@rekog/mcp-nest 1.7.0-alpha.0 → 1.7.0-alpha.2

package/src/authz/stores/sqlite/sqlite-store.service.ts

@@ -0,0 +1,279 @@
+import { Injectable } from '@nestjs/common';
+import Database from 'better-sqlite3';
+import { randomBytes } from 'crypto';
+import { OAuthSession } from '../../providers/oauth-provider.interface';
+import {
+  AuthorizationCode,
+  IOAuthStore,
+  OAuthClient,
+} from '../oauth-store.interface';
+
+@Injectable()
+export class SQLiteStore implements IOAuthStore {
+  private sqlite: any;
+
+  constructor(databasePath: string = './oauth-sqlite.db') {
+    this.sqlite = new Database(databasePath);
+    this.initializeTables();
+  }
+
+  private initializeTables() {
+    // Enable foreign keys
+    this.sqlite.pragma('foreign_keys = ON');
+
+    // Create tables if they don't exist
+    this.sqlite.exec(`
+      CREATE TABLE IF NOT EXISTS oauth_clients (
+        client_id TEXT PRIMARY KEY,
+        client_name TEXT NOT NULL,
+        client_description TEXT,
+        logo_uri TEXT,
+        client_uri TEXT,
+        developer_name TEXT,
+        developer_email TEXT,
+        redirect_uris TEXT NOT NULL,
+        grant_types TEXT NOT NULL,
+        response_types TEXT NOT NULL,
+        token_endpoint_auth_method TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      )
+    `);
+
+    this.sqlite.exec(`
+      CREATE TABLE IF NOT EXISTS authorization_codes (
+        code TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        redirect_uri TEXT NOT NULL,
+        code_challenge TEXT NOT NULL,
+        code_challenge_method TEXT NOT NULL,
+        expires_at INTEGER NOT NULL,
+        used_at INTEGER,
+        github_access_token TEXT NOT NULL
+      )
+    `);
+
+    this.sqlite.exec(`
+      CREATE TABLE IF NOT EXISTS oauth_sessions (
+        session_id TEXT PRIMARY KEY,
+        client_id TEXT NOT NULL,
+        redirect_uri TEXT NOT NULL,
+        code_challenge TEXT NOT NULL,
+        code_challenge_method TEXT NOT NULL,
+        state TEXT,
+        resource TEXT,
+        expires_at INTEGER NOT NULL
+      )
+    `);
+  }
+
+  // Client management
+  async storeClient(client: OAuthClient): Promise<OAuthClient> {
+    const stmt = this.sqlite.prepare(`
+      INSERT INTO oauth_clients (
+        client_id, client_name, client_description, logo_uri, client_uri,
+        developer_name, developer_email, redirect_uris, grant_types,
+        response_types, token_endpoint_auth_method, created_at, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+
+    stmt.run(
+      client.client_id,
+      client.client_name,
+      client.client_description || null,
+      client.logo_uri || null,
+      client.client_uri || null,
+      client.developer_name || null,
+      client.developer_email || null,
+      JSON.stringify(client.redirect_uris),
+      JSON.stringify(client.grant_types),
+      JSON.stringify(client.response_types),
+      client.token_endpoint_auth_method,
+      client.created_at.getTime(),
+      client.updated_at.getTime(),
+    );
+
+    return client;
+  }
+
+  async getClient(client_id: string): Promise<OAuthClient | undefined> {
+    const stmt = this.sqlite.prepare(
+      'SELECT * FROM oauth_clients WHERE client_id = ?',
+    );
+    const result = stmt.get(client_id) as any;
+
+    if (!result) {
+      return undefined;
+    }
+
+    return {
+      client_id: result.client_id,
+      client_name: result.client_name,
+      client_description: result.client_description || undefined,
+      logo_uri: result.logo_uri || undefined,
+      client_uri: result.client_uri || undefined,
+      developer_name: result.developer_name || undefined,
+      developer_email: result.developer_email || undefined,
+      redirect_uris: JSON.parse(result.redirect_uris),
+      grant_types: JSON.parse(result.grant_types),
+      response_types: JSON.parse(result.response_types),
+      token_endpoint_auth_method: result.token_endpoint_auth_method,
+      created_at: new Date(result.created_at),
+      updated_at: new Date(result.updated_at),
+    };
+  }
+
+  async findClient(client_name: string): Promise<OAuthClient | undefined> {
+    const stmt = this.sqlite.prepare(
+      'SELECT * FROM oauth_clients WHERE client_name = ?',
+    );
+    const result = stmt.get(client_name) as any;
+
+    if (!result) {
+      return undefined;
+    }
+
+    return {
