOAuthConsentPage(view, options = {}) {
+    const t = { ...TEXTS[view.locale], ...options.texts?.[view.locale] };
     const clientName = view.client.name?.trim() || t.unnamedClient;
     const fill = (text) => escapeHtml(text).replace(/\{(client|app)\}/g, (_, key) => `<strong>${escapeHtml(key === 'client' ? clientName : view.appHost)}</strong>`);
     const body = view.user ? consentView(view, t, fill) : signInView(view, t, fill);
@@ -86,7 +86,7 @@ export function renderMcpOAuthConsentPage(view) {
 <meta name="robots" content="noindex">
 <link rel="icon" href="data:,">
 <title>${escapeHtml(t.title)} – ${escapeHtml(view.appHost)}</title>
-<style nonce="${escapeHtml(view.nonce)}">${STYLES}</style>
+<style nonce="${escapeHtml(view.nonce)}">${STYLES}${confinedStyles(options.styles)}</style>
 </head>
 <body>
 <main class="card">
@@ -97,6 +97,9 @@ ${pageScript(view)}
 </html>
 `;
 }
+function confinedStyles(styles) {
+    return typeof styles === 'string' ? styles.replace(/</g, '\\3c ') : '';
+}
 function consentView(view, t, fill) {
     const target = view.redirect.loopback
         ? `${escapeHtml(t.loopback)} (${escapeHtml(view.redirect.host)})`

