@rekog/mcp-nest 1.7.0-alpha.0 → 1.7.0-alpha.2

package/dist/authz/stores/typeorm/typeorm-store.service.js

@@ -0,0 +1,87 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TypeOrmStore = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const crypto_1 = require("crypto");
+const entities_1 = require("./entities");
+let TypeOrmStore = class TypeOrmStore {
+    constructor(clientRepository, authCodeRepository, sessionRepository) {
+        this.clientRepository = clientRepository;
+        this.authCodeRepository = authCodeRepository;
+        this.sessionRepository = sessionRepository;
+    }
+    async storeClient(client) {
+        const savedClient = await this.clientRepository.save(client);
+        return savedClient;
+    }
+    async getClient(client_id) {
+        return ((await this.clientRepository.findOne({ where: { client_id } })) ??
+            undefined);
+    }
+    async findClient(client_name) {
+        return ((await this.clientRepository.findOne({ where: { client_name } })) ??
+            undefined);
+    }
+    async storeAuthCode(code) {
+        await this.authCodeRepository.save(code);
+    }
+    async getAuthCode(code) {
+        const authCode = await this.authCodeRepository.findOne({ where: { code } });
+        if (authCode && authCode.expires_at < Date.now()) {
+            await this.authCodeRepository.delete({ code });
+            return undefined;
+        }
+        return authCode ?? undefined;
+    }
+    async removeAuthCode(code) {
+        await this.authCodeRepository.delete({ code });
+    }
+    async storeOAuthSession(sessionId, session) {
+        await this.sessionRepository.save({ ...session, sessionId });
+    }
+    async getOAuthSession(sessionId) {
+        const session = await this.sessionRepository.findOne({
+            where: { sessionId },
+        });
+        if (session && session.expiresAt < Date.now()) {
+            await this.sessionRepository.delete({ sessionId });
+            return undefined;
+        }
+        return session ?? undefined;
+    }
+    async removeOAuthSession(sessionId) {
+        await this.sessionRepository.delete({ sessionId });
+    }
+    generateClientId(client) {
+        const normalizedName = client.client_name
+            .toLowerCase()
+            .replace(/[^a-z0-9]/g, '');
+        const salt = (0, crypto_1.randomBytes)(4).toString('hex');
+        return `${normalizedName}_${salt}`;
+    }
+};
+exports.TypeOrmStore = TypeOrmStore;
+exports.TypeOrmStore = TypeOrmStore = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(entities_1.OAuthClientEntity)),
+    __param(1, (0, typeorm_1.InjectRepository)(entities_1.AuthorizationCodeEntity)),
+    __param(2, (0, typeorm_1.InjectRepository)(entities_1.OAuthSessionEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository])
+], TypeOrmStore);
+//# sourceMappingURL=typeorm-store.service.js.map

package/dist/authz/stores/typeorm/typeorm-store.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typeorm-store.service.js","sourceRoot":"","sources":["../../../../src/authz/stores/typeorm/typeorm-store.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4C;AAC5C,6CAAmD;AACnD,qCAAqC;AACrC,mCAAqC;AACrC,yCAIoB;AASb,IAAM,YAAY,GAAlB,MAAM,YAAY;IACvB,YAEmB,gBAA+C,EAE/C,kBAAuD,EAEvD,iBAAiD;QAJjD,qBAAgB,GAAhB,gBAAgB,CAA+B;QAE/C,uBAAkB,GAAlB,kBAAkB,CAAqC;QAEvD,sBAAiB,GAAjB,iBAAiB,CAAgC;IACjE,CAAC;IAGJ,KAAK,CAAC,WAAW,CAAC,MAAmB;QACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,SAAiB;QAC/B,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAC/D,SAAS,CACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YACjE,SAAS,CACV,CAAC;IACJ,CAAC;IAGD,KAAK,CAAC,aAAa,CAAC,IAAuB;QACzC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAE5E,IAAI,QAAQ,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,QAAQ,IAAI,SAAS,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAGD,KAAK,CAAC,iBAAiB,CACrB,SAAiB,EACjB,OAAqB;QAErB,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACnD,KAAK,EAAE,EAAE,SAAS,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,IAAI,SAAS,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,SAAiB;QACxC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,gBAAgB,CAAC,MAAmB;QAElC,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW;aACtC,WAAW,EAAE;aACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,GAAG,cAAc,IAAI,IAAI,EAAE,CAAC;IACrC,CAAC;CACF,CAAA;AAhFY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,0BAAgB,EAAC,4BAAiB,CAAC,CAAA;IAEnC,WAAA,IAAA,0BAAgB,EAAC,kCAAuB,CAAC,CAAA;IAEzC,WAAA,IAAA,0BAAgB,EAAC,6BAAkB,CAAC,CAAA;qCAHF,oBAAU;QAER,oBAAU;QAEX,oBAAU;GAPrC,YAAY,CAgFxB","sourcesContent":["import { Injectable } from '@nestjs/common';\nimport { InjectRepository } from '@nestjs/typeorm';\nimport { Repository } from 'typeorm';\nimport { randomBytes } from 'crypto';\nimport {\n  OAuthClientEntity,\n  AuthorizationCodeEntity,\n  OAuthSessionEntity,\n} from './entities';\nimport { OAuthSession } from '../../providers/oauth-provider.interface';\nimport {\n  AuthorizationCode,\n  IOAuthStore,\n  OAuthClient,\n} from '../oauth-store.interface';\n\n@Injectable()\nexport class TypeOrmStore implements IOAuthStore {\n  constructor(\n    @InjectRepository(OAuthClientEntity)\n    private readonly clientRepository: Repository<OAuthClientEntity>,\n    @InjectRepository(AuthorizationCodeEntity)\n    private readonly authCodeRepository: Repository<AuthorizationCodeEntity>,\n    @InjectRepository(OAuthSessionEntity)\n    private readonly sessionRepository: Repository<OAuthSessionEntity>,\n  ) {}\n\n  // Client management\n  async storeClient(client: OAuthClient): Promise<OAuthClient> {\n    const savedClient = await this.clientRepository.save(client);\n    return savedClient;\n  }\n\n  async getClient(client_id: string): Promise<OAuthClient | undefined> {\n    return (\n      (await this.clientRepository.findOne({ where: { client_id } })) ??\n      undefined\n    );\n  }\n\n  async findClient(client_name: string): Promise<OAuthClient | undefined> {\n    return (\n      (await this.clientRepository.findOne({ where: { client_name } })) ??\n      undefined\n    );\n  }\n\n  // Authorization code management\n  async storeAuthCode(code: AuthorizationCode): Promise<void> {\n    await this.authCodeRepository.save(code);\n  }\n\n  async getAuthCode(code: string): Promise<AuthorizationCode | undefined> {\n    const authCode = await this.authCodeRepository.findOne({ where: { code } });\n    // Check if expired\n    if (authCode && authCode.expires_at < Date.now()) {\n      await this.authCodeRepository.delete({ code });\n      return undefined;\n    }\n    return authCode ?? undefined;\n  }\n\n  async removeAuthCode(code: string): Promise<void> {\n    await this.authCodeRepository.delete({ code });\n  }\n\n  // OAuth session management\n  async storeOAuthSession(\n    sessionId: string,\n    session: OAuthSession,\n  ): Promise<void> {\n    await this.sessionRepository.save({ ...session, sessionId });\n  }\n\n  async getOAuthSession(sessionId: string): Promise<OAuthSession | undefined> {\n    const session = await this.sessionRepository.findOne({\n      where: { sessionId },\n    });\n    if (session && session.expiresAt < Date.now()) {\n      await this.sessionRepository.delete({ sessionId });\n      return undefined;\n    }\n    return session ?? undefined;\n  }\n\n  async removeOAuthSession(sessionId: string): Promise<void> {\n    await this.sessionRepository.delete({ sessionId });\n  }\n\n  generateClientId(client: OAuthClient): string {\n    // Create deterministic client ID based on name + random salt\n    const normalizedName = client.client_name\n      .toLowerCase()\n      .replace(/[^a-z0-9]/g, '');\n    const salt = randomBytes(4).toString('hex');\n    return `${normalizedName}_${salt}`;\n  }\n}\n"]}

package/dist/mcp/services/handlers/mcp-tools.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-tools.handler.d.ts","sourceRoot":"","sources":["../../../../src/mcp/services/handlers/mcp-tools.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQpE,OAAO,EAAoB,SAAS,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,qBACa,eAAgB,SAAQ,cAAc;IAItB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAFrD,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,kBAAkB,EACc,WAAW,EAAE,MAAM;IAK/D,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,gBAAgB;IAwBxB,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO;CAoG5D"}
+{"version":3,"file":"mcp-tools.handler.d.ts","sourceRoot":"","sources":["../../../../src/mcp/services/handlers/mcp-tools.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQpE,OAAO,EAAoB,SAAS,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,qBACa,eAAgB,SAAQ,cAAc;IAItB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAFrD,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,kBAAkB,EACc,WAAW,EAAE,MAAM;IAK/D,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,gBAAgB;IAwBxB,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO;CAuG5D"}

package/dist/mcp/services/handlers/mcp-tools.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-tools.handler.js","sourceRoot":"","sources":["../../../../src/mcp/services/handlers/mcp-tools.