@rekog/mcp-nest 1.7.4-alpha.13 → 1.7.4-alpha.14

package/dist/authz/mcp-oauth.controller.d.ts

@@ -11,6 +11,10 @@ interface OAuthCallbackRequest extends ExpressRequest {
         provider: string;
     };
 }
+interface RequestWithRawBody extends ExpressRequest {
+    rawBody?: Buffer;
+    textBody?: string;
+}
 export declare function createMcpOAuthController(endpoints?: OAuthEndpointConfiguration, options?: {
     disableWellKnownProtectedResourceMetadata?: boolean;
     disableWellKnownAuthorizationServerMetadata?: boolean;
@@ -23,6 +27,8 @@ export declare function createMcpOAuthController(endpoints?: OAuthEndpointConfig
         readonly store: IOAuthStore;
         readonly jwtTokenService: JwtTokenService;
         readonly clientService: ClientService;
+        parseRequestBody(body: any, req?: RequestWithRawBody): Record<string, any>;
+        captureRawBody(req: RequestWithRawBody, res: Response, next: NextFunction): Promise<void>;
         getProtectedResourceMetadata(): {
             authorization_servers: string[];
             resource: string;
@@ -47,8 +53,9 @@ export declare function createMcpOAuthController(endpoints?: OAuthEndpointConfig
         authorize(query: any, req: any, res: Response, next: NextFunction): Promise<void>;
         handleProviderCallback(req: OAuthCallbackRequest, res: Response, next: NextFunction): void;
         processAuthenticationSuccess(req: OAuthCallbackRequest, res: Response): Promise<void>;
-        exchangeToken(body: any, req: any): Promise<TokenPair>;
-        extractClientCredentials(req: any, body: any): {
+        exchangeToken(body: any, req: RequestWithRawBody, res: Response, next: NextFunction): Promise<TokenPair>;
+        processTokenExchange(parsedBody: Record<string, any>, req: RequestWithRawBody): Promise<TokenPair>;
+        extractClientCredentials(req: RequestWithRawBody, body: any): {
             client_id: string;
             client_secret?: string;
         };
@@ -65,7 +72,6 @@ export declare function createMcpOAuthController(endpoints?: OAuthEndpointConfig
             client_secret?: string;
         }): Promise<TokenPair>;
         validatePKCE(code_verifier: string, code_challenge: string, method: string): boolean;
-        parseRequestBody(body: any): Record<string, any>;
     };
 };
 export {};

package/dist/authz/mcp-oauth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth.controller.d.ts","sourceRoot":"","sources":["../../src/authz/mcp-oauth.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,MAAM,EAMP,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAG5E,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAE7D,UAAU,oBAAqB,SAAQ,cAAc;IACnD,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,gBAAgB,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,wBAAgB,wBAAwB,CACtC,SAAS,GAAE,0BAA+B,EAC1C,OAAO,CAAC,EAAE;IACR,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,2CAA2C,CAAC,EAAE,OAAO,CAAC;CACvD;kBA8B4C,kBAAkB,SACpB,WAAW,mBACxB,eAAe,iBACjB,aAAa;;4BAPnB,MAAM;+BACH,OAAO;0BACZ,kBAAkB;wBAGK,WAAW;kCACxB,eAAe;gCACjB,aAAa;;;;;;;;;;;;;;;;;;;;;wCAwGO,GAAG;yBAM/B,GAAG,OAEd,GAAG,OACI,QAAQ,QACN,YAAY;oCA2Ed,oBAAoB,OACpB,QAAQ,QACN,YAAY;0CA2BrB,oBAAoB,OACpB,QAAQ;4BAmFC,GAAG,OACL,GAAG,GACd,OAAO,CAAC,SAAS,CAAC;sCA0Dd,GAAG,QACF,GAAG,GACR;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE;6CA+BtC,GAAG,qBACQ;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,IAAI;2CAqCC,MAAM,iBACG,MAAM,iBACN,MAAM,qBACF;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,OAAO,CAAC,SAAS,CAAC;+CA4FJ,MAAM,qBACF;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,OAAO,CAAC,SAAS,CAAC;oCA6EJ,MAAM,kBACL,MAAM,UACd,MAAM,GACb,OAAO;+BAgBa,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;;EAsBnD"}
+{"version":3,"file":"mcp-oauth.controller.d.ts","sourceRoot":"","sources":["../../src/authz/mcp-oauth.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,MAAM,EAMP,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAG5E,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAE7D,UAAU,oBAAqB,SAAQ,cAAc;IACnD,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,gBAAgB,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAGD,UAAU,kBAAmB,SAAQ,cAAc;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,wBAAwB,CACtC,SAAS,GAAE,0BAA+B,EAC1C,OAAO,CAAC,EAAE;IACR,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,2CAA2C,CAAC,EAAE,OAAO,CAAC;CACvD;kBAgC4C,kBAAkB,SACpB,WAAW,mBACxB,eAAe,iBACjB,aAAa;;4BARnB,MAAM;+BACH,OAAO;0BACZ,kBAAkB;wBAIK,WAAW;kCACxB,eAAe;gCACjB,aAAa;+BAWhB,GAAG,QAAQ,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;4BAgDnE,kBAAkB,OAClB,QAAQ,QACP,YAAY;;;;;;;;;;;;;;;;;;;;;wCAqI0B,GAAG;yBAM/B,GAAG,OAEd,GAAG,OACI,QAAQ,QACN,YAAY;oCA2Ed,oBAAoB,OACpB,QAAQ,QACN,YAAY;0CA2BrB,oBAAoB,OACpB,QAAQ;4BAmFC,GAAG,OACL,kBAAkB,OAClB,QAAQ,QACN,YAAY,GACzB,OAAO,CAAC,SAAS,CAAC;yCAiCP,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,OAC1B,kBAAkB,GACtB,OAAO,CAAC,SAAS,CAAC;sCAsDd,kBAAkB,QACjB,GAAG,GACR;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE;6CA+BtC,GAAG,qBACQ;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,IAAI;2CAqCC,MAAM,iBACG,MAAM,iBACN,MAAM,qBACF;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,OAAO,CAAC,SAAS,CAAC;+CA4FJ,MAAM,qBACF;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,OAAO,CAAC,SAAS,CAAC;oCA6EJ,MAAM,kBACL,MAAM,UACd,MAAM,GACb,OAAO;;EAcb"}

package/dist/authz/mcp-oauth.controller.js

@@ -45,6 +45,66 @@ function createMcpOAuthController(endpoints = {}, options) {
             this.isProduction = options.cookieSecure;
             this.options = options;
         }
+        parseRequestBody(body, req) {
+            if (body && typeof body === 'object' && Object.keys(body).length > 0) {
+                return body;
+            }
+            if (typeof body === 'string' && body.length > 0) {
+                const params = new URLSearchParams(body);
+                const parsedBody = {};
+                for (const [key, value] of params.entries()) {
+                    parsedBody[key] = value;
+                }
+                return parsedBody;
+            }
+            if (req?.textBody) {
+                const params = new URLSearchParams(req.textBody);
+                const parsedBody = {};
+                for (const [key, value] of params.entries()) {
+                    parsedBody[key] = value;
+                }
+                return parsedBody;
+            }
+            if (req?.rawBody) {
+                const bodyString = req.rawBody.toString('utf-8');
+                if (bodyString) {
+                    const params = new URLSearchParams(bodyString);
+                    const parsedBody = {};
+                    for (const [key, value] of params.entries()) {
+                        parsedBody[key] = value;
+                    }
+                    return parsedBody;
+                }
+            }
+            return {};
+        }
+        async captureRawBody(req, res, next) {
+            if (req.headers['content-type']?.includes('application/x-www-form-urlencoded')) {
+                let rawBody = '';
+                req.on('data', (chunk) => {
+                    rawBody += chunk.toString('utf-8');
+                });
+                req.on('end', () => {
+                    req.textBody = rawBody;
+                    if (rawBody) {
+                        const params = new URLSearchParams(rawBody);
+                        const parsedBody = {};
+                        for (const [key, value] of params.entries()) {
+                            parsedBody[key] = value;
+                        }
+                        req.body = parsedBody;
+                    }
+                    next();
+                });
+                req.on('error', (err) => {
+                    this.logger.error('Error reading request body:', err);
+                    next(err);
+                });
+            }
+            else {
+                next();
+            }
+        }
         getProtectedResourceMetadata() {
             const authorizationServerIssuer = this.options.jwtIssuer;
             const resourceIdentifier = this.options.resource;
@@ -189,16 +249,37 @@ function createMcpOAuthController(endpoints = {}, options) {
             await this.store.removeOAuthSession(sessionId);
             res.redirect(redirectUrl.toString());
         }
-        async exchangeToken(body, req) {
-            const parsedBody = this.parseRequestBody(body);
+        async exchangeToken(body, req, res, next) {
+            if (req.headers['content-type']?.includes('application/x-www-form-urlencoded') &&
+                (!body || Object.keys(body).length === 0)) {
+                return new Promise((resolve, reject) => {
+                    this.captureRawBody(req, res, async (err) => {
+                        if (err) {
+                            reject(err);
+                            return;
+                        }
+                        try {
+                            const parsedBody = this.parseRequestBody(req.body || body, req);
+                            const result = await this.processTokenExchange(parsedBody, req);
+                            resolve(result);
+                        }
+                        catch (error) {
+                            reject(error);
+                        }
+                    });
+                });
+            }
+            const parsedBody = this.parseRequestBody(body, req);
+            return this.processTokenExchange(parsedBody, req);
+        }
+        async processTokenExchange(parsedBody, req) {
             const { grant_type, code, code_verifier, redirect_uri, refresh_token } = parsedBody;
             if (!grant_type) {
                 this.logger.error('Missing grant_type in request body:', {
-                    bodyType: typeof body,
-                    bodyKeys: Object.keys(body || {}),
                     parsedBodyKeys: Object.keys(parsedBody),
                     contentType: req.headers['content-type'],
-                    rawBody: body,
+                    textBody: req.textBody,
+                    parsedBody,
                 });
                 throw new common_1.BadRequestException('Missing grant_type parameter');
             }
@@ -222,7 +303,7 @@ function createMcpOAuthController(endpoints = {}, options) {
             }
         }
         extractClientCredentials(req, body) {
-            const parsedBody = this.parseRequestBody(body);
+            const parsedBody = this.parseRequestBody(body, req);
             const authHeader = req.headers?.authorization;
             if (authHeader && authHeader.startsWith('Basic ')) {
                 const credentials = Buffer.from(authHeader.slice(6), 'base64').toString('utf-8');
@@ -376,20 +457,6 @@ function createMcpOAuthController(endpoints = {}, options) {
             }
             return false;
         }
-        parseRequestBody(body) {
-            if (body && typeof body === 'object' && Object.keys(body).length > 0) {
-                return body;
-            }
-            if (typeof body === 'string' && body.length > 0) {
-                const params = new URLSearchParams(body);
-                const parsedBody = {};
-                for (const [key, value] of params.entries()) {
-                    parsedBody[key] = value;
-                }
-                return parsedBody;
-            }
-            return {};
-        }
     };
     __decorate([
         OptionalGet(endpoints.wellKnownProtectedResourceMetadata, !options?.disableWellKnownProtectedResourceMetadata),
@@ -439,8 +506,10 @@ function createMcpOAuthController(endpoints = {}, options) {
         (0, common_1.HttpCode)(200),
         __param(0, (0, common_1.Body)()),
         __param(1, (0, common_1.Req)()),
+        __param(2, (0, common_1.Res)()),
+        __param(3, (0, common_1.Next)()),
         __metadata("design:type", Function),
-        __metadata("design:paramtypes", [Object, Object]),
+        __metadata("design:paramtypes", [Object, Object, Object, Function]),
         __metadata("design:returntype", Promise)
     ], McpOAuthController.prototype, "exchangeToken", null);
     McpOAuthController = McpOAuthController_1 = __decorate([

