@nestjs/authentication 0.1.3 → 0.1.4

package/dist/context/authentication-scope.service.d.ts

@@ -36,7 +36,9 @@ export declare class AuthenticationScope {
      * GraphQL resolver whose context carries `req` (and `res`), or an
      * `@nestjs/mcp` call that arrived over HTTP (its context, the second of
      * its arguments, carries `request`). An MCP call has no response of its own
-     * to set cookies on: the MCP SDK writes the HTTP response.
+     * to set cookies on: the MCP SDK writes the HTTP response. An `@nestjs/ai`
+     * agent function called in an HTTP request carries it the same way, and has
+     * no response either: the route that runs the agent owns it.
      */
     exchange(): HttpExchange | undefined;
 }

package/dist/context/authentication-scope.service.js

@@ -43,7 +43,9 @@ let AuthenticationScope = class AuthenticationScope {
      * GraphQL resolver whose context carries `req` (and `res`), or an
      * `@nestjs/mcp` call that arrived over HTTP (its context, the second of
      * its arguments, carries `request`). An MCP call has no response of its own
-     * to set cookies on: the MCP SDK writes the HTTP response.
+     * to set cookies on: the MCP SDK writes the HTTP response. An `@nestjs/ai`
+     * agent function called in an HTTP request carries it the same way, and has
+     * no response either: the route that runs the agent owns it.
      */
     exchange() {
         const context = this.current?.context;
@@ -56,7 +58,8 @@ let AuthenticationScope = class AuthenticationScope {
                 const gql = context.getArgByIndex(2);
                 return gql?.req ? { request: gql.req, response: gql.res } : undefined;
             }
-            case 'mcp': {
+            case 'mcp':
+            case 'ai': {
                 const request = context.getArgByIndex(1)?.request;
                 return request?.headers ? { request } : undefined;
             }

package/dist/utils/auth-state.util.d.ts

@@ -45,9 +45,9 @@ export declare function getRawResult(context: ExecutionContext): State | undefin
 export declare function getRequestHeaders(context: ExecutionContext): Headers | undefined;
 /**
  * The request behind a call, as far as authentication needs it: headers,
- * and the method for HTTP, GraphQL and MCP (a WebSocket handshake has none,
- * so it counts as a safe request). `undefined` for RPC, and for MCP over
- * stdio.
+ * and the method for HTTP, GraphQL, MCP and agent functions (a WebSocket
+ * handshake has none, so it counts as a safe request). `undefined` for RPC,
+ * for MCP over stdio, and for an agent function called in a job.
  */
 export declare function requestOf(context: ExecutionContext): {
     headers: Headers;

