@rekog/mcp-nest 1.7.0-alpha.0 → 1.7.0-alpha.2

package/dist/authz/guards/jwt-auth.guard.d.ts

@@ -0,0 +1,13 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Request } from 'express';
+import { JwtPayload, JwtTokenService } from '../services/jwt-token.service';
+export interface AuthenticatedRequest extends Request {
+    user: JwtPayload;
+}
+export declare class JwtAuthGuard implements CanActivate {
+    private readonly jwtTokenService;
+    constructor(jwtTokenService: JwtTokenService);
+    canActivate(context: ExecutionContext): boolean;
+    private extractTokenFromHeader;
+}
+//# sourceMappingURL=jwt-auth.guard.d.ts.map

package/dist/authz/guards/jwt-auth.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.d.ts","sourceRoot":"","sources":["../../../src/authz/guards/jwt-auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAEjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAE5E,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,qBACa,YAAa,YAAW,WAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe;gBAAf,eAAe,EAAE,eAAe;IAE7D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;IAkB/C,OAAO,CAAC,sBAAsB;CAS/B"}

package/dist/authz/guards/jwt-auth.guard.js

@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_token_service_1 = require("../services/jwt-token.service");
+let JwtAuthGuard = class JwtAuthGuard {
+    constructor(jwtTokenService) {
+        this.jwtTokenService = jwtTokenService;
+    }
+    canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const token = this.extractTokenFromHeader(request);
+        if (!token) {
+            throw new common_1.UnauthorizedException('Access token required');
+        }
+        const payload = this.jwtTokenService.validateToken(token);
+        if (!payload || payload.type !== 'access') {
+            throw new common_1.UnauthorizedException('Invalid or expired access token');
+        }
+        request.user = payload;
+        return true;
+    }
+    extractTokenFromHeader(request) {
+        const authHeader = request.headers.authorization;
+        if (!authHeader) {
+            return undefined;
+        }
+        const [type, token] = authHeader.split(' ');
+        return type === 'Bearer' ? token : undefined;
+    }
+};
+exports.JwtAuthGuard = JwtAuthGuard;
+exports.JwtAuthGuard = JwtAuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jwt_token_service_1.JwtTokenService])
+], JwtAuthGuard);
+//# sourceMappingURL=jwt-auth.guard.js.map

package/dist/authz/guards/jwt-auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../src/authz/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AAExB,qEAA4E;AAOrE,IAAM,YAAY,GAAlB,MAAM,YAAY;IACvB,YAA6B,eAAgC;QAAhC,oBAAe,GAAf,eAAe,CAAiB;IAAG,CAAC;IAEjE,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAwB,CAAC;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,OAAgB;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AA9BY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAEmC,mCAAe;GADlD,YAAY,CA8BxB","sourcesContent":["import {\n  Injectable,\n  CanActivate,\n  ExecutionContext,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Request } from 'express';\nimport { JwtPayload, JwtTokenService } from '../services/jwt-token.service';\n\nexport interface AuthenticatedRequest extends Request {\n  user: JwtPayload;\n}\n\n@Injectable()\nexport class JwtAuthGuard implements CanActivate {\n  constructor(private readonly jwtTokenService: JwtTokenService) {}\n\n  canActivate(context: ExecutionContext): boolean {\n    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();\n    const token = this.extractTokenFromHeader(request);\n\n    if (!token) {\n      throw new UnauthorizedException('Access token required');\n    }\n\n    const payload = this.jwtTokenService.validateToken(token);\n\n    if (!payload || payload.type !== 'access') {\n      throw new UnauthorizedException('Invalid or expired access token');\n    }\n\n    request.user = payload;\n    return true;\n  }\n\n  private extractTokenFromHeader(request: Request): string | undefined {\n    const authHeader = request.headers.authorization;\n    if (!authHeader) {\n      return undefined;\n    }\n\n    const [type, token] = authHeader.split(' ');\n    return type === 'Bearer' ? token : undefined;\n  }\n}\n"]}

package/dist/authz/index.d.ts

@@ -1,2 +1,9 @@
-export {};
+export * from './mcp-oauth.controller';
+export * from './mcp-oauth.module';
+export * from './providers/oauth-provider.interface';
+export * from './providers/google.provider';
+export * from './providers/github.provider';
+export * from './stores/oauth-store.interface';
+export * from './stores/memory-store.service';
+export * from './stores/typeorm/typeorm-store.service';
 //# sourceMappingURL=index.d.ts.map

package/dist/authz/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sCAAsC,CAAC;AACrD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC"}

package/dist/authz/index.js

@@ -1,3 +1,25 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./mcp-oauth.controller"), exports);
+__exportStar(require("./mcp-oauth.module"), exports);
+__exportStar(require("./providers/oauth-provider.interface"), exports);
+__exportStar(require("./providers/google.provider"), exports);
+__exportStar(require("./providers/github.provider"), exports);
+__exportStar(require("./stores/oauth-store.interface"), exports);
+__exportStar(require("./stores/memory-store.service"), exports);
+__exportStar(require("./stores/typeorm/typeorm-store.service"), exports);
 //# sourceMappingURL=index.js.map

package/dist/authz/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":"","sourcesContent":["\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,qDAAmC;AACnC,uEAAqD;AACrD,8DAA4C;AAC5C,8DAA4C;AAC5C,iEAA+C;AAC/C,gEAA8C;AAC9C,yEAAuD","sourcesContent":["export * from './mcp-oauth.controller';\nexport * from './mcp-oauth.module';\nexport * from './providers/oauth-provider.interface';\nexport * from './providers/google.provider';\nexport * from './providers/github.provider';\nexport * from './stores/oauth-store.interface';\nexport * from './stores/memory-store.service';\nexport * from './stores/typeorm/typeorm-store.service';\n"]}