package/dist/core/modules/ai/helpers/ai-mcp-oauth-consent.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-mcp-oauth-consent.helper.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-mcp-oauth-consent.helper.ts"],"names":[],"mappings":"AAwCA,MAAM,CAAC,MAAM,gCAAgC,GAAG,gBAAgB,CAAC;AAEjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAAC;AAE3D,MAAM,KAAK,GAAG;IACZ,EAAE,EAAE;QACF,KAAK,EAAE,UAAU;QACjB,eAAe,EAAE,0CAA0C;QAC3D,UAAU,EAAE,uBAAuB;QACnC,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,wBAAwB;QACpC,QAAQ,EAAE,gDAAgD;QAC1D,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,mCAAmC;QAC7C,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,+DAA+D;QACxE,KAAK,EAAE,oFAAoF;QAC3F,QAAQ,EAAE,oCAAoC;QAC9C,QAAQ,EAAE,6CAA6C;QACvD,QAAQ,EAAE,qEAAqE;QAC/E,WAAW,EAAE,mDAAmD;QAChE,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,uBAAuB;QACnC,aAAa,EAAE,eAAe;QAC9B,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,4DAA4D;QAC1E,WAAW,EAAE,+DAA+D;QAC5E,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,kBAAkB;QACzB,aAAa,EAAE,2BAA2B;QAC1C,OAAO,EAAE,+EAA+E;KACzF;IACD,EAAE,EAAE;QACF,KAAK,EAAE,OAAO;QACd,eAAe,EAAE,iCAAiC;QAClD,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,sBAAsB;QAClC,QAAQ,EAAE,6CAA6C;QACvD,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,6BAA6B;QACvC,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,wDAAwD;QACjE,KAAK,EAAE,oFAAoF;QAC3F,QAAQ,EAAE,iCAAiC;QAC3C,QAAQ,EAAE,iCAAiC;QAC3C,QAAQ,EAAE,uDAAuD;QACjE,WAAW,EAAE,0CAA0C;QACvD,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,qBAAqB;QACjC,aAAa,EAAE,qBAAqB;QACpC,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,uDAAuD;QACrE,WAAW,EAAE,4CAA4C;QACzD,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,wBAAwB;QACvC,OAAO,EAAE,iEAAiE;KAC3E;CAC8D,CAAC;AAGlE,MAAM,UAAU,qBAAqB,CAAC,cAAuB;IAC3D,MAAM,KAAK,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1G,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAOD,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO;QACL,eAAe,EAAE,UAAU;QAC3B,yBAAyB,EACvB,yCAAyC,KAAK,uBAAuB,KAAK,yBAAyB;YACnG,+DAA+D;QACjE,cAAc,EAAE,0BAA0B;QAC1C,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;AACJ,CAAC;AAGD,MAAM,UAAU,yBAAyB,CAAC,IAA0B;IAClE,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,aAAa,CAAC;IAG/D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CACtB,mBAAmB,EACnB,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE,CAAC,WAAW,UAAU,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CACnG,CAAC;IAEJ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAChF,OAAO;cACK,IAAI,CAAC,MAAM;;;;;;SAMhB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC1C,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,MAAM;;;;EAI/C,IAAI;;EAEJ,UAAU,CAAC,IAAI,CAAC;;;CAGjB,CAAC;AACF,CAAC;AAID,SAAS,WAAW,CAAC,IAA0B,EAAE,CAAQ,EAAE,IAA8B;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ;QACnC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG;QACjE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC5C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;SACvG,IAAI,CAAC,IAAI,CAAC,CAAC;IAGd,MAAM,OAAO,GAAG,GAAG;QACjB,CAAC,CAAC,sBAAsB,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,GAC3G,IAAI,CAAC,YAAY;YACf,CAAC,CAAC,+DAA+D,UAAU,CAAC,GAAG,IAAI,CAAC,YAAY,WAAW,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM;YAClJ,CAAC,CAAC,EACN,MAAM;QACR,CAAC,CAAC,EAAE,CAAC;IAGP,OAAO,OAAO,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;EACjC,OAAO;EACP,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kCAAkC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KAC3F,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;oBACE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,MAAM;qBACrC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;8BACZ,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;;EAEzD,MAAM;6BACqB,6BAA6B,YAAY,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;8BACxE,gCAAgC,oCAAoC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;8BACtF,gCAAgC,gEAAgE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;QACzI,CAAC;AACT,CAAC;AAGD,SAAS,UAAU,CAAC,IAA0B;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,OAAO,MAAM,CAAC,CAAC,CAAC,kBAAkB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,MAAM,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,UAAU,CAAC,IAA0B,EAAE,CAAQ,EAAE,IAA8B;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ;QACzB,CAAC,CAAC;WACK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4CAA4C,IAAI,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;EACrJ,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;OACvF;QACH,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;KACjC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;EACzB,KAAK,EAAE,CAAC;IACR,CAAC;IACD,OAAO,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;KAC/B,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;8BACM,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;0CACV,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,0BAA0B,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,uBAAuB,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;;SAEjK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;SACnB,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;wCACS,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;;;mBAGzC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;SAChC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;8DACmC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;wCAC9C,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;;;;EAI3D,KAAK,EAAE,CAAC;AACV,CAAC;AAaD,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAgCxC,CAAC;AAQP,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA+ClC,CAAC;AAGP,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC"}
+{"version":3,"file":"ai-mcp-oauth-consent.helper.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-mcp-oauth-consent.helper.ts"],"names":[],"mappings":"AAwCA,MAAM,CAAC,MAAM,gCAAgC,GAAG,gBAAgB,CAAC;AAEjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAAC;AAE3D,MAAM,KAAK,GAAG;IACZ,EAAE,EAAE;QACF,KAAK,EAAE,UAAU;QACjB,eAAe,EAAE,0CAA0C;QAC3D,UAAU,EAAE,uBAAuB;QACnC,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,wBAAwB;QACpC,QAAQ,EAAE,gDAAgD;QAC1D,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,mCAAmC;QAC7C,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,+DAA+D;QACxE,KAAK,EAAE,oFAAoF;QAC3F,QAAQ,EAAE,oCAAoC;QAC9C,QAAQ,EAAE,6CAA6C;QACvD,QAAQ,EAAE,qEAAqE;QAC/E,WAAW,EAAE,mDAAmD;QAChE,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,uBAAuB;QACnC,aAAa,EAAE,eAAe;QAC9B,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,4DAA4D;QAC1E,WAAW,EAAE,+DAA+D;QAC5E,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,kBAAkB;QACzB,aAAa,EAAE,2BAA2B;QAC1C,OAAO,EAAE,+EAA+E;KACzF;IACD,EAAE,EAAE;QACF,KAAK,EAAE,OAAO;QACd,eAAe,EAAE,iCAAiC;QAClD,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,sBAAsB;QAClC,QAAQ,EAAE,6CAA6C;QACvD,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,6BAA6B;QACvC,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,wDAAwD;QACjE,KAAK,EAAE,oFAAoF;QAC3F,QAAQ,EAAE,iCAAiC;QAC3C,QAAQ,EAAE,iCAAiC;QAC3C,QAAQ,EAAE,uDAAuD;QACjE,WAAW,EAAE,0CAA0C;QACvD,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,qBAAqB;QACjC,aAAa,EAAE,qBAAqB;QACpC,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,uDAAuD;QACrE,WAAW,EAAE,4CAA4C;QACzD,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,wBAAwB;QACvC,OAAO,EAAE,iEAAiE;KAC3E;CAC8D,CAAC;AAGlE,MAAM,UAAU,qBAAqB,CAAC,cAAuB;IAC3D,MAAM,KAAK,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1G,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAOD,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO;QACL,eAAe,EAAE,UAAU;QAC3B,yBAAyB,EACvB,yCAAyC,KAAK,uBAAuB,KAAK,yBAAyB;YACnG,+DAA+D;QACjE,cAAc,EAAE,0BAA0B;QAC1C,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;AACJ,CAAC;AAsBD,MAAM,UAAU,yBAAyB,CACvC,IAA0B,EAC1B,UAAuC,EAAE;IAEzC,MAAM,CAAC,GAAU,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,aAAa,CAAC;IAG/D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CACtB,mBAAmB,EACnB,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE,CAAC,WAAW,UAAU,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CACnG,CAAC;IAEJ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAChF,OAAO;cACK,IAAI,CAAC,MAAM;;;;;;SAMhB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC1C,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;;;;EAIhF,IAAI;;EAEJ,UAAU,CAAC,IAAI,CAAC;;;CAGjB,CAAC;AACF,CAAC;AASD,SAAS,cAAc,CAAC,MAA0B;IAChD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,IAA0B,EAAE,CAAQ,EAAE,IAA8B;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ;QACnC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG;QACjE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC5C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;SACvG,IAAI,CAAC,IAAI,CAAC,CAAC;IAGd,MAAM,OAAO,GAAG,GAAG;QACjB,CAAC,CAAC,sBAAsB,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,GAC3G,IAAI,CAAC,YAAY;YACf,CAAC,CAAC,+DAA+D,UAAU,CAAC,GAAG,IAAI,CAAC,YAAY,WAAW,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM;YAClJ,CAAC,CAAC,EACN,MAAM;QACR,CAAC,CAAC,EAAE,CAAC;IAGP,OAAO,OAAO,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;EACjC,OAAO;EACP,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kCAAkC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KAC3F,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;oBACE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,MAAM;qBACrC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;8BACZ,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;;EAEzD,MAAM;6BACqB,6BAA6B,YAAY,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;8BACxE,gCAAgC,oCAAoC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;8BACtF,gCAAgC,gEAAgE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;QACzI,CAAC;AACT,CAAC;AAGD,SAAS,UAAU,CAAC,IAA0B;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,OAAO,MAAM,CAAC,CAAC,CAAC,kBAAkB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,MAAM,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,UAAU,CAAC,IAA0B,EAAE,CAAQ,EAAE,IAA8B;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ;QACzB,CAAC,CAAC;WACK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4CAA4C,IAAI,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;EACrJ,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;OACvF;QACH,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;KACjC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;EACzB,KAAK,EAAE,CAAC;IACR,CAAC;IACD,OAAO,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;KAC/B,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;8BACM,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;0CACV,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,0BAA0B,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,uBAAuB,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;;SAEjK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;SACnB,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;wCACS,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;;;mBAGzC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;SAChC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;8DACmC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;wCAC9C,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;;;;EAI3D,KAAK,EAAE,CAAC;AACV,CAAC;AAaD,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAgCxC,CAAC;AAQP,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA+ClC,CAAC;AAGP,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC"}