+      client_id: result.client_id,
+      client_name: result.client_name,
+      client_description: result.client_description || undefined,
+      logo_uri: result.logo_uri || undefined,
+      client_uri: result.client_uri || undefined,
+      developer_name: result.developer_name || undefined,
+      developer_email: result.developer_email || undefined,
+      redirect_uris: JSON.parse(result.redirect_uris),
+      grant_types: JSON.parse(result.grant_types),
+      response_types: JSON.parse(result.response_types),
+      token_endpoint_auth_method: result.token_endpoint_auth_method,
+      created_at: new Date(result.created_at),
+      updated_at: new Date(result.updated_at),
+    };
+  }
+
+  // Authorization code management
+  async storeAuthCode(code: AuthorizationCode): Promise<void> {
+    const stmt = this.sqlite.prepare(`
+      INSERT INTO authorization_codes (
+        code, user_id, client_id, redirect_uri, code_challenge,
+        code_challenge_method, expires_at, used_at, github_access_token
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+
+    stmt.run(
+      code.code,
+      code.user_id,
+      code.client_id,
+      code.redirect_uri,
+      code.code_challenge,
+      code.code_challenge_method,
+      code.expires_at,
+      code.used_at ? code.used_at.getTime() : null,
+      code.github_access_token,
+    );
+  }
+
+  async getAuthCode(code: string): Promise<AuthorizationCode | undefined> {
+    const stmt = this.sqlite.prepare(
+      'SELECT * FROM authorization_codes WHERE code = ?',
+    );
+    const result = stmt.get(code) as any;
+
+    if (!result) {
+      return undefined;
+    }
+
+    // Check if expired
+    if (result.expires_at < Date.now()) {
+      await this.removeAuthCode(code);
+      return undefined;
+    }
+
+    return {
+      code: result.code,
+      user_id: result.user_id,
+      client_id: result.client_id,
+      redirect_uri: result.redirect_uri,
+      code_challenge: result.code_challenge,
+      code_challenge_method: result.code_challenge_method,
+      expires_at: result.expires_at,
+      used_at: result.used_at ? new Date(result.used_at) : undefined,
+      github_access_token: result.github_access_token,
+    };
+  }
+
+  async removeAuthCode(code: string): Promise<void> {
+    const stmt = this.sqlite.prepare(
+      'DELETE FROM authorization_codes WHERE code = ?',
+    );
+    stmt.run(code);
+  }
+
+  // OAuth session management
+  async storeOAuthSession(
+    sessionId: string,
+    session: OAuthSession,
+  ): Promise<void> {
+    const stmt = this.sqlite.prepare(`
+      INSERT INTO oauth_sessions (
+        session_id, client_id, redirect_uri, code_challenge,
+        code_challenge_method, state, resource, expires_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+
+    stmt.run(
+      sessionId,
+      session.clientId,
+      session.redirectUri,
+      session.codeChallenge,
+      session.codeChallengeMethod,
+      session.state || null,
+      session.resource || null,
+      session.expiresAt,
+    );
+  }
+
+  async getOAuthSession(sessionId: string): Promise<OAuthSession | undefined> {
+    const stmt = this.sqlite.prepare(
+      'SELECT * FROM oauth_sessions WHERE session_id = ?',
+    );
+    const result = stmt.get(sessionId) as any;
+
+    if (!result) {
+      return undefined;
+    }
+
+    // Check if expired
+    if (result.expires_at < Date.now()) {
+      await this.removeOAuthSession(sessionId);
+      return undefined;
+    }
+
+    return {
+      sessionId: result.session_id,
+      clientId: result.client_id,
+      redirectUri: result.redirect_uri,
+      codeChallenge: result.code_challenge,
+      codeChallengeMethod: result.code_challenge_method,
+      state: result.state || undefined,
+      resource: result.resource || undefined,
+      expiresAt: result.expires_at,
+    };
+  }
+
+  async removeOAuthSession(sessionId: string): Promise<void> {
+    const stmt = this.sqlite.prepare(
+      'DELETE FROM oauth_sessions WHERE session_id = ?',
+    );
+    stmt.run(sessionId);
+  }
+
+  generateClientId(client: OAuthClient): string {
+    // Create deterministic client ID based on name + random salt
+    const normalizedName = client.client_name
+      .toLowerCase()
+      .replace(/[^a-z0-9]/g, '');
+    const salt = randomBytes(4).toString('hex');
+    return `${normalizedName}_${salt}`;
+  }
+}

