@owox/backend 0.35.0 → 0.36.0

package/dist/src/ee/mcp/tools/update-report.tool.js

@@ -14,7 +14,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpdateReportTool = exports.updateReportInputSchema = void 0;
 const common_1 = require("@nestjs/common");
-const zod_1 = require("zod");
+const zod_v4_1 = require("zod-v4");
 const mcp_reports_facade_1 = require("../../../data-marts/facades/mcp-reports.facade");
 const mcp_destination_type_1 = require("../../../data-marts/facades/mcp-destination-type");
 const mcp_tool_definition_1 = require("./mcp-tool.definition");
@@ -27,56 +27,56 @@ const EMAIL_FAMILY_DESTINATION_TYPES = new Set(['email', 'slack', 'teams', 'goog
 function isEmailFamily(type) {
     return EMAIL_FAMILY_DESTINATION_TYPES.has(type);
 }
-const baseInputSchema = zod_1.z
+const baseInputSchema = zod_v4_1.z
     .object({
-    report_id: zod_1.z.string().min(1),
-    fields: zod_1.z
-        .array(zod_1.z.string().min(1))
+    report_id: zod_v4_1.z.string().min(1),
+    fields: zod_v4_1.z
+        .array(zod_v4_1.z.string().min(1))
         .min(1)
         .optional()
         .describe("Replacement column selection, e.g. ['field_name_1', 'field_name_2'], or ['*'] for every field; omit to keep current. At least one change parameter is required."),
-    filters: zod_1.z
+    filters: zod_v4_1.z
         .array((0, query_data_mart_input_1.makeMcpFilterSchema)())
         .optional()
         .describe('Replacement row filters applied on every report run — same shape and operator vocabulary as query_data_mart\'s "filters". Replaces only the current row filters MCP can express (stored slices are untouched); rules created in the OWOX UI that MCP cannot express — post-aggregation (HAVING) constraints, regex, calendar presets such as today or last month — are kept automatically and listed as ui_only_filters. Copy the filters to keep from get_data_mart_reports; pass [] to remove every expressible row filter; omit to keep current.'),
-    slices: zod_1.z
+    slices: zod_v4_1.z
         .array((0, query_data_mart_input_1.makeMcpFilterSchema)())
         .optional()
         .describe('Replacement pre-join filters (blended data marts only), same as query_data_mart\'s "slices". Replaces only the current slices MCP can express (stored row filters and UI-only slices are untouched); pass [] to remove every expressible slice; omit to keep current.'),
-    aggregations: zod_1.z
+    aggregations: zod_v4_1.z
         .array((0, query_data_mart_input_1.makeMcpReportAggregationSchema)())
         .optional()
         .describe('Replacement aggregations, same as query_data_mart\'s "aggregations" plus the report-only STRING_AGG and ANY_VALUE. Each aggregated field must also appear in the report\'s column selection. Replaces ALL current aggregations — copy the ones to keep from get_data_mart_reports; pass [] to remove them; omit to keep current.'),
-    date_buckets: zod_1.z
+    date_buckets: zod_v4_1.z
         .array((0, query_data_mart_input_1.makeMcpDateBucketSchema)())
         .optional()
         .describe('Replacement date buckets (DAY/WEEK/MONTH/QUARTER/YEAR), same as query_data_mart\'s "date_buckets". Replaces ALL current buckets; pass [] to remove them; omit to keep current.'),
-    sort: zod_1.z
+    sort: zod_v4_1.z
         .array((0, query_data_mart_input_1.makeMcpSortSchema)())
         .optional()
         .describe('Replacement sort order, same as query_data_mart\'s "sort". Replaces the current order; pass [] to remove it; omit to keep current.'),
-    limit: zod_1.z
+    limit: zod_v4_1.z
         .number()
         .int()
         .min(1)
         .nullable()
         .optional()
         .describe('New max rows per report run; pass null to remove the cap; omit to keep current.'),
-    name: zod_1.z
+    name: zod_v4_1.z
         .string()
         .trim()
         .min(1)
         .optional()
         .describe('New report name; omit to keep current. At least one change parameter is required.'),
-    message: zod_1.z
+    message: zod_v4_1.z
         .object({
-        subject: zod_1.z
+        subject: zod_v4_1.z
             .string()
             .trim()
             .min(1)
             .optional()
             .describe('New message subject or heading; omit to keep the current one.'),
-        body: zod_1.z
+        body: zod_v4_1.z
             .string()
             .trim()
             .min(1)
@@ -86,7 +86,7 @@ const baseInputSchema = zod_1.z
         .strict()
         .optional()
         .describe('Message changes. Applies only to reports with an email, slack, teams, or google_chat destination; rejected for other types. Provide at least one of subject/body inside. The send condition and recipients are not editable here.'),
-    run_immediately: zod_1.z
+    run_immediately: zod_v4_1.z
         .boolean()
         .optional()
         .describe('Whether to run the report after the update (one billed Report Run). Omit for the default: a Google Sheets report re-runs when what it exports actually changed (fields or any output control differ from the stored definition), so the sheet reflects the change; it does not run for a name-only or message-only change or for re-sent identical controls. Email, Slack, Microsoft Teams, and Google Chat reports are NOT re-sent by default, because a run delivers the message to every configured recipient or channel — set true only when the user explicitly wants it sent now. Set false to update a Google Sheets report without refreshing it. Looker Studio is pull-based: omit or set false; true is rejected.'),
@@ -116,10 +116,10 @@ let UpdateReportTool = class UpdateReportTool {
     description = 'Update an existing report: rename it, replace which data mart fields it exports, replace its output controls — filters/slices, aggregations, date_buckets, sort, limit — using the same vocabulary as query_data_mart ([] removes a control, null removes the limit), and/or — for reports with an email, slack, teams, or google_chat destination — change the message subject or body. Use it whenever the user asks to change a report that already exists — including one you created earlier in this conversation ("add a filter", "sort by revenue", "rename it") — instead of creating another report with add_report. Provide at least one change; anything not provided stays unchanged. Returns the report as it is after the update, and by default re-runs a Google Sheets report when the export changed (run.status="queued" — poll get_report_run_status), so the sheet shows the new definition; email, Slack, Teams, and Google Chat reports are re-sent only with run_immediately=true.';
     zodSchema = baseInputSchema.shape;
     outputSchema = {
-        report_id: zod_1.z.string().describe('Id of the updated report'),
-        status: zod_1.z.literal('updated').describe("Always 'updated' on success"),
-        destination_type: zod_1.z.enum(mcp_destination_type_1.MCP_DESTINATION_TYPES),
-        name: zod_1.z.string().describe('Report name after the update'),
+        report_id: zod_v4_1.z.string().describe('Id of the updated report'),
+        status: zod_v4_1.z.literal('updated').describe("Always 'updated' on success"),
+        destination_type: zod_v4_1.z.enum(mcp_destination_type_1.MCP_DESTINATION_TYPES),
+        name: zod_v4_1.z.string().describe('Report name after the update'),
         ...report_output_controls_output_1.reportOutputControlsOutputShape,
         ...report_output_controls_output_1.reportSheetInfoOutputShape,
         run: report_run_outcome_1.reportRunOutcomeSchema.describe('Outcome of the refresh run queued after the update. The update is saved for every status.'),

