@rekog/mcp-nest 1.9.10 → 2.0.0-alpha.0

package/src/mcp/utils/mcp-logger.factory.spec.ts

@@ -1,6 +1,6 @@
 import { Logger } from '@nestjs/common';
 import { createMcpLogger } from './mcp-logger.factory';
-import type { McpOptions } from '../interfaces';
+import type { McpLoggingOptions } from './mcp-logger.factory';
 
 describe('McpLoggerFactory', () => {
   describe('createMcpLogger', () => {
@@ -10,9 +10,7 @@ describe('McpLoggerFactory', () => {
     });
 
     it('should create standard logger when logging is undefined', () => {
-      const options: McpOptions = {
-        name: 'test',
-        version: '1.0.0',
+      const options: McpLoggingOptions = {
         // logging is undefined
       };
       const logger = createMcpLogger('TestContext', options);
@@ -20,9 +18,7 @@ describe('McpLoggerFactory', () => {
     });
 
     it('should create no-op logger when logging is false', () => {
-      const options: McpOptions = {
-        name: 'test',
-        version: '1.0.0',
+      const options: McpLoggingOptions = {
         logging: false,
       };
       const logger = createMcpLogger('TestContext', options);
@@ -39,9 +35,7 @@ describe('McpLoggerFactory', () => {
     });
 
     it('should create filtered logger with specified levels', () => {
-      const options: McpOptions = {
-        name: 'test',
-        version: '1.0.0',
+      const options: McpLoggingOptions = {
         logging: {
           level: ['error', 'warn'],
         },
@@ -60,9 +54,7 @@ describe('McpLoggerFactory', () => {
     });
 
     it('should create logger with all log levels when specified', () => {
-      const options: McpOptions = {
-        name: 'test',
-        version: '1.0.0',
+      const options: McpLoggingOptions = {
         logging: {
           level: ['log', 'error', 'warn', 'debug', 'verbose'],
         },
@@ -72,9 +64,7 @@ describe('McpLoggerFactory', () => {
     });
 
     it('should handle empty level array gracefully', () => {
-      const options: McpOptions = {
-        name: 'test',
-        version: '1.0.0',
+      const options: McpLoggingOptions = {
         logging: {
           level: [],
         },
@@ -95,9 +85,7 @@ describe('McpLoggerFactory', () => {
 
   describe('FilteredLogger behavior', () => {
     it('should only call parent logger methods for enabled levels', () => {
-      const options: McpOptions = {
-        name: 'test',
-        version: '1.0.0',
+      const options: McpLoggingOptions = {
         logging: {
           level: ['error', 'warn'],
         },
@@ -141,9 +129,7 @@ describe('McpLoggerFactory', () => {
 
   describe('NoOpLogger behavior', () => {
     it('should not call parent logger methods when logging is disabled', () => {
-      const options: McpOptions = {
-        name: 'test',
-        version: '1.0.0',
+      const options: McpLoggingOptions = {
         logging: false,
       };
 

package/src/mcp/utils/mcp-logger.factory.ts

@@ -1,5 +1,16 @@
 import { Logger, LogLevel } from '@nestjs/common';
-import type { McpOptions } from '../interfaces';
+
+/**
+ * The subset of server options the logger factory cares about. Matches the
+ * `logging` field on {@link McpServerOptions}.
+ */
+export interface McpLoggingOptions {
+  logging?:
+    | false
+    | {
+        level: ('log' | 'error' | 'warn' | 'debug' | 'verbose')[];
+      };
+}
 
 /**
  * Logger that filters log messages based on configured log levels
@@ -85,7 +96,7 @@ class NoOpLogger extends Logger {
  */
 export function createMcpLogger(
   context: string,
-  options: McpOptions | undefined,
+  options: McpLoggingOptions | undefined,
 ): Logger {
   // If no options provided or logging not configured, use standard logger
   if (!options || options.logging === undefined) {