package/src/authz/stores/typeorm/README.md

@@ -0,0 +1,133 @@
+# TypeORM OAuth Store Implementation
+
+This directory contains a TypeORM implementation of the `IOAuthStore` interface for persistent OAuth data storage.
+
+## Features
+
+- **Persistent Storage**: Unlike the in-memory store, data survives server restarts
+- **Database Support**: Works with any database supported by TypeORM (PostgreSQL, MySQL, SQLite, etc.)
+- **Automatic Schema Management**: Entities automatically create the required database tables
+- **Expiration Handling**: Automatic cleanup of expired sessions and authorization codes
+
+## Entities
+
+### OAuthClientEntity
+Stores OAuth client information including:
+- Client credentials and metadata
+- Redirect URIs and grant types
+- Creation and update timestamps
+
+### AuthorizationCodeEntity
+Stores authorization codes with:
+- Code challenge and method for PKCE
+- Expiration and usage tracking
+- Associated user and client information
+
+### OAuthSessionEntity
+Stores OAuth session data including:
+- Session state and parameters
+- Expiration handling
+- Client association
+
+## Usage
+
+### Basic SQLite Configuration
+
+```typescript
+McpOAuthModule.forRoot({
+  provider: GoogleOAuthProvider,
+  clientId: process.env.GOOGLE_CLIENT_ID!,
+  clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+  jwtSecret: process.env.JWT_SECRET!,
+  typeormOptions: {
+    type: 'sqlite',
+    database: 'oauth.db',
+    synchronize: true,
+    logging: false,
+  },
+})
+```
+
+### PostgreSQL Configuration
+
+```typescript
+McpOAuthModule.forRoot({
+  provider: GoogleOAuthProvider,
+  clientId: process.env.GOOGLE_CLIENT_ID!,
+  clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+  jwtSecret: process.env.JWT_SECRET!,
+  typeormOptions: {
+    type: 'postgres',
+    host: process.env.DB_HOST || 'localhost',
+    port: parseInt(process.env.DB_PORT) || 5432,
+    username: process.env.DB_USERNAME || 'postgres',
+    password: process.env.DB_PASSWORD || 'password',
+    database: process.env.DB_NAME || 'oauth_db',
+    synchronize: process.env.NODE_ENV !== 'production',
+    logging: process.env.NODE_ENV === 'development',
+  },
+})
+```
+
+### MySQL Configuration
+
+```typescript
+McpOAuthModule.forRoot({
+  provider: GoogleOAuthProvider,
+  clientId: process.env.GOOGLE_CLIENT_ID!,
+  clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+  jwtSecret: process.env.JWT_SECRET!,
+  typeormOptions: {
+    type: 'mysql',
+    host: process.env.DB_HOST || 'localhost',
+    port: parseInt(process.env.DB_PORT) || 3306,
+    username: process.env.DB_USERNAME || 'root',
+    password: process.env.DB_PASSWORD || 'password',
+    database: process.env.DB_NAME || 'oauth_db',
+    synchronize: process.env.NODE_ENV !== 'production',
+    logging: process.env.NODE_ENV === 'development',
+  },
+})
+```
+
+## Configuration Options
+
+All standard TypeORM options are supported:
+
+- `type`: Database type (sqlite, postgres, mysql, etc.)
+- `host`: Database host
+- `port`: Database port
+- `username`: Database username
+- `password`: Database password
+- `database`: Database name or file path (for SQLite)
+- `synchronize`: Auto-create tables (disable in production)
+- `logging`: Enable query logging
+- `entities`: Additional entities (OAuth entities are automatically included)
+- `migrations`: Database migrations
+- `ssl`: SSL configuration for production databases
+
+## Production Considerations
+
+1. **Disable synchronize**: Use migrations instead of auto-sync in production
+2. **Enable SSL**: Configure SSL for production database connections
+3. **Connection Pooling**: Configure appropriate connection pool settings
+4. **Logging**: Disable query logging in production for performance
+5. **Backup Strategy**: Implement regular database backups
+
+## Migrations
+
+For production use, create migrations instead of using `synchronize: true`:
+
+```bash
+npx typeorm migration:generate -n CreateOAuthTables
+npx typeorm migration:run
+```
+
+## Interface Compatibility
+
+The TypeORM implementation provides both synchronous and asynchronous methods:
+
+- Synchronous methods (for IOAuthStore compatibility): Log warnings and use fire-and-forget async operations
+- Asynchronous methods (recommended): `*Async` versions that return promises
+
+Consider updating your application to use the async methods for better error handling and performance.