package/dist/authz/mcp-oauth.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth.controller.js","sourceRoot":"","sources":["../../src/authz/mcp-oauth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAsCA,4DAgrBC;AAttBD,2CAcwB;AACxB,mCAAiD;AAEjD,wDAAgC;AAChC,wEAAoE;AAOpE,8DAA0D;AAC1D,oEAA0E;AAC1E,8EAAkE;AAWlE,SAAgB,wBAAwB,CACtC,YAAwC,EAAE,EAC1C,OAGC;;IAGD,MAAM,WAAW,GAAG,CAClB,IAAmC,EACnC,OAAgB,EACC,EAAE;QACnB,OAAO,OAAO,IAAI,IAAI;YACpB,CAAC,CAAE,YAA+C,CAAC,IAAI,CAAC;YACxD,CAAC,CAAE,CAAC,GAAG,EAAE,GAAE,CAAC,CAAgC,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,CACrB,IAAY,EACZ,KAAa,EACb,OAAgB,EACC,EAAE;QACnB,OAAO,OAAO;YACZ,CAAC,CAAE,eAA+D,CAC9D,IAAI,EACJ,KAAK,CACN;YACH,CAAC,CAAE,CAAC,GAAG,EAAE,GAAE,CAAC,CAAgC,CAAC;IACjD,CAAC,CAAC;IACF,IACM,kBAAkB,0BADxB,MACM,kBAAkB;QAKtB,YACkC,OAA2B,EACpC,KAA2B,EACzC,eAAgC,EAChC,aAA4B;YAFL,UAAK,GAAL,KAAK,CAAa;YACzC,oBAAe,GAAf,eAAe,CAAiB;YAChC,kBAAa,GAAb,aAAa,CAAe;YAR9B,WAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;YAUpD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACnC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QAWD,4BAA4B;YAE1B,MAAM,yBAAyB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAGzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAEjD,MAAM,QAAQ,GAAG;gBAKf,qBAAqB,EAAE,CAAC,yBAAyB,CAAC;gBAMlD,QAAQ,EAAE,kBAAkB;gBAM5B,gBAAgB,EACd,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,eAAe;gBAMxD,wBAAwB,EACtB,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,sBAAsB;gBAM/D,sBAAsB,EACpB,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,oBAAoB;aAC9D,CAAC;YAEF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAYD,8BAA8B;YAC5B,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,SAAS;gBACtB,sBAAsB,EAAE,IAAA,sCAAiB,EACvC,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,CAC3C;gBACD,cAAc,EAAE,IAAA,sCAAiB,EAC/B,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,EAAE,CACvC;gBACD,qBAAqB,EAAE,IAAA,sCAAiB,EACtC,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,EAAE,CAC1C;gBACD,wBAAwB,EACtB,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,sBAAsB;gBACjE,wBAAwB,EACtB,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,sBAAsB;gBACjE,qBAAqB,EACnB,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,mBAAmB;gBAC9D,qCAAqC,EACnC,IAAI,CAAC,OAAO,CAAC,2BAA2B;qBACrC,iCAAiC;gBACtC,gBAAgB,EACd,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,eAAe;gBAC1D,mBAAmB,EAAE,IAAA,sCAAiB,EACpC,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,EAAE,MAAM,EAAE,CACzC;gBACD,gCAAgC,EAC9B,IAAI,CAAC,OAAO,CAAC,2BAA2B;qBACrC,6BAA6B;aACnC,CAAC;QACJ,CAAC;QAGK,AAAN,KAAK,CAAC,cAAc,CAAS,eAAoB;YAC/C,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAClE,CAAC;QAGK,AAAN,KAAK,CAAC,SAAS,CACJ,KAAU,EAEnB,GAAQ,EACD,GAAa,EACZ,IAAkB;YAE1B,MAAM,EACJ,aAAa,EACb,SAAS,EACT,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,KAAK,EACL,KAAK,GACN,GAAG,KAAK,CAAC;YACV,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACvC,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;YAC/D,CAAC;YAGD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,4BAAmB,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAChE,SAAS,EACT,YAAY,CACb,CAAC;YACF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;YACxD,CAAC;YAGD,MAAM,SAAS,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxD,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAE3D,MAAM,YAAY,GAAiB;gBACjC,SAAS;gBACT,KAAK,EAAE,YAAY;gBACnB,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE,YAAY;gBACzB,aAAa,EAAE,cAAc;gBAC7B,mBAAmB,EAAE,qBAAqB,IAAI,OAAO;gBACrD,UAAU,EAAE,KAAK;gBACjB,KAAK,EAAE,KAAK;gBACZ,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB;aAC3D,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAG5D,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,EAAE;gBACrC,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAGH,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE;gBACtC,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAGH,kBAAQ,CAAC,YAAY,CAAC,sCAAa,EAAE;gBACnC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW;aAChC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC;QAGD,sBAAsB,CACb,GAAyB,EACzB,GAAa,EACZ,IAAkB;YAG1B,kBAAQ,CAAC,YAAY,CACnB,sCAAa,EACb,EAAE,OAAO,EAAE,KAAK,EAAE,EAClB,KAAK,EAAE,GAAQ,EAAE,IAAS,EAAE,EAAE;gBAC5B,IAAI,CAAC;oBACH,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;wBAChD,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;oBACzD,CAAC;oBAED,IAAI,CAAC,IAAI,EAAE,CAAC;wBACV,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;oBACzD,CAAC;oBAED,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;oBAChB,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,KAAK,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CACF,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,4BAA4B,CAChC,GAAyB,EACzB,GAAa;YAEb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;YAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;YACpE,CAAC;YAGD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC;YACjD,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBACtC,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;YAC3D,CAAC;YAGD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,EACrB,IAAI,CAAC,OAAO,CACb,CAAC;YAGF,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;gBAC5B,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;aAClC,CAAC,CAAC;YAGH,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YACjC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YAG/B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CACxD,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,CACd,CAAC;YAGF,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAGvD,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBAC7B,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC9B,SAAS,EAAE,OAAO,CAAC,QAAS;gBAC5B,YAAY,EAAE,OAAO,CAAC,WAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,aAAc;gBACtC,qBAAqB,EAAE,OAAO,CAAC,mBAAoB;gBACnD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB;gBACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,mBAAmB,EAAE,EAAE;gBACvB,eAAe;aAChB,CAAC,CAAC;YAGH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAY,CAAC,CAAC;YAClD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAC5D,CAAC;YAGD,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAE/C,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvC,CAAC;QAOK,AAAN,KAAK,CAAC,aAAa,CACT,IAAS,EACV,GAAQ;YAGf,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAE/C,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,GACpE,UAAU,CAAC;YAGb,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;oBACvD,QAAQ,EAAE,OAAO,IAAI;oBACrB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;oBACjC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;oBACvC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;oBACxC,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;gBACH,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;YAChE,CAAC;YAED,QAAQ,UAAU,EAAE,CAAC;gBACnB,KAAK,oBAAoB,CAAC,CAAC,CAAC;oBAE1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CACrD,GAAG,EACH,UAAU,CACX,CAAC;oBACF,OAAO,MAAM,IAAI,CAAC,4BAA4B,CAC5C,IAAI,EACJ,aAAa,EACb,YAAY,EACZ,iBAAiB,CAClB,CAAC;gBACJ,CAAC;gBACD,KAAK,eAAe,CAAC,CAAC,CAAC;oBAErB,IAAI,iBAAgE,CAAC;oBACrE,IAAI,CAAC;wBACH,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;oBACrE,CAAC;oBAAC,MAAM,CAAC;wBAEP,iBAAiB,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;oBACxC,CAAC;oBACD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CACvC,aAAa,EACb,iBAAiB,CAClB,CAAC;gBACJ,CAAC;gBACD;oBACE,MAAM,IAAI,4BAAmB,CAC3B,2BAA2B,UAAU,EAAE,CACxC,CAAC;YACN,CAAC;QACH,CAAC;QAKD,wBAAwB,CACtB,GAAQ,EACR,IAAS;YAGT,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAG/C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CACrE,OAAO,CACR,CAAC;gBACF,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC7D,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;gBACtC,CAAC;YACH,CAAC;YAGD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;gBACzB,OAAO;oBACL,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;iBACxC,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAKD,4BAA4B,CAC1B,MAAW,EACX,iBAAgE;YAEhE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,4BAAmB,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,CAAC;YAE9C,QAAQ,0BAA0B,EAAE,CAAC;gBACnC,KAAK,qBAAqB,CAAC;gBAC3B,KAAK,oBAAoB;oBACvB,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC;wBACrC,MAAM,IAAI,4BAAmB,CAC3B,uDAAuD,CACxD,CAAC;oBACJ,CAAC;oBACD,IAAI,MAAM,CAAC,aAAa,KAAK,iBAAiB,CAAC,aAAa,EAAE,CAAC;wBAC7D,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;oBAC9D,CAAC;oBACD,MAAM;gBAER,KAAK,MAAM;oBAET,IAAI,iBAAiB,CAAC,aAAa,EAAE,CAAC;wBACpC,MAAM,IAAI,4BAAmB,CAC3B,8CAA8C,CAC/C,CAAC;oBACJ,CAAC;oBACD,MAAM;gBAER;oBACE,MAAM,IAAI,4BAAmB,CAC3B,sCAAsC,0BAA0B,EAAE,CACnE,CAAC;YACN,CAAC;QACH,CAAC;QAED,KAAK,CAAC,4BAA4B,CAChC,IAAY,EACZ,aAAqB,EACrB,aAAqB,EACrB,iBAAgE;YAEhE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;gBAC1D,IAAI;gBACJ,SAAS,EAAE,iBAAiB,CAAC,SAAS;aACvC,CAAC,CAAC;YAGH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4DAA4D,EAC5D,IAAI,CACL,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4DAA4D,EAC5D,IAAI,CACL,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAAC,gCAAgC,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,QAAQ,CAAC,SAAS,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,oDAAoD,EACpD,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,EAAE,CACnE,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;YACtD,CAAC;YAGD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAC/C,iBAAiB,CAAC,SAAS,CAC5B,CAAC;YACF,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAC7D,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAC/B,aAAa,EACb,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,qBAAqB,CAC/B,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0DAA0D,CAC3D,CAAC;oBACF,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,iEAAiE,CAClE,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAC3B,sDAAsD,CACvD,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,GAAoB,SAAS,CAAC;YAC1C,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CACjD,QAAQ,CAAC,eAAe,CACzB,CAAC;oBACF,IAAI,OAAO,EAAE,CAAC;wBAEZ,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CACnD,QAAQ,CAAC,OAAO,EAChB,iBAAiB,CAAC,SAAS,EAC3B,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,QAAQ,EACjB;gBACE,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,SAAS,EAAE,QAAQ;aACpB,CACF,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,+DAA+D,EAC/D,QAAQ,CAAC,OAAO,CACjB,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,uBAAuB,CAC3B,aAAqB,EACrB,iBAAgE;YAGhE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;YACpE,CAAC;YAGD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC;YAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;YACjE,CAAC;YAGD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAI5D,IAAI,MAAM,EAAE,0BAA0B,KAAK,MAAM,EAAE,CAAC;gBAClD,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE;oBACxC,GAAG,iBAAiB;oBACpB,SAAS,EAAE,QAAQ;iBACpB,CAAC,CAAC;YACL,CAAC;YAGD,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,IAAI,4BAAmB,CAC3B,+DAA+D,CAChE,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,GAAqB,IAAI,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;gBAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;gBACpE,CAAC;gBAED,IAAI,QAAQ,GAAoB,SAAS,CAAC;gBAC1C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;oBAC5B,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CACjD,OAAO,CAAC,eAAe,CACxB,CAAC;wBACF,IAAI,OAAO;4BAAE,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;oBACzC,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yDAAyD,EACzD,CAAC,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAChD,OAAO,CAAC,GAAG,EACX,QAAQ,EACR,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,EAChB;oBACE,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,SAAS,EAAE,QAAQ;iBACpB,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mDAAmD,EACnD,CAAC,CACF,CAAC;gBACF,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YACrE,CAAC;YAED,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,YAAY,CACV,aAAqB,EACrB,cAAsB,EACtB,MAAc;YAEd,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO,aAAa,KAAK,cAAc,CAAC;YAC1C,CAAC;iBAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;qBAC9B,MAAM,CAAC,aAAa,CAAC;qBACrB,MAAM,CAAC,WAAW,CAAC,CAAC;gBACvB,OAAO,IAAI,KAAK,cAAc,CAAC;YACjC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAMD,gBAAgB,CAAC,IAAS;YAExB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;YAGD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;gBACzC,MAAM,UAAU,GAAwB,EAAE,CAAC;gBAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC5C,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC1B,CAAC;gBACD,OAAO,UAAU,CAAC;YACpB,CAAC;YAGD,OAAO,EAAE,CAAC;QACZ,CAAC;KACF,CAAA;IAvnBC;QATC,WAAW,CACV,SAAS,CAAC,kCAAkC,EAC5C,CAAC,OAAO,EAAE,yCAAyC,CACpD;QACA,cAAc,CACb,cAAc,EACd,kBAAkB,EAClB,CAAC,OAAO,EAAE,yCAAyC,CACpD;;;;0EA4CA;IAYD;QATC,WAAW,CACV,SAAS,CAAC,oCAAoC,EAC9C,CAAC,OAAO,EAAE,2CAA2C,CACtD;QACA,cAAc,CACb,cAAc,EACd,kBAAkB,EAClB,CAAC,OAAO,EAAE,2CAA2C,CACtD;;;;4EA+BA;IAGK;QADL,IAAA,aAAI,EAAC,SAAS,CAAC,QAAQ,CAAC;QACH,WAAA,IAAA,aAAI,GAAE,CAAA;;;;4DAE3B;IAGK;QADL,IAAA,YAAG,EAAC,SAAS,CAAC,SAAS,CAAC;QAEtB,WAAA,IAAA,cAAK,GAAE,CAAA;QACP,WAAA,IAAA,YAAG,GAAE,CAAA;QAEL,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,aAAI,GAAE,CAAA;;;;uDAuER;IAGD;QADC,IAAA,YAAG,EAAC,SAAS,CAAC,QAAQ,CAAC;QAErB,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,aAAI,GAAE,CAAA;;;;oEAwBR;IAsFK;QALL,IAAA,aAAI,EAAC,SAAS,CAAC,KAAK,CAAC;QACrB,IAAA,eAAM,EAAC,cAAc,EAAE,kBAAkB,CAAC;QAC1C,IAAA,eAAM,EAAC,eAAe,EAAE,UAAU,CAAC;QACnC,IAAA,eAAM,EAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAA,iBAAQ,EAAC,GAAG,CAAC;QAEX,WAAA,IAAA,aAAI,GAAE,CAAA;QACN,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAqDP;IA7WG,kBAAkB;QADvB,IAAA,mBAAU,GAAE;QAOR,WAAA,IAAA,eAAM,EAAC,sBAAsB,CAAC,CAAA;QAC9B,WAAA,IAAA,eAAM,EAAC,aAAa,CAAC,CAAA;yDACI,mCAAe;YACjB,8BAAa;OATnC,kBAAkB,CAgpBvB;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import {\n  BadRequestException,\n  Body,\n  Controller,\n  Get,\n  Header,\n  HttpCode,\n  Inject,\n  Logger,\n  Next,\n  Post,\n  Query,\n  Req,\n  Res,\n} from '@nestjs/common';\nimport { createHash, randomBytes } from 'crypto';\nimport { Request as ExpressRequest, NextFunction, Response } from 'express';\nimport passport from 'passport';\nimport { normalizeEndpoint } from '../mcp/utils/normalize-endpoint';\nimport {\n  OAuthEndpointConfiguration,\n  OAuthModuleOptions,\n  OAuthSession,\n  OAuthUserProfile,\n} from './providers/oauth-provider.interface';\nimport { ClientService } from './services/client.service';\nimport { JwtTokenService, TokenPair } from './services/jwt-token.service';\nimport { STRATEGY_NAME } from './services/oauth-strategy.service';\nimport { IOAuthStore } from './stores/oauth-store.interface';\n\ninterface OAuthCallbackRequest extends ExpressRequest {\n  user?: {\n    profile: OAuthUserProfile;\n    accessToken: string;\n    provider: string;\n  };\n}\n\nexport function createMcpOAuthController(\n  endpoints: OAuthEndpointConfiguration = {},\n  options?: {\n    disableWellKnownProtectedResourceMetadata?: boolean;\n    disableWellKnownAuthorizationServerMetadata?: boolean;\n  },\n) {\n  // Optional decorator helpers\n  const OptionalGet = (\n    path: string | string[] | undefined,\n    enabled: boolean,\n  ): MethodDecorator => {\n    return enabled && path\n      ? (Get as unknown as (p?: any) => MethodDecorator)(path)\n      : ((() => {}) as unknown as MethodDecorator);\n  };\n  const OptionalHeader = (\n    name: string,\n    value: string,\n    enabled: boolean,\n  ): MethodDecorator => {\n    return enabled\n      ? (Header as unknown as (n: string, v: string) => MethodDecorator)(\n          name,\n          value,\n        )\n      : ((() => {}) as unknown as MethodDecorator);\n  };\n  @Controller()\n  class McpOAuthController {\n    readonly logger = new Logger(McpOAuthController.name);\n    readonly serverUrl: string;\n    readonly isProduction: boolean;\n    readonly options: OAuthModuleOptions;\n    constructor(\n      @Inject('OAUTH_MODULE_OPTIONS') options: OAuthModuleOptions,\n      @Inject('IOAuthStore') readonly store: IOAuthStore,\n      readonly jwtTokenService: JwtTokenService,\n      readonly clientService: ClientService,\n    ) {\n      this.serverUrl = options.serverUrl;\n      this.isProduction = options.cookieSecure;\n      this.options = options;\n    }\n\n    @OptionalGet(\n      endpoints.wellKnownProtectedResourceMetadata,\n      !options?.disableWellKnownProtectedResourceMetadata,\n    )\n    @OptionalHeader(\n      'content-type',\n      'application/json',\n      !options?.disableWellKnownProtectedResourceMetadata,\n    )\n    getProtectedResourceMetadata() {\n      // The issuer URL of your authorization server.\n      const authorizationServerIssuer = this.options.jwtIssuer;\n\n      // The canonical URI of the MCP server resource itself.\n      const resourceIdentifier = this.options.resource;\n\n      const metadata = {\n        /**\n         * REQUIRED by MCP Spec.\n         * A list of authorization server issuer URLs that can issue tokens for this resource.\n         */\n        authorization_servers: [authorizationServerIssuer],\n\n        /**\n         * RECOMMENDED by RFC 9728.\n         * The identifier for this resource server.\n         */\n        resource: resourceIdentifier,\n\n        /**\n         * RECOMMENDED by RFC 9728.\n         * A list of scopes that this resource server understands.\n         */\n        scopes_supported:\n          this.options.protectedResourceMetadata.scopesSupported,\n\n        /**\n         * RECOMMENDED by RFC 9728.\n         * A list of methods clients can use to present the access token.\n         */\n        bearer_methods_supported:\n          this.options.protectedResourceMetadata.bearerMethodsSupported,\n\n        /**\n         * OPTIONAL but helpful custom metadata.\n         * Declares which version of the MCP spec this server supports.\n         */\n        mcp_versions_supported:\n          this.options.protectedResourceMetadata.mcpVersionsSupported,\n      };\n\n      return metadata;\n    }\n\n    // OAuth endpoints\n    @OptionalGet(\n      endpoints.wellKnownAuthorizationServerMetadata,\n      !options?.disableWellKnownAuthorizationServerMetadata,\n    )\n    @OptionalHeader(\n      'content-type',\n      'application/json',\n      !options?.disableWellKnownAuthorizationServerMetadata,\n    )\n    getAuthorizationServerMetadata() {\n      return {\n        issuer: this.serverUrl,\n        authorization_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints.authorize}`,\n        ),\n        token_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints.token}`,\n        ),\n        registration_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints.register}`,\n        ),\n        response_types_supported:\n          this.options.authorizationServerMetadata.responseTypesSupported,\n        response_modes_supported:\n          this.options.authorizationServerMetadata.responseModesSupported,\n        grant_types_supported:\n          this.options.authorizationServerMetadata.grantTypesSupported,\n        token_endpoint_auth_methods_supported:\n          this.options.authorizationServerMetadata\n            .tokenEndpointAuthMethodsSupported,\n        scopes_supported:\n          this.options.authorizationServerMetadata.scopesSupported,\n        revocation_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints?.revoke}`,\n        ),\n        code_challenge_methods_supported:\n          this.options.authorizationServerMetadata\n            .codeChallengeMethodsSupported,\n      };\n    }\n\n    @Post(endpoints.register)\n    async registerClient(@Body() registrationDto: any) {\n      return await this.clientService.registerClient(registrationDto);\n    }\n\n    @Get(endpoints.authorize)\n    async authorize(\n      @Query() query: any,\n      @Req()\n      req: any,\n      @Res() res: Response,\n      @Next() next: NextFunction,\n    ) {\n      const {\n        response_type,\n        client_id,\n        redirect_uri,\n        code_challenge,\n        code_challenge_method,\n        state,\n        scope,\n      } = query;\n      const resource = this.options.resource;\n      if (response_type !== 'code') {\n        throw new BadRequestException('Only response_type=code is supported');\n      }\n\n      if (!client_id) {\n        throw new BadRequestException('Missing required parameters');\n      }\n\n      // Validate client and redirect URI\n      const client = await this.clientService.getClient(client_id);\n      if (!client) {\n        throw new BadRequestException('Invalid client_id');\n      }\n\n      const validRedirect = await this.clientService.validateRedirectUri(\n        client_id,\n        redirect_uri,\n      );\n      if (!validRedirect) {\n        throw new BadRequestException('Invalid redirect_uri');\n      }\n\n      // Create OAuth session\n      const sessionId = randomBytes(32).toString('base64url');\n      const sessionState = randomBytes(32).toString('base64url');\n\n      const oauthSession: OAuthSession = {\n        sessionId,\n        state: sessionState,\n        clientId: client_id,\n        redirectUri: redirect_uri,\n        codeChallenge: code_challenge,\n        codeChallengeMethod: code_challenge_method || 'plain',\n        oauthState: state,\n        scope: scope,\n        resource,\n        expiresAt: Date.now() + this.options.oauthSessionExpiresIn,\n      };\n\n      await this.store.storeOAuthSession(sessionId, oauthSession);\n\n      // Set session cookie\n      res.cookie('oauth_session', sessionId, {\n        httpOnly: true,\n        secure: this.isProduction,\n        maxAge: this.options.oauthSessionExpiresIn,\n      });\n\n      // Store state for passport\n      res.cookie('oauth_state', sessionState, {\n        httpOnly: true,\n        secure: this.isProduction,\n        maxAge: this.options.oauthSessionExpiresIn,\n      });\n\n      // Redirect to the provider's auth endpoint\n      passport.authenticate(STRATEGY_NAME, {\n        state: req.cookies?.oauth_state,\n      })(req, res, next);\n    }\n\n    @Get(endpoints.callback)\n    handleProviderCallback(\n      @Req() req: OAuthCallbackRequest,\n      @Res() res: Response,\n      @Next() next: NextFunction,\n    ) {\n      // Use a custom callback to handle the authentication result\n      passport.authenticate(\n        STRATEGY_NAME,\n        { session: false },\n        async (err: any, user: any) => {\n          try {\n            if (err) {\n              this.logger.error('OAuth callback error:', err);\n              throw new BadRequestException('Authentication failed');\n            }\n\n            if (!user) {\n              throw new BadRequestException('Authentication failed');\n            }\n\n            req.user = user;\n            await this.processAuthenticationSuccess(req, res);\n          } catch (error) {\n            next(error);\n          }\n        },\n      )(req, res, next);\n    }\n\n    async processAuthenticationSuccess(\n      req: OAuthCallbackRequest,\n      res: Response,\n    ) {\n      const user = req.user;\n      if (!user) {\n        throw new BadRequestException('Authentication failed');\n      }\n\n      const sessionId = req.cookies?.oauth_session;\n      if (!sessionId) {\n        throw new BadRequestException('Missing OAuth session');\n      }\n\n      const session = await this.store.getOAuthSession(sessionId);\n      if (!session) {\n        throw new BadRequestException('Invalid or expired OAuth session');\n      }\n\n      // Verify state\n      const stateFromCookie = req.cookies?.oauth_state;\n      if (session.state !