package/dist/src/ee/mcp/transport/mcp-http-entry.service.d.ts

@@ -0,0 +1,30 @@
+import { OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import { HttpAdapterHost } from '@nestjs/core';
+import { GracefulShutdownService } from '../../../common/scheduler/services/graceful-shutdown.service';
+import { ClsContextService } from '../../../common/logger/cls-context.service';
+import { McpAuthMiddleware } from '../auth/mcp-auth.middleware';
+import { McpInstructionsService } from '../instructions/mcp-instructions.service';
+import { McpSdkServerFactory } from '../sdk/mcp-sdk-server.factory';
+export declare const MCP_REQUEST_SOCKET_TIMEOUT_MS: number;
+export declare class McpHttpEntryService implements OnModuleInit, OnModuleDestroy {
+    private readonly adapterHost;
+    private readonly authMiddleware;
+    private readonly serverFactory;
+    private readonly instructionsService;
+    private readonly clsContextService;
+    private readonly gracefulShutdownService;
+    private readonly logger;
+    private handler?;
+    private handlerClosePromise?;
+    constructor(adapterHost: HttpAdapterHost, authMiddleware: McpAuthMiddleware, serverFactory: McpSdkServerFactory, instructionsService: McpInstructionsService, clsContextService: ClsContextService, gracefulShutdownService: GracefulShutdownService);
+    onModuleInit(): void;
+    onModuleDestroy(): Promise<void>;
+    closeTransport(): Promise<void>;
+    private handleRequest;
+    private isLongLivedSubscription;
+    private onTransportError;
+    private getRequestedSessionId;
+    private isExpectedStandaloneSseRejection;
+    private getJsonRpcSummary;
+    private toLoggableJsonRpcId;
+}