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,iEAK4C;AAC5C,2CAA2D;AAC3D,uCAA2D;AAE3D,2DAAqD;AACrD,kEAA6D;AAC7D,yDAAoD;AAI7C,IAAM,eAAe,uBAArB,MAAM,eAAgB,SAAQ,iCAAc;IACjD,YACE,SAAoB,EACpB,QAA4B,EACc,WAAmB;QAE7D,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAe,CAAC,IAAI,CAAC,CAAC;QAFP,gBAAW,GAAX,WAAW,CAAQ;IAG/D,CAAC;IAEO,wBAAwB,CAAC,MAAW;QAC1C,OAAO;YACL;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aACtC;SACF,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,MAAW,EAAE,YAAyB;QAC7D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,aAAa,EACvB,4CAA4C,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CACvE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,iBAAiB,EAAE,MAAM;gBACzB,OAAO,EAAE,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;aAC/C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,SAAoB,EAAE,WAAoB;QACzD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,GAAG,EAAE;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBAElE,MAAM,UAAU,GAAG;oBACjB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;oBACxB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;oBACtC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;iBACvC,CAAC;gBAGF,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;oBAC7B,UAAU,CAAC,aAAa,CAAC,GAAG,IAAA,oCAAe,EAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACxE,CAAC;gBAGD,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;oBAC/B,MAAM,YAAY,GAAG,IAAA,oCAAe,EAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;oBAGjE,MAAM,UAAU,GAAG;wBACjB,GAAG,YAAY;wBACf,IAAI,EAAE,QAAQ;qBACf,CAAC;oBAEF,UAAU,CAAC,cAAc,CAAC,GAAG,UAAU,CAAC;gBAC1C,CAAC;gBAED,OAAO,UAAU,CAAC;YACpB,CAAC,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK;aACN,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAChC,gCAAqB,EACrB,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAE3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CACrC,IAAI,CAAC,WAAW,EAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CACpB,CAAC;YAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CACvC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,uBAAgB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAC7D,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBAElE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAC/C,QAAQ,CAAC,aAAa,EACtB,SAAS,EACT,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;gBAEF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAEvD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CACvC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CACzD,YAAY,EACZ,OAAO,CAAC,MAAM,CAAC,SAAS,EACxB,OAAO,EACP,WAAW,CACZ,CAAC;gBAEF,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAGxF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;gBAErE,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;oBAChD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AA9IY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,OAAO,EAAE,CAAC;IAKhC,WAAA,IAAA,eAAM,EAAC,eAAe,CAAC,CAAA;qCAFb,gBAAS;QACV,yCAAkB;GAHnB,eAAe,CA8I3B","sourcesContent":["import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport {\n  CallToolRequestSchema,\n  ErrorCode,\n  ListToolsRequestSchema,\n  McpError,\n} from '@modelcontextprotocol/sdk/types.js';\nimport { Inject, Injectable, Scope } from '@nestjs/common';\nimport { ContextIdFactory, ModuleRef } from '@nestjs/core';\nimport { Request } from 'express';\nimport { zodToJsonSchema } from 'zod-to-json-schema';\nimport { McpRegistryService } from '../mcp-registry.service';\nimport { McpHandlerBase } from './mcp-handler.base';\nimport { ZodTypeAny } from 'zod';\n\n@Injectable({ scope: Scope.REQUEST })\nexport class McpToolsHandler extends McpHandlerBase {\n  constructor(\n    moduleRef: ModuleRef,\n    registry: McpRegistryService,\n    @Inject('MCP_MODULE_ID') private readonly mcpModuleId: string,\n  ) {\n    super(moduleRef, registry, McpToolsHandler.name);\n  }\n\n  private buildDefaultContentBlock(result: any) {\n    return [\n      {\n        type: 'text',\n        text: JSON.stringify(result, null, 2),\n      },\n    ];\n  }\n\n  private formatToolResult(result: any, outputSchema?: ZodTypeAny): any {\n    if (result && typeof result === 'object' && Array.isArray(result.content)) {\n      return result;\n    }\n\n    if (outputSchema) {\n      const validation = outputSchema.safeParse(result);\n      if (!validation.success) {\n        throw new McpError(\n          ErrorCode.InternalError,\n          `Tool result does not match outputSchema: ${validation.error.message}`\n        );\n      }\n      return {\n        structuredContent: result,\n        content: this.buildDefaultContentBlock(result),\n      };\n    }\n\n    return {\n      content: this.buildDefaultContentBlock(result),\n    };\n  }\n\n  registerHandlers(mcpServer: McpServer, httpRequest: Request) {\n    if (this.registry.getTools(this.mcpModuleId).length === 0) {\n      this.logger.debug('No tools registered, skipping tool handlers');\n      return;\n    }\n\n    mcpServer.server.setRequestHandler(ListToolsRequestSchema, () => {\n      const tools = this.registry.getTools(this.mcpModuleId).map((tool) => {\n        // Create base schema\n        const toolSchema = {\n          name: tool.metadata.name,\n          description: tool.metadata.description,\n          annotations: tool.metadata.annotations,\n        };\n\n        // Add input schema if defined\n        if (tool.metadata.parameters) {\n          toolSchema['inputSchema'] = zodToJsonSchema(tool.metadata.parameters);\n        }\n\n        // Add output schema if defined, ensuring it has type: 'object'\n        if (tool.metadata.outputSchema) {\n          const outputSchema = zodToJsonSchema(tool.metadata.outputSchema);\n\n          // Create a new object that explicitly includes type: 'object'\n          const jsonSchema = {\n            ...outputSchema,\n            type: 'object',\n          };\n\n          toolSchema['outputSchema'] = jsonSchema;\n        }\n\n        return toolSchema;\n      });\n\n      return {\n        tools,\n      };\n    });\n\n    mcpServer.server.setRequestHandler(\n      CallToolRequestSchema,\n      async (request) => {\n        this.logger.debug('CallToolRequestSchema is being called');\n\n        const toolInfo = this.registry.findTool(\n          this.mcpModuleId,\n          request.params.name,\n        );\n\n        if (!toolInfo) {\n          throw new McpError(\n            ErrorCode.MethodNotFound,\n            `Unknown tool: ${request.params.name}`,\n          );\n        }\n\n        try {\n          const contextId = ContextIdFactory.getByRequest(httpRequest);\n          this.moduleRef.registerRequestByContextId(httpRequest, contextId);\n\n          const toolInstance = await this.moduleRef.resolve(\n            toolInfo.providerClass,\n            contextId,\n            { strict: false },\n          );\n\n          const context = this.createContext(mcpServer, request);\n\n          if (!toolInstance) {\n            throw new McpError(\n              ErrorCode.MethodNotFound,\n              `Unknown tool: ${request.params.name}`,\n            );\n          }\n\n          const result = await toolInstance[toolInfo.methodName].call(\n            toolInstance,\n            request.params.arguments,\n            context,\n            httpRequest,\n          );\n\n          const transformedResult = this.formatToolResult(result, toolInfo.metadata.outputSchema);\n\n          // eslint-disable-next-line @typescript-eslint/no-unsafe-return\n          this.logger.debug(transformedResult, 'CallToolRequestSchema result');\n\n          return transformedResult;\n        } catch (error) {\n          this.logger.error(error);\n          return {\n            content: [{ type: 'text', text: error.message }],\n            isError: true,\n          };\n        }\n      },\n    );\n  }\n}\n"]}
+{"version":3,"file":"mcp-tools.handler.js","sourceRoot":"","sources":["../../../../src/mcp/services/handlers/mcp-tools.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,iEAK4C;AAC5C,2CAA2D;AAC3D,uCAA2D;AAE3D,2DAAqD;AACrD,kEAA6D;AAC7D,yDAAoD;AAI7C,IAAM,eAAe,uBAArB,MAAM,eAAgB,SAAQ,iCAAc;IACjD,YACE,SAAoB,EACpB,QAA4B,EACc,WAAmB;QAE7D,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAe,CAAC,IAAI,CAAC,CAAC;QAFP,gBAAW,GAAX,WAAW,CAAQ;IAG/D,CAAC;IAEO,wBAAwB,CAAC,MAAW;QAC1C,OAAO;YACL;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aACtC;SACF,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,MAAW,EAAE,YAAyB;QAC7D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,aAAa,EACvB,4CAA4C,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CACvE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,iBAAiB,EAAE,MAAM;gBACzB,OAAO,EAAE,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;aAC/C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,SAAoB,EAAE,WAAoB;QACzD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,GAAG,EAAE;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBAElE,MAAM,UAAU,GAAG;oBACjB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;oBACxB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;oBACtC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;iBACvC,CAAC;gBAGF,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;oBAC7B,UAAU,CAAC,aAAa,CAAC,GAAG,IAAA,oCAAe,EAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACxE,CAAC;gBAGD,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;oBAC/B,MAAM,YAAY,GAAG,IAAA,oCAAe,EAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;oBAGjE,MAAM,UAAU,GAAG;wBACjB,GAAG,YAAY;wBACf,IAAI,EAAE,QAAQ;qBACf,CAAC;oBAEF,UAAU,CAAC,cAAc,CAAC,GAAG,UAAU,CAAC;gBAC1C,CAAC;gBAED,OAAO,UAAU,CAAC;YACpB,CAAC,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK;aACN,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAChC,gCAAqB,EACrB,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAE3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CACrC,IAAI,CAAC,WAAW,EAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CACpB,CAAC;YAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CACvC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,uBAAgB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAC7D,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBAElE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAC/C,QAAQ,CAAC,aAAa,EACtB,SAAS,EACT,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;gBAEF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAEvD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CACvC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CACzD,YAAY,EACZ,OAAO,CAAC,MAAM,CAAC,SAAS,EACxB,OAAO,EACP,WAAW,CACZ,CAAC;gBAEF,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAC7C,MAAM,EACN,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAC/B,CAAC;gBAGF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;gBAErE,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;oBAChD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AAjJY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,OAAO,EAAE,CAAC;IAKhC,WAAA,IAAA,eAAM,EAAC,eAAe,CAAC,CAAA;qCAFb,gBAAS;QACV,yCAAkB;GAHnB,eAAe,CAiJ3B","sourcesContent":["import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport {\n  CallToolRequestSchema,\n  ErrorCode,\n  ListToolsRequestSchema,\n  McpError,\n} from '@modelcontextprotocol/sdk/types.js';\nimport { Inject, Injectable, Scope } from '@nestjs/common';\nimport { ContextIdFactory, ModuleRef } from '@nestjs/core';\nimport { Request } from 'express';\nimport { zodToJsonSchema } from 'zod-to-json-schema';\nimport { McpRegistryService } from '../mcp-registry.service';\nimport { McpHandlerBase } from './mcp-handler.base';\nimport { ZodTypeAny } from 'zod';\n\n@Injectable({ scope: Scope.REQUEST })\nexport class McpToolsHandler extends McpHandlerBase {\n  constructor(\n    moduleRef: ModuleRef,\n    registry: McpRegistryService,\n    @Inject('MCP_MODULE_ID') private readonly mcpModuleId: string,\n  ) {\n    super(moduleRef, registry, McpToolsHandler.name);\n  }\n\n  private buildDefaultContentBlock(result: any) {\n    return [\n      {\n        type: 'text',\n        text: JSON.stringify(result, null, 2),\n      },\n    ];\n  }\n\n  private formatToolResult(result: any, outputSchema?: ZodTypeAny): any {\n    if (result && typeof result === 'object' && Array.isArray(result.content)) {\n      return result;\n    }\n\n    if (outputSchema) {\n      const validation = outputSchema.safeParse(result);\n      if (!validation.success) {\n        throw new McpError(\n          ErrorCode.InternalError,\n          `Tool result does not match outputSchema: ${validation.error.message}`,\n        );\n      }\n      return {\n        structuredContent: result,\n        content: this.buildDefaultContentBlock(result),\n      };\n    }\n\n    return {\n      content: this.buildDefaultContentBlock(result),\n    };\n  }\n\n  registerHandlers(mcpServer: McpServer, httpRequest: Request) {\n    if (this.registry.getTools(this.mcpModuleId).length === 0) {\n      this.logger.debug('No tools registered, skipping tool handlers');\n      return;\n    }\n\n    mcpServer.server.setRequestHandler(ListToolsRequestSchema, () => {\n      const tools = this.registry.getTools(this.mcpModuleId).map((tool) => {\n        // Create base schema\n        const toolSchema = {\n          name: tool.metadata.name,\n          description: tool.metadata.description,\n          annotations: tool.metadata.annotations,\n        };\n\n        // Add input schema if defined\n        if (tool.metadata.parameters) {\n          toolSchema['inputSchema'] = zodToJsonSchema(tool.metadata.parameters);\n        }\n\n        // Add output schema if defined, ensuring it has type: 'object'\n        if (tool.metadata.outputSchema) {\n          const outputSchema = zodToJsonSchema(tool.metadata.outputSchema);\n\n          // Create a new object that explicitly includes type: 'object'\n          const jsonSchema = {\n            ...outputSchema,\n            type: 'object',\n          };\n\n          toolSchema['outputSchema'] = jsonSchema;\n        }\n\n        return toolSchema;\n      });\n\n      return {\n        tools,\n      };\n    });\n\n    mcpServer.server.setRequestHandler(\n      CallToolRequestSchema,\n      async (request) => {\n        this.logger.debug('CallToolRequestSchema is being called');\n\n        const toolInfo = this.registry.findTool(\n          this.mcpModuleId,\n          request.params.name,\n        );\n\n        if (!toolInfo) {\n          throw new McpError(\n            ErrorCode.MethodNotFound,\n            `Unknown tool: ${request.params.name}`,\n          );\n        }\n\n        try {\n          const contextId = ContextIdFactory.getByRequest(httpRequest);\n          this.moduleRef.registerRequestByContextId(httpRequest, contextId);\n\n          const toolInstance = await this.moduleRef.resolve(\n            toolInfo.providerClass,\n            contextId,\n            { strict: false },\n          );\n\n          const context = this.createContext(mcpServer, request);\n\n          if (!toolInstance) {\n            throw new McpError(\n              ErrorCode.MethodNotFound,\n              `Unknown tool: ${request.params.name}`,\n            );\n          }\n\n          const result = await toolInstance[toolInfo.methodName].call(\n            toolInstance,\n            request.params.arguments,\n            context,\n            httpRequest,\n          );\n\n          const transformedResult = this.formatToolResult(\n            result,\n            toolInfo.metadata.outputSchema,\n          );\n\n          // eslint-disable-next-line @typescript-eslint/no-unsafe-return\n          this.logger.debug(transformedResult, 'CallToolRequestSchema result');\n\n          return transformedResult;\n        } catch (error) {\n          this.logger.error(error);\n          return {\n            content: [{ type: 'text', text: error.message }],\n            isError: true,\n          };\n        }\n      },\n    );\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rekog/mcp-nest",