package/dist/utils/auth-state.util.js

@@ -29,13 +29,14 @@ function callKeys(context) {
     return keys;
 }
 /**
- * The context of an `@nestjs/mcp` call (a tool, resource or prompt), read from
- * its arguments, `[input, context]`, so this package needs no `@nestjs/mcp`
- * dependency. Its `request` is the HTTP platform's request (a plain
+ * The context of an `@nestjs/mcp` call (a tool, resource or prompt) or of an
+ * `@nestjs/ai` agent function call, read from its arguments, `[input,
+ * context]`, so this package needs neither dependency. Its `request` is the
+ * HTTP platform's request: the one an MCP call arrived in (a plain
  * `{ method, url, headers }` object for `@nestjs/mcp/testing`'s in-memory
- * client), absent over stdio.
+ * client), or the one the agent runs in. Absent over stdio, and in a job.
  */
-function mcpCallOf(context) {
+function callContextOf(context) {
     const call = context.getArgByIndex(1);
     return typeof call === 'object' && call !== null ? call : undefined;
 }
@@ -48,7 +49,9 @@ function mcpCallOf(context) {
  * request it arrived in, else (over stdio) its own context object. Each MCP
  * request travels in an HTTP request of its own, so the request is per call,
  * and it is the one the endpoint's route was authenticated on: a guard there
- * and on the call authenticate once.
+ * and on the call authenticate once. An agent function call (`ai`) is carried
+ * the same way: the HTTP request the agent runs in, which the route that runs
+ * it authenticated, else (in a job) its own context object.
  */
 function carrierOf(context) {
     switch (context.getType()) {
@@ -62,8 +65,9 @@ function carrierOf(context) {
         }
         case 'graphql':
             return context.getArgByIndex(2)?.req;
-        case 'mcp': {
-            const call = mcpCallOf(context);
+        case 'mcp':
+        case 'ai': {
+            const call = callContextOf(context);
             return call?.request ?? call;
         }
         default:
@@ -206,9 +210,9 @@ export function getRequestHeaders(context) {
 }
 /**
  * The request behind a call, as far as authentication needs it: headers,
- * and the method for HTTP, GraphQL and MCP (a WebSocket handshake has none,
- * so it counts as a safe request). `undefined` for RPC, and for MCP over
- * stdio.
+ * and the method for HTTP, GraphQL, MCP and agent functions (a WebSocket
+ * handshake has none, so it counts as a safe request). `undefined` for RPC,
+ * for MCP over stdio, and for an agent function called in a job.
  */
 export function requestOf(context) {
     switch (context.getType()) {
@@ -221,8 +225,9 @@ export function requestOf(context) {
         }
         case 'graphql':
             return context.getArgByIndex(2)?.req;
-        case 'mcp': {
-            const request = mcpCallOf(context)?.request;
+        case 'mcp':
+        case 'ai': {
+            const request = callContextOf(context)?.request;
             return request?.headers ? request : undefined;
         }
         default:

package/dist/utils/transport-errors.util.js

@@ -74,6 +74,10 @@ export async function refusal(context, { status = 401, message, code, details, c
             // MCP SDK writes the HTTP response, so no challenge goes with it: an MCP client learns where to sign in from
             // the endpoint's own 401 (`@nestjs/mcp`'s `auth` option).
             break;
+        case 'ai':
+            // Nest's own exception too, which `@nestjs/ai` gives the model as the function's error. The route that runs
+            // the agent owns the HTTP response, so no challenge goes with it.
+            break;
     }
     const Exception = status === 409 ? ConflictException : status === 403 ? ForbiddenException : UnauthorizedException;
     // Nest builds the body: `error` is the code (the description) or the status phrase, then `errorCode`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/authentication",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Nest - modern, fast, powerful node.js web framework (@authentication)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -46,21 +46,21 @@
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-socket": "0.2.11",
     "@nestjs/apollo": "14.0.1",
-    "@nestjs/authorization": "0.1.0",
-    "@nestjs/common": "12.3.2",
-    "@nestjs/core": "12.3.2",
+    "@nestjs/authorization": "0.1.1",
+    "@nestjs/common": "12.3.3",
+    "@nestjs/core": "12.3.3",
     "@nestjs/drizzle": "0.0.2",
     "@nestjs/graphql": "14.0.1",
     "@nestjs/idempotency": "0.0.3",
     "@nestjs/mail": "0.0.1",
-    "@nestjs/microservices": "12.3.2",
-    "@nestjs/platform-express": "12.3.2",
-    "@nestjs/platform-fastify": "12.3.2",
-    "@nestjs/platform-ws": "12.3.2",
+    "@nestjs/microservices": "12.3.3",
+    "@nestjs/platform-express": "12.3.3",
+    "@nestjs/platform-fastify": "12.3.3",
+    "@nestjs/platform-ws": "12.3.3",
     "@nestjs/resilience": "0.0.3",
-    "@nestjs/testing": "12.3.2",
+    "@nestjs/testing": "12.3.3",
     "@nestjs/throttler": "6.7.1",
-    "@nestjs/websockets": "12.3.2",
+    "@nestjs/websockets": "12.3.3",
     "@types/node": "24.19.2",
     "@types/pg": "8.23.1",
     "@types/supertest": "7.2.1",