@rekog/mcp-nest 1.9.1 → 1.9.3-alpha.0

package/dist/authz/guards/jwt-auth.guard.d.ts

@@ -2,8 +2,8 @@ import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { ModuleRef } from '@nestjs/core';
 import { Request } from 'express';
 import { JwtPayload, JwtTokenService } from '../services/jwt-token.service';
-import { IOAuthStore } from '../stores/oauth-store.interface';
-import { McpOptions } from '../../mcp';
+import type { IOAuthStore } from '../stores/oauth-store.interface';
+import type { McpOptions } from '../../mcp';
 export interface AuthenticatedRequest extends Request {
     user: JwtPayload;
 }

package/dist/authz/guards/jwt-auth.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-auth.guard.d.ts","sourceRoot":"","sources":["../../../src/authz/guards/jwt-auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAIjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,qBACa,eAAgB,YAAW,WAAW;IAEnC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAG5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAPI,eAAe,EAAE,eAAe,GAAG,IAAI,EAGnD,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,SAAS,EAAE,SAAS,EAGpB,OAAO,CAAC,EAAE,UAAU,YAAA;IAGjC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAsF9D,OAAO,CAAC,sBAAsB;CAS/B"}
+{"version":3,"file":"jwt-auth.guard.d.ts","sourceRoot":"","sources":["../../../src/authz/guards/jwt-auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAIjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,qBACa,eAAgB,YAAW,WAAW;IAEnC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAG5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAPI,eAAe,EAAE,eAAe,GAAG,IAAI,EAGnD,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,SAAS,EAAE,SAAS,EAGpB,OAAO,CAAC,EAAE,UAAU,YAAA;IAGjC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAsF9D,OAAO,CAAC,sBAAsB;CAS/B"}

package/dist/authz/guards/jwt-auth.guard.js

@@ -0,0 +1,108 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpAuthJwtGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const jwt_token_service_1 = require("../services/jwt-token.service");
+let McpAuthJwtGuard = class McpAuthJwtGuard {
+    constructor(jwtTokenService, store, moduleRef, options) {
+        this.jwtTokenService = jwtTokenService;
+        this.store = store;
+        this.moduleRef = moduleRef;
+        this.options = options;
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const token = this.extractTokenFromHeader(request);
+        const allowUnauthenticated = this.options?.allowUnauthenticatedAccess ?? false;
+        if (!token) {
+            if (allowUnauthenticated) {
+                return true;
+            }
+            else {
+                throw new common_1.UnauthorizedException('Access token required');
+            }
+        }
+        const jwtTokenService = this.jwtTokenService ||
+            this.moduleRef.get(jwt_token_service_1.JwtTokenService, { strict: false });
+        const store = this.store ||
+            this.moduleRef.get('IOAuthStore', { strict: false });
+        if (!jwtTokenService || !store) {
+            throw new common_1.UnauthorizedException('Authentication service not available');
+        }
+        const payload = jwtTokenService.validateToken(token);
+        if (!payload) {
+            throw new common_1.UnauthorizedException('Invalid or expired access token');
+        }
+        const enriched = { ...payload };
+        try {
+            if (!enriched.user_data && enriched.user_profile_id) {
+                const profile = await store.getUserProfileById(enriched.user_profile_id);
+                if (profile) {
+                    enriched.user_data = profile;
+                }
+            }
+            const ud = enriched.user_data || {};
+            enriched.username =
+                enriched.username || ud.username || ud.id || enriched.sub;
+            enriched.email = enriched.email || ud.email;
+            enriched.displayName = enriched.displayName || ud.displayName;
+            enriched.avatarUrl = enriched.avatarUrl || ud.avatarUrl;
+            enriched.name =
+                enriched.name ||
+                    ud.displayName ||
+                    ud.username ||
+                    ud.email ||
+                    enriched.sub;
+            if (enriched.scope && typeof enriched.scope === 'string') {
+                enriched.scopes = enriched.scope
+                    .split(' ')
+                    .filter((s) => s.length > 0);
+            }
+            else if (!enriched.scopes) {
+                enriched.scopes = [];
+            }
+            if (!enriched.roles && ud.roles && Array.isArray(ud.roles)) {
+                enriched.roles = ud.roles;
+            }
+            else if (!enriched.roles) {
+                enriched.roles = [];
+            }
+        }
+        catch {
+        }
+        request.user = enriched;
+        return true;
+    }
+    extractTokenFromHeader(request) {
+        const authHeader = request.headers.authorization;
+        if (!authHeader) {
+            return undefined;
+        }
+        const [type, token] = authHeader.split(' ');
+        return type === 'Bearer' ? token : undefined;
+    }
+};
+exports.McpAuthJwtGuard = McpAuthJwtGuard;
+exports.McpAuthJwtGuard = McpAuthJwtGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __param(1, (0, common_1.Optional)()),
+    __param(1, (0, common_1.Inject)('IOAuthStore')),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)('MCP_OPTIONS')),
+    __metadata("design:paramtypes", [Object, Object, core_1.ModuleRef, Object])
+], McpAuthJwtGuard);
+//# sourceMappingURL=jwt-auth.guard.js.map