package/dist/authz/interfaces/index.d.ts

@@ -0,0 +1,3 @@
+export * from '../providers/oauth-provider.interface';
+export * from '../stores/oauth-store.interface';
+//# sourceMappingURL=index.d.ts.map

package/dist/authz/interfaces/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authz/interfaces/index.ts"],"names":[],"mappings":"AACA,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC"}

package/dist/authz/interfaces/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../providers/oauth-provider.interface"), exports);
+__exportStar(require("../stores/oauth-store.interface"), exports);
+//# sourceMappingURL=index.js.map

package/dist/authz/interfaces/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authz/interfaces/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wEAAsD;AACtD,kEAAgD","sourcesContent":["// Re-export main interfaces\nexport * from '../providers/oauth-provider.interface';\nexport * from '../stores/oauth-store.interface';\n\n/**\n * @fileoverview Store Configuration Examples\n *\n * The `storeConfiguration` property in `OAuthUserModuleOptions` allows you to configure\n * how OAuth sessions, authorization codes, and client information are stored.\n *\n * @example\n * // Option 1: Memory Store (default)\n * // Just omit storeConfiguration or explicitly set it\n * storeConfiguration: { type: 'memory' }\n *\n * @example\n * // Option 2: Custom Store Implementation\n * import { MyCustomStore } from './my-custom-store';\n * storeConfiguration: {\n *   type: 'custom',\n *   store: new MyCustomStore()\n * }\n *\n * @example\n * // Option 3: TypeORM Persistent Storage\n * storeConfiguration: {\n *   type: 'typeorm',\n *   options: {\n *     type: 'sqlite',\n *     database: './oauth.db',\n *     synchronize: true,\n *     logging: false\n *   }\n * }\n *\n * @example\n * // Option 3b: TypeORM with PostgreSQL\n * storeConfiguration: {\n *   type: 'typeorm',\n *   options: {\n *     type: 'postgres',\n *     host: process.env.DB_HOST || 'localhost',\n *     port: parseInt(process.env.DB_PORT) || 5432,\n *     username: process.env.DB_USERNAME || 'postgres',\n *     password: process.env.DB_PASSWORD || 'password',\n *     database: process.env.DB_NAME || 'oauth_db',\n *     synchronize: process.env.NODE_ENV !== 'production',\n *     logging: process.env.NODE_ENV === 'development'\n *   }\n * }\n */\n"]}

package/dist/authz/mcp-oauth.controller.d.ts

@@ -0,0 +1,53 @@
+import { Request as ExpressRequest, NextFunction, Response } from 'express';
+import { AuthenticatedRequest } from './guards/jwt-auth.guard';
+import { OAuthModuleOptions, OAuthUserProfile } from './providers/oauth-provider.interface';
+import { ClientService } from './services/client.service';
+import { JwtTokenService, TokenPair } from './services/jwt-token.service';
+import { ClientRegistrationDto, IOAuthStore } from './stores/oauth-store.interface';
+interface OAuthCallbackRequest extends ExpressRequest {
+    user?: {
+        profile: OAuthUserProfile;
+        accessToken: string;
+        provider: string;
+    };
+}
+export declare class McpOAuthController {
+    private options;
+    private readonly store;
+    private readonly jwtTokenService;
+    private readonly clientService;
+    private readonly serverUrl;
+    private readonly isProduction;
+    constructor(options: OAuthModuleOptions, store: IOAuthStore, jwtTokenService: JwtTokenService, clientService: ClientService);
+    getAuthorizationServerMetadata(): {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        registration_endpoint: string;
+        response_types_supported: string[];
+        response_modes_supported: string[];
+        grant_types_supported: string[];
+        token_endpoint_auth_methods_supported: string[];
+        revocation_endpoint: string;
+        code_challenge_methods_supported: string[];
+    };
+    registerClient(registrationDto: ClientRegistrationDto): Promise<import("./stores/oauth-store.interface").OAuthClient>;
+    authorize(query: any, res: Response): Promise<void>;
+    authenticate(req: any, res: Response, next: NextFunction): void;
+    handleProviderCallback(req: OAuthCallbackRequest, res: Response, next: NextFunction): Promise<void>;
+    private processAuthenticationSuccess;
+    exchangeToken(body: any): Promise<TokenPair>;
+    private handleAuthorizationCodeGrant;
+    private handleRefreshTokenGrant;
+    validateToken(req: AuthenticatedRequest): {
+        valid: boolean;
+        user_id: string;
+        client_id: string | undefined;
+        scope: string | undefined;
+        expires_at: number;
+    };
+    private parseExpiresInToMs;
+    private validatePKCE;
+}
+export {};
+//# sourceMappingURL=mcp-oauth.controller.d.ts.map