package/dist/src/ee/mcp/transport/mcp-http-entry.service.js

@@ -0,0 +1,193 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var McpHttpEntryService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpHttpEntryService = exports.MCP_REQUEST_SOCKET_TIMEOUT_MS = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const node_crypto_1 = require("node:crypto");
+const server_1 = require("@modelcontextprotocol/server");
+const node_1 = require("@modelcontextprotocol/node");
+const graceful_shutdown_service_1 = require("../../../common/scheduler/services/graceful-shutdown.service");
+const cls_context_service_1 = require("../../../common/logger/cls-context.service");
+const mcp_auth_middleware_1 = require("../auth/mcp-auth.middleware");
+const mcp_auth_middleware_2 = require("../auth/mcp-auth.middleware");
+const http_headers_util_1 = require("../http-headers.util");
+const mcp_instructions_service_1 = require("../instructions/mcp-instructions.service");
+const mcp_log_context_1 = require("../observability/mcp-log-context");
+const mcp_sdk_server_factory_1 = require("../sdk/mcp-sdk-server.factory");
+exports.MCP_REQUEST_SOCKET_TIMEOUT_MS = 4 * 60_000;
+const REQUIRED_MODERN_PROTOCOL_VERSIONS = new Set(['2026-07-28']);
+let McpHttpEntryService = McpHttpEntryService_1 = class McpHttpEntryService {
+    adapterHost;
+    authMiddleware;
+    serverFactory;
+    instructionsService;
+    clsContextService;
+    gracefulShutdownService;
+    logger = new common_1.Logger(McpHttpEntryService_1.name);
+    handler;
+    handlerClosePromise;
+    constructor(adapterHost, authMiddleware, serverFactory, instructionsService, clsContextService, gracefulShutdownService) {
+        this.adapterHost = adapterHost;
+        this.authMiddleware = authMiddleware;
+        this.serverFactory = serverFactory;
+        this.instructionsService = instructionsService;
+        this.clsContextService = clsContextService;
+        this.gracefulShutdownService = gracefulShutdownService;
+    }
+    onModuleInit() {
+        if (this.handler) {
+            return;
+        }
+        const express = this.adapterHost.httpAdapter.getInstance();
+        this.handler = (0, server_1.createMcpHandler)(({ authInfo }) => this.serverFactory.create((0, mcp_auth_middleware_1.toMcpAuthContext)(authInfo), this.instructionsService.getInstructions()), { onerror: error => this.onTransportError(error) });
+        const nodeHandler = (0, node_1.toNodeHandler)(this.handler, {
+            onerror: error => this.onTransportError(error),
+        });
+        express.all('/mcp', this.authMiddleware.handle, (request, response) => this.handleRequest(request, response, nodeHandler));
+    }
+    async onModuleDestroy() {
+        await this.gracefulShutdownService.initiateShutdown();
+        await this.closeTransport();
+    }
+    async closeTransport() {
+        const handler = this.handler;
+        if (!handler) {
+            return;
+        }
+        this.handlerClosePromise ??= Promise.resolve().then(() => handler.close());
+        await this.handlerClosePromise;
+    }
+    async handleRequest(request, response, nodeHandler) {
+        if (typeof request.setTimeout === 'function') {
+            request.setTimeout(exports.MCP_REQUEST_SOCKET_TIMEOUT_MS);
+        }
+        const requestId = (0, node_crypto_1.randomUUID)();
+        const requestSessionId = this.getRequestedSessionId(request);
+        const mcpContext = (0, mcp_auth_middleware_1.toMcpAuthContext)(request.auth);
+        const processId = this.isLongLivedSubscription(request.body) ? undefined : `mcp-${requestId}`;
+        if (processId) {
+            this.gracefulShutdownService.registerActiveProcess(processId);
+        }
+        try {
+            await this.clsContextService.runWithContext(mcp_log_context_1.MCP_LOG_CONTEXT_KEY, {
+                projectId: mcpContext.projectId,
+                userId: mcpContext.userId,
+                clientId: mcpContext.clientId,
+                sessionId: requestSessionId,
+                requestId,
+                protocolVersion: (0, http_headers_util_1.firstHeaderValue)(request, 'mcp-protocol-version'),
+                userAgent: (0, http_headers_util_1.firstHeaderValue)(request, 'user-agent'),
+                clientVendor: (0, http_headers_util_1.firstHeaderValue)(request, 'x-anthropic-client'),
+                traceparent: (0, http_headers_util_1.firstHeaderValue)(request, 'traceparent'),
+            }, async () => {
+                const startedAt = Date.now();