package/src/authz/stores/typeorm/entities/authorization-code.entity.ts

@@ -0,0 +1,34 @@
+import { Entity, Column, PrimaryColumn, CreateDateColumn } from 'typeorm';
+
+@Entity('authorization_codes')
+export class AuthorizationCodeEntity {
+  @PrimaryColumn()
+  code: string;
+
+  @Column()
+  user_id: string;
+
+  @Column()
+  client_id: string;
+
+  @Column()
+  redirect_uri: string;
+
+  @Column()
+  code_challenge: string;
+
+  @Column()
+  code_challenge_method: string;
+
+  @Column('bigint')
+  expires_at: number;
+
+  @Column({ nullable: true })
+  used_at?: Date;
+
+  @Column()
+  github_access_token: string;
+
+  @CreateDateColumn()
+  created_at: Date;
+}

package/src/authz/stores/typeorm/entities/index.ts

@@ -0,0 +1,3 @@
+export { OAuthClientEntity } from './oauth-client.entity';
+export { AuthorizationCodeEntity } from './authorization-code.entity';
+export { OAuthSessionEntity } from './oauth-session.entity';

package/src/authz/stores/typeorm/entities/oauth-client.entity.ts

@@ -0,0 +1,49 @@
+import {
+  Entity,
+  Column,
+  PrimaryColumn,
+  CreateDateColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+
+@Entity('oauth_clients')
+export class OAuthClientEntity {
+  @PrimaryColumn()
+  client_id: string;
+
+  @Column()
+  client_name: string;
+
+  @Column({ nullable: true })
+  client_description?: string;
+
+  @Column({ nullable: true })
+  logo_uri?: string;
+
+  @Column({ nullable: true })
+  client_uri?: string;
+
+  @Column({ nullable: true })
+  developer_name?: string;
+
+  @Column({ nullable: true })
+  developer_email?: string;
+
+  @Column('simple-array')
+  redirect_uris: string[];
+
+  @Column('simple-array')
+  grant_types: string[];
+
+  @Column('simple-array')
+  response_types: string[];
+
+  @Column()
+  token_endpoint_auth_method: string;
+
+  @CreateDateColumn()
+  created_at: Date;
+
+  @UpdateDateColumn()
+  updated_at: Date;
+}

package/src/authz/stores/typeorm/entities/oauth-session.entity.ts

@@ -0,0 +1,34 @@
+import { Entity, Column, PrimaryColumn, CreateDateColumn } from 'typeorm';
+
+@Entity('oauth_sessions')
+export class OAuthSessionEntity {
+  @PrimaryColumn()
+  sessionId: string;
+
+  @Column()
+  state: string;
+
+  @Column({ nullable: true })
+  clientId?: string;
+
+  @Column({ nullable: true })
+  redirectUri?: string;
+
+  @Column({ nullable: true })
+  codeChallenge?: string;
+
+  @Column({ nullable: true })
+  codeChallengeMethod?: string;
+
+  @Column({ nullable: true })
+  oauthState?: string;
+
+  @Column({ nullable: true })
+  resource?: string;
+
+  @Column('bigint')
+  expiresAt: number;
+
+  @CreateDateColumn()
+  created_at: Date;
+}