package/dist/authz/mcp-oauth.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.controller.d.ts","sourceRoot":"","sources":["../../src/authz/mcp-oauth.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE5E,OAAO,EAAE,oBAAoB,EAAgB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,EACL,qBAAqB,EACrB,WAAW,EACZ,MAAM,gCAAgC,CAAC;AAExC,UAAU,oBAAqB,SAAQ,cAAc;IACnD,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,gBAAgB,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,qBACa,kBAAkB;IAKK,OAAO,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAGG,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,WAAW,EACzC,eAAe,EAAE,eAAe,EAChC,aAAa,EAAE,aAAa;IAQ/C,8BAA8B;;;;;;;;;;;;IAoBxB,cAAc,CAAS,eAAe,EAAE,qBAAqB;IAK7D,SAAS,CAAU,KAAK,EAAE,GAAG,EAAS,GAAG,EAAE,QAAQ;IAuEzD,YAAY,CACH,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,QAAQ,EACZ,IAAI,EAAE,YAAY;IAQtB,sBAAsB,CACnB,GAAG,EAAE,oBAAoB,EACzB,GAAG,EAAE,QAAQ,EACZ,IAAI,EAAE,YAAY;YA0Bd,4BAA4B;IAwEpC,aAAa,CAAS,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;YAwB5C,4BAA4B;YAgD5B,uBAAuB;IAarC,aAAa,CAAQ,GAAG,EAAE,oBAAoB;;;;;;;IAU9C,OAAO,CAAC,kBAAkB;IAoB1B,OAAO,CAAC,YAAY;CAerB"}