+                const rpc = this.getJsonRpcSummary(request.body);
+                this.logger.debug('MCP request received', {
+                    method: request.method,
+                    url: request.originalUrl ?? request.url,
+                    requestSessionId,
+                    accept: request.headers?.accept,
+                    contentType: request.headers?.['content-type'],
+                    rpc,
+                    projectId: mcpContext.projectId,
+                    clientId: mcpContext.clientId,
+                });
+                if (typeof response.once === 'function') {
+                    response.once('finish', () => {
+                        const metadata = {
+                            statusCode: response.statusCode,
+                            durationMs: Date.now() - startedAt,
+                            contentType: response.getHeader('content-type'),
+                            requestSessionId,
+                            responseSessionId: response.getHeader('mcp-session-id'),
+                            rpc,
+                            projectId: mcpContext.projectId,
+                            userId: mcpContext.userId,
+                            clientId: mcpContext.clientId,
+                            requestId,
+                        };
+                        if (response.statusCode >= 400 &&
+                            !this.isExpectedStandaloneSseRejection(request, response)) {
+                            this.logger.warn('MCP response finished with error status', metadata);
+                            return;
+                        }
+                        this.logger.debug('MCP response finished', metadata);
+                    });
+                }
+                await nodeHandler(request, response, request.body);
+            });
+        }
+        finally {
+            if (processId) {
+                this.gracefulShutdownService.unregisterActiveProcess(processId);
+            }
+        }
+    }
+    isLongLivedSubscription(body) {
+        return (!Array.isArray(body) &&
+            body !== null &&
+            typeof body === 'object' &&
+            body.method === 'subscriptions/listen');
+    }
+    onTransportError(error) {
+        const isVersionRejection = server_1.UnsupportedProtocolVersionError.isInstance(error);
+        const logContext = this.clsContextService.get(mcp_log_context_1.MCP_LOG_CONTEXT_KEY);
+        const metadata = {
+            message: error.message,
+            requestedProtocolVersion: isVersionRejection ? error.requested : undefined,
+            supportedProtocolVersions: isVersionRejection ? error.supported : undefined,
+            ...logContext,
+        };
+        if (isVersionRejection && REQUIRED_MODERN_PROTOCOL_VERSIONS.has(error.requested)) {
+            this.logger.error('MCP rejected a protocol version it is expected to support', metadata);
+            return;
+        }
+        this.logger.warn('MCP SDK transport error', metadata);
+    }
+    getRequestedSessionId(request) {
+        return (0, http_headers_util_1.firstHeaderValue)(request, 'mcp-session-id');
+    }
+    isExpectedStandaloneSseRejection(request, response) {
+        return request.method === 'GET' && response.statusCode === 405;
+    }
+    getJsonRpcSummary(body) {
+        if (Array.isArray(body)) {
+            return body.map(item => this.getJsonRpcSummary(item));
+        }
+        if (!body || typeof body !== 'object') {
+            return typeof body;
+        }
+        const message = body;
+        return {
+            id: this.toLoggableJsonRpcId(message.id),
+            method: typeof message.method === 'string' ? message.method : undefined,
+        };
+    }
+    toLoggableJsonRpcId(id) {
+        if (typeof id === 'string' || typeof id === 'number' || id === null || id === undefined) {
+            return id;
+        }
+        return '<non-scalar>';
+    }
+};
+exports.McpHttpEntryService = McpHttpEntryService;
+exports.McpHttpEntryService = McpHttpEntryService = McpHttpEntryService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.HttpAdapterHost,
+        mcp_auth_middleware_2.McpAuthMiddleware,
+        mcp_sdk_server_factory_1.McpSdkServerFactory,
+        mcp_instructions_service_1.McpInstructionsService,
+        cls_context_service_1.ClsContextService,
+        graceful_shutdown_service_1.GracefulShutdownService])
+], McpHttpEntryService);
+//# sourceMappingURL=mcp-http-entry.service.js.map