package/dist/core/modules/ai/helpers/ai-mcp-oauth.helper.js

@@ -39,6 +39,7 @@ async function mountRouter(use, oauthService, options) {
     const resourceServerUrl = new URL(`${baseUrl.replace(/\/$/, '')}${options.mcpPath}`);
     const { getOAuthProtectedResourceMetadataUrl, mcpAuthRouter } = await import('@modelcontextprotocol/sdk/server/auth/router.js');
     const provider = oauthService.buildOAuthProvider();
+    markAuthorizeReached(provider);
     let router;
     try {
         router = mcpAuthRouter({ issuerUrl, provider, resourceServerUrl });
@@ -49,7 +50,7 @@ async function mountRouter(use, oauthService, options) {
             cause: error,
         });
     }
-    use(router);
+    use(guardErrorRedirects(router));
     const mounted = {
         authBasePath: options.authBasePath,
         baseUrl: baseUrl.replace(/\/$/, ''),
@@ -64,6 +65,52 @@ async function mountRouter(use, oauthService, options) {
     logger.log(`MCP OAuth issuer: ${issuerUrl.href} (from ${source}), resource: ${resourceServerUrl.href}`);
     return mounted;
 }
+const AUTHORIZE_REACHED = Symbol('ltMcpOAuthAuthorizeReached');
+function markAuthorizeReached(provider) {
+    const authorize = provider.authorize;
+    if (typeof authorize !== 'function') {
+        return;
+    }
+    provider.authorize = (client, params, res) => {
+        if (res) {
+            res.locals = res.locals ?? {};
+            res.locals[AUTHORIZE_REACHED] = true;
+        }
+        return authorize.call(provider, client, params, res);
+    };
+}
+function guardErrorRedirects(router) {
+    return (req, res, next) => {
+        if (String(req.path ?? '')
+            .toLowerCase()
+            .replace(/\/+$/, '') === '/authorize') {
+            refuseUnvouchedErrorRedirects(res);
+        }
+        router(req, res, next);
+    };
+}
+function refuseUnvouchedErrorRedirects(res) {
+    const redirect = res.redirect.bind(res);
+    res.redirect = (...args) => {
+        const target = typeof args[0] === 'number' ? args[1] : args[0];
+        let error = null;
+        let description = null;
+        try {
+            const url = new URL(String(target));
+            error = url.searchParams.get('error');
+            description = url.searchParams.get('error_description');
+        }
+        catch {
+        }
+        if (error && !res.locals?.[AUTHORIZE_REACHED]) {
+            res
+                .status(error === 'server_error' ? 500 : 400)
+                .json({ error, ...(description ? { error_description: description } : {}) });
+            return;
+        }
+        return redirect(...args);
+    };
+}
 function mountTargetOf(app) {
     const instance = app.getHttpAdapter?.()?.getInstance?.();
     return (typeof instance === 'object' && instance !== null) || typeof instance === 'function'

package/dist/core/modules/ai/helpers/ai-mcp-oauth.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-mcp-oauth.helper.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-mcp-oauth.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAoB,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAElF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAS7C,MAAM,cAAc,GAAG,IAAI,OAAO,EAAqC,CAAC;AAoDxE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAA2B,EAC3B,UAAkD,EAAE;IAEpD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,oBAAoB,CAAC,MAAM,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,MAAM,qBAAqB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE;QAC/F,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,iBAAiB;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS;KACtC,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,GAA8B,EAC9B,YAAmC,EACnC,OAAiC;IAEjC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACxD,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAEf,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAGD,KAAK,UAAU,WAAW,CACxB,GAA8B,EAC9B,YAAmC,EACnC,OAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,EAAE,oCAAoC,EAAE,aAAa,EAAE,GAC3D,MAAM,MAAM,CAAC,iDAAiD,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,kBAAkB,EAAS,CAAC;IAE1D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAIf,MAAM,MAAM,GAAI,KAAe,CAAC,OAAO,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,WAAW,MAAM,eAAe,MAAM,EAAE,EAAE;YACjG,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,CAAC;IACZ,MAAM,OAAO,GAAqB;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACnC,SAAS,EAAE,SAAS,CAAC,IAAI;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO;QAExB,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc;QACtD,mBAAmB,EAAE,oCAAoC,CAAC,iBAAiB,CAAC;QAC5E,WAAW,EAAE,iBAAiB,CAAC,IAAI;QACnC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW;KACpC,CAAC;IACF,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,IAAI,UAAU,MAAM,gBAAgB,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;IACxG,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,aAAa,CAAC,GAA2B;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC;IACzD,OAAO,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,OAAO,QAAQ,KAAK,UAAU;QAC1F,CAAC,CAAE,QAAmB;QACtB,CAAC,CAAC,GAAG,CAAC;AACV,CAAC;AAGD,SAAS,oBAAoB,CAAC,OAAyB,EAAE,OAA+C;IACtG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,OAAO,IAAI,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,OAAO,gBAAgB,OAAO,CAAC,OAAO,qCAAqC,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,CAAC,IAAI,CACV,YAAY,OAAO,CAAC,OAAO,gBAAgB,OAAO,CAAC,OAAO,6CAA6C,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,kFAAkF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpH,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,CACR,uHAAuH,CACxH,CAAC;AACJ,CAAC;AAMD,SAAS,sBAAsB,CAAC,QAAiB,EAAE,cAAsB;IACvE,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,CAAC;IACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EACJ,QAAQ,CAAC,aAAa,KAAK,mBAAmB,CAAC,CAAC,CAAC,2BAA2B,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,gBAAgB;SAChH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oEAAoE,MAAM,EAAE,GAAG,IAAI,OAAO,KAAK;QAC7F,+EAA+E;QAC/E,sEAAsE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,WAAW,MAAM,0BAA0B,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}
+{"version":3,"file":"ai-mcp-oauth.helper.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-mcp-oauth.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAoB,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAElF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAS7C,MAAM,cAAc,GAAG,IAAI,OAAO,EAAqC,CAAC;AAoDxE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAA2B,EAC3B,UAAkD,EAAE;IAEpD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,oBAAoB,CAAC,MAAM,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,MAAM,qBAAqB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE;QAC/F,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,iBAAiB;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS;KACtC,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,GAA8B,EAC9B,YAAmC,EACnC,OAAiC;IAEjC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACxD,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAEf,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAGD,KAAK,UAAU,WAAW,CACxB,GAA8B,EAC9B,YAAmC,EACnC,OAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,EAAE,oCAAoC,EAAE,aAAa,EAAE,GAC3D,MAAM,MAAM,CAAC,iDAAiD,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,kBAAkB,EAAS,CAAC;IAC1D,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAIf,MAAM,MAAM,GAAI,KAAe,CAAC,OAAO,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,WAAW,MAAM,eAAe,MAAM,EAAE,EAAE;YACjG,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,mBAAmB,CAAC,MAAuE,CAAC,CAAC,CAAC;IAClG,MAAM,OAAO,GAAqB;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACnC,SAAS,EAAE,SAAS,CAAC,IAAI;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO;QAExB,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc;QACtD,mBAAmB,EAAE,oCAAoC,CAAC,iBAAiB,CAAC;QAC5E,WAAW,EAAE,iBAAiB,CAAC,IAAI;QACnC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW;KACpC,CAAC;IACF,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,IAAI,UAAU,MAAM,gBAAgB,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;IACxG,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,MAAM,iBAAiB,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAG/D,SAAS,oBAAoB,CAAC,QAA2D;IACvF,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAe,EAAE,MAAe,EAAE,GAAQ,EAAE,EAAE;QAClE,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC;QACvC,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC;AAWD,SAAS,mBAAmB,CAC1B,MAAqE;IAErE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IACE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;aACnB,WAAW,EAAE;aACb,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,YAAY,EACvC,CAAC;YACD,6BAA6B,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAGD,SAAS,6BAA6B,CAAC,GAAQ;IAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,GAAG,CAAC,QAAQ,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9C,GAAG;iBACA,MAAM,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;iBAC5C,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC;AAGD,SAAS,aAAa,CAAC,GAA2B;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC;IACzD,OAAO,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,OAAO,QAAQ,KAAK,UAAU;QAC1F,CAAC,CAAE,QAAmB;QACtB,CAAC,CAAC,GAAG,CAAC;AACV,CAAC;AAGD,SAAS,oBAAoB,CAAC,OAAyB,EAAE,OAA+C;IACtG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,OAAO,IAAI,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,OAAO,gBAAgB,OAAO,CAAC,OAAO,qCAAqC,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,CAAC,IAAI,CACV,YAAY,OAAO,CAAC,OAAO,gBAAgB,OAAO,CAAC,OAAO,6CAA6C,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,kFAAkF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpH,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,CACR,uHAAuH,CACxH,CAAC;AACJ,CAAC;AAMD,SAAS,sBAAsB,CAAC,QAAiB,EAAE,cAAsB;IACvE,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,CAAC;IACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EACJ,QAAQ,CAAC,aAAa,KAAK,mBAAmB,CAAC,CAAC,CAAC,2BAA2B,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,gBAAgB;SAChH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oEAAoE,MAAM,EAAE,GAAG,IAAI,OAAO,KAAK;QAC7F,+EAA+E;QAC/E,sEAAsE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,WAAW,MAAM,0BAA0B,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}