package/dist/authz/mcp-oauth.controller.js

@@ -0,0 +1,305 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthController = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const passport_1 = __importDefault(require("passport"));
+const jwt_auth_guard_1 = require("./guards/jwt-auth.guard");
+const client_service_1 = require("./services/client.service");
+const jwt_token_service_1 = require("./services/jwt-token.service");
+const oauth_strategy_service_1 = require("./services/oauth-strategy.service");
+let McpOAuthController = class McpOAuthController {
+    constructor(options, store, jwtTokenService, clientService) {
+        this.options = options;
+        this.store = store;
+        this.jwtTokenService = jwtTokenService;
+        this.clientService = clientService;
+        this.serverUrl = this.options.serverUrl;
+        this.isProduction = this.options.cookieSecure;
+    }
+    getAuthorizationServerMetadata() {
+        return {
+            issuer: this.serverUrl,
+            authorization_endpoint: `${this.serverUrl}/authorize`,
+            token_endpoint: `${this.serverUrl}/token`,
+            registration_endpoint: `${this.serverUrl}/register`,
+            response_types_supported: ['code'],
+            response_modes_supported: ['query'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            token_endpoint_auth_methods_supported: [
+                'client_secret_basic',
+                'client_secret_post',
+                'none',
+            ],
+            revocation_endpoint: `${this.serverUrl}/revoke`,
+            code_challenge_methods_supported: ['plain', 'S256'],
+        };
+    }
+    async registerClient(registrationDto) {
+        return await this.clientService.registerClient(registrationDto);
+    }
+    async authorize(query, res) {
+        const { response_type, client_id, redirect_uri, code_challenge, code_challenge_method, state, resource, } = query;
+        if (response_type !== 'code') {
+            throw new common_1.BadRequestException('Only response_type=code is supported');
+        }
+        if (!client_id || !redirect_uri || !code_challenge) {
+            throw new common_1.BadRequestException('Missing required parameters');
+        }
+        const client = await this.clientService.getClient(client_id);
+        if (!client) {
+            throw new common_1.BadRequestException('Invalid client_id');
+        }
+        const validRedirect = await this.clientService.validateRedirectUri(client_id, redirect_uri);
+        if (!validRedirect) {
+            throw new common_1.BadRequestException('Invalid redirect_uri');
+        }
+        const sessionId = (0, crypto_1.randomBytes)(32).toString('base64url');
+        const sessionState = (0, crypto_1.randomBytes)(32).toString('base64url');
+        const oauthSession = {
+            sessionId,
+            state: sessionState,
+            clientId: client_id,
+            redirectUri: redirect_uri,
+            codeChallenge: code_challenge,
+            codeChallengeMethod: code_challenge_method || 'plain',
+            oauthState: state,
+            resource,
+            expiresAt: Date.now() + this.options.oauthSessionExpiresIn,
+        };
+        this.store.storeOAuthSession(sessionId, oauthSession);
+        res.cookie('oauth_session', sessionId, {
+            httpOnly: true,
+            secure: this.isProduction,
+            maxAge: this.options.oauthSessionExpiresIn,
+        });
+        res.cookie('oauth_state', sessionState, {
+            httpOnly: true,
+            secure: this.isProduction,
+            maxAge: this.options.oauthSessionExpiresIn,
+        });
+        res.redirect(`/auth`);
+    }
+    authenticate(req, res, next) {
+        passport_1.default.authenticate(oauth_strategy_service_1.STRATEGY_NAME, {
+            state: req.cookies?.oauth_state,
+        })(req, res, next);
+    }
+    async handleProviderCallback(req, res, next) {
+        passport_1.default.authenticate(oauth_strategy_service_1.STRATEGY_NAME, { session: false }, async (err, user) => {
+            try {
+                if (err) {
+                    console.error('OAuth callback error:', err);
+                    throw new common_1.BadRequestException('Authentication failed');
+                }
+                if (!user) {
+                    throw new common_1.BadRequestException('Authentication failed');
+                }
+                req.user = user;
+                await this.processAuthenticationSuccess(req, res);
+            }
+            catch (error) {
+                next(error);
+            }
+        })(req, res, next);
+    }
+    async processAuthenticationSuccess(req, res) {
+        const user = req.user;
+        if (!user) {
+            throw new common_1.BadRequestException('Authentication failed');
+        }
+        const sessionId = req.cookies?.oauth_session;
+        if (!sessionId) {
+            throw new common_1.BadRequestException('Missing OAuth session');
+        }
+        const session = await this.store.getOAuthSession(sessionId);
+        if (!session || session.expiresAt < Date.now()) {
+            throw new common_1.BadRequestException('Invalid or expired OAuth session');
+        }
+        const stateFromCookie = req.cookies?.oauth_state;
+        if (session.state !== stateFromCookie) {
+            throw new common_1.BadRequestException('Invalid state parameter');
+        }
+        const jwt = this.jwtTokenService.generateUserToken(user.profile.username, user.profile);
+        res.cookie('auth_token', jwt, {
+            httpOnly: true,
+            secure: this.isProduction,
+            maxAge: this.options.cookieMaxAge,
+        });
+        res.clearCookie('oauth_session');
+        res.clearCookie('oauth_state');
+        const authCode = (0, crypto_1.randomBytes)(32).toString('base64url');
+        this.store.storeAuthCode({
+            code: authCode,
+            user_id: user.profile.username,
+            client_id: session.clientId,
+            redirect_uri: session.redirectUri,
+            code_challenge: session.codeChallenge,
+            code_challenge_method: session.codeChallengeMethod,
+            expires_at: Date.now() + this.options.authCodeExpiresIn,
+            github_access_token: '',
+        });
+        const redirectUrl = new URL(session.redirectUri);
+        redirectUrl.searchParams.set('code', authCode);
+        if (session.oauthState) {
+            redirectUrl.searchParams.set('state', session.oauthState);
+        }
+        this.store.removeOAuthSession(sessionId);
+        res.redirect(redirectUrl.toString());
+    }
+    async exchangeToken(body) {
+        const { grant_type, code, code_verifier, redirect_uri, client_id, refresh_token, } = body;
+        if (grant_type === 'authorization_code') {
+            return this.handleAuthorizationCodeGrant(code, code_verifier, redirect_uri, client_id);
+        }
+        else if (grant_type === 'refresh_token') {
+            return this.handleRefreshTokenGrant(refresh_token);
+        }
+        else {
+            throw new common_1.BadRequestException('Unsupported grant_type');
+        }
+    }
+    async handleAuthorizationCodeGrant(code, code_verifier, redirect_uri, client_id) {
+        const authCode = await this.store.getAuthCode(code);
+        if (!authCode) {
+            throw new common_1.BadRequestException('Invalid authorization code');
+        }
+        if (authCode.expires_at < Date.now()) {
+            await this.store.removeAuthCode(code);
+            throw new common_1.BadRequestException('Authorization code has expired');
+        }
+        if (authCode.client_id !== client_id) {
+            throw new common_1.BadRequestException('Client ID mismatch');
+        }
+        if (authCode.code_challenge) {
+            const isValid = this.validatePKCE(code_verifier, authCode.code_challenge, authCode.code_challenge_method);
+            if (!isValid) {
+                throw new common_1.BadRequestException('Invalid PKCE verification');
+            }
+        }
+        const tokens = this.jwtTokenService.generateTokenPair(authCode.user_id, client_id, 'mcp:access');
+        this.store.removeAuthCode(code);
+        return tokens;
+    }
+    async handleRefreshTokenGrant(refresh_token) {
+        const newTokens = this.jwtTokenService.refreshAccessToken(refresh_token);
+        if (!newTokens) {
+            throw new common_1.BadRequestException('Failed to refresh token');
+        }
+        return newTokens;
+    }
+    validateToken(req) {
+        return {
+            valid: true,
+            user_id: req.user.sub,
+            client_id: req.user.client_id,
+            scope: req.user.scope,
+            expires_at: req.user.exp * 1000,
+        };
+    }
+    parseExpiresInToMs(expiresIn) {
+        const match = expiresIn.match(/^(\d+)([smhd]?)$/);
+        if (!match) {
+            throw new Error(`Invalid expiresIn format: ${expiresIn}`);
+        }
+        const value = parseInt(match[1], 10);
+        const unit = match[2] || 's';
+        const multipliers = {
+            s: 1000,
+            m: 60 * 1000,
+            h: 60 * 60 * 1000,
+            d: 24 * 60 * 60 * 1000,
+        };
+        return value * multipliers[unit];
+    }
+    validatePKCE(code_verifier, code_challenge, method) {
+        if (method === 'plain') {
+            return code_verifier === code_challenge;
+        }
+        else if (method === 'S256') {
+            const hash = (0, crypto_1.createHash)('sha256')
+                .update(code_verifier)
+                .digest('base64url');
+            return hash === code_challenge;
+        }
+        return false;
+    }
+};
+exports.McpOAuthController = McpOAuthController;
+__decorate([
+    (0, common_1.Get)('/.well-known/oauth-authorization-server'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], McpOAuthController.prototype, "getAuthorizationServerMetadata", null);
+__decorate([
+    (0, common_1.Post)('/register'),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], McpOAuthController.prototype, "registerClient", null);
+__decorate([
+    (0, common_1.Get)('/authorize'),
+    __param(0, (0, common_1.Query)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], McpOAuthController.prototype, "authorize", null);
+__decorate([
+    (0, common_1.Get)('/auth'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], McpOAuthController.prototype, "authenticate", null);
+__decorate([
+    (0, common_1.Get)('/auth/callback'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", Promise)
+], McpOAuthController.prototype, "handleProviderCallback", null);
+__decorate([
+    (0, common_1.Post)('/token'),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], McpOAuthController.prototype, "exchangeToken", null);
+__decorate([
+    (0, common_1.Get)('/validate'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], McpOAuthController.prototype, "validateToken", null);
+exports.McpOAuthController = McpOAuthController = __decorate([
+    (0, common_1.Controller)(),
+    __param(0, (0, common_1.Inject)('OAUTH_MODULE_OPTIONS')),
+    __param(1, (0, common_1.Inject)('IOAuthStore')),
+    __metadata("design:paramtypes", [Object, Object, jwt_token_service_1.JwtTokenService,
+        client_service_1.ClientService])
+], McpOAuthController);
+//# sourceMappingURL=mcp-oauth.controller.js.map

package/dist/authz/mcp-oauth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.controller.js","sourceRoot":"","sources":["../../src/authz/mcp-oauth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,2CAYwB;AACxB,mCAAiD;AAEjD,wDAAgC;AAChC,4DAA6E;AAM7E,8DAA0D;AAC1D,oEAA0E;AAC1E,8EAAkE;AAe3D,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAI7B,YAC0C,OAA2B,EAC3B,KAAkB,EACzC,eAAgC,EAChC,aAA4B;QAHL,YAAO,GAAP,OAAO,CAAoB;QAC3B,UAAK,GAAL,KAAK,CAAa;QACzC,oBAAe,GAAf,eAAe,CAAiB;QAChC,kBAAa,GAAb,aAAa,CAAe;QAE7C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IAChD,CAAC;IAID,8BAA8B;QAC5B,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,sBAAsB,EAAE,GAAG,IAAI,CAAC,SAAS,YAAY;YACrD,cAAc,EAAE,GAAG,IAAI,CAAC,SAAS,QAAQ;YACzC,qBAAqB,EAAE,GAAG,IAAI,CAAC,SAAS,WAAW;YACnD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;YACnC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,qCAAqC,EAAE;gBACrC,qBAAqB;gBACrB,oBAAoB;gBACpB,MAAM;aACP;YACD,mBAAmB,EAAE,GAAG,IAAI,CAAC,SAAS,SAAS;YAC/C,gCAAgC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;SACpD,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAS,eAAsC;QACjE,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAGK,AAAN,KAAK,CAAC,SAAS,CAAU,KAAU,EAAS,GAAa;QACvD,MAAM,EACJ,aAAa,EACb,SAAS,EACT,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,KAAK,EACL,QAAQ,GACT,GAAG,KAAK,CAAC;QAGV,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,EAAE,CAAC;YACnD,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;QAC/D,CAAC;QAGD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,4BAAmB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAChE,SAAS,EACT,YAAY,CACb,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAGD,MAAM,SAAS,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE3D,MAAM,YAAY,GAAiB;YACjC,SAAS;YACT,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,YAAY;YACzB,aAAa,EAAE,cAAc;YAC7B,mBAAmB,EAAE,qBAAqB,IAAI,OAAO;YACrD,UAAU,EAAE,KAAK;YACjB,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB;SAC3D,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAGtD,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,EAAE;YACrC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;SAC3C,CAAC,CAAC;QAGH,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE;YACtC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;SAC3C,CAAC,CAAC;QAGH,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAGD,YAAY,CACH,GAAQ,EACR,GAAa,EACZ,IAAkB;QAE1B,kBAAQ,CAAC,YAAY,CAAC,sCAAa,EAAE;YACnC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW;SAChC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC;IAGK,AAAN,KAAK,CAAC,sBAAsB,CACnB,GAAyB,EACzB,GAAa,EACZ,IAAkB;QAG1B,kBAAQ,CAAC,YAAY,CACnB,sCAAa,EACb,EAAE,OAAO,EAAE,KAAK,EAAE,EAClB,KAAK,EAAE,GAAQ,EAAE,IAAS,EAAE,EAAE;YAC5B,IAAI,CAAC;gBACH,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;oBAC5C,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;gBACzD,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;gBACzD,CAAC;gBAED,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CACF,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,4BAA4B,CACxC,GAAyB,EACzB,GAAa;QAEb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;QACpE,CAAC;QAGD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAGD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,EACrB,IAAI,CAAC,OAAO,CACb,CAAC;QAGF,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;YAC5B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SAClC,CAAC,CAAC;QAGH,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QACjC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;QAG/B,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAGvD,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YACvB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC9B,SAAS,EAAE,OAAO,CAAC,QAAS;YAC5B,YAAY,EAAE,OAAO,CAAC,WAAY;YAClC,cAAc,EAAE,OAAO,CAAC,aAAc;YACtC,qBAAqB,EAAE,OAAO,CAAC,mBAAoB;YACnD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACvD,mBAAmB,EAAE,EAAE;SACxB,CAAC,CAAC;QAGH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAY,CAAC,CAAC;QAClD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QAGD,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAEzC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvC,CAAC;IAIK,AAAN,KAAK,CAAC,aAAa,CAAS,IAAS;QACnC,MAAM,EACJ,UAAU,EACV,IAAI,EACJ,aAAa,EACb,YAAY,EACZ,SAAS,EACT,aAAa,GACd,GAAG,IAAI,CAAC;QAET,IAAI,UAAU,KAAK,oBAAoB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,4BAA4B,CACtC,IAAI,EACJ,aAAa,EACb,YAAY,EACZ,SAAS,CACV,CAAC;QACJ,CAAC;aAAM,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,4BAA4B,CACxC,IAAY,EACZ,aAAqB,EACrB,YAAoB,EACpB,SAAiB;QAGjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAGD,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,gCAAgC,CAAC,CAAC;QAClE,CAAC;QAGD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAGD,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAC/B,aAAa,EACb,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,qBAAqB,CAC/B,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAGD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CACnD,QAAQ,CAAC,OAAO,EAChB,SAAS,EACT,YAAY,CACb,CAAC;QAGF,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAEhC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,aAAqB;QAErB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAID,aAAa,CAAQ,GAAyB;QAC5C,OAAO;YACL,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG;YACrB,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;YAC7B,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK;YACrB,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,GAAI,GAAG,IAAI;SACjC,CAAC;IACJ,CAAC;IAEO,kBAAkB,CAAC,SAAiB;QAE1C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAE7B,MAAM,WAAW,GAAG;YAClB,CAAC,EAAE,IAAI;YACP,CAAC,EAAE,EAAE,GAAG,IAAI;YACZ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;YACjB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;SACvB,CAAC;QAEF,OAAO,KAAK,GAAG,WAAW,CAAC,IAAgC,CAAC,CAAC;IAC/D,CAAC;IAEO,YAAY,CAClB,aAAqB,EACrB,cAAsB,EACtB,MAAc;QAEd,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,aAAa,KAAK,cAAc,CAAC;QAC1C,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;iBAC9B,MAAM,CAAC,aAAa,CAAC;iBACrB,MAAM,CAAC,WAAW,CAAC,CAAC;YACvB,OAAO,IAAI,KAAK,cAAc,CAAC;QACjC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAlWY,gDAAkB;AAgB7B;IADC,IAAA,YAAG,EAAC,yCAAyC,CAAC;;;;wEAkB9C;AAGK;IADL,IAAA,aAAI,EAAC,WAAW,CAAC;IACI,WAAA,IAAA,aAAI,GAAE,CAAA;;;;wDAE3B;AAGK;IADL,IAAA,YAAG,EAAC,YAAY,CAAC;IACD,WAAA,IAAA,cAAK,GAAE,CAAA;IAAc,WAAA,IAAA,YAAG,GAAE,CAAA;;;;mDAoE1C;AAGD;IADC,IAAA,YAAG,EAAC,OAAO,CAAC;IAEV,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;;;;sDAKR;AAGK;IADL,IAAA,YAAG,EAAC,gBAAgB,CAAC;IAEnB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;;;;gEAwBR;AA0EK;IADL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACM,WAAA,IAAA,aAAI,GAAE,CAAA;;;;uDAsB1B;AA+DD;IAFC,IAAA,YAAG,EAAC,WAAW,CAAC;IAChB,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACT,WAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAQnB;6BA7TU,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,sBAAsB,CAAC,CAAA;IAC9B,WAAA,IAAA,eAAM,EAAC,aAAa,CAAC,CAAA;qDACY,mCAAe;QACjB,8BAAa;GARpC,kBAAkB,CAkW9B","sourcesContent":["import {\n  BadRequestException,\n  Body,\n  Controller,\n  Get,\n  Inject,\n  Next,\n  Post,\n  Query,\n  Req,\n  Res,\n  UseGuards,\n} from '@nestjs/common';\nimport { createHash, randomBytes } from 'crypto';\nimport { Request as ExpressRequest, NextFunction, Response } from 'express';\nimport passport from 'passport';\nimport { AuthenticatedRequest, JwtAuthGuard } from './guards/jwt-auth.guard';\nimport {\n  OAuthModuleOptions,\n  OAuthSession,\n  OAuthUserProfile,\n} from './providers/oauth-provider.interface';\nimport { ClientService } from './services/client.service';\nimport { JwtTokenService, TokenPair } from './services/jwt-token.service';\nimport { STRATEGY_NAME } from './services/oauth-strategy.service';\nimport {\n  ClientRegistrationDto,\n  IOAuthStore,\n} from './stores/oauth-store.interface';\n\ninterface OAuthCallbackRequest extends ExpressRequest {\n  user?: {\n    profile: OAuthUserProfile;\n    accessToken: string;\n    provider: string;\n  };\n}\n\n@Controller()\nexport class McpOAuthController {\n  private readonly serverUrl: string;\n  private readonly isProduction: boolean;\n\n  constructor(\n    @Inject('OAUTH_MODULE_OPTIONS') private options: OAuthModuleOptions,\n    @Inject('IOAuthStore') private readonly store: IOAuthStore,\n    private readonly jwtTokenService: JwtTokenService,\n    private readonly clientService: ClientService,\n  ) {\n    this.serverUrl = this.options.serverUrl;\n    this.isProduction = this.options.cookieSecure;\n  }\n\n  // OAuth endpoints\n  @Get('/.well-known/oauth-authorization-server')\n  getAuthorizationServerMetadata() {\n    return {\n      issuer: this.serverUrl,\n      authorization_endpoint: `${this.serverUrl}/authorize`,\n      token_endpoint: `${this.serverUrl}/token`,\n      registration_endpoint: `${this.serverUrl}/register`,\n      response_types_supported: ['code'],\n      response_modes_supported: ['query'],\n      grant_types_supported: ['authorization_code', 'refresh_token'],\n      token_endpoint_auth_methods_supported: [\n        'client_secret_basic',\n        'client_secret_post',\n        'none',\n      ],\n      revocation_endpoint: `${this.serverUrl}/revoke`,\n      code_challenge_methods_supported: ['plain', 'S256'],\n    };\n  }\n\n  @Post('/register')\n  async registerClient(@Body() registrationDto: ClientRegistrationDto) {\n    return await this.clientService.registerClient(registrationDto);\n  }\n\n  @Get('/authorize')\n  async authorize(@Query() query: any, @Res() res: Response) {\n    const {\n      response_type,\n      client_id,\n      redirect_uri,\n      code_challenge,\n      code_challenge_method,\n      state,\n      resource,\n    } = query;\n\n    // Validate parameters\n    if (response_type !== 'code') {\n      throw new BadRequestException('Only response_type=code is supported');\n    }\n\n    if (!client_id || !redirect_uri || !code_challenge) {\n      throw new BadRequestException('Missing required parameters');\n    }\n\n    // Validate client and redirect URI\n    const client = await this.clientService.getClient(client_id);\n    if (!client) {\n      throw new BadRequestException('Invalid client_id');\n    }\n\n    const validRedirect = await this.clientService.validateRedirectUri(\n      client_id,\n      redirect_uri,\n    );\n    if (!validRedirect) {\n      throw new BadRequestException('Invalid redirect_uri');\n    }\n\n    // Create OAuth session\n    const sessionId = randomBytes(32).toString('base64url');\n    const sessionState = randomBytes(32).toString('base64url');\n\n    const oauthSession: OAuthSession = {\n      sessionId,\n      state: sessionState,\n      clientId: client_id,\n      redirectUri: redirect_uri,\n      codeChallenge: code_challenge,\n      codeChallengeMethod: code_challenge_method || 'plain',\n      oauthState: state,\n      resource,\n      expiresAt: Date.now() + this.options.oauthSessionExpiresIn,\n    };\n\n    this.store.storeOAuthSession(sessionId, oauthSession);\n\n    // Set session cookie\n    res.cookie('oauth_session', sessionId, {\n      httpOnly: true,\n      secure: this.isProduction,\n      maxAge: this.options.oauthSessionExpiresIn,\n    });\n\n    // Store state for passport\n    res.cookie('oauth_state', sessionState, {\n      httpOnly: true,\n      secure: this.isProduction,\n      maxAge: this.options.oauthSessionExpiresIn,\n    });\n\n    // Redirect to the provider's auth endpoint\n    res.redirect(`/auth`);\n  }\n\n  @Get('/auth')\n  authenticate(\n    @Req() req: any,\n    @Res() res: Response,\n    @Next() next: NextFunction,\n  ) {\n    passport.authenticate(STRATEGY_NAME, {\n      state: req.cookies?.oauth_state,\n    })(req, res, next);\n  }\n\n  @Get('/auth/callback')\n  async handleProviderCallback(\n    @Req() req: OAuthCallbackRequest,\n    @Res() res: Response,\n    @Next() next: NextFunction,\n  ) {\n    // Use a custom callback to handle the authentication result\n    passport.authenticate(\n      STRATEGY_NAME,\n      { session: false },\n      async (err: any, user: any) => {\n        try {\n          if (err) {\n            console.error('OAuth callback error:', err);\n            throw new BadRequestException('Authentication failed');\n          }\n\n          if (!user) {\n            throw new BadRequestException('Authentication failed');\n          }\n\n          req.user = user;\n          await this.processAuthenticationSuccess(req, res);\n        } catch (error) {\n          next(error);\n        }\n      },\n    )(req, res, next);\n  }\n\n  private async processAuthenticationSuccess(\n    req: OAuthCallbackRequest,\n    res: Response,\n  ) {\n    const user = req.user;\n    if (!user) {\n      throw new BadRequestException('Authentication failed');\n    }\n\n    const sessionId = req.cookies?.oauth_session;\n    if (!sessionId) {\n      throw new BadRequestException('Missing OAuth session');\n    }\n\n    const session = await this.store.getOAuthSession(sessionId);\n    if (!session || session.expiresAt < Date.now()) {\n      throw new BadRequestException('Invalid or expired OAuth session');\n    }\n\n    // Verify state\n    const stateFromCookie = req.cookies?.oauth_state;\n    if (session.state !== stateFromCookie) {\n      throw new BadRequestException('Invalid state parameter');\n    }\n\n    // Generate JWT for UI access\n    const jwt = this.jwtTokenService.generateUserToken(\n      user.profile.username,\n      user.profile,\n    );\n\n    // Set JWT token as cookie for UI endpoints\n    res.cookie('auth_token', jwt, {\n      httpOnly: true,\n      secure: this.isProduction,\n      maxAge: this.options.cookieMaxAge,\n    });\n\n    // Clear temporary cookies\n    res.clearCookie('oauth_session');\n    res.clearCookie('oauth_state');\n\n    // Generate authorization code\n    const authCode = randomBytes(32).toString('base64url');\n\n    // Store the auth code\n    this.store.storeAuthCode({\n      code: authCode,\n      user_id: user.profile.username,\n      client_id: session.clientId!,\n      redirect_uri: session.redirectUri!,\n      code_challenge: session.codeChallenge!,\n      code_challenge_method: session.codeChallengeMethod!,\n      expires_at: Date.now() + this.options.authCodeExpiresIn,\n      github_access_token: '', // No longer provider-specific\n    });\n\n    // Build redirect URL with authorization code\n    const redirectUrl = new URL(session.redirectUri!);\n    redirectUrl.searchParams.set('code', authCode);\n    if (session.oauthState) {\n      redirectUrl.searchParams.set('state', session.oauthState);\n    }\n\n    // Clean up session\n    this.store.removeOAuthSession(sessionId);\n\n    res.redirect(redirectUrl.toString());\n  }\n\n  // Token endpoints (remain the same)\n  @Post('/token')\n  async exchangeToken(@Body() body: any): Promise<TokenPair> {\n    const {\n      grant_type,\n      code,\n      code_verifier,\n      redirect_uri,\n      client_id,\n      refresh_token,\n    } = body;\n\n    if (grant_type === 'authorization_code') {\n      return this.handleAuthorizationCodeGrant(\n        code,\n        code_verifier,\n        redirect_uri,\n        client_id,\n      );\n    } else if (grant_type === 'refresh_token') {\n      return this.handleRefreshTokenGrant(refresh_token);\n    } else {\n      throw new BadRequestException('Unsupported grant_type');\n    }\n  }\n\n  private async handleAuthorizationCodeGrant(\n    code: string,\n    code_verifier: string,\n    redirect_uri: string,\n    client_id: string,\n  ): Promise<TokenPair> {\n    // Validate the authorization code\n    const authCode = await this.store.getAuthCode(code);\n    if (!authCode) {\n      throw new BadRequestException('Invalid authorization code');\n    }\n\n    // Check if code has expired\n    if (authCode.expires_at < Date.now()) {\n      await this.store.removeAuthCode(code);\n      throw new BadRequestException('Authorization code has expired');\n    }\n\n    // Validate client_id matches\n    if (authCode.client_id !== client_id) {\n      throw new BadRequestException('Client ID mismatch');\n    }\n\n    // Validate PKCE if required\n    if (authCode.code_challenge) {\n      const isValid = this.validatePKCE(\n        code_verifier,\n        authCode.code_challenge,\n        authCode.code_challenge_method,\n      );\n      if (!isValid) {\n        throw new BadRequestException('Invalid PKCE verification');\n      }\n    }\n\n    // Generate tokens\n    const tokens = this.jwtTokenService.generateTokenPair(\n      authCode.user_id,\n      client_id,\n      'mcp:access',\n    );\n\n    // Remove the used authorization code\n    this.store.removeAuthCode(code);\n\n    return tokens;\n  }\n\n  private async handleRefreshTokenGrant(\n    refresh_token: string,\n  ): Promise<TokenPair> {\n    const newTokens = this.jwtTokenService.refreshAccessToken(refresh_token);\n    if (!newTokens) {\n      throw new BadRequestException('Failed to refresh token');\n    }\n\n    return newTokens;\n  }\n\n  @Get('/validate')\n  @UseGuards(JwtAuthGuard)\n  validateToken(@Req() req: AuthenticatedRequest) {\n    return {\n      valid: true,\n      user_id: req.user.sub,\n      client_id: req.user.client_id,\n      scope: req.user.scope,\n      expires_at: req.user.exp! * 1000,\n    };\n  }\n\n  private parseExpiresInToMs(expiresIn: string): number {\n    // Handle formats like \"60s\", \"30d\", \"24h\", \"1440m\"\n    const match = expiresIn.match(/^(\\d+)([smhd]?)$/);\n    if (!match) {\n      throw new Error(`Invalid expiresIn format: ${expiresIn}`);\n    }\n\n    const value = parseInt(match[1], 10);\n    const unit = match[2] || 's'; // default to seconds\n\n    const multipliers = {\n      s: 1000,\n      m: 60 * 1000,\n      h: 60 * 60 * 1000,\n      d: 24 * 60 * 60 * 1000,\n    };\n\n    return value * multipliers[unit as keyof typeof multipliers];\n  }\n\n  private validatePKCE(\n    code_verifier: string,\n    code_challenge: string,\n    method: string,\n  ): boolean {\n    if (method === 'plain') {\n      return code_verifier === code_challenge;\n    } else if (method === 'S256') {\n      const hash = createHash('sha256')\n        .update(code_verifier)\n        .digest('base64url');\n      return hash === code_challenge;\n    }\n    return false;\n  }\n}\n"]}

package/dist/authz/mcp-oauth.module.d.ts

@@ -0,0 +1,11 @@
+import { DynamicModule } from '@nestjs/common';
+import { OAuthModuleDefaults, OAuthUserModuleOptions as AuthUserModuleOptions } from './providers/oauth-provider.interface';
+export declare const DEFAULT_OPTIONS: OAuthModuleDefaults;
+export declare class McpAuthModule {
+    static forRoot(options: AuthUserModuleOptions): DynamicModule;
+    private static mergeAndValidateOptions;
+    private static validateRequiredOptions;
+    private static validateResolvedOptions;
+    private static createStoreProvider;
+}
+//# sourceMappingURL=mcp-oauth.module.d.ts.map

package/dist/authz/mcp-oauth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.module.d.ts","sourceRoot":"","sources":["../../src/authz/mcp-oauth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAkB,MAAM,gBAAgB,CAAC;AAU/D,OAAO,EACL,mBAAmB,EAEnB,sBAAsB,IAAI,qBAAqB,EAChD,MAAM,sCAAsC,CAAC;AAU9C,eAAO,MAAM,eAAe,EAAE,mBAU7B,CAAC;AAEF,qBAEa,aAAa;IACxB,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,GAAG,aAAa;IA4F7D,OAAO,CAAC,MAAM,CAAC,uBAAuB;IA2BtC,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAmBtC,OAAO,CAAC,MAAM,CAAC,uBAAuB;IA0BtC,OAAO,CAAC,MAAM,CAAC,mBAAmB;CA+BnC"}