== stateFromCookie) {\n        throw new BadRequestException('Invalid state parameter');\n      }\n\n      // Generate JWT for UI access\n      const jwt = this.jwtTokenService.generateUserToken(\n        user.profile.username,\n        user.profile,\n      );\n\n      // Set JWT token as cookie for UI endpoints\n      res.cookie('auth_token', jwt, {\n        httpOnly: true,\n        secure: this.isProduction,\n        maxAge: this.options.cookieMaxAge,\n      });\n\n      // Clear temporary cookies\n      res.clearCookie('oauth_session');\n      res.clearCookie('oauth_state');\n\n      // Persist user profile and get stable profile_id\n      const user_profile_id = await this.store.upsertUserProfile(\n        user.profile,\n        user.provider,\n      );\n\n      // Generate authorization code\n      const authCode = randomBytes(32).toString('base64url');\n\n      // Store the auth code\n      await this.store.storeAuthCode({\n        code: authCode,\n        user_id: user.profile.username,\n        client_id: session.clientId!,\n        redirect_uri: session.redirectUri!,\n        code_challenge: session.codeChallenge!,\n        code_challenge_method: session.codeChallengeMethod!,\n        expires_at: Date.now() + this.options.authCodeExpiresIn,\n        resource: session.resource,\n        scope: session.scope,\n        github_access_token: '', // No longer provider-specific\n        user_profile_id,\n      });\n\n      // Build redirect URL with authorization code\n      const redirectUrl = new URL(session.redirectUri!);\n      redirectUrl.searchParams.set('code', authCode);\n      if (session.oauthState) {\n        redirectUrl.searchParams.set('state', session.oauthState);\n      }\n\n      // Clean up session\n      await this.store.removeOAuthSession(sessionId);\n\n      res.redirect(redirectUrl.toString());\n    }\n\n    @Post(endpoints.token)\n    @Header('content-type', 'application/json')\n    @Header('Cache-Control', 'no-store')\n    @Header('Pragma', 'no-cache')\n    @HttpCode(200)\n    async exchangeToken(\n      @Body() body: any,\n      @Req() req: any,\n    ): Promise<TokenPair> {\n      // Parse the body to handle both JSON and form-encoded data\n      const parsedBody = this.parseRequestBody(body);\n\n      const { grant_type, code, code_verifier, redirect_uri, refresh_token } =\n        parsedBody;\n\n      // Add debugging to help identify issues\n      if (!grant_type) {\n        this.logger.error('Missing grant_type in request body:', {\n          bodyType: typeof body,\n          bodyKeys: Object.keys(body || {}),\n          parsedBodyKeys: Object.keys(parsedBody),\n          contentType: req.headers['content-type'],\n          rawBody: body,\n        });\n        throw new BadRequestException('Missing grant_type parameter');\n      }\n\n      switch (grant_type) {\n        case 'authorization_code': {\n          // Extract client credentials based on authentication method\n          const clientCredentials = this.extractClientCredentials(\n            req,\n            parsedBody,\n          );\n          return await this.handleAuthorizationCodeGrant(\n            code,\n            code_verifier,\n            redirect_uri,\n            clientCredentials,\n          );\n        }\n        case 'refresh_token': {\n          // For refresh tokens, try to extract client credentials, but allow fallback to token-based extraction\n          let clientCredentials: { client_id: string; client_secret?: string };\n          try {\n            clientCredentials = this.extractClientCredentials(req, parsedBody);\n          } catch {\n            // If we can't extract credentials, we'll try to get them from the refresh token\n            clientCredentials = { client_id: '' }; // Will be filled from token\n          }\n          return await this.handleRefreshTokenGrant(\n            refresh_token,\n            clientCredentials,\n          );\n        }\n        default:\n          throw new BadRequestException(\n            `Unsupported grant_type: ${grant_type}`,\n          );\n      }\n    }\n\n    /**\n     * Extract client credentials from request based on authentication method\n     */\n    extractClientCredentials(\n      req: any,\n      body: any,\n    ): { client_id: string; client_secret?: string } {\n      // Parse the body using the shared utility function\n      const parsedBody = this.parseRequestBody(body);\n\n      // Try client_secret_basic first (Authorization header)\n      const authHeader = req.headers?.authorization;\n      if (authHeader && authHeader.startsWith('Basic ')) {\n        const credentials = Buffer.from(authHeader.slice(6), 'base64').toString(\n          'utf-8',\n        );\n        const [client_id, client_secret] = credentials.split(':', 2);\n        if (client_id) {\n          return { client_id, client_secret };\n        }\n      }\n\n      // Try client_secret_post (body parameters)\n      if (parsedBody.client_id) {\n        return {\n          client_id: parsedBody.client_id,\n          client_secret: parsedBody.client_secret,\n        };\n      }\n\n      throw new BadRequestException('Missing client credentials');\n    }\n\n    /**\n     * Validate client authentication based on the client's configured method\n     */\n    validateClientAuthentication(\n      client: any,\n      clientCredentials: { client_id: string; client_secret?: string },\n    ): void {\n      if (!client) {\n        throw new BadRequestException('Invalid client_id');\n      }\n\n      const { token_endpoint_auth_method } = client;\n\n      switch (token_endpoint_auth_method) {\n        case 'client_secret_basic':\n        case 'client_secret_post':\n          if (!clientCredentials.client_secret) {\n            throw new BadRequestException(\n              'Client secret required for this authentication method',\n            );\n          }\n          if (client.client_secret !== clientCredentials.client_secret) {\n            throw new BadRequestException('Invalid client credentials');\n          }\n          break;\n\n        case 'none':\n          // Public client - no secret required\n          if (clientCredentials.client_secret) {\n            throw new BadRequestException(\n              'Client secret not allowed for public clients',\n            );\n          }\n          break;\n\n        default:\n          throw new BadRequestException(\n            `Unsupported authentication method: ${token_endpoint_auth_method}`,\n          );\n      }\n    }\n\n    async handleAuthorizationCodeGrant(\n      code: string,\n      code_verifier: string,\n      _redirect_uri: string,\n      clientCredentials: { client_id: string; client_secret?: string },\n    ): Promise<TokenPair> {\n      this.logger.debug('handleAuthorizationCodeGrant - Params:', {\n        code,\n        client_id: clientCredentials.client_id,\n      });\n\n      // Get and validate the authorization code\n      const authCode = await this.store.getAuthCode(code);\n      if (!authCode) {\n        this.logger.error(\n          'handleAuthorizationCodeGrant - Invalid authorization code:',\n          code,\n        );\n        throw new BadRequestException('Invalid authorization code');\n      }\n      if (authCode.expires_at < Date.now()) {\n        await this.store.removeAuthCode(code);\n        this.logger.error(\n          'handleAuthorizationCodeGrant - Authorization code expired:',\n          code,\n        );\n        throw new BadRequestException('Authorization code has expired');\n      }\n      if (authCode.client_id !== clientCredentials.client_id) {\n        this.logger.error(\n          'handleAuthorizationCodeGrant - Client ID mismatch:',\n          { expected: authCode.client_id, got: clientCredentials.client_id },\n        );\n        throw new BadRequestException('Client ID mismatch');\n      }\n\n      // Get client and validate authentication\n      const client = await this.clientService.getClient(\n        clientCredentials.client_id,\n      );\n      this.validateClientAuthentication(client, clientCredentials);\n      if (authCode.code_challenge) {\n        const isValid = this.validatePKCE(\n          code_verifier,\n          authCode.code_challenge,\n          authCode.code_challenge_method,\n        );\n        if (!isValid) {\n          this.logger.error(\n            'handleAuthorizationCodeGrant - Invalid PKCE verification',\n          );\n          throw new BadRequestException('Invalid PKCE verification');\n        }\n      }\n      if (!authCode.resource) {\n        this.logger.error(\n          'handleAuthorizationCodeGrant - No resource associated with code',\n        );\n        throw new BadRequestException(\n          'Authorization code is not associated with a resource',\n        );\n      }\n\n      let userData: any | undefined = undefined;\n      if (authCode.user_profile_id) {\n        try {\n          const profile = await this.store.getUserProfileById(\n            authCode.user_profile_id,\n          );\n          if (profile) {\n            // Avoid circular/large raw payloads if present\n            userData = { ...profile };\n          }\n        } catch (e) {\n          this.logger.warn('Failed to load user profile for token payload', e);\n        }\n      }\n\n      const tokens = this.jwtTokenService.generateTokenPair(\n        authCode.user_id,\n        clientCredentials.client_id,\n        authCode.scope,\n        authCode.resource,\n        {\n          user_profile_id: authCode.user_profile_id,\n          user_data: userData,\n        },\n      );\n      await this.store.removeAuthCode(code);\n      this.logger.log(\n        'handleAuthorizationCodeGrant - Token pair generated for user:',\n        authCode.user_id,\n      );\n      return tokens;\n    }\n\n    async handleRefreshTokenGrant(\n      refresh_token: string,\n      clientCredentials: { client_id: string; client_secret?: string },\n    ): Promise<TokenPair> {\n      // Verify the refresh token first to get client_id from token if not provided\n      const payload = this.jwtTokenService.validateToken(refresh_token);\n      if (!payload || payload.type !== 'refresh') {\n        throw new BadRequestException('Invalid or expired refresh token');\n      }\n\n      // Use client_id from token if not provided in credentials\n      const clientId = clientCredentials.client_id || payload.client_id;\n      if (!clientId) {\n        throw new BadRequestException('Unable to determine client_id');\n      }\n\n      // Get client and validate authentication\n      const client = await this.clientService.getClient(clientId);\n\n      // For refresh token grants, we can be more lenient with client authentication\n      // if the token already contains the client_id and the client is public\n      if (client?.token_endpoint_auth_method !== 'none') {\n        this.validateClientAuthentication(client, {\n          ...clientCredentials,\n          client_id: clientId,\n        });\n      }\n\n      // Verify the refresh token belongs to the client\n      if (payload.client_id !== clientId) {\n        throw new BadRequestException(\n          'Invalid refresh token or token does not belong to this client',\n        );\n      }\n\n      let newTokens: TokenPair | null = null;\n      try {\n        const payload = this.jwtTokenService.validateToken(refresh_token);\n        if (!payload || payload.type !== 'refresh') {\n          throw new BadRequestException('Invalid or expired refresh token');\n        }\n\n        let userData: any | undefined = undefined;\n        if (payload.user_profile_id) {\n          try {\n            const profile = await this.store.getUserProfileById(\n              payload.user_profile_id,\n            );\n            if (profile) userData = { ...profile };\n          } catch (e) {\n            this.logger.warn(\n              'Failed to load user profile for refreshed token payload',\n              e,\n            );\n          }\n        }\n\n        newTokens = this.jwtTokenService.generateTokenPair(\n          payload.sub,\n          clientId,\n          payload.scope,\n          payload.resource,\n          {\n            user_profile_id: payload.user_profile_id,\n            user_data: userData,\n          },\n        );\n      } catch (e) {\n        this.logger.warn(\n          'Refresh flow failed using enriched path, fallback',\n          e,\n        );\n        newTokens = this.jwtTokenService.refreshAccessToken(refresh_token);\n      }\n\n      if (!newTokens) throw new BadRequestException('Failed to refresh token');\n      return newTokens;\n    }\n\n    validatePKCE(\n      code_verifier: string,\n      code_challenge: string,\n      method: string,\n    ): boolean {\n      if (method === 'plain') {\n        return code_verifier === code_challenge;\n      } else if (method === 'S256') {\n        const hash = createHash('sha256')\n          .update(code_verifier)\n          .digest('base64url');\n        return hash === code_challenge;\n      }\n      return false;\n    }\n\n    /**\n     * Utility function to parse form-encoded or JSON bodies\n     * Handles both string (raw form data) and object bodies\n     */\n    parseRequestBody(body: any): Record<string, any> {\n      // If body is already a parsed object with properties, return it\n      if (body && typeof body === 'object' && Object.keys(body).length > 0) {\n        return body;\n      }\n\n      // If body is a string (raw form data), parse it\n      if (typeof body === 'string' && body.length > 0) {\n        const params = new URLSearchParams(body);\n        const parsedBody: Record<string, any> = {};\n        for (const [key, value] of params.entries()) {\n          parsedBody[key] = value;\n        }\n        return parsedBody;\n      }\n\n      // Return empty object if no valid body\n      return {};\n    }\n  }\n\n  return McpOAuthController;\n}\n"]}