package/src/authz/stores/typeorm/typeorm-store.service.ts

@@ -0,0 +1,98 @@
+import { Injectable } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { randomBytes } from 'crypto';
+import {
+  OAuthClientEntity,
+  AuthorizationCodeEntity,
+  OAuthSessionEntity,
+} from './entities';
+import { OAuthSession } from '../../providers/oauth-provider.interface';
+import {
+  AuthorizationCode,
+  IOAuthStore,
+  OAuthClient,
+} from '../oauth-store.interface';
+
+@Injectable()
+export class TypeOrmStore implements IOAuthStore {
+  constructor(
+    @InjectRepository(OAuthClientEntity)
+    private readonly clientRepository: Repository<OAuthClientEntity>,
+    @InjectRepository(AuthorizationCodeEntity)
+    private readonly authCodeRepository: Repository<AuthorizationCodeEntity>,
+    @InjectRepository(OAuthSessionEntity)
+    private readonly sessionRepository: Repository<OAuthSessionEntity>,
+  ) {}
+
+  // Client management
+  async storeClient(client: OAuthClient): Promise<OAuthClient> {
+    const savedClient = await this.clientRepository.save(client);
+    return savedClient;
+  }
+
+  async getClient(client_id: string): Promise<OAuthClient | undefined> {
+    return (
+      (await this.clientRepository.findOne({ where: { client_id } })) ??
+      undefined
+    );
+  }
+
+  async findClient(client_name: string): Promise<OAuthClient | undefined> {
+    return (
+      (await this.clientRepository.findOne({ where: { client_name } })) ??
+      undefined
+    );
+  }
+
+  // Authorization code management
+  async storeAuthCode(code: AuthorizationCode): Promise<void> {
+    await this.authCodeRepository.save(code);
+  }
+
+  async getAuthCode(code: string): Promise<AuthorizationCode | undefined> {
+    const authCode = await this.authCodeRepository.findOne({ where: { code } });
+    // Check if expired
+    if (authCode && authCode.expires_at < Date.now()) {
+      await this.authCodeRepository.delete({ code });
+      return undefined;
+    }
+    return authCode ?? undefined;
+  }
+
+  async removeAuthCode(code: string): Promise<void> {
+    await this.authCodeRepository.delete({ code });
+  }
+
+  // OAuth session management
+  async storeOAuthSession(
+    sessionId: string,
+    session: OAuthSession,
+  ): Promise<void> {
+    await this.sessionRepository.save({ ...session, sessionId });
+  }
+
+  async getOAuthSession(sessionId: string): Promise<OAuthSession | undefined> {
+    const session = await this.sessionRepository.findOne({
+      where: { sessionId },
+    });
+    if (session && session.expiresAt < Date.now()) {
+      await this.sessionRepository.delete({ sessionId });
+      return undefined;
+    }
+    return session ?? undefined;
+  }
+
+  async removeOAuthSession(sessionId: string): Promise<void> {
+    await this.sessionRepository.delete({ sessionId });
+  }
+
+  generateClientId(client: OAuthClient): string {
+    // Create deterministic client ID based on name + random salt
+    const normalizedName = client.client_name
+      .toLowerCase()
+      .replace(/[^a-z0-9]/g, '');
+    const salt = randomBytes(4).toString('hex');
+    return `${normalizedName}_${salt}`;
+  }
+}

package/src/mcp/services/handlers/mcp-tools.handler.ts

@@ -42,7 +42,7 @@ export class McpToolsHandler extends McpHandlerBase {
       if (!validation.success) {
         throw new McpError(
           ErrorCode.InternalError,
-          `Tool result does not match outputSchema: ${validation.error.message}`
+          `Tool result does not match outputSchema: ${validation.error.message}`,
         );
       }
       return {
@@ -140,7 +140,10 @@ export class McpToolsHandler extends McpHandlerBase {
             httpRequest,
           );
 
-          const transformedResult = this.formatToolResult(result, toolInfo.metadata.outputSchema);
+          const transformedResult = this.formatToolResult(
+            result,
+            toolInfo.metadata.outputSchema,
+          );
 
           // eslint-disable-next-line @typescript-eslint/no-unsafe-return
           this.logger.debug(transformedResult, 'CallToolRequestSchema result');