package/dist/core/modules/ai/helpers/ai-tool-authorization.helper.d.ts

@@ -0,0 +1,9 @@
+import type { AiToolAuthorization, AiToolContext, IAiTool } from '../interfaces/ai-tool.interface.js';
+export declare function authorizeToolCall(tool: IAiTool, args: Record<string, any>, context: AiToolContext): Promise<AiToolAuthorization>;
+export declare function toolRequiresConfirmation(tool: IAiTool, requireConfirmation?: boolean): boolean;
+export interface AiMcpConfirmationPolicy {
+    default: boolean;
+    enforced: boolean;
+}
+export declare function mcpConfirmationPolicy(): AiMcpConfirmationPolicy;
+export declare function effectiveMcpConfirmation(policy: AiMcpConfirmationPolicy, userChoice?: boolean | null): boolean;

package/dist/core/modules/ai/helpers/ai-tool-authorization.helper.js

@@ -0,0 +1,54 @@
+import { Logger } from '@nestjs/common';
+import { ConfigService } from '../../../common/services/config.service.js';
+const logger = new Logger('AiToolAuthorization');
+export async function authorizeToolCall(tool, args, context) {
+    if (!tool.authorize) {
+        return { allowed: true };
+    }
+    try {
+        const result = await tool.authorize(args, context);
+        if (typeof result === 'boolean') {
+            return { allowed: result };
+        }
+        if (!result || typeof result !== 'object') {
+            return { allowed: false };
+        }
+        return { ...result, allowed: result.allowed === true };
+    }
+    catch (err) {
+        logger.warn(`authorize() of AI tool "${tool.name}" threw, call refused: ${err.message}`);
+        return { allowed: false, reason: 'The authorization check for this action failed.' };
+    }
+}
+export function toolRequiresConfirmation(tool, requireConfirmation) {
+    if (tool.destructive) {
+        return true;
+    }
+    if (!tool.mutating) {
+        return false;
+    }
+    const cfg = ConfigService.get('ai.confirmation.mutating');
+    if (cfg?.enforced === true) {
+        return true;
+    }
+    return requireConfirmation ?? cfg?.default === true;
+}
+export function mcpConfirmationPolicy() {
+    const mcp = ConfigService.get('ai.mcp');
+    const setting = mcp && typeof mcp === 'object' ? mcp.confirmation : undefined;
+    if (setting === false) {
+        return { default: false, enforced: false };
+    }
+    if (setting && typeof setting === 'object') {
+        const { default: defaultValue, enforced } = setting;
+        return { default: defaultValue !== false, enforced: enforced === true };
+    }
+    return { default: true, enforced: false };
+}
+export function effectiveMcpConfirmation(policy, userChoice) {
+    if (policy.enforced || typeof userChoice !== 'boolean') {
+        return policy.default;
+    }
+    return userChoice;
+}
+//# sourceMappingURL=ai-tool-authorization.helper.js.map

package/dist/core/modules/ai/helpers/ai-tool-authorization.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-tool-authorization.helper.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-tool-authorization.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAG3E,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAUjD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAa,EACb,IAAyB,EACzB,OAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,IAAI,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IACvF,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,wBAAwB,CAAC,IAAa,EAAE,mBAA6B;IACnF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAC3B,0BAA0B,CAC3B,CAAC;IACF,IAAI,GAAG,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,mBAAmB,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;AACtD,CAAC;AAgBD,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAU,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAkC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,OAAoD,CAAC;QACjG,OAAO,EAAE,OAAO,EAAE,YAAY,KAAK,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAMD,MAAM,UAAU,wBAAwB,CAAC,MAA+B,EAAE,UAA2B;IACnG,IAAI,MAAM,CAAC,QAAQ,IAAI,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/core/modules/ai/index.d.ts