package/dist/src/idp/guards/idp.guard.js

@@ -23,6 +23,7 @@ const reject_plugin_auth_decorator_1 = require("../decorators/reject-plugin-auth
 const require_plugin_auth_decorator_1 = require("../decorators/require-plugin-auth.decorator");
 const view_only_safe_decorator_1 = require("../decorators/view-only-safe.decorator");
 const plugin_runtime_authorizer_port_1 = require("../ports/plugin-runtime-authorizer.port");
+const role_hierarchy_1 = require("../utils/role-hierarchy");
 exports.AUTH_CONTEXT = 'AuthContext';
 const STATE_CHANGING_METHODS = ['POST', 'PUT', 'PATCH', 'DELETE'];
 let IdpGuard = class IdpGuard {
@@ -191,14 +192,7 @@ let IdpGuard = class IdpGuard {
         if (!request.idpContext?.roles) {
             throw new idp_protocol_1.AuthorizationError('Access denied: No roles information available');
         }
-        const roleHierarchy = {
-            viewer: ['viewer', 'editor', 'admin'],
-            editor: ['editor', 'admin'],
-            admin: ['admin'],
-        };
-        const acceptableRoles = roleHierarchy[requiredRole];
-        const hasRequiredRole = request.idpContext.roles.some(userRole => acceptableRoles.includes(userRole));
-        if (!hasRequiredRole) {
+        if (!(0, role_hierarchy_1.satisfiesRole)(request.idpContext.roles, requiredRole)) {
             const displayName = IdpGuard_1.ROLE_DISPLAY_NAMES[requiredRole] ?? requiredRole;
             throw new idp_protocol_1.AuthorizationError(`Access denied. Required role: ${displayName}`);
         }

package/dist/src/idp/oauth/controllers/oauth-authorization.controller.d.ts

@@ -15,6 +15,10 @@ export declare class OAuthAuthorizationController {
     private readonly logger;
     constructor(validator: OAuthRequestValidator, projectMemberResolver: OAuthProjectMemberResolver, idpProviderService: IdpProviderService, oauthIdp: OAuthIdpPort, clientRegistry: OAuthClientRegistry, projectSelectionService: OAuthProjectSelectionService);
     authorize(query: Record<string, unknown>, request: Request, response: Response): Promise<void>;
+    private completeAuthorization;
+    private redirectAuthorizationError;
+    private toAuthorizationErrorContext;
+    private mapAuthorizationError;
     private resolveProjectHostMember;
     private resolveSharedProjectMember;
     private resolveAuthorizationContext;