+{"version":3,"file":"mcp-oauth.controller.js","sourceRoot":"","sources":["../../src/authz/mcp-oauth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA4CA,4DAqxBC;AAj0BD,2CAcwB;AACxB,mCAAiD;AAEjD,wDAAgC;AAChC,wEAAoE;AAOpE,8DAA0D;AAC1D,oEAA0E;AAC1E,8EAAkE;AAiBlE,SAAgB,wBAAwB,CACtC,YAAwC,EAAE,EAC1C,OAGC;;IAGD,MAAM,WAAW,GAAG,CAClB,IAAmC,EACnC,OAAgB,EACC,EAAE;QACnB,OAAO,OAAO,IAAI,IAAI;YACpB,CAAC,CAAE,YAA+C,CAAC,IAAI,CAAC;YACxD,CAAC,CAAE,CAAC,GAAG,EAAE,GAAE,CAAC,CAAgC,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,CACrB,IAAY,EACZ,KAAa,EACb,OAAgB,EACC,EAAE;QACnB,OAAO,OAAO;YACZ,CAAC,CAAE,eAA+D,CAC9D,IAAI,EACJ,KAAK,CACN;YACH,CAAC,CAAE,CAAC,GAAG,EAAE,GAAE,CAAC,CAAgC,CAAC;IACjD,CAAC,CAAC;IAEF,IACM,kBAAkB,0BADxB,MACM,kBAAkB;QAMtB,YACkC,OAA2B,EACpC,KAA2B,EACzC,eAAgC,EAChC,aAA4B;YAFL,UAAK,GAAL,KAAK,CAAa;YACzC,oBAAe,GAAf,eAAe,CAAiB;YAChC,kBAAa,GAAb,aAAa,CAAe;YAT9B,WAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;YAWpD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACnC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QAMD,gBAAgB,CAAC,IAAS,EAAE,GAAwB;YAElD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;YAGD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;gBACzC,MAAM,UAAU,GAAwB,EAAE,CAAC;gBAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC5C,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC1B,CAAC;gBACD,OAAO,UAAU,CAAC;YACpB,CAAC;YAGD,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjD,MAAM,UAAU,GAAwB,EAAE,CAAC;gBAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC5C,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC1B,CAAC;gBACD,OAAO,UAAU,CAAC;YACpB,CAAC;YAGD,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;oBAC/C,MAAM,UAAU,GAAwB,EAAE,CAAC;oBAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;wBAC5C,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;oBAC1B,CAAC;oBACD,OAAO,UAAU,CAAC;gBACpB,CAAC;YACH,CAAC;YAGD,OAAO,EAAE,CAAC;QACZ,CAAC;QAMD,KAAK,CAAC,cAAc,CAClB,GAAuB,EACvB,GAAa,EACb,IAAkB;YAElB,IACE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CACnC,mCAAmC,CACpC,EACD,CAAC;gBACD,IAAI,OAAO,GAAG,EAAE,CAAC;gBAEjB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACrC,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;oBAEvB,IAAI,OAAO,EAAE,CAAC;wBACZ,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;wBAC5C,MAAM,UAAU,GAAQ,EAAE,CAAC;wBAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;4BAC5C,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;wBAC1B,CAAC;wBACA,GAAW,CAAC,IAAI,GAAG,UAAU,CAAC;oBACjC,CAAC;oBACD,IAAI,EAAE,CAAC;gBACT,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;oBACtD,IAAI,CAAC,GAAG,CAAC,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,EAAE,CAAC;YACT,CAAC;QACH,CAAC;QAWD,4BAA4B;YAE1B,MAAM,yBAAyB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAGzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAEjD,MAAM,QAAQ,GAAG;gBAKf,qBAAqB,EAAE,CAAC,yBAAyB,CAAC;gBAMlD,QAAQ,EAAE,kBAAkB;gBAM5B,gBAAgB,EACd,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,eAAe;gBAMxD,wBAAwB,EACtB,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,sBAAsB;gBAM/D,sBAAsB,EACpB,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,oBAAoB;aAC9D,CAAC;YAEF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAYD,8BAA8B;YAC5B,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,SAAS;gBACtB,sBAAsB,EAAE,IAAA,sCAAiB,EACvC,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,CAC3C;gBACD,cAAc,EAAE,IAAA,sCAAiB,EAC/B,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,EAAE,CACvC;gBACD,qBAAqB,EAAE,IAAA,sCAAiB,EACtC,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,EAAE,CAC1C;gBACD,wBAAwB,EACtB,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,sBAAsB;gBACjE,wBAAwB,EACtB,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,sBAAsB;gBACjE,qBAAqB,EACnB,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,mBAAmB;gBAC9D,qCAAqC,EACnC,IAAI,CAAC,OAAO,CAAC,2BAA2B;qBACrC,iCAAiC;gBACtC,gBAAgB,EACd,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,eAAe;gBAC1D,mBAAmB,EAAE,IAAA,sCAAiB,EACpC,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,EAAE,MAAM,EAAE,CACzC;gBACD,gCAAgC,EAC9B,IAAI,CAAC,OAAO,CAAC,2BAA2B;qBACrC,6BAA6B;aACnC,CAAC;QACJ,CAAC;QAGK,AAAN,KAAK,CAAC,cAAc,CAAS,eAAoB;YAC/C,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAClE,CAAC;QAGK,AAAN,KAAK,CAAC,SAAS,CACJ,KAAU,EAEnB,GAAQ,EACD,GAAa,EACZ,IAAkB;YAE1B,MAAM,EACJ,aAAa,EACb,SAAS,EACT,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,KAAK,EACL,KAAK,GACN,GAAG,KAAK,CAAC;YACV,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACvC,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;YAC/D,CAAC;YAGD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,4BAAmB,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAChE,SAAS,EACT,YAAY,CACb,CAAC;YACF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;YACxD,CAAC;YAGD,MAAM,SAAS,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxD,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAE3D,MAAM,YAAY,GAAiB;gBACjC,SAAS;gBACT,KAAK,EAAE,YAAY;gBACnB,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE,YAAY;gBACzB,aAAa,EAAE,cAAc;gBAC7B,mBAAmB,EAAE,qBAAqB,IAAI,OAAO;gBACrD,UAAU,EAAE,KAAK;gBACjB,KAAK,EAAE,KAAK;gBACZ,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB;aAC3D,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAG5D,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,EAAE;gBACrC,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAGH,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE;gBACtC,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAGH,kBAAQ,CAAC,YAAY,CAAC,sCAAa,EAAE;gBACnC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW;aAChC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC;QAGD,sBAAsB,CACb,GAAyB,EACzB,GAAa,EACZ,IAAkB;YAG1B,kBAAQ,CAAC,YAAY,CACnB,sCAAa,EACb,EAAE,OAAO,EAAE,KAAK,EAAE,EAClB,KAAK,EAAE,GAAQ,EAAE,IAAS,EAAE,EAAE;gBAC5B,IAAI,CAAC;oBACH,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;wBAChD,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;oBACzD,CAAC;oBAED,IAAI,CAAC,IAAI,EAAE,CAAC;wBACV,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;oBACzD,CAAC;oBAED,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;oBAChB,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,KAAK,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CACF,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,4BAA4B,CAChC,GAAyB,EACzB,GAAa;YAEb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;YAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;YACpE,CAAC;YAGD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC;YACjD,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBACtC,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;YAC3D,CAAC;YAGD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,EACrB,IAAI,CAAC,OAAO,CACb,CAAC;YAGF,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;gBAC5B,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;aAClC,CAAC,CAAC;YAGH,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YACjC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YAG/B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CACxD,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,CACd,CAAC;YAGF,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAGvD,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBAC7B,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC9B,SAAS,EAAE,OAAO,CAAC,QAAS;gBAC5B,YAAY,EAAE,OAAO,CAAC,WAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,aAAc;gBACtC,qBAAqB,EAAE,OAAO,CAAC,mBAAoB;gBACnD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB;gBACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,mBAAmB,EAAE,EAAE;gBACvB,eAAe;aAChB,CAAC,CAAC;YAGH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAY,CAAC,CAAC;YAClD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAC5D,CAAC;YAGD,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAE/C,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvC,CAAC;QAOK,AAAN,KAAK,CAAC,aAAa,CACT,IAAS,EACV,GAAuB,EACvB,GAAa,EACZ,IAAkB;YAG1B,IACE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CACnC,mCAAmC,CACpC;gBACD,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EACzC,CAAC;gBACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBACrC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAS,EAAE,EAAE;wBAChD,IAAI,GAAG,EAAE,CAAC;4BACR,MAAM,CAAC,GAAG,CAAC,CAAC;4BACZ,OAAO;wBACT,CAAC;wBAED,IAAI,CAAC;4BAEH,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC;4BAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;4BAChE,OAAO,CAAC,MAAM,CAAC,CAAC;wBAClB,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,MAAM,CAAC,KAAK,CAAC,CAAC;wBAChB,CAAC;oBACH,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;YAGD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,UAA+B,EAC/B,GAAuB;YAEvB,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,GACpE,UAAU,CAAC;YAGb,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;oBACvD,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;oBACvC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;oBACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;YAChE,CAAC;YAED,QAAQ,UAAU,EAAE,CAAC;gBACnB,KAAK,oBAAoB,CAAC,CAAC,CAAC;oBAE1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CACrD,GAAG,EACH,UAAU,CACX,CAAC;oBACF,OAAO,MAAM,IAAI,CAAC,4BAA4B,CAC5C,IAAI,EACJ,aAAa,EACb,YAAY,EACZ,iBAAiB,CAClB,CAAC;gBACJ,CAAC;gBACD,KAAK,eAAe,CAAC,CAAC,CAAC;oBAErB,IAAI,iBAAgE,CAAC;oBACrE,IAAI,CAAC;wBACH,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;oBACrE,CAAC;oBAAC,MAAM,CAAC;wBAEP,iBAAiB,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;oBACxC,CAAC;oBACD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CACvC,aAAa,EACb,iBAAiB,CAClB,CAAC;gBACJ,CAAC;gBACD;oBACE,MAAM,IAAI,4BAAmB,CAC3B,2BAA2B,UAAU,EAAE,CACxC,CAAC;YACN,CAAC;QACH,CAAC;QAKD,wBAAwB,CACtB,GAAuB,EACvB,IAAS;YAGT,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAGpD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CACrE,OAAO,CACR,CAAC;gBACF,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC7D,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;gBACtC,CAAC;YACH,CAAC;YAGD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;gBACzB,OAAO;oBACL,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;iBACxC,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAKD,4BAA4B,CAC1B,MAAW,EACX,iBAAgE;YAEhE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,4BAAmB,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,CAAC;YAE9C,QAAQ,0BAA0B,EAAE,CAAC;gBACnC,KAAK,qBAAqB,CAAC;gBAC3B,KAAK,oBAAoB;oBACvB,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC;wBACrC,MAAM,IAAI,4BAAmB,CAC3B,uDAAuD,CACxD,CAAC;oBACJ,CAAC;oBACD,IAAI,MAAM,CAAC,aAAa,KAAK,iBAAiB,CAAC,aAAa,EAAE,CAAC;wBAC7D,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;oBAC9D,CAAC;oBACD,MAAM;gBAER,KAAK,MAAM;oBAET,IAAI,iBAAiB,CAAC,aAAa,EAAE,CAAC;wBACpC,MAAM,IAAI,4BAAmB,CAC3B,8CAA8C,CAC/C,CAAC;oBACJ,CAAC;oBACD,MAAM;gBAER;oBACE,MAAM,IAAI,4BAAmB,CAC3B,sCAAsC,0BAA0B,EAAE,CACnE,CAAC;YACN,CAAC;QACH,CAAC;QAED,KAAK,CAAC,4BAA4B,CAChC,IAAY,EACZ,aAAqB,EACrB,aAAqB,EACrB,iBAAgE;YAEhE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;gBAC1D,IAAI;gBACJ,SAAS,EAAE,iBAAiB,CAAC,SAAS;aACvC,CAAC,CAAC;YAGH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4DAA4D,EAC5D,IAAI,CACL,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4DAA4D,EAC5D,IAAI,CACL,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAAC,gCAAgC,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,QAAQ,CAAC,SAAS,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,oDAAoD,EACpD,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,EAAE,CACnE,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;YACtD,CAAC;YAGD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAC/C,iBAAiB,CAAC,SAAS,CAC5B,CAAC;YACF,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAC7D,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAC/B,aAAa,EACb,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,qBAAqB,CAC/B,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0DAA0D,CAC3D,CAAC;oBACF,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,iEAAiE,CAClE,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAC3B,sDAAsD,CACvD,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,GAAoB,SAAS,CAAC;YAC1C,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CACjD,QAAQ,CAAC,eAAe,CACzB,CAAC;oBACF,IAAI,OAAO,EAAE,CAAC;wBAEZ,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CACnD,QAAQ,CAAC,OAAO,EAChB,iBAAiB,CAAC,SAAS,EAC3B,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,QAAQ,EACjB;gBACE,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,SAAS,EAAE,QAAQ;aACpB,CACF,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,+DAA+D,EAC/D,QAAQ,CAAC,OAAO,CACjB,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,uBAAuB,CAC3B,aAAqB,EACrB,iBAAgE;YAGhE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;YACpE,CAAC;YAGD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC;YAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;YACjE,CAAC;YAGD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAI5D,IAAI,MAAM,EAAE,0BAA0B,KAAK,MAAM,EAAE,CAAC;gBAClD,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE;oBACxC,GAAG,iBAAiB;oBACpB,SAAS,EAAE,QAAQ;iBACpB,CAAC,CAAC;YACL,CAAC;YAGD,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,IAAI,4BAAmB,CAC3B,+DAA+D,CAChE,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,GAAqB,IAAI,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;gBAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;gBACpE,CAAC;gBAED,IAAI,QAAQ,GAAoB,SAAS,CAAC;gBAC1C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;oBAC5B,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CACjD,OAAO,CAAC,eAAe,CACxB,CAAC;wBACF,IAAI,OAAO;4BAAE,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;oBACzC,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yDAAyD,EACzD,CAAC,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAChD,OAAO,CAAC,GAAG,EACX,QAAQ,EACR,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,EAChB;oBACE,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,SAAS,EAAE,QAAQ;iBACpB,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mDAAmD,EACnD,CAAC,CACF,CAAC;gBACF,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YACrE,CAAC;YAED,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,YAAY,CACV,aAAqB,EACrB,cAAsB,EACtB,MAAc;YAEd,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO,aAAa,KAAK,cAAc,CAAC;YAC1C,CAAC;iBAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;qBAC9B,MAAM,CAAC,aAAa,CAAC;qBACrB,MAAM,CAAC,WAAW,CAAC,CAAC;gBACvB,OAAO,IAAI,KAAK,cAAc,CAAC;YACjC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAA;IAhoBC;QATC,WAAW,CACV,SAAS,CAAC,kCAAkC,EAC5C,CAAC,OAAO,EAAE,yCAAyC,CACpD;QACA,cAAc,CACb,cAAc,EACd,kBAAkB,EAClB,CAAC,OAAO,EAAE,yCAAyC,CACpD;;;;0EA4CA;IAYD;QATC,WAAW,CACV,SAAS,CAAC,oCAAoC,EAC9C,CAAC,OAAO,EAAE,2CAA2C,CACtD;QACA,cAAc,CACb,cAAc,EACd,kBAAkB,EAClB,CAAC,OAAO,EAAE,2CAA2C,CACtD;;;;4EA+BA;IAGK;QADL,IAAA,aAAI,EAAC,SAAS,CAAC,QAAQ,CAAC;QACH,WAAA,IAAA,aAAI,GAAE,CAAA;;;;4DAE3B;IAGK;QADL,IAAA,YAAG,EAAC,SAAS,CAAC,SAAS,CAAC;QAEtB,WAAA,IAAA,cAAK,GAAE,CAAA;QACP,WAAA,IAAA,YAAG,GAAE,CAAA;QAEL,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,aAAI,GAAE,CAAA;;;;uDAuER;IAGD;QADC,IAAA,YAAG,EAAC,SAAS,CAAC,QAAQ,CAAC;QAErB,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,aAAI,GAAE,CAAA;;;;oEAwBR;IAsFK;QALL,IAAA,aAAI,EAAC,SAAS,CAAC,KAAK,CAAC;QACrB,IAAA,eAAM,EAAC,cAAc,EAAE,kBAAkB,CAAC;QAC1C,IAAA,eAAM,EAAC,eAAe,EAAE,UAAU,CAAC;QACnC,IAAA,eAAM,EAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAA,iBAAQ,EAAC,GAAG,CAAC;QAEX,WAAA,IAAA,aAAI,GAAE,CAAA;QACN,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,aAAI,GAAE,CAAA;;;;2DA+BR;IApbG,kBAAkB;QADvB,IAAA,mBAAU,GAAE;QAQR,WAAA,IAAA,eAAM,EAAC,sBAAsB,CAAC,CAAA;QAC9B,WAAA,IAAA,eAAM,EAAC,aAAa,CAAC,CAAA;yDACI,mCAAe;YACjB,8BAAa;OAVnC,kBAAkB,CAovBvB;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import {\n  BadRequestException,\n  Body,\n  Controller,\n  Get,\n  Header,\n  HttpCode,\n  Inject,\n  Logger,\n  Next,\n  Post,\n  Query,\n  Req,\n  Res,\n} from '@nestjs/common';\nimport { createHash, randomBytes } from 'crypto';\nimport { Request as ExpressRequest, NextFunction, Response } from 'express';\nimport passport from 'passport';\nimport { normalizeEndpoint } from '../mcp/utils/normalize-endpoint';\nimport {\n  OAuthEndpointConfiguration,\n  OAuthModuleOptions,\n  OAuthSession,\n  OAuthUserProfile,\n} from './providers/oauth-provider.interface';\nimport { ClientService } from './services/client.service';\nimport { JwtTokenService, TokenPair } from './services/jwt-token.service';\nimport { STRATEGY_NAME } from './services/oauth-strategy.service';\nimport { IOAuthStore } from './stores/oauth-store.interface';\n\ninterface OAuthCallbackRequest extends ExpressRequest {\n  user?: {\n    profile: OAuthUserProfile;\n    accessToken: string;\n    provider: string;\n  };\n}\n\n// Add this interface to properly type the Express request with raw body\ninterface RequestWithRawBody extends ExpressRequest {\n  rawBody?: Buffer;\n  textBody?: string;\n}\n\nexport function createMcpOAuthController(\n  endpoints: OAuthEndpointConfiguration = {},\n  options?: {\n    disableWellKnownProtectedResourceMetadata?: boolean;\n    disableWellKnownAuthorizationServerMetadata?: boolean;\n  },\n) {\n  // Optional decorator helpers\n  const OptionalGet = (\n    path: string | string[] | undefined,\n    enabled: boolean,\n  ): MethodDecorator => {\n    return enabled && path\n      ? (Get as unknown as (p?: any) => MethodDecorator)(path)\n      : ((() => {}) as unknown as MethodDecorator);\n  };\n  const OptionalHeader = (\n    name: string,\n    value: string,\n    enabled: boolean,\n  ): MethodDecorator => {\n    return enabled\n      ? (Header as unknown as (n: string, v: string) => MethodDecorator)(\n          name,\n          value,\n        )\n      : ((() => {}) as unknown as MethodDecorator);\n  };\n\n  @Controller()\n  class McpOAuthController {\n    readonly logger = new Logger(McpOAuthController.name);\n    readonly serverUrl: string;\n    readonly isProduction: boolean;\n    readonly options: OAuthModuleOptions;\n\n    constructor(\n      @Inject('OAUTH_MODULE_OPTIONS') options: OAuthModuleOptions,\n      @Inject('IOAuthStore') readonly store: IOAuthStore,\n      readonly jwtTokenService: JwtTokenService,\n      readonly clientService: ClientService,\n    ) {\n      this.serverUrl = options.serverUrl;\n      this.isProduction = options.cookieSecure;\n      this.options = options;\n    }\n\n    /**\n     * Utility function to parse form-encoded or JSON bodies\n     * Handles both string (raw form data) and object bodies\n     */\n    parseRequestBody(body: any, req?: RequestWithRawBody): Record<string, any> {\n      // If body is already a parsed object with properties, return it\n      if (body && typeof body === 'object' && Object.keys(body).length > 0) {\n        return body;\n      }\n\n      // If body is a string (raw form data), parse it\n      if (typeof body === 'string' && body.length > 0) {\n        const params = new URLSearchParams(body);\n        const parsedBody: Record<string, any> = {};\n        for (const [key, value] of params.entries()) {\n          parsedBody[key] = value;\n        }\n        return parsedBody;\n      }\n\n      // Check if we have a text body stored on the request (from our middleware)\n      if (req?.textBody) {\n        const params = new URLSearchParams(req.textBody);\n        const parsedBody: Record<string, any> = {};\n        for (const [key, value] of params.entries()) {\n          parsedBody[key] = value;\n        }\n        return parsedBody;\n      }\n\n      // Check if we have a raw body buffer stored on the request\n      if (req?.rawBody) {\n        const bodyString = req.rawBody.toString('utf-8');\n        if (bodyString) {\n          const params = new URLSearchParams(bodyString);\n          const parsedBody: Record<string, any> = {};\n          for (const [key, value] of params.entries()) {\n            parsedBody[key] = value;\n          }\n          return parsedBody;\n        }\n      }\n\n      // Return empty object if no valid body\n      return {};\n    }\n\n    /**\n     * Middleware to capture raw body for form-encoded requests\n     * This is needed when bodyParser is disabled in the main app\n     */\n    async captureRawBody(\n      req: RequestWithRawBody,\n      res: Response,\n      next: NextFunction,\n    ) {\n      if (\n        req.headers['content-type']?.includes(\n          'application/x-www-form-urlencoded',\n        )\n      ) {\n        let rawBody = '';\n\n        req.on('data', (chunk: Buffer) => {\n          rawBody += chunk.toString('utf-8');\n        });\n\n        req.on('end', () => {\n          req.textBody = rawBody;\n          // Also parse and set it as body for NestJS\n          if (rawBody) {\n            const params = new URLSearchParams(rawBody);\n            const parsedBody: any = {};\n            for (const [key, value] of params.entries()) {\n              parsedBody[key] = value;\n            }\n            (req as any).body = parsedBody;\n          }\n          next();\n        });\n\n        req.on('error', (err) => {\n          this.logger.error('Error reading request body:', err);\n          next(err);\n        });\n      } else {\n        next();\n      }\n    }\n\n    @OptionalGet(\n      endpoints.wellKnownProtectedResourceMetadata,\n      !options?.disableWellKnownProtectedResourceMetadata,\n    )\n    @OptionalHeader(\n      'content-type',\n      'application/json',\n      !options?.disableWellKnownProtectedResourceMetadata,\n    )\n    getProtectedResourceMetadata() {\n      // The issuer URL of your authorization server.\n      const authorizationServerIssuer = this.options.jwtIssuer;\n\n      // The canonical URI of the MCP server resource itself.\n      const resourceIdentifier = this.options.resource;\n\n      const metadata = {\n        /**\n         * REQUIRED by MCP Spec.\n         * A list of authorization server issuer URLs that can issue tokens for this resource.\n         */\n        authorization_servers: [authorizationServerIssuer],\n\n        /**\n         * RECOMMENDED by RFC 9728.\n         * The identifier for this resource server.\n         */\n        resource: resourceIdentifier,\n\n        /**\n         * RECOMMENDED by RFC 9728.\n         * A list of scopes that this resource server understands.\n         */\n        scopes_supported:\n          this.options.protectedResourceMetadata.scopesSupported,\n\n        /**\n         * RECOMMENDED by RFC 9728.\n         * A list of methods clients can use to present the access token.\n         */\n        bearer_methods_supported:\n          this.options.protectedResourceMetadata.bearerMethodsSupported,\n\n        /**\n         * OPTIONAL but helpful custom metadata.\n         * Declares which version of the MCP spec this server supports.\n         */\n        mcp_versions_supported:\n          this.options.protectedResourceMetadata.mcpVersionsSupported,\n      };\n\n      return metadata;\n    }\n\n    // OAuth endpoints\n    @OptionalGet(\n      endpoints.wellKnownAuthorizationServerMetadata,\n      !options?.disableWellKnownAuthorizationServerMetadata,\n    )\n    @OptionalHeader(\n      'content-type',\n      'application/json',\n      !options?.disableWellKnownAuthorizationServerMetadata,\n    )\n    getAuthorizationServerMetadata() {\n      return {\n        issuer: this.serverUrl,\n        authorization_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints.authorize}`,\n        ),\n        token_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints.token}`,\n        ),\n        registration_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints.register}`,\n        ),\n        response_types_supported:\n          this.options.authorizationServerMetadata.responseTypesSupported,\n        response_modes_supported:\n          this.options.authorizationServerMetadata.responseModesSupported,\n        grant_types_supported:\n          this.options.authorizationServerMetadata.grantTypesSupported,\n        token_endpoint_auth_methods_supported:\n          this.options.authorizationServerMetadata\n            .tokenEndpointAuthMethodsSupported,\n        scopes_supported:\n          this.options.authorizationServerMetadata.scopesSupported,\n        revocation_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints?.revoke}`,\n        ),\n        code_challenge_methods_supported:\n          this.options.authorizationServerMetadata\n            .codeChallengeMethodsSupported,\n      };\n    }\n\n    @Post(endpoints.register)\n    async registerClient(@Body() registrationDto: any) {\n      return await this.clientService.registerClient(registrationDto);\n    }\n\n    @Get(endpoints.authorize)\n    async authorize(\n      @Query() query: any,\n      @Req()\n      req: any,\n      @Res() res: Response,\n      @Next() next: NextFunction,\n    ) {\n      const {\n        response_type,\n        client_id,\n        redirect_uri,\n        code_challenge,\n        code_challenge_method,\n        state,\n        scope,\n      } = query;\n      const resource = this.options.resource;\n      if (response_type !