@@ -1,6 +1,9 @@
 export * from './core-ai-mcp-oauth.initializer.js';
 export * from './core-ai-mcp.controller.js';
 export * from './helpers/ai-mcp-oauth.helper.js';
+export { MCP_OAUTH_CONSENT_DECISION_FIELD, MCP_OAUTH_CONSENT_TOKEN_FIELD, mcpOAuthConsentLocale, renderMcpOAuthConsentPage, } from './helpers/ai-mcp-oauth-consent.helper.js';
+export type { IMcpOAuthConsentPageOptions, IMcpOAuthConsentView, McpOAuthConsentLocale, McpOAuthConsentTexts, } from './helpers/ai-mcp-oauth-consent.helper.js';
+export * from './helpers/ai-tool-authorization.helper.js';
 export * from './core-ai.controller.js';
 export * from './core-ai.module.js';
 export * from './core-ai.resolver.js';
@@ -18,6 +21,7 @@ export * from './inputs/core-ai-prompt-update.input.js';
 export * from './inputs/core-ai-slot-create.input.js';
 export * from './inputs/core-ai-slot-update.input.js';
 export * from './inputs/core-ai-prompt.input.js';
+export * from './inputs/core-ai-settings.input.js';
 export * from './hooks/ai-hook.base.js';
 export * from './hooks/ai-hook.registry.js';
 export * from './interfaces/ai-interaction-record.interface.js';
@@ -40,6 +44,8 @@ export * from './models/core-ai-slot.model.js';
 export * from './models/core-ai-tool-grant.model.js';
 export * from './models/core-ai-mode.model.js';
 export * from './models/core-ai-tool-policy.model.js';
+export * from './models/core-ai-settings.model.js';
+export * from './models/core-ai-user-setting.model.js';
 export * from './models/core-ai-response.model.js';
 export * from './models/core-ai-usage-info.model.js';
 export * from './models/core-ai-usage.model.js';
@@ -64,6 +70,7 @@ export * from './services/core-ai-tool-grant.service.js';
 export * from './services/core-ai-mcp-client.service.js';
 export * from './services/core-ai-mode.service.js';
 export * from './services/core-ai-tool-policy.service.js';
+export * from './services/core-ai-user-setting.service.js';
 export * from './services/core-ai.service.js';
 export * from './tools/ai-tool.base.js';
 export * from './tools/ai-tool.registry.js';

package/dist/core/modules/ai/index.js

@@ -1,6 +1,8 @@
 export * from './core-ai-mcp-oauth.initializer.js';
 export * from './core-ai-mcp.controller.js';
 export * from './helpers/ai-mcp-oauth.helper.js';
+export { MCP_OAUTH_CONSENT_DECISION_FIELD, MCP_OAUTH_CONSENT_TOKEN_FIELD, mcpOAuthConsentLocale, renderMcpOAuthConsentPage, } from './helpers/ai-mcp-oauth-consent.helper.js';
+export * from './helpers/ai-tool-authorization.helper.js';
 export * from './core-ai.controller.js';
 export * from './core-ai.module.js';
 export * from './core-ai.resolver.js';
@@ -18,6 +20,7 @@ export * from './inputs/core-ai-prompt-update.input.js';
 export * from './inputs/core-ai-slot-create.input.js';
 export * from './inputs/core-ai-slot-update.input.js';
 export * from './inputs/core-ai-prompt.input.js';
+export * from './inputs/core-ai-settings.input.js';
 export * from './hooks/ai-hook.base.js';
 export * from './hooks/ai-hook.registry.js';
 export * from './interfaces/ai-interaction-record.interface.js';
@@ -40,6 +43,8 @@ export * from './models/core-ai-slot.model.js';
 export * from './models/core-ai-tool-grant.model.js';
 export * from './models/core-ai-mode.model.js';
 export * from './models/core-ai-tool-policy.model.js';
+export * from './models/core-ai-settings.model.js';
+export * from './models/core-ai-user-setting.model.js';
 export * from './models/core-ai-response.model.js';
 export * from './models/core-ai-usage-info.model.js';
 export * from './models/core-ai-usage.model.js';
@@ -64,6 +69,7 @@ export * from './services/core-ai-tool-grant.service.js';
 export * from './services/core-ai-mcp-client.service.js';
 export * from './services/core-ai-mode.service.js';
 export * from './services/core-ai-tool-policy.service.js';
+export * from './services/core-ai-user-setting.service.js';
 export * from './services/core-ai.service.js';
 export * from './tools/ai-tool.base.js';
 export * from './tools/ai-tool.registry.js';

package/dist/core/modules/ai/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/modules/ai/index.ts"],"names":[],"mappings":"AACA,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,+CAA+C,CAAC;AAC9D,cAAc,wCAAwC,CAAC;AACvD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,iDAAiD,CAAC;AAChE,cAAc,sCAAsC,CAAC;AACrD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,uCAAuC,CAAC;AACtD,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,kCAAkC,CAAC;AACjD,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iDAAiD,CAAC;AAChE,cAAc,mCAAmC,CAAC;AAClD,cAAc,0CAA0C,CAAC;AACzD,cAAc,mCAAmC,CAAC;AAClD,cAAc,wCAAwC,CAAC;AACvD,cAAc,kDAAkD,CAAC;AACjE,cAAc,kCAAkC,CAAC;AACjD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,wCAAwC,CAAC;AACvD,cAAc,iDAAiD,CAAC;AAChE,cAAc,sCAAsC,CAAC;AACrD,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,sCAAsC,CAAC;AACrD,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,qCAAqC,CAAC;AACpD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,iCAAiC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,mCAAmC,CAAC;AAClD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,sCAAsC,CAAC;AACrD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/modules/ai/index.ts"],"names":[],"mappings":"AACA,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AAEjD,OAAO,EACL,gCAAgC,EAChC,6BAA6B,EAC7B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,0CAA0C,CAAC;AAOlD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,+CAA+C,CAAC;AAC9D,cAAc,wCAAwC,CAAC;AACvD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,iDAAiD,CAAC;AAChE,cAAc,sCAAsC,CAAC;AACrD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,uCAAuC,CAAC;AACtD,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iDAAiD,CAAC;AAChE,cAAc,mCAAmC,CAAC;AAClD,cAAc,0CAA0C,CAAC;AACzD,cAAc,mCAAmC,CAAC;AAClD,cAAc,wCAAwC,CAAC;AACvD,cAAc,kDAAkD,CAAC;AACjE,cAAc,kCAAkC,CAAC;AACjD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,wCAAwC,CAAC;AACvD,cAAc,iDAAiD,CAAC;AAChE,cAAc,sCAAsC,CAAC;AACrD,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,sCAAsC,CAAC;AACrD,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,qCAAqC,CAAC;AACpD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,iCAAiC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,mCAAmC,CAAC;AAClD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,sCAAsC,CAAC;AACrD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8BAA8B,CAAC"}

package/dist/core/modules/ai/inputs/core-ai-settings.input.d.ts

@@ -0,0 +1,3 @@
+export declare class CoreAiSettingsInput {
+    mcpConfirmation?: boolean;
+}