package/dist/authz/guards/jwt-auth.guard.d.ts

@@ -1,19 +0,0 @@
-import { CanActivate, ExecutionContext } from '@nestjs/common';
-import { ModuleRef } from '@nestjs/core';
-import { Request } from 'express';
-import { JwtPayload, JwtTokenService } from '../services/jwt-token.service';
-import type { IOAuthStore } from '../stores/oauth-store.interface';
-import type { McpOptions } from '../../mcp';
-export interface AuthenticatedRequest extends Request {
-    user: JwtPayload;
-}
-export declare class McpAuthJwtGuard implements CanActivate {
-    private readonly jwtTokenService;
-    private readonly store;
-    private readonly moduleRef;
-    private readonly options?;
-    constructor(jwtTokenService: JwtTokenService | null, store: IOAuthStore | null, moduleRef: ModuleRef, options?: McpOptions | undefined);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-    private extractTokenFromHeader;
-}
-//# sourceMappingURL=jwt-auth.guard.d.ts.map

package/dist/authz/guards/jwt-auth.guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt-auth.guard.d.ts","sourceRoot":"","sources":["../../../src/authz/guards/jwt-auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAIjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,qBACa,eAAgB,YAAW,WAAW;IAEnC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAG5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAPI,eAAe,EAAE,eAAe,GAAG,IAAI,EAGnD,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,SAAS,EAAE,SAAS,EAGpB,OAAO,CAAC,EAAE,UAAU,YAAA;IAGjC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAsF9D,OAAO,CAAC,sBAAsB;CAS/B"}

package/dist/authz/guards/jwt-auth.guard.js

@@ -1,108 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpAuthJwtGuard = void 0;
-const common_1 = require("@nestjs/common");
-const core_1 = require("@nestjs/core");
-const jwt_token_service_1 = require("../services/jwt-token.service");
-let McpAuthJwtGuard = class McpAuthJwtGuard {
-    constructor(jwtTokenService, store, moduleRef, options) {
-        this.jwtTokenService = jwtTokenService;
-        this.store = store;
-        this.moduleRef = moduleRef;
-        this.options = options;
-    }
-    async canActivate(context) {
-        const request = context.switchToHttp().getRequest();
-        const token = this.extractTokenFromHeader(request);
-        const allowUnauthenticated = this.options?.allowUnauthenticatedAccess ?? false;
-        if (!token) {
-            if (allowUnauthenticated) {
-                return true;
-            }
-            else {
-                throw new common_1.UnauthorizedException('Access token required');
-            }
-        }
-        const jwtTokenService = this.jwtTokenService ||
-            this.moduleRef.get(jwt_token_service_1.JwtTokenService, { strict: false });
-        const store = this.store ||
-            this.moduleRef.get('IOAuthStore', { strict: false });
-        if (!jwtTokenService || !store) {
-            throw new common_1.UnauthorizedException('Authentication service not available');
-        }
-        const payload = jwtTokenService.validateToken(token);
-        if (!payload) {
-            throw new common_1.UnauthorizedException('Invalid or expired access token');
-        }
-        const enriched = { ...payload };
-        try {
-            if (!enriched.user_data && enriched.user_profile_id) {
-                const profile = await store.getUserProfileById(enriched.user_profile_id);
-                if (profile) {
-                    enriched.user_data = profile;
-                }
-            }
-            const ud = enriched.user_data || {};
-            enriched.username =
-                enriched.username || ud.username || ud.id || enriched.sub;
-            enriched.email = enriched.email || ud.email;
-            enriched.displayName = enriched.displayName || ud.displayName;
-            enriched.avatarUrl = enriched.avatarUrl || ud.avatarUrl;
-            enriched.name =
-                enriched.name ||
-                    ud.displayName ||
-                    ud.username ||
-                    ud.email ||
-                    enriched.sub;
-            if (enriched.scope && typeof enriched.scope === 'string') {
-                enriched.scopes = enriched.scope
-                    .split(' ')
-                    .filter((s) => s.length > 0);
-            }
-            else if (!enriched.scopes) {
-                enriched.scopes = [];
-            }
-            if (!enriched.roles && ud.roles && Array.isArray(ud.roles)) {
-                enriched.roles = ud.roles;
-            }
-            else if (!enriched.roles) {
-                enriched.roles = [];
-            }
-        }
-        catch {
-        }
-        request.user = enriched;
-        return true;
-    }
-    extractTokenFromHeader(request) {
-        const authHeader = request.headers.authorization;
-        if (!authHeader) {
-            return undefined;
-        }
-        const [type, token] = authHeader.split(' ');
-        return type === 'Bearer' ? token : undefined;
-    }
-};
-exports.McpAuthJwtGuard = McpAuthJwtGuard;
-exports.McpAuthJwtGuard = McpAuthJwtGuard = __decorate([
-    (0, common_1.Injectable)(),
-    __param(0