== 'code') {\n        throw new BadRequestException('Only response_type=code is supported');\n      }\n\n      if (!client_id) {\n        throw new BadRequestException('Missing required parameters');\n      }\n\n      // Validate client and redirect URI\n      const client = await this.clientService.getClient(client_id);\n      if (!client) {\n        throw new BadRequestException('Invalid client_id');\n      }\n\n      const validRedirect = await this.clientService.validateRedirectUri(\n        client_id,\n        redirect_uri,\n      );\n      if (!validRedirect) {\n        throw new BadRequestException('Invalid redirect_uri');\n      }\n\n      // Create OAuth session\n      const sessionId = randomBytes(32).toString('base64url');\n      const sessionState = randomBytes(32).toString('base64url');\n\n      const oauthSession: OAuthSession = {\n        sessionId,\n        state: sessionState,\n        clientId: client_id,\n        redirectUri: redirect_uri,\n        codeChallenge: code_challenge,\n        codeChallengeMethod: code_challenge_method || 'plain',\n        oauthState: state,\n        scope: scope,\n        resource,\n        expiresAt: Date.now() + this.options.oauthSessionExpiresIn,\n      };\n\n      await this.store.storeOAuthSession(sessionId, oauthSession);\n\n      // Set session cookie\n      res.cookie('oauth_session', sessionId, {\n        httpOnly: true,\n        secure: this.isProduction,\n        maxAge: this.options.oauthSessionExpiresIn,\n      });\n\n      // Store state for passport\n      res.cookie('oauth_state', sessionState, {\n        httpOnly: true,\n        secure: this.isProduction,\n        maxAge: this.options.oauthSessionExpiresIn,\n      });\n\n      // Redirect to the provider's auth endpoint\n      passport.authenticate(STRATEGY_NAME, {\n        state: req.cookies?.oauth_state,\n      })(req, res, next);\n    }\n\n    @Get(endpoints.callback)\n    handleProviderCallback(\n      @Req() req: OAuthCallbackRequest,\n      @Res() res: Response,\n      @Next() next: NextFunction,\n    ) {\n      // Use a custom callback to handle the authentication result\n      passport.authenticate(\n        STRATEGY_NAME,\n        { session: false },\n        async (err: any, user: any) => {\n          try {\n            if (err) {\n              this.logger.error('OAuth callback error:', err);\n              throw new BadRequestException('Authentication failed');\n            }\n\n            if (!user) {\n              throw new BadRequestException('Authentication failed');\n            }\n\n            req.user = user;\n            await this.processAuthenticationSuccess(req, res);\n          } catch (error) {\n            next(error);\n          }\n        },\n      )(req, res, next);\n    }\n\n    async processAuthenticationSuccess(\n      req: OAuthCallbackRequest,\n      res: Response,\n    ) {\n      const user = req.user;\n      if (!user) {\n        throw new BadRequestException('Authentication failed');\n      }\n\n      const sessionId = req.cookies?.oauth_session;\n      if (!sessionId) {\n        throw new BadRequestException('Missing OAuth session');\n      }\n\n      const session = await this.store.getOAuthSession(sessionId);\n      if (!session) {\n        throw new BadRequestException('Invalid or expired OAuth session');\n      }\n\n      // Verify state\n      const stateFromCookie = req.cookies?.oauth_state;\n      if (session.state !== stateFromCookie) {\n        throw new BadRequestException('Invalid state parameter');\n      }\n\n      // Generate JWT for UI access\n      const jwt = this.jwtTokenService.generateUserToken(\n        user.profile.username,\n        user.profile,\n      );\n\n      // Set JWT token as cookie for UI endpoints\n      res.cookie('auth_token', jwt, {\n        httpOnly: true,\n        secure: this.isProduction,\n        maxAge: this.options.cookieMaxAge,\n      });\n\n      // Clear temporary cookies\n      res.clearCookie('oauth_session');\n      res.clearCookie('oauth_state');\n\n      // Persist user profile and get stable profile_id\n      const user_profile_id = await this.store.upsertUserProfile(\n        user.profile,\n        user.provider,\n      );\n\n      // Generate authorization code\n      const authCode = randomBytes(32).toString('base64url');\n\n      // Store the auth code\n      await this.store.storeAuthCode({\n        code: authCode,\n        user_id: user.profile.username,\n        client_id: session.clientId!,\n        redirect_uri: session.redirectUri!,\n        code_challenge: session.codeChallenge!,\n        code_challenge_method: session.codeChallengeMethod!,\n        expires_at: Date.now() + this.options.authCodeExpiresIn,\n        resource: session.resource,\n        scope: session.scope,\n        github_access_token: '', // No longer provider-specific\n        user_profile_id,\n      });\n\n      // Build redirect URL with authorization code\n      const redirectUrl = new URL(session.redirectUri!);\n      redirectUrl.searchParams.set('code', authCode);\n      if (session.oauthState) {\n        redirectUrl.searchParams.set('state', session.oauthState);\n      }\n\n      // Clean up session\n      await this.store.removeOAuthSession(sessionId);\n\n      res.redirect(redirectUrl.toString());\n    }\n\n    @Post(endpoints.token)\n    @Header('content-type', 'application/json')\n    @Header('Cache-Control', 'no-store')\n    @Header('Pragma', 'no-cache')\n    @HttpCode(200)\n    async exchangeToken(\n      @Body() body: any,\n      @Req() req: RequestWithRawBody,\n      @Res() res: Response,\n      @Next() next: NextFunction,\n    ): Promise<TokenPair> {\n      // Apply middleware to capture raw body if needed\n      if (\n        req.headers['content-type']?.includes(\n          'application/x-www-form-urlencoded',\n        ) &&\n        (!body || Object.keys(body).length === 0)\n      ) {\n        return new Promise((resolve, reject) => {\n          this.captureRawBody(req, res, async (err?: any) => {\n            if (err) {\n              reject(err);\n              return;\n            }\n\n            try {\n              // Re-parse the body after middleware has captured it\n              const parsedBody = this.parseRequestBody(req.body || body, req);\n              const result = await this.processTokenExchange(parsedBody, req);\n              resolve(result);\n            } catch (error) {\n              reject(error);\n            }\n          });\n        });\n      }\n\n      // Body is already parsed, process directly\n      const parsedBody = this.parseRequestBody(body, req);\n      return this.processTokenExchange(parsedBody, req);\n    }\n\n    async processTokenExchange(\n      parsedBody: Record<string, any>,\n      req: RequestWithRawBody,\n    ): Promise<TokenPair> {\n      const { grant_type, code, code_verifier, redirect_uri, refresh_token } =\n        parsedBody;\n\n      // Add debugging to help identify issues\n      if (!grant_type) {\n        this.logger.error('Missing grant_type in request body:', {\n          parsedBodyKeys: Object.keys(parsedBody),\n          contentType: req.headers['content-type'],\n          textBody: req.textBody,\n          parsedBody,\n        });\n        throw new BadRequestException('Missing grant_type parameter');\n      }\n\n      switch (grant_type) {\n        case 'authorization_code': {\n          // Extract client credentials based on authentication method\n          const clientCredentials = this.extractClientCredentials(\n            req,\n            parsedBody,\n          );\n          return await this.handleAuthorizationCodeGrant(\n            code,\n            code_verifier,\n            redirect_uri,\n            clientCredentials,\n          );\n        }\n        case 'refresh_token': {\n          // For refresh tokens, try to extract client credentials, but allow fallback to token-based extraction\n          let clientCredentials: { client_id: string; client_secret?: string };\n          try {\n            clientCredentials = this.extractClientCredentials(req, parsedBody);\n          } catch {\n            // If we can't extract credentials, we'll try to get them from the refresh token\n            clientCredentials = { client_id: '' }; // Will be filled from token\n          }\n          return await this.handleRefreshTokenGrant(\n            refresh_token,\n            clientCredentials,\n          );\n        }\n        default:\n          throw new BadRequestException(\n            `Unsupported grant_type: ${grant_type}`,\n          );\n      }\n    }\n\n    /**\n     * Extract client credentials from request based on authentication method\n     */\n    extractClientCredentials(\n      req: RequestWithRawBody,\n      body: any,\n    ): { client_id: string; client_secret?: string } {\n      // Parse the body using the shared utility function\n      const parsedBody = this.parseRequestBody(body, req);\n\n      // Try client_secret_basic first (Authorization header)\n      const authHeader = req.headers?.authorization;\n      if (authHeader && authHeader.startsWith('Basic ')) {\n        const credentials = Buffer.from(authHeader.slice(6), 'base64').toString(\n          'utf-8',\n        );\n        const [client_id, client_secret] = credentials.split(':', 2);\n        if (client_id) {\n          return { client_id, client_secret };\n        }\n      }\n\n      // Try client_secret_post (body parameters)\n      if (parsedBody.client_id) {\n        return {\n          client_id: parsedBody.client_id,\n          client_secret: parsedBody.client_secret,\n        };\n      }\n\n      throw new BadRequestException('Missing client credentials');\n    }\n\n    /**\n     * Validate client authentication based on the client's configured method\n     */\n    validateClientAuthentication(\n      client: any,\n      clientCredentials: { client_id: string; client_secret?: string },\n    ): void {\n      if (!client) {\n        throw new BadRequestException('Invalid client_id');\n      }\n\n      const { token_endpoint_auth_method } = client;\n\n      switch (token_endpoint_auth_method) {\n        case 'client_secret_basic':\n        case 'client_secret_post':\n          if (!clientCredentials.client_secret) {\n            throw new BadRequestException(\n              'Client secret required for this authentication method',\n            );\n          }\n          if (client.client_secret !== clientCredentials.client_secret) {\n            throw new BadRequestException('Invalid client credentials');\n          }\n          break;\n\n        case 'none':\n          // Public client - no secret required\n          if (clientCredentials.client_secret) {\n            throw new BadRequestException(\n              'Client secret not allowed for public clients',\n            );\n          }\n          break;\n\n        default:\n          throw new BadRequestException(\n            `Unsupported authentication method: ${token_endpoint_auth_method}`,\n          );\n      }\n    }\n\n    async handleAuthorizationCodeGrant(\n      code: string,\n      code_verifier: string,\n      _redirect_uri: string,\n      clientCredentials: { client_id: string; client_secret?: string },\n    ): Promise<TokenPair> {\n      this.logger.debug('handleAuthorizationCodeGrant - Params:', {\n        code,\n        client_id: clientCredentials.client_id,\n      });\n\n      // Get and validate the authorization code\n      const authCode = await this.store.getAuthCode(code);\n      if (!authCode) {\n        this.logger.error(\n          'handleAuthorizationCodeGrant - Invalid authorization code:',\n          code,\n        );\n        throw new BadRequestException('Invalid authorization code');\n      }\n      if (authCode.expires_at < Date.now()) {\n        await this.store.removeAuthCode(code);\n        this.logger.error(\n          'handleAuthorizationCodeGrant - Authorization code expired:',\n          code,\n        );\n        throw new BadRequestException('Authorization code has expired');\n      }\n      if (authCode.client_id !