package/dist/core/modules/ai/inputs/core-ai-settings.input.js

@@ -0,0 +1,31 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { InputType } from '@nestjs/graphql';
+import { Restricted } from '../../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+let CoreAiSettingsInput = class CoreAiSettingsInput {
+    mcpConfirmation = undefined;
+};
+__decorate([
+    UnifiedField({
+        description: 'Whether MCP asks before a tool that needs confirmation',
+        isOptional: true,
+        roles: RoleEnum.S_USER,
+        type: () => Boolean,
+    }),
+    __metadata("design:type", Boolean)
+], CoreAiSettingsInput.prototype, "mcpConfirmation", void 0);
+CoreAiSettingsInput = __decorate([
+    InputType({ description: "Changes to the current user's AI settings" }),
+    Restricted(RoleEnum.S_USER)
+], CoreAiSettingsInput);
+export { CoreAiSettingsInput };
+//# sourceMappingURL=core-ai-settings.input.js.map

package/dist/core/modules/ai/inputs/core-ai-settings.input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-ai-settings.input.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/inputs/core-ai-settings.input.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,MAAM,oDAAoD,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,uDAAuD,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAOvD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAW9B,eAAe,GAAa,SAAS,CAAC;CACvC,CAAA;AADC;IANC,YAAY,CAAC;QACZ,WAAW,EAAE,wDAAwD;QACrE,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO;KACpB,CAAC;;4DACoC;AAX3B,mBAAmB;IAF/B,SAAS,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;IACvE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;GACf,mBAAmB,CAY/B"}

package/dist/core/modules/ai/interfaces/ai-tool.interface.d.ts

@@ -6,11 +6,13 @@ export interface AiToolContext {
         id: string;
         roles?: string[];
     };
+    authorization?: AiToolAuthorization;
     language?: string;
     serviceOptions: ServiceOptions;
 }
 export interface AiToolAuthorization {
     allowed: boolean;
+    data?: unknown;
     reason?: string;
 }
 export interface AiToolResult {

package/dist/core/modules/ai/models/core-ai-settings.model.d.ts

@@ -0,0 +1,4 @@
+export declare class CoreAiSettings {
+    mcpConfirmation: boolean;
+    mcpConfirmationEnforced: boolean;
+}

package/dist/core/modules/ai/models/core-ai-settings.model.js

@@ -0,0 +1,30 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Field, ObjectType } from '@nestjs/graphql';
+import { Restricted } from '../../../common/decorators/restricted.decorator.js';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+let CoreAiSettings = class CoreAiSettings {
+    mcpConfirmation;
+    mcpConfirmationEnforced;
+};
+__decorate([
+    Field(() => Boolean, { description: 'Whether MCP asks before a tool that needs confirmation' }),
+    __metadata("design:type", Boolean)
+], CoreAiSettings.prototype, "mcpConfirmation", void 0);
+__decorate([
+    Field(() => Boolean, { description: 'Whether the server fixed mcpConfirmation, so it cannot be changed' }),
+    __metadata("design:type", Boolean)
+], CoreAiSettings.prototype, "mcpConfirmationEnforced", void 0);
+CoreAiSettings = __decorate([
+    ObjectType({ description: "The current user's effective AI settings" }),
+    Restricted(RoleEnum.S_EVERYONE)
+], CoreAiSettings);
+export { CoreAiSettings };
+//# sourceMappingURL=core-ai-settings.model.js.map

package/dist/core/modules/ai/models/core-ai-settings.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-ai-settings.model.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/models/core-ai-settings.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,oDAAoD,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAQvD,IAAM,cAAc,GAApB,MAAM,cAAc;IAMzB,eAAe,CAAU;IAIzB,uBAAuB,CAAU;CAClC,CAAA;AALC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,wDAAwD,EAAE,CAAC;;uDACvE;AAIzB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,mEAAmE,EAAE,CAAC;;+DAC1E;AAVtB,cAAc;IAF1B,UAAU,CAAC,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;IACvE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;GACnB,cAAc,CAW1B"}

package/dist/core/modules/ai/models/core-ai-user-setting.model.d.ts

@@ -0,0 +1,8 @@
+import type { Document } from 'mongoose';
+import { CorePersistenceModel } from '../../../common/models/core-persistence.model.js';
+export type AiUserSettingDocument = CoreAiUserSetting & Document;
+export declare class CoreAiUserSetting extends CorePersistenceModel {
+    mcpConfirmation?: boolean;
+    userId: string;
+}
+export declare const AiUserSettingSchema: any;

package/dist/core/modules/ai/models/core-ai-user-setting.model.js

@@ -0,0 +1,45 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { ObjectType } from '@nestjs/graphql';
+import { Schema as MongooseSchema, SchemaFactory } from '../../../common/persistence/mongo/mongoose-compat.js';
+import { Restricted } from '../../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { CorePersistenceModel } from '../../../common/models/core-persistence.model.js';
+let CoreAiUserSetting = class CoreAiUserSetting extends CorePersistenceModel {
+    mcpConfirmation = undefined;
+    userId = undefined;
+};
+__decorate([
+    UnifiedField({
+        description: 'Whether MCP asks this user before a tool that needs confirmation (unset = server default)',
+        isOptional: true,
+        mongoose: true,
+        roles: RoleEnum.ADMIN,
+        type: () => Boolean,
+    }),
+    __metadata("design:type", Boolean)
+], CoreAiUserSetting.prototype, "mcpConfirmation", void 0);
+__decorate([
+    UnifiedField({
+        description: 'The user the settings belong to',
+        mongoose: { unique: true },
+        roles: RoleEnum.ADMIN,
+    }),
+    __metadata("design:type", String)
+], CoreAiUserSetting.prototype, "userId", void 0);
+CoreAiUserSetting = __decorate([
+    MongooseSchema({ collection: 'aiUserSettings', timestamps: true }),
+    ObjectType({ description: 'Personal AI settings of one user' }),
+    Restricted(RoleEnum.ADMIN)
+], CoreAiUserSetting);
+export { CoreAiUserSetting };
+export const AiUserSettingSchema = SchemaFactory.createForClass(CoreAiUserSetting);
+//# sourceMappingURL=core-ai-user-setting.model.js.map

package/dist/core/modules/ai/models/core-ai-user-setting.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-ai-user-setting.model.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/models/core-ai-user-setting.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AAG/G,OAAO,EAAE,UAAU,EAAE,MAAM,oDAAoD,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,uDAAuD,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAejF,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,oBAAoB;IAYzD,eAAe,GAAa,SAAS,CAAC;IAQtC,MAAM,GAAW,SAAS,CAAC;CAC5B,CAAA;AATC;IAPC,YAAY,CAAC;QACZ,WAAW,EAAE,2FAA2F;QACxG,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO;KACpB,CAAC;;0DACoC;AAQtC;IALC,YAAY,CAAC;QACZ,WAAW,EAAE,iCAAiC;QAC9C,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC1B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC;;iDACyB;AApBhB,iBAAiB;IAH7B,cAAc,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAClE,UAAU,CAAC,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAC/D,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;GACd,iBAAiB,CAqB7B;;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/core/modules/ai/services/core-ai-conversation.service.d.ts