package/dist/authz/guards/jwt-auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../src/authz/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AAEzC,qEAA4E;AASrE,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YAC+B,eAAuC,EAGnD,KAAyB,EACzB,SAAoB,EAGpB,OAAoB;QAPR,oBAAe,GAAf,eAAe,CAAwB;QAGnD,UAAK,GAAL,KAAK,CAAoB;QACzB,cAAS,GAAT,SAAS,CAAW;QAGpB,YAAO,GAAP,OAAO,CAAa;IACpC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAwB,CAAC;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAGnD,MAAM,oBAAoB,GACxB,IAAI,CAAC,OAAO,EAAE,0BAA0B,IAAI,KAAK,CAAC;QAEpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,oBAAoB,EAAE,CAAC;gBAGzB,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBAEN,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAGD,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe;YACpB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,mCAAe,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,GACT,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,SAAS,CAAC,GAAG,CAAc,aAAa,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;QAC1E,CAAC;QAGD,MAAM,OAAO,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAGD,MAAM,QAAQ,GAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBACpD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAC5C,QAAQ,CAAC,eAAe,CACzB,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC;gBAC/B,CAAC;YACH,CAAC;YACD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;YAEpC,QAAQ,CAAC,QAAQ;gBACf,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC;YAC5D,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC;YAC5C,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,WAAW,CAAC;YAC9D,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC;YACxD,QAAQ,CAAC,IAAI;gBACX,QAAQ,CAAC,IAAI;oBACb,EAAE,CAAC,WAAW;oBACd,EAAE,CAAC,QAAQ;oBACX,EAAE,CAAC,KAAK;oBACR,QAAQ,CAAC,GAAG,CAAC;YAGf,IAAI,QAAQ,CAAC,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACzD,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,KAAK;qBAC7B,KAAK,CAAC,GAAG,CAAC;qBACV,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC5B,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;YACvB,CAAC;YAGD,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;YAC5B,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;QAED,OAAO,CAAC,IAAI,GAAG,QAAsB,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,OAAgB;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AA3GY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,aAAa,CAAC,CAAA;IAGrB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,aAAa,CAAC,CAAA;qDAFM,gBAAS;GAN5B,eAAe,CA2G3B","sourcesContent":["import {\n  Injectable,\n  CanActivate,\n  ExecutionContext,\n  UnauthorizedException,\n  Inject,\n  Optional,\n} from '@nestjs/common';\nimport { ModuleRef } from '@nestjs/core';\nimport { Request } from 'express';\nimport { JwtPayload, JwtTokenService } from '../services/jwt-token.service';\nimport type { IOAuthStore } from '../stores/oauth-store.interface';\nimport type { McpOptions } from '../../mcp';\n\nexport interface AuthenticatedRequest extends Request {\n  user: JwtPayload;\n}\n\n@Injectable()\nexport class McpAuthJwtGuard implements CanActivate {\n  constructor(\n    @Optional() private readonly jwtTokenService: JwtTokenService | null,\n    @Optional()\n    @Inject('IOAuthStore')\n    private readonly store: IOAuthStore | null,\n    private readonly moduleRef: ModuleRef,\n    @Optional()\n    @Inject('MCP_OPTIONS')\n    private readonly options?: McpOptions,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();\n    const token = this.extractTokenFromHeader(request);\n\n    // Check if unauthenticated access is allowed\n    const allowUnauthenticated =\n      this.options?.allowUnauthenticatedAccess ?? false;\n\n    if (!token) {\n      if (allowUnauthenticated) {\n        // Allow unauthenticated sessions\n        // Per-tool authorization will decide what's accessible (@PublicTool() tools only)\n        return true;\n      } else {\n        // Standard OAuth flow: Reject and trigger authorization\n        throw new UnauthorizedException('Access token required');\n      }\n    }\n\n    // Resolve services dynamically if not injected directly\n    const jwtTokenService =\n      this.jwtTokenService ||\n      this.moduleRef.get(JwtTokenService, { strict: false });\n    const store =\n      this.store ||\n      this.moduleRef.get<IOAuthStore>('IOAuthStore', { strict: false });\n\n    if (!jwtTokenService || !store) {\n      throw new UnauthorizedException('Authentication service not available');\n    }\n\n    // If a token is provided, it must be valid\n    const payload = jwtTokenService.validateToken(token);\n\n    if (!payload) {\n      throw new UnauthorizedException('Invalid or expired access token');\n    }\n\n    // Enrich request.user with friendly fields for tools\n    const enriched: any = { ...payload };\n    try {\n      if (!enriched.user_data && enriched.user_profile_id) {\n        const profile = await store.getUserProfileById(\n          enriched.user_profile_id,\n        );\n        if (profile) {\n          enriched.user_data = profile;\n        }\n      }\n      const ud = enriched.user_data || {};\n      // Provide convenient top-level fields commonly used by tools\n      enriched.username =\n        enriched.username || ud.username || ud.id || enriched.sub;\n      enriched.email = enriched.email || ud.email;\n      enriched.displayName = enriched.displayName || ud.displayName;\n      enriched.avatarUrl = enriched.avatarUrl || ud.avatarUrl;\n      enriched.name =\n        enriched.name ||\n        ud.displayName ||\n        ud.username ||\n        ud.email ||\n        enriched.sub;\n\n      // Parse scopes: OAuth 2.0 standard is space-delimited string in 'scope' field\n      if (enriched.scope && typeof enriched.scope === 'string') {\n        enriched.scopes = enriched.scope\n          .split(' ')\n          .filter((s: string) => s.length > 0);\n      } else if (!enriched.scopes) {\n        enriched.scopes = [];\n      }\n\n      // Extract roles from user_data if present\n      if (!enriched.roles && ud.roles && Array.isArray(ud.roles)) {\n        enriched.roles = ud.roles;\n      } else if (!enriched.roles) {\n        enriched.roles = [];\n      }\n    } catch {\n      // Non-fatal; proceed with raw payload\n    }\n\n    request.user = enriched as JwtPayload;\n    return true;\n  }\n\n  private extractTokenFromHeader(request: Request): string | undefined {\n    const authHeader = request.headers.authorization;\n    if (!authHeader) {\n      return undefined;\n    }\n\n    const [type, token] = authHeader.split(' ');\n    return type === 'Bearer' ? token : undefined;\n  }\n}\n"]}