package/dist/src/idp/oauth/controllers/oauth-authorization.controller.js

@@ -15,6 +15,7 @@ var OAuthAuthorizationController_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuthAuthorizationController = void 0;
 const common_1 = require("@nestjs/common");
+const internal_helpers_1 = require("@owox/internal-helpers");
 const idp_protocol_1 = require("@owox/idp-protocol");
 const idp_provider_service_1 = require("../../services/idp-provider.service");
 const oauth_client_registry_1 = require("../oauth-client.registry");
@@ -39,7 +40,29 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
         this.projectSelectionService = projectSelectionService;
     }
     async authorize(query, request, response) {
-        const validated = await this.validator.validateAuthorizationRequest(query);
+        let validated;
+        try {
+            validated = await this.validator.validateAuthorizationRequest(query);
+        }
+        catch (error) {
+            const errorContext = await this.validator.resolveAuthorizationErrorContext(query);
+            if (!errorContext) {
+                throw error;
+            }
+            this.redirectAuthorizationError(errorContext, response, error);
+            return;
+        }
+        try {
+            await this.completeAuthorization(query, request, response, validated);
+        }
+        catch (error) {
+            if (response.headersSent) {
+                throw error;
+            }
+            this.redirectAuthorizationError(this.toAuthorizationErrorContext(validated), response, error);
+        }
+    }
+    async completeAuthorization(query, request, response, validated) {
         const authorizationRequest = validated.request;
         const resourceContext = validated.resourceContext;
         const provider = this.idpProviderService.getProvider(request);
@@ -63,8 +86,61 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
         const redirectUrl = new URL(authorizationRequest.redirectUri);
         redirectUrl.searchParams.set('code', authorizationCode.code);
         redirectUrl.searchParams.set('state', authorizationRequest.state);
+        if (resourceContext.kind === 'project') {
+            redirectUrl.searchParams.set('iss', resourceContext.publicBaseUrl);
+        }
+        response.redirect(redirectUrl.toString());
+    }
+    redirectAuthorizationError(context, response, cause) {
+        const oauthError = this.mapAuthorizationError(cause);
+        const redirectUrl = new URL(context.redirectUri);
+        redirectUrl.searchParams.set('error', oauthError.error);
+        redirectUrl.searchParams.set('error_description', oauthError.description);
+        if (context.state) {
+            redirectUrl.searchParams.set('state', context.state);
+        }
+        if (context.resourceContext.kind === 'project') {
+            redirectUrl.searchParams.set('iss', context.resourceContext.publicBaseUrl);
+        }
+        const metadata = {
+            clientId: context.clientId,
+            error: oauthError.error,
+            issuer: context.resourceContext.publicBaseUrl,
+        };
+        if (oauthError.error === 'server_error') {
+            this.logger.error('OAuth authorization failed after request validation', (0, internal_helpers_1.castError)(cause).stack, metadata);
+        }
+        else {
+            this.logger.warn('OAuth authorization rejected after request validation', metadata);
+        }
         response.redirect(redirectUrl.toString());
     }
+    toAuthorizationErrorContext(validated) {
+        return {
+            clientId: validated.request.clientId,
+            redirectUri: validated.request.redirectUri,
+            state: validated.request.state,
+            resourceContext: validated.resourceContext,
+        };
+    }
+    mapAuthorizationError(cause) {
+        if (cause instanceof idp_protocol_1.AuthorizationError) {
+            return {
+                error: 'access_denied',
+                description: 'The authorization request was denied.',
+            };
+        }
+        if (cause instanceof common_1.BadRequestException) {
+            return {
+                error: 'invalid_request',
+                description: 'The authorization request could not be completed.',
+            };
+        }
+        return {
+            error: 'server_error',
+            description: 'The authorization server encountered an unexpected condition.',
+        };
+    }
     resolveProjectHostMember(provider, context, projects, selectedProjectId, projectId) {
         if (selectedProjectId && selectedProjectId !== projectId) {
             throw new common_1.BadRequestException('selected project conflicts with MCP resource');