@@ -1,3 +1,4 @@
+import { Logger } from '@nestjs/common';
 import type { Connection, Model } from 'mongoose';
 import { ServiceOptions } from '../../../common/interfaces/service-options.interface.js';
 import { CrudService } from '../../../common/services/crud.service.js';
@@ -10,17 +11,19 @@ export declare class CoreAiConversationService extends CrudService<CoreAiConvers
     protected readonly mainDbModel: Model<AiConversationDocument>;
     protected readonly mainModelConstructor: CoreModelConstructor<CoreAiConversation>;
     protected readonly connection: Connection;
+    protected readonly logger: Logger;
     protected readonly maxRetainedMessages = 500;
     constructor(mainDbModel: Model<AiConversationDocument>, mainModelConstructor: CoreModelConstructor<CoreAiConversation>, connection: Connection);
     findForCurrentUser(serviceOptions?: ServiceOptions, options?: {
         all?: boolean;
     }): Promise<CoreAiConversation[]>;
     protected attachCreators(conversations: CoreAiConversation[]): Promise<void>;
+    isOwnedBy(id: string, userId: string | undefined): Promise<boolean>;
     appendMessage(id: string, message: {
         content: string;
         createdAt?: Date;
         role: string;
-    }): Promise<void>;
+    }, ownerId: string | undefined): Promise<void>;
     loadRecentMessages(id: string, currentUser: {
         id?: string;
         roles?: string[];

package/dist/core/modules/ai/services/core-ai-conversation.service.js

@@ -10,7 +10,8 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Inject, Injectable } from '@nestjs/common';
+var CoreAiConversationService_1;
+import { Inject, Injectable, Logger } from '@nestjs/common';
 import { InjectConnection, InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
 import { RoleEnum } from '../../../common/enums/role.enum.js';
 import { isWellFormedId } from '../../../common/persistence/id-format.js';
@@ -18,10 +19,11 @@ import { getModelStore } from '../../../common/persistence/persistence-runtime.r
 import { CrudService } from '../../../common/services/crud.service.js';
 import { AI_CONVERSATION_CLASS, AI_CONVERSATION_MODEL } from '../core-ai.constants.js';
 export { AI_CONVERSATION_CLASS, AI_CONVERSATION_MODEL } from '../core-ai.constants.js';
-let CoreAiConversationService = class CoreAiConversationService extends CrudService {
+let CoreAiConversationService = CoreAiConversationService_1 = class CoreAiConversationService extends CrudService {
     mainDbModel;
     mainModelConstructor;
     connection;
+    logger = new Logger(CoreAiConversationService_1.name);
     maxRetainedMessages = 500;
     constructor(mainDbModel, mainModelConstructor, connection) {
         super();
@@ -80,7 +82,17 @@ let CoreAiConversationService = class CoreAiConversationService extends CrudServ
             conversation.createdByUser = byId.get(String(conversation.createdBy));
         }
     }
-    async appendMessage(id, message) {
+    async isOwnedBy(id, userId) {
+        if (!isWellFormedId(id) || !isWellFormedId(userId)) {
+            return false;
+        }
+        return !!(await this.dataStore.findOne({ createdBy: userId, id }, { select: ['id'] }));
+    }
+    async appendMessage(id, message, ownerId) {
+        if (!(await this.isOwnedBy(id, ownerId))) {
+            this.logger.warn(`Message not appended: conversation ${id} is not owned by user ${ownerId ?? '(none)'}`);
+            return;
+        }
         await this.dataStore.pushToArray(id, 'messages', [{ ...message, createdAt: message.createdAt ?? new Date() }], {
             slice: -this.maxRetainedMessages,
         });
@@ -108,7 +120,7 @@ let CoreAiConversationService = class CoreAiConversationService extends CrudServ
         }));
     }
 };
-CoreAiConversationService = __decorate([
+CoreAiConversationService = CoreAiConversationService_1 = __decorate([
     Injectable(),
     __param(0, InjectModel(AI_CONVERSATION_MODEL)),
     __param(1, Inject(AI_CONVERSATION_CLASS)),