package/dist/authz/index.js

@@ -0,0 +1,27 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./mcp-oauth.controller"), exports);
+__exportStar(require("./mcp-oauth.module"), exports);
+__exportStar(require("./providers/oauth-provider.interface"), exports);
+__exportStar(require("./providers/google.provider"), exports);
+__exportStar(require("./providers/github.provider"), exports);
+__exportStar(require("./providers/azure-ad.provider"), exports);
+__exportStar(require("./stores/oauth-store.interface"), exports);
+__exportStar(require("./stores/memory-store.service"), exports);
+__exportStar(require("./interfaces/request-with-user"), exports);
+__exportStar(require("./guards/jwt-auth.guard"), exports);
+//# sourceMappingURL=index.js.map

package/dist/authz/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,qDAAmC;AACnC,uEAAqD;AACrD,8DAA4C;AAC5C,8DAA4C;AAC5C,gEAA8C;AAC9C,iEAA+C;AAC/C,gEAA8C;AAC9C,iEAA+C;AAC/C,0DAAwC","sourcesContent":["export * from './mcp-oauth.controller';\nexport * from './mcp-oauth.module';\nexport * from './providers/oauth-provider.interface';\nexport * from './providers/google.provider';\nexport * from './providers/github.provider';\nexport * from './providers/azure-ad.provider';\nexport * from './stores/oauth-store.interface';\nexport * from './stores/memory-store.service';\nexport * from './interfaces/request-with-user';\nexport * from './guards/jwt-auth.guard';\n"]}

package/dist/authz/interfaces/oauth-common.interface.d.ts

@@ -0,0 +1,21 @@
+export interface OAuthUserProfile {
+    id: string;
+    username: string;
+    email?: string;
+    displayName?: string;
+    avatarUrl?: string;
+    raw?: any;
+}
+export interface OAuthSession {
+    sessionId: string;
+    state: string;
+    clientId?: string;
+    redirectUri?: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: string;
+    oauthState?: string;
+    scope?: string;
+    resource?: string;
+    expiresAt: number;
+}
+//# sourceMappingURL=oauth-common.interface.d.ts.map