package/dist/src/idp/oauth/controllers/oauth-metadata.controller.d.ts

@@ -6,6 +6,7 @@ export declare class OAuthMetadataController {
     private readonly resourceResolver;
     constructor(config: OAuthConfigService, resourceResolver: McpResourceResolverService);
     getAuthorizationServerMetadata(request?: Request): {
+        authorization_response_iss_parameter_supported?: boolean | undefined;
         issuer: string;
         authorization_endpoint: string;
         token_endpoint: string;
@@ -20,6 +21,7 @@ export declare class OAuthMetadataController {
     getOpenIdConfigurationMetadata(request?: Request): {
         subject_types_supported: string[];
         id_token_signing_alg_values_supported: string[];
+        authorization_response_iss_parameter_supported?: boolean | undefined;
         issuer: string;
         authorization_endpoint: string;
         token_endpoint: string;
@@ -32,5 +34,4 @@ export declare class OAuthMetadataController {
         token_endpoint_auth_methods_supported: string[];
     };
     private getBaseMetadata;
-    private resolveIssuer;
 }

package/dist/src/idp/oauth/controllers/oauth-metadata.controller.js

@@ -44,7 +44,8 @@ let OAuthMetadataController = class OAuthMetadataController {
         };
     }
     getBaseMetadata(request) {
-        const issuer = this.resolveIssuer(request);
+        const resourceContext = request ? this.resourceResolver.tryResolveRequest(request) : null;
+        const issuer = resourceContext?.publicBaseUrl ?? this.config.issuer;
         return {
             issuer,
             authorization_endpoint: this.config.authorizationEndpoint,
@@ -56,15 +57,11 @@ let OAuthMetadataController = class OAuthMetadataController {
             code_challenge_methods_supported: ['S256'],
             scopes_supported: this.config.scopes,
             token_endpoint_auth_methods_supported: ['none'],
+            ...(resourceContext?.kind === 'project'
+                ? { authorization_response_iss_parameter_supported: true }
+                : {}),
         };
     }
-    resolveIssuer(request) {
-        if (!request) {
-            return this.config.issuer;
-        }
-        const resourceContext = this.resourceResolver.tryResolveRequest(request);
-        return resourceContext?.publicBaseUrl ?? this.config.issuer;
-    }
 };
 exports.OAuthMetadataController = OAuthMetadataController;
 __decorate([

package/dist/src/idp/oauth/controllers/oauth-token.controller.js

@@ -15,6 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuthTokenController = void 0;
 const common_1 = require("@nestjs/common");
 const mcp_resource_resolver_service_1 = require("../../../mcp-resource/mcp-resource-resolver.service");
+const is_authentication_error_1 = require("../../utils/is-authentication-error");
 const oauth_client_registry_1 = require("../oauth-client.registry");
 const oauth_idp_port_1 = require("../oauth-idp.port");
 const oauth_request_validator_1 = require("../oauth-request.validator");
@@ -33,7 +34,19 @@ let OAuthTokenController = class OAuthTokenController {
         const requestResource = this.resourceResolver.tryResolveRequest(request)?.resource;
         const validated = await this.validator.validateTokenRequest(body, requestResource);
         const tokenRequest = validated.request;
-        const result = await this.oauthIdp.exchangeToken(tokenRequest);
+        let result;
+        try {
+            result = await this.oauthIdp.exchangeToken(tokenRequest);
+        }
+        catch (error) {
+            if ((0, is_authentication_error_1.isAuthenticationError)(error)) {
+                throw new common_1.HttpException({
+                    error: 'invalid_grant',
+                    error_description: 'The provided authorization grant or refresh token is invalid or expired.',
+                }, common_1.HttpStatus.BAD_REQUEST);
+            }
+            throw error;
+        }
         await this.clientRegistry.markSuccessfulTokenExchange(tokenRequest.clientId);
         return result;
     }