-  "version": "1.7.0-alpha.0",
+  "version": "1.7.0-alpha.2",
   "description": "NestJS module for creating Model Context Protocol (MCP) servers",
   "main": "dist/index.js",
   "license": "MIT",
@@ -31,8 +31,12 @@
     "@modelcontextprotocol/sdk": ">=1.10.0",
     "@nestjs/common": ">=9.0.0",
     "@nestjs/core": ">=9.0.0",
+    "@nestjs/jwt": "^11.0.0",
+    "@nestjs/passport": "^11.0.5",
+    "@nestjs/typeorm": ">=9.0.0",
     "express": ">=4.0.0",
     "reflect-metadata": ">=0.1.14",
+    "typeorm": ">=0.3.25",
     "zod": "^3.0.0",
     "zod-to-json-schema": ">=3.23.0"
   },
@@ -44,9 +48,12 @@
     "@nestjs/core": "^11.1.1",
     "@nestjs/platform-express": "^11.1.1",
     "@nestjs/testing": "^11.1.1",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/cookie-parser": "^1.4.9",
     "@types/express": "^5.0.2",
     "@types/jest": "^29.5.14",
     "@types/node": "^22.10.10",
+    "@types/passport-google-oauth20": "^2.0.16",
     "@types/supertest": "^6.0.3",
     "eslint": "^9.18.0",
     "eslint-config-prettier": "^10.0.1",
@@ -60,6 +67,14 @@
     "typescript-eslint": "^8.20.0"
   },
   "dependencies": {
-    "path-to-regexp": "^8.2.0"
+    "@nestjs/config": "^4.0.2",
+    "better-sqlite3": "11.10.0",
+    "cookie-parser": "^1.4.7",
+    "passport": "^0.7.0",
+    "passport-github": "^1.1.0",
+    "passport-google-oauth20": "^2.0.0",
+    "path-to-regexp": "^8.2.0",
+    "rxjs": "^7.8.2",
+    "sqlite3": "^5.1.7"
   }
 }

package/src/authz/guards/jwt-auth.guard.ts

@@ -0,0 +1,45 @@
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Request } from 'express';
+import { JwtPayload, JwtTokenService } from '../services/jwt-token.service';
+
+export interface AuthenticatedRequest extends Request {
+  user: JwtPayload;
+}
+
+@Injectable()
+export class JwtAuthGuard implements CanActivate {
+  constructor(private readonly jwtTokenService: JwtTokenService) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
+    const token = this.extractTokenFromHeader(request);
+
+    if (!token) {
+      throw new UnauthorizedException('Access token required');
+    }
+
+    const payload = this.jwtTokenService.validateToken(token);
+
+    if (!payload || payload.type !== 'access') {
+      throw new UnauthorizedException('Invalid or expired access token');
+    }
+
+    request.user = payload;
+    return true;
+  }
+
+  private extractTokenFromHeader(request: Request): string | undefined {
+    const authHeader = request.headers.authorization;
+    if (!authHeader) {
+      return undefined;
+    }
+
+    const [type, token] = authHeader.split(' ');
+    return type === 'Bearer' ? token : undefined;
+  }
+}

package/src/authz/index.ts

@@ -1 +1,8 @@
-
+export * from './mcp-oauth.controller';
+export * from './mcp-oauth.module';
+export * from './providers/oauth-provider.interface';
+export * from './providers/google.provider';
+export * from './providers/github.provider';
+export * from './stores/oauth-store.interface';
+export * from './stores/memory-store.service';
+export * from './stores/typeorm/typeorm-store.service';

package/src/authz/mcp-oauth.controller.ts

@@ -0,0 +1,394 @@
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Get,
+  Inject,
+  Next,
+  Post,
+  Query,
+  Req,
+  Res,
+  UseGuards,
+} from '@nestjs/common';
+import { createHash, randomBytes } from 'crypto';
+import { Request as ExpressRequest, NextFunction, Response } from 'express';
+import passport from 'passport';
+import { AuthenticatedRequest, JwtAuthGuard } from './guards/jwt-auth.guard';
+import {
+  OAuthModuleOptions,
+  OAuthSession,
+  OAuthUserProfile,
+} from './providers/oauth-provider.interface';
+import { ClientService } from './services/client.service';
+import { JwtTokenService, TokenPair } from './services/jwt-token.service';
+import { STRATEGY_NAME } from './services/oauth-strategy.service';
+import {
+  ClientRegistrationDto,
+  IOAuthStore,
+} from './stores/oauth-store.interface';
+
+interface OAuthCallbackRequest extends ExpressRequest {
+  user?: {
+    profile: OAuthUserProfile;
+    accessToken: string;
+    provider: string;
+  };
+}
+
+@Controller()
+export class McpOAuthController {
+  private readonly serverUrl: string;
+  private readonly isProduction: boolean;
+
+  constructor(
+    @Inject('OAUTH_MODULE_OPTIONS') private options: OAuthModuleOptions,
+    @Inject('IOAuthStore') private readonly store: IOAuthStore,
+    private readonly jwtTokenService: JwtTokenService,
+    private readonly clientService: ClientService,