package/dist/authz/interfaces/oauth-common.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-common.interface.d.ts","sourceRoot":"","sources":["../../../src/authz/interfaces/oauth-common.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/authz/interfaces/oauth-common.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=oauth-common.interface.js.map

package/dist/authz/interfaces/oauth-common.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-common.interface.js","sourceRoot":"","sources":["../../../src/authz/interfaces/oauth-common.interface.ts"],"names":[],"mappings":"","sourcesContent":["export interface OAuthUserProfile {\n  id: string;\n  username: string;\n  email?: string;\n  displayName?: string;\n  avatarUrl?: string;\n  raw?: any; // Original profile data\n}\n\nexport interface OAuthSession {\n  sessionId: string;\n  state: string;\n  clientId?: string;\n  redirectUri?: string;\n  codeChallenge?: string;\n  codeChallengeMethod?: string;\n  oauthState?: string;\n  scope?: string;\n  resource?: string;\n  expiresAt: number;\n}\n"]}

package/dist/authz/interfaces/request-with-user.d.ts

@@ -0,0 +1,13 @@
+import type { Request } from 'express';
+import type { JwtPayload } from '../services/jwt-token.service';
+export type McpUserPayload = JwtPayload & {
+    name?: string;
+    username?: string;
+    email?: string;
+    displayName?: string;
+    avatarUrl?: string;
+};
+export type McpRequestWithUser = Request & {
+    user: McpUserPayload;
+};
+//# sourceMappingURL=request-with-user.d.ts.map

package/dist/authz/interfaces/request-with-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-with-user.d.ts","sourceRoot":"","sources":["../../../src/authz/interfaces/request-with-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAGhE,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAGF,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG;IACzC,IAAI,EAAE,cAAc,CAAC;CACtB,CAAC"}

package/dist/authz/interfaces/request-with-user.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=request-with-user.js.map

package/dist/authz/interfaces/request-with-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-with-user.js","sourceRoot":"","sources":["../../../src/authz/interfaces/request-with-user.ts"],"names":[],"mappings":"","sourcesContent":["import type { Request } from 'express';\nimport type { JwtPayload } from '../services/jwt-token.service';\n\n// Enriched user payload placed on request.user by McpAuthJwtGuard\nexport type McpUserPayload = JwtPayload & {\n  name?: string;\n  username?: string;\n  email?: string;\n  displayName?: string;\n  avatarUrl?: string;\n};\n\n// Express Request with enriched user information\nexport type McpRequestWithUser = Request & {\n  user: McpUserPayload;\n};\n"]}