package/dist/src/idp/oauth/oauth-request.validator.d.ts

@@ -8,6 +8,12 @@ export interface ValidatedOAuthAuthorizationRequest {
     request: OAuthAuthorizationRequest;
     resourceContext: McpResourceContext;
 }
+export interface OAuthAuthorizationErrorContext {
+    clientId: string;
+    redirectUri: string;
+    state?: string;
+    resourceContext: McpResourceContext;
+}
 export interface ValidatedOAuthTokenRequest {
     request: OAuthTokenExchangeRequest;
     resourceContext: McpResourceContext;
@@ -18,10 +24,12 @@ export declare class OAuthRequestValidator {
     private readonly resourceResolver;
     constructor(config: OAuthConfigService, clientRegistry: OAuthClientRegistry, resourceResolver: McpResourceResolverService);
     validateAuthorizationRequest(input: OAuthInput): Promise<ValidatedOAuthAuthorizationRequest>;
+    resolveAuthorizationErrorContext(input: OAuthInput): Promise<OAuthAuthorizationErrorContext | null>;
     validateTokenRequest(input: OAuthInput, requestResource?: string): Promise<ValidatedOAuthTokenRequest>;
     private getClient;
     private parseScopes;
     private requiredString;
+    private optionalString;
     private resolveClientResource;
     private assertMatchingResource;
     private validateResource;

package/dist/src/idp/oauth/oauth-request.validator.js

@@ -48,6 +48,30 @@ let OAuthRequestValidator = class OAuthRequestValidator {
             resourceContext,
         };
     }
+    async resolveAuthorizationErrorContext(input) {
+        const clientId = this.optionalString(input.client_id);
+        const redirectUri = this.optionalString(input.redirect_uri);
+        if (!clientId || !redirectUri) {
+            return null;
+        }
+        const client = await this.clientRegistry.get(clientId);
+        if (!client || !client.redirectUris.includes(redirectUri) || !client.resource) {
+            return null;
+        }
+        let resourceContext;
+        try {
+            resourceContext = this.resourceResolver.resolveResource(client.resource);
+        }
+        catch {
+            return null;
+        }
+        return {
+            clientId,
+            redirectUri,
+            state: this.optionalString(input.state),
+            resourceContext,
+        };
+    }
     async validateTokenRequest(input, requestResource) {
         const grantType = this.requiredString(input.grant_type, 'grant_type');
         const clientId = this.requiredString(input.client_id, 'client_id');
@@ -106,6 +130,9 @@ let OAuthRequestValidator = class OAuthRequestValidator {
         }
         return value.trim();
     }
+    optionalString(value) {
+        return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+    }
     resolveClientResource(client, clientResource, requestResource) {
         if (!client.resource) {
             throw new common_1.BadRequestException('client is not bound to an MCP resource');

package/dist/src/idp/utils/is-authentication-error.d.ts

@@ -0,0 +1 @@
+export declare function isAuthenticationError(err: unknown): err is Error;

package/dist/src/idp/utils/is-authentication-error.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAuthenticationError = isAuthenticationError;
+function isAuthenticationError(err) {
+    if (!(err instanceof Error))
+        return false;
+    return err.name === 'AuthenticationException';
+}
+//# sourceMappingURL=is-authentication-error.js.map

package/dist/src/idp/utils/role-hierarchy.d.ts

@@ -0,0 +1,3 @@
+import { Role } from '@owox/idp-protocol';
+export declare const ROLE_HIERARCHY: Record<Role, readonly Role[]>;
+export declare function satisfiesRole(roles: readonly string[], requiredRole: Role): boolean;

package/dist/src/idp/utils/role-hierarchy.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROLE_HIERARCHY = void 0;
+exports.satisfiesRole = satisfiesRole;
+exports.ROLE_HIERARCHY = {
+    viewer: ['viewer', 'editor', 'admin'],
+    editor: ['editor', 'admin'],
+    admin: ['admin'],
+};
+function satisfiesRole(roles, requiredRole) {
+    const acceptableRoles = exports.ROLE_HIERARCHY[requiredRole];
+    return roles.some(role => acceptableRoles.includes(role));
+}
+//# sourceMappingURL=role-hierarchy.js.map