+  ) {
+    this.serverUrl = this.options.serverUrl;
+    this.isProduction = this.options.cookieSecure;
+  }
+
+  // OAuth endpoints
+  @Get('/.well-known/oauth-authorization-server')
+  getAuthorizationServerMetadata() {
+    return {
+      issuer: this.serverUrl,
+      authorization_endpoint: `${this.serverUrl}/authorize`,
+      token_endpoint: `${this.serverUrl}/token`,
+      registration_endpoint: `${this.serverUrl}/register`,
+      response_types_supported: ['code'],
+      response_modes_supported: ['query'],
+      grant_types_supported: ['authorization_code', 'refresh_token'],
+      token_endpoint_auth_methods_supported: [
+        'client_secret_basic',
+        'client_secret_post',
+        'none',
+      ],
+      revocation_endpoint: `${this.serverUrl}/revoke`,
+      code_challenge_methods_supported: ['plain', 'S256'],
+    };
+  }
+
+  @Post('/register')
+  async registerClient(@Body() registrationDto: ClientRegistrationDto) {
+    return await this.clientService.registerClient(registrationDto);
+  }
+
+  @Get('/authorize')
+  async authorize(@Query() query: any, @Res() res: Response) {
+    const {
+      response_type,
+      client_id,
+      redirect_uri,
+      code_challenge,
+      code_challenge_method,
+      state,
+      resource,
+    } = query;
+
+    // Validate parameters
+    if (response_type !== 'code') {
+      throw new BadRequestException('Only response_type=code is supported');
+    }
+
+    if (!client_id || !redirect_uri || !code_challenge) {
+      throw new BadRequestException('Missing required parameters');
+    }
+
+    // Validate client and redirect URI
+    const client = await this.clientService.getClient(client_id);
+    if (!client) {
+      throw new BadRequestException('Invalid client_id');
+    }
+
+    const validRedirect = await this.clientService.validateRedirectUri(
+      client_id,
+      redirect_uri,
+    );
+    if (!validRedirect) {
+      throw new BadRequestException('Invalid redirect_uri');
+    }
+
+    // Create OAuth session
+    const sessionId = randomBytes(32).toString('base64url');
+    const sessionState = randomBytes(32).toString('base64url');
+
+    const oauthSession: OAuthSession = {
+      sessionId,
+      state: sessionState,
+      clientId: client_id,
+      redirectUri: redirect_uri,
+      codeChallenge: code_challenge,
+      codeChallengeMethod: code_challenge_method || 'plain',
+      oauthState: state,
+      resource,
+      expiresAt: Date.now() + this.options.oauthSessionExpiresIn,
+    };
+
+    this.store.storeOAuthSession(sessionId, oauthSession);
+
+    // Set session cookie
+    res.cookie('oauth_session', sessionId, {
+      httpOnly: true,
+      secure: this.isProduction,
+      maxAge: this.options.oauthSessionExpiresIn,
+    });
+
+    // Store state for passport
+    res.cookie('oauth_state', sessionState, {
+      httpOnly: true,
+      secure: this.isProduction,
+      maxAge: this.options.oauthSessionExpiresIn,
+    });
+
+    // Redirect to the provider's auth endpoint
+    res.redirect(`/auth`);
+  }
+
+  @Get('/auth')
+  authenticate(
+    @Req() req: any,
+    @Res() res: Response,
+    @Next() next: NextFunction,
+  ) {
+    passport.authenticate(STRATEGY_NAME, {
+      state: req.cookies?.oauth_state,
+    })(req, res, next);
+  }
+
+  @Get('/auth/callback')
+  async handleProviderCallback(
+    @Req() req: OAuthCallbackRequest,
+    @Res() res: Response,
+    @Next() next: NextFunction,
+  ) {
+    // Use a custom callback to handle the authentication result
+    passport.authenticate(
+      STRATEGY_NAME,
+      { session: false },
+      async (err: any, user: any) => {
+        try {
+          if (err) {
+            console.error('OAuth callback error:', err);
+            throw new BadRequestException('Authentication failed');
+          }
+
+          if (!user) {
+            throw new BadRequestException('Authentication failed');
+          }
+
+          req.user = user;
+          await this.processAuthenticationSuccess(req, res);
+        } catch (error) {
+          next(error);
+        }
+      },
+    )(req, res, next);
+  }
+
+  private async processAuthenticationSuccess(
+    req: OAuthCallbackRequest,
+    res: Response,
+  ) {
+    const user = req.user;
+    if (!user) {
+      throw new BadRequestException('Authentication failed');
+    }
+
+    const sessionId = req.cookies?.oauth_session;
+    if (!sessionId) {
+      throw new BadRequestException('Missing OAuth session');
+    }
+
+    const session = await this.store.getOAuthSession(sessionId);
+    if (!session || session.expiresAt < Date.now()) {
+      throw new BadRequestException('Invalid or expired OAuth session');
+    }
+
+    // Verify state
+    const stateFromCookie = req.cookies?.oauth_state;
+    if (session.state !== stateFromCookie) {
+      throw new BadRequestException('Invalid state parameter');
+    }
+