package/dist/authz/mcp-oauth.controller.d.ts

@@ -0,0 +1,81 @@
+import { Logger } from '@nestjs/common';
+import type { Request as ExpressRequest, NextFunction, Response } from 'express';
+import type { OAuthEndpointConfiguration, OAuthModuleOptions, OAuthUserProfile } from './providers/oauth-provider.interface';
+import { ClientService } from './services/client.service';
+import { JwtTokenService, TokenPair } from './services/jwt-token.service';
+import { OAuthStrategyService } from './services/oauth-strategy.service';
+import type { IOAuthStore } from './stores/oauth-store.interface';
+interface OAuthCallbackRequest extends ExpressRequest {
+    user?: {
+        profile: OAuthUserProfile;
+        accessToken: string;
+        provider: string;
+    };
+}
+interface RequestWithRawBody extends ExpressRequest {
+    rawBody?: Buffer;
+    textBody?: string;
+}
+export declare function createMcpOAuthController(endpoints?: OAuthEndpointConfiguration, options?: {
+    disableWellKnownProtectedResourceMetadata?: boolean;
+    disableWellKnownAuthorizationServerMetadata?: boolean;
+}, authModuleId?: string): {
+    new (options: OAuthModuleOptions, store: IOAuthStore, jwtTokenService: JwtTokenService, clientService: ClientService, oauthStrategyService: OAuthStrategyService): {
+        readonly logger: Logger;
+        readonly serverUrl: string;
+        readonly isProduction: boolean;
+        readonly options: OAuthModuleOptions;
+        readonly strategyName: string;
+        readonly store: IOAuthStore;
+        readonly jwtTokenService: JwtTokenService;
+        readonly clientService: ClientService;
+        readonly oauthStrategyService: OAuthStrategyService;
+        parseRequestBody(body: any, req?: RequestWithRawBody): Record<string, any>;
+        captureRawBody(req: RequestWithRawBody, res: Response, next: NextFunction): void;
+        getProtectedResourceMetadata(): {
+            authorization_servers: string[];
+            resource: string;
+            scopes_supported: string[];
+            bearer_methods_supported: string[];
+            mcp_versions_supported: string[];
+        };
+        getAuthorizationServerMetadata(): {
+            issuer: string;
+            authorization_endpoint: string;
+            token_endpoint: string;
+            registration_endpoint: string;
+            response_types_supported: string[];
+            response_modes_supported: string[];
+            grant_types_supported: string[];
+            token_endpoint_auth_methods_supported: string[];
+            scopes_supported: string[];
+            revocation_endpoint: string;
+            code_challenge_methods_supported: string[];
+        };
+        registerClient(registrationDto: any): Promise<import("./stores/oauth-store.interface").OAuthClient>;
+        authorize(query: any, req: any, res: Response, next: NextFunction): Promise<void>;
+        handleProviderCallback(req: OAuthCallbackRequest, res: Response, next: NextFunction): void;
+        processAuthenticationSuccess(req: OAuthCallbackRequest, res: Response): Promise<void>;
+        exchangeToken(body: any, req: RequestWithRawBody, res: Response): Promise<TokenPair>;
+        processTokenExchange(parsedBody: Record<string, any>, req: RequestWithRawBody): Promise<TokenPair>;
+        extractClientCredentials(req: RequestWithRawBody, body: any): {
+            client_id: string;
+            client_secret?: string;
+        };
+        validateClientAuthentication(client: any, clientCredentials: {
+            client_id: string;
+            client_secret?: string;
+        }): void;
+        handleAuthorizationCodeGrant(code: string, code_verifier: string, _redirect_uri: string, clientCredentials: {
+            client_id: string;
+            client_secret?: string;
+        }): Promise<TokenPair>;
+        handleRefreshTokenGrant(refresh_token: string, clientCredentials: {
+            client_id: string;
+            client_secret?: string;
+        }): Promise<TokenPair>;
+        validatePKCE(code_verifier: string, code_challenge: string, method: string): boolean;
+    };
+};
+export {};
+//# sourceMappingURL=mcp-oauth.controller.d.ts.map

package/dist/authz/mcp-oauth.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.controller.d.ts","sourceRoot":"","sources":["../../src/authz/mcp-oauth.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,MAAM,EAMP,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EACV,OAAO,IAAI,cAAc,EACzB,YAAY,EACZ,QAAQ,EACT,MAAM,SAAS,CAAC;AAGjB,OAAO,KAAK,EACV,0BAA0B,EAC1B,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAElE,UAAU,oBAAqB,SAAQ,cAAc;IACnD,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,gBAAgB,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAGD,UAAU,kBAAmB,SAAQ,cAAc;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,wBAAwB,CACtC,SAAS,GAAE,0BAA+B,EAC1C,OAAO,CAAC,EAAE;IACR,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,2CAA2C,CAAC,EAAE,OAAO,CAAC;CACvD,EACD,YAAY,CAAC,EAAE,MAAM;kBAsCR,kBAAkB,SAEX,WAAW,mBACD,eAAe,iBACjB,aAAa,wBACN,oBAAoB;;4BAhBjC,MAAM;+BACH,OAAO;0BACZ,kBAAkB;+BACb,MAAM;wBAUX,WAAW;kCACD,eAAe;gCACjB,aAAa;uCACN,oBAAoB;+BAY9B,GAAG,QAAQ,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;4BA+CtD,kBAAkB,OAAO,QAAQ,QAAQ,YAAY;;;;;;;;;;;;;;;;;;;;;wCAoI3B,GAAG;yBAM/B,GAAG,OAEd,GAAG,OACI,QAAQ,QACN,YAAY;oCA2Ed,oBAAoB,OACpB,QAAQ,QACN,YAAY;0CA2BrB,oBAAoB,OACpB,QAAQ;4BAkFC,GAAG,OACL,kBAAkB,OACG,QAAQ,GACxC,OAAO,CAAC,SAAS,CAAC;yCA6CP,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,OAC1B,kBAAkB,GACtB,OAAO,CAAC,SAAS,CAAC;sCA4Dd,kBAAkB,QACjB,GAAG,GACR;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE;6CA+BtC,GAAG,qBACQ;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,IAAI;2CAqCC,MAAM,iBACG,MAAM,iBACN,MAAM,qBACF;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,OAAO,CAAC,SAAS,CAAC;+CA4FJ,MAAM,qBACF;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,OAAO,CAAC,SAAS,CAAC;oCA6EJ,MAAM,kBACL,MAAM,UACd,MAAM,GACb,OAAO;;EAcb"}