package/dist/core/modules/ai/services/core-ai-conversation.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-ai-conversation.service.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/services/core-ai-conversation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sDAAsD,CAAC;AAGrG,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAE5F,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAMvE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAOvF,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAiBhF,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,WAI9C;IAKmE;IAEpC;IACW;IANtB,mBAAmB,GAAG,GAAG,CAAC;IAE7C,YACkE,WAA0C,EAE9E,oBAA8D,EACnD,UAAsB;QAE7D,KAAK,EAAE,CAAC;QALwD,gBAAW,GAAX,WAAW,CAA+B;QAE9E,yBAAoB,GAApB,oBAAoB,CAA0C;QACnD,eAAU,GAAV,UAAU,CAAY;IAG/D,CAAC;IA4BD,KAAK,CAAC,kBAAkB,CACtB,cAA+B,EAC/B,OAA2B;QAE3B,MAAM,WAAW,GAAG,cAAc,EAAE,WAAW,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QACjE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CACnC,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAC1D,EAAE,GAAG,cAAc,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CACrE,CAAC;QAGF,IAAI,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAUS,KAAK,CAAC,cAAc,CAAC,aAAmC;QAChE,MAAM,GAAG,GAAG;YACV,GAAG,IAAI,GAAG,CACR,aAAa;iBACV,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC7C,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,MAAM,CAAC,CACf;SACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QAGD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAA8B,CAAC;QAC1E,IAAI,KAAgB,CAAC;QACrB,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACjH,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,KAAK,GAAG,MAAM,SAAS;iBACpB,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;iBAC3B,MAAM,CAAC,mCAAmC,CAAC;iBAC3C,IAAI,EAAE;iBACN,IAAI,EAAE,CAAC;QACZ,CAAC;aAAM,CAAC;YAEN,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,CACjB,KAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;YAC3B;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB;SACF,CAAC,CACH,CAAC;QACF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,YAAY,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAQD,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,OAA4D;QAC1F,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,EAAE;YAC7G,KAAK,EAAE,CAAC,IAAI,CAAC,mBAAmB;SACjC,CAAC,CAAC;IACL,CAAC;IAkBD,KAAK,CAAC,kBAAkB,CACtB,EAAU,EACV,WAA0D,EAC1D,KAAK,GAAG,EAAE;QAEV,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAI,GAAgC,CAAC,QAAQ,CAAC;QAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,GAAgC,CAAC,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,EAAE,EAAE,IAAI,MAAM,CAAE,GAA+B,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjH,MAAM,OAAO,GAAG,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,CAAE,GAA0D,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAA;AA7KY,yBAAyB;IADrC,UAAU,EAAE;IAUR,WAAA,WAAW,CAAC,qBAAqB,CAAC,CAAA;IAClC,WAAA,MAAM,CAAC,qBAAqB,CAAC,CAAA;IAE7B,WAAA,gBAAgB,EAAE,CAAA;;GAZV,yBAAyB,CA6KrC"}
+{"version":3,"file":"core-ai-conversation.service.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/services/core-ai-conversation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sDAAsD,CAAC;AAGrG,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,6DAA6D,CAAC;AAE5F,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAMvE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAOvF,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAiBhF,IAAM,yBAAyB,iCAA/B,MAAM,yBAA0B,SAAQ,WAI9C;IAOmE;IAEpC;IACW;IATtB,MAAM,GAAG,IAAI,MAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;IAGpD,mBAAmB,GAAG,GAAG,CAAC;IAE7C,YACkE,WAA0C,EAE9E,oBAA8D,EACnD,UAAsB;QAE7D,KAAK,EAAE,CAAC;QALwD,gBAAW,GAAX,WAAW,CAA+B;QAE9E,yBAAoB,GAApB,oBAAoB,CAA0C;QACnD,eAAU,GAAV,UAAU,CAAY;IAG/D,CAAC;IA4BD,KAAK,CAAC,kBAAkB,CACtB,cAA+B,EAC/B,OAA2B;QAE3B,MAAM,WAAW,GAAG,cAAc,EAAE,WAAW,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QACjE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CACnC,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAC1D,EAAE,GAAG,cAAc,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CACrE,CAAC;QAGF,IAAI,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAUS,KAAK,CAAC,cAAc,CAAC,aAAmC;QAChE,MAAM,GAAG,GAAG;YACV,GAAG,IAAI,GAAG,CACR,aAAa;iBACV,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC7C,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,MAAM,CAAC,CACf;SACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QAGD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAA8B,CAAC;QAC1E,IAAI,KAAgB,CAAC;QACrB,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACjH,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,KAAK,GAAG,MAAM,SAAS;iBACpB,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;iBAC3B,MAAM,CAAC,mCAAmC,CAAC;iBAC3C,IAAI,EAAE;iBACN,IAAI,EAAE,CAAC;QACZ,CAAC;aAAM,CAAC;YAEN,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,CACjB,KAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;YAC3B;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB;SACF,CAAC,CACH,CAAC;QACF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,YAAY,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAOD,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAA0B;QACpD,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAWD,KAAK,CAAC,aAAa,CACjB,EAAU,EACV,OAA4D,EAC5D,OAA2B;QAE3B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,yBAAyB,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,EAAE;YAC7G,KAAK,EAAE,CAAC,IAAI,CAAC,mBAAmB;SACjC,CAAC,CAAC;IACL,CAAC;IAkBD,KAAK,CAAC,kBAAkB,CACtB,EAAU,EACV,WAA0D,EAC1D,KAAK,GAAG,EAAE;QAEV,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAI,GAAgC,CAAC,QAAQ,CAAC;QAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,GAAgC,CAAC,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,EAAE,EAAE,IAAI,MAAM,CAAE,GAA+B,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjH,MAAM,OAAO,GAAG,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,CAAE,GAA0D,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAA;AAtMY,yBAAyB;IADrC,UAAU,EAAE;IAYR,WAAA,WAAW,CAAC,qBAAqB,CAAC,CAAA;IAClC,WAAA,MAAM,CAAC,qBAAqB,CAAC,CAAA;IAE7B,WAAA,gBAAgB,EAAE,CAAA;;GAdV,yBAAyB,CAsMrC"}

package/dist/core/modules/ai/services/core-ai-mcp-oauth.service.js

@@ -313,12 +313,8 @@ let CoreAiMcpOAuthService = CoreAiMcpOAuthService_1 = class CoreAiMcpOAuthServic
         const req = res?.req;
         const user = await this.consentUser(req);
         const decision = req?.method === 'POST' ? req.body?.[MCP_OAUTH_CONSENT_DECISION_FIELD] : undefined;
-        if (user && decision === 'deny') {
-            const { AccessDeniedError } = await this.loadOAuthErrors();
-            throw new AccessDeniedError('The user denied access');
-        }
         let notice;
-        if (user && decision === 'approve') {
+        if (user && (decision === 'approve' || decision === 'deny')) {
             const binding = {
                 clientId: String(client.client_id),
                 codeChallenge: String(params.codeChallenge),
@@ -326,6 +322,10 @@ let CoreAiMcpOAuthService = CoreAiMcpOAuthService_1 = class CoreAiMcpOAuthServic
                 userId: user.id,
             };
             const verdict = this.verifyConsentToken(req.body?.[MCP_OAUTH_CONSENT_TOKEN_FIELD], binding);
+            if (verdict === 'valid' && decision === 'deny') {
+                const { AccessDeniedError } = await this.loadOAuthErrors();
+                throw new AccessDeniedError('The user denied access');
+            }
             if (verdict === 'valid') {
                 const code = this.generateId();
                 await this.saveAuthorizationCode(code, {
@@ -346,7 +346,7 @@ let CoreAiMcpOAuthService = CoreAiMcpOAuthService_1 = class CoreAiMcpOAuthServic
             }
             else {
                 this.logger.warn(`MCP OAuth consent for client ${binding.clientId} carried an invalid token (forged, tampered, or from ` +
-                    'another session); no code issued, the form is shown again.');
+                    'another session); neither approved nor denied, the form is shown again.');
             }
         }
         const view = this.buildConsentView(req, client, params, user, notice);