== clientCredentials.client_id) {\n        this.logger.error(\n          'handleAuthorizationCodeGrant - Client ID mismatch:',\n          { expected: authCode.client_id, got: clientCredentials.client_id },\n        );\n        throw new BadRequestException('Client ID mismatch');\n      }\n\n      // Get client and validate authentication\n      const client = await this.clientService.getClient(\n        clientCredentials.client_id,\n      );\n      this.validateClientAuthentication(client, clientCredentials);\n      if (authCode.code_challenge) {\n        const isValid = this.validatePKCE(\n          code_verifier,\n          authCode.code_challenge,\n          authCode.code_challenge_method,\n        );\n        if (!isValid) {\n          this.logger.error(\n            'handleAuthorizationCodeGrant - Invalid PKCE verification',\n          );\n          throw new BadRequestException('Invalid PKCE verification');\n        }\n      }\n      if (!authCode.resource) {\n        this.logger.error(\n          'handleAuthorizationCodeGrant - No resource associated with code',\n        );\n        throw new BadRequestException(\n          'Authorization code is not associated with a resource',\n        );\n      }\n\n      let userData: any | undefined = undefined;\n      if (authCode.user_profile_id) {\n        try {\n          const profile = await this.store.getUserProfileById(\n            authCode.user_profile_id,\n          );\n          if (profile) {\n            // Avoid circular/large raw payloads if present\n            userData = { ...profile };\n          }\n        } catch (e) {\n          this.logger.warn('Failed to load user profile for token payload', e);\n        }\n      }\n\n      const tokens = this.jwtTokenService.generateTokenPair(\n        authCode.user_id,\n        clientCredentials.client_id,\n        authCode.scope,\n        authCode.resource,\n        {\n          user_profile_id: authCode.user_profile_id,\n          user_data: userData,\n        },\n      );\n      await this.store.removeAuthCode(code);\n      this.logger.log(\n        'handleAuthorizationCodeGrant - Token pair generated for user:',\n        authCode.user_id,\n      );\n      return tokens;\n    }\n\n    async handleRefreshTokenGrant(\n      refresh_token: string,\n      clientCredentials: { client_id: string; client_secret?: string },\n    ): Promise<TokenPair> {\n      // Verify the refresh token first to get client_id from token if not provided\n      const payload = this.jwtTokenService.validateToken(refresh_token);\n      if (!payload || payload.type !== 'refresh') {\n        throw new BadRequestException('Invalid or expired refresh token');\n      }\n\n      // Use client_id from token if not provided in credentials\n      const clientId = clientCredentials.client_id || payload.client_id;\n      if (!clientId) {\n        throw new BadRequestException('Unable to determine client_id');\n      }\n\n      // Get client and validate authentication\n      const client = await this.clientService.getClient(clientId);\n\n      // For refresh token grants, we can be more lenient with client authentication\n      // if the token already contains the client_id and the client is public\n      if (client?.token_endpoint_auth_method !== 'none') {\n        this.validateClientAuthentication(client, {\n          ...clientCredentials,\n          client_id: clientId,\n        });\n      }\n\n      // Verify the refresh token belongs to the client\n      if (payload.client_id !== clientId) {\n        throw new BadRequestException(\n          'Invalid refresh token or token does not belong to this client',\n        );\n      }\n\n      let newTokens: TokenPair | null = null;\n      try {\n        const payload = this.jwtTokenService.validateToken(refresh_token);\n        if (!payload || payload.type !== 'refresh') {\n          throw new BadRequestException('Invalid or expired refresh token');\n        }\n\n        let userData: any | undefined = undefined;\n        if (payload.user_profile_id) {\n          try {\n            const profile = await this.store.getUserProfileById(\n              payload.user_profile_id,\n            );\n            if (profile) userData = { ...profile };\n          } catch (e) {\n            this.logger.warn(\n              'Failed to load user profile for refreshed token payload',\n              e,\n            );\n          }\n        }\n\n        newTokens = this.jwtTokenService.generateTokenPair(\n          payload.sub,\n          clientId,\n          payload.scope,\n          payload.resource,\n          {\n            user_profile_id: payload.user_profile_id,\n            user_data: userData,\n          },\n        );\n      } catch (e) {\n        this.logger.warn(\n          'Refresh flow failed using enriched path, fallback',\n          e,\n        );\n        newTokens = this.jwtTokenService.refreshAccessToken(refresh_token);\n      }\n\n      if (!newTokens) throw new BadRequestException('Failed to refresh token');\n      return newTokens;\n    }\n\n    validatePKCE(\n      code_verifier: string,\n      code_challenge: string,\n      method: string,\n    ): boolean {\n      if (method === 'plain') {\n        return code_verifier === code_challenge;\n      } else if (method === 'S256') {\n        const hash = createHash('sha256')\n          .update(code_verifier)\n          .digest('base64url');\n        return hash === code_challenge;\n      }\n      return false;\n    }\n  }\n\n  return McpOAuthController;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rekog/mcp-nest",
-  "version": "1.7.4-alpha.13",
+  "version": "1.7.4-alpha.14",
   "description": "NestJS module for creating Model Context Protocol (MCP) servers",
   "main": "dist/index.js",
   "license": "MIT",

package/src/authz/mcp-oauth.controller.ts

@@ -36,6 +36,12 @@ interface OAuthCallbackRequest extends ExpressRequest {
   };
 }
 
+// Add this interface to properly type the Express request with raw body
+interface RequestWithRawBody extends ExpressRequest {
+  rawBody?: Buffer;
+  textBody?: string;
+}
+
 export function createMcpOAuthController(
   endpoints: OAuthEndpointConfiguration = {},
   options?: {
@@ -64,12 +70,14 @@ export function createMcpOAuthController(
         )
       : ((() => {}) as unknown as MethodDecorator);
   };
+
   @Controller()
   class McpOAuthController {
     readonly logger = new Logger(McpOAuthController.name);
     readonly serverUrl: string;
     readonly isProduction: boolean;
     readonly options: OAuthModuleOptions;
+
     constructor(
       @Inject('OAUTH_MODULE_OPTIONS') options: OAuthModuleOptions,
       @Inject('IOAuthStore') readonly store: IOAuthStore,
@@ -81,6 +89,96 @@ export function createMcpOAuthController(
       this.options = options;
     }
 
+    /**
+     * Utility function to parse form-encoded or JSON bodies
+     * Handles both string (raw form data) and object bodies
+     */
+    parseRequestBody(body: any, req?: RequestWithRawBody): Record<string, any> {
+      // If body is already a parsed object with properties, return it
+      if (body && typeof body === 'object' && Object.keys(body).length > 0) {
+        return body;
+      }
+
+      // If body is a string (raw form data), parse it
+      if (typeof body === 'string' && body.length > 0) {
+        const params = new URLSearchParams(body);
+        const parsedBody: Record<string, any> = {};
+        for (const [key, value] of params.entries()) {
+          parsedBody[key] = value;
+        }
+        return parsedBody;
+      }
+
+      // Check if we have a text body stored on the request (from our middleware)
+      if (req?.textBody) {
+        const params = new URLSearchParams(req.textBody);
+        const parsedBody: Record<string, any> = {};
+        for (const [key, value] of params.entries()) {
+          parsedBody[key] = value;
+        }
+        return parsedBody;
+      }
+
+      // Check if we have a raw body buffer stored on the request
+      if (req?.rawBody) {
+        const bodyString = req.rawBody.toString('utf-8');
+        if (bodyString) {
+          const params = new URLSearchParams(bodyString);
+          const parsedBody: Record<string, any> = {};
+          for (const [key, value] of params.entries()) {
+            parsedBody[key] = value;
+          }
+          return parsedBody;
+        }
+      }
+
+      // Return empty object if no valid body
+      return {};
+    }
+
+    /**
+     * Middleware to capture raw body for form-encoded requests
+     * This is needed when bodyParser is disabled in the main app
+     */
+    async captureRawBody(
+      req: RequestWithRawBody,
+      res: Response,
+      next: NextFunction,
+    ) {
+      if (
+        req.headers['content-type']?.includes(
+          'application/x-www-form-urlencoded',
+        )
+      ) {
+        let rawBody = '';
+
+        req.on('data', (chunk: Buffer) => {
+          rawBody += chunk.toString('utf-8');
+        });
+
+        req.on('end', () => {
+          req.textBody = rawBody;
+          // Also parse and set it as body for NestJS
+          if (rawBody) {
+            const params = new URLSearchParams(rawBody);
+            const parsedBody: any = {};
+            for (const [key, value] of params.entries()) {
+              parsedBody[key] = value;
+            }
+            (req as any).body = parsedBody;
+          }
+          next();
+        });
+
+        req.on('error', (err) => {
+          this.logger.error('Error reading request body:', err);
+          next(err);
+        });
+      } else {
+        next();
+      }
+    }
+
     @OptionalGet(
       endpoints.wellKnownProtectedResourceMetadata,
       !options?.disableWellKnownProtectedResourceMetadata,
@@ -377,22 +475,55 @@ export function createMcpOAuthController(
     @HttpCode(200)
     async exchangeToken(
       @Body() body: any,
-      @Req() req: any,
+      @Req() req: RequestWithRawBody,
+      @Res() res: Response,
+      @Next() next: NextFunction,
     ): Promise<TokenPair> {
-      // Parse the body to handle both JSON and form-encoded data
-      const parsedBody = this.parseRequestBody(body);
+      // Apply middleware to capture raw body if needed
+      if (
+        req.headers['content-type']?.includes(
+          'application/x-www-form-urlencoded',
+        ) &&
+        (!body || Object.keys(body).length === 0)
+      ) {
+        return new Promise((resolve, reject) => {
+          this.captureRawBody(req, res, async (err?: any) => {
+            if (err) {
+              reject(err);
+              return;
+            }
+
+            try {
+              // Re-parse the body after middleware has captured it
+              const parsedBody = this.parseRequestBody(req.body || body, req);
+              const result = await this.processTokenExchange(parsedBody, req);
+              resolve(result);
+            } catch (error) {
+              reject(error);
+            }
+          });
+        });
+      }
 
+      // Body is already parsed, process directly
+      const parsedBody = this.parseRequestBody(body, req);
+      return this.processTokenExchange(parsedBody, req);
+    }
+
+    async processTokenExchange(
+      parsedBody: Record<string, any>,
+      req: RequestWithRawBody,
+    ): Promise<TokenPair> {
       const { grant_type, code, code_verifier, redirect_uri, refresh_token } =
         parsedBody;
 
       // Add debugging to help identify issues
       if (!grant_type) {
         this.logger.error('Missing grant_type in request body:', {
-          bodyType: typeof body,
-          bodyKeys: Object.keys(body || {}),
           parsedBodyKeys: Object.keys(parsedBody),
           contentType: req.headers['content-type'],
-          rawBody: body,
+          textBody: req.textBody,
+          parsedBody,
         });
         throw new BadRequestException('Missing grant_type parameter');
       }
@@ -436,11 +567,11 @@ export function createMcpOAuthController(
      * Extract client credentials from request based on authentication method
      */
     extractClientCredentials(
-      req: any,
+      req: RequestWithRawBody,
       body: any,
     ): { client_id: string; client_secret?: string } {
       // Parse the body using the shared utility function
-      const parsedBody = this.parseRequestBody(body);
+      const parsedBody = this.parseRequestBody(body, req);
 
       // Try client_secret_basic first (Authorization header)
       const authHeader = req.headers?.authorization;
@@ -697,30 +828,6 @@ export function createMcpOAuthController(
       }
       return false;
     }
-
-    /**
-     * Utility function to parse form-encoded or JSON bodies
-     * Handles both string (raw form data) and object bodies
-     */
-    parseRequestBody(body: any): Record<string, any> {
-      // If body is already a parsed object with properties, return it
-      if (body && typeof body === 'object' && Object.keys(body).length > 0) {
-        return body;
-      }
-
-      // If body is a string (raw form data), parse it
-      if (typeof body === 'string' && body.length > 0) {
-        const params = new URLSearchParams(body);
-        const parsedBody: Record<string, any> = {};
-        for (const [key, value] of params.entries()) {
-          parsedBody[key] = value;
-        }
-        return parsedBody;
-      }
-
-      // Return empty object if no valid body
-      return {};
-    }
   }
 
   return McpOAuthController;