+    // Generate JWT for UI access
+    const jwt = this.jwtTokenService.generateUserToken(
+      user.profile.username,
+      user.profile,
+    );
+
+    // Set JWT token as cookie for UI endpoints
+    res.cookie('auth_token', jwt, {
+      httpOnly: true,
+      secure: this.isProduction,
+      maxAge: this.options.cookieMaxAge,
+    });
+
+    // Clear temporary cookies
+    res.clearCookie('oauth_session');
+    res.clearCookie('oauth_state');
+
+    // Generate authorization code
+    const authCode = randomBytes(32).toString('base64url');
+
+    // Store the auth code
+    this.store.storeAuthCode({
+      code: authCode,
+      user_id: user.profile.username,
+      client_id: session.clientId!,
+      redirect_uri: session.redirectUri!,
+      code_challenge: session.codeChallenge!,
+      code_challenge_method: session.codeChallengeMethod!,
+      expires_at: Date.now() + this.options.authCodeExpiresIn,
+      github_access_token: '', // No longer provider-specific
+    });
+
+    // Build redirect URL with authorization code
+    const redirectUrl = new URL(session.redirectUri!);
+    redirectUrl.searchParams.set('code', authCode);
+    if (session.oauthState) {
+      redirectUrl.searchParams.set('state', session.oauthState);
+    }
+
+    // Clean up session
+    this.store.removeOAuthSession(sessionId);
+
+    res.redirect(redirectUrl.toString());
+  }
+
+  // Token endpoints (remain the same)
+  @Post('/token')
+  async exchangeToken(@Body() body: any): Promise<TokenPair> {
+    const {
+      grant_type,
+      code,
+      code_verifier,
+      redirect_uri,
+      client_id,
+      refresh_token,
+    } = body;
+
+    if (grant_type === 'authorization_code') {
+      return this.handleAuthorizationCodeGrant(
+        code,
+        code_verifier,
+        redirect_uri,
+        client_id,
+      );
+    } else if (grant_type === 'refresh_token') {
+      return this.handleRefreshTokenGrant(refresh_token);
+    } else {
+      throw new BadRequestException('Unsupported grant_type');
+    }
+  }
+
+  private async handleAuthorizationCodeGrant(
+    code: string,
+    code_verifier: string,
+    redirect_uri: string,
+    client_id: string,
+  ): Promise<TokenPair> {
+    // Validate the authorization code
+    const authCode = await this.store.getAuthCode(code);
+    if (!authCode) {
+      throw new BadRequestException('Invalid authorization code');
+    }
+
+    // Check if code has expired
+    if (authCode.expires_at < Date.now()) {
+      await this.store.removeAuthCode(code);
+      throw new BadRequestException('Authorization code has expired');
+    }
+
+    // Validate client_id matches
+    if (authCode.client_id !== client_id) {
+      throw new BadRequestException('Client ID mismatch');
+    }
+
+    // Validate PKCE if required
+    if (authCode.code_challenge) {
+      const isValid = this.validatePKCE(
+        code_verifier,
+        authCode.code_challenge,
+        authCode.code_challenge_method,
+      );
+      if (!isValid) {
+        throw new BadRequestException('Invalid PKCE verification');
+      }
+    }
+
+    // Generate tokens
+    const tokens = this.jwtTokenService.generateTokenPair(
+      authCode.user_id,
+      client_id,
+      'mcp:access',
+    );
+
+    // Remove the used authorization code
+    this.store.removeAuthCode(code);
+
+    return tokens;
+  }
+
+  private async handleRefreshTokenGrant(
+    refresh_token: string,
+  ): Promise<TokenPair> {
+    const newTokens = this.jwtTokenService.refreshAccessToken(refresh_token);
+    if (!newTokens) {
+      throw new BadRequestException('Failed to refresh token');
+    }
+
+    return newTokens;
+  }
+
+  @Get('/validate')
+  @UseGuards(JwtAuthGuard)
+  validateToken(@Req() req: AuthenticatedRequest) {
+    return {
+      valid: true,
+      user_id: req.user.sub,
+      client_id: req.user.client_id,
+      scope: req.user.scope,
+      expires_at: req.user.exp! * 1000,
+    };
+  }
+
+  private parseExpiresInToMs(expiresIn: string): number {
+    // Handle formats like "60s", "30d", "24h", "1440m"
+    const match = expiresIn.match(/^(\d+)([smhd]?)$/);
+    if (!match) {
+      throw new Error(`Invalid expiresIn format: ${expiresIn}`);
+    }
+
+    const value = parseInt(match[1], 10);
+    const unit = match[2] || 's'; // default to seconds
+
+    const multipliers = {
+      s: 1000,
+      m: 60 * 1000,
+      h: 60 * 60 * 1000,
+      d: 24 * 60 * 60 * 1000,
+    };
+
+    return value * multipliers[unit as keyof typeof multipliers];
+  }
+
+  private validatePKCE(
+    code_verifier: string,
+    code_challenge: string,
+    method: string,
+  ): boolean {
+    if (method === 'plain') {
+      return code_verifier === code_challenge;
+    } else if (method === 'S256') {
+      const hash = createHash('sha256')
+        .update(code_verifier)
+        .digest('base64url');
+      return hash === code_challenge;
+    }
+    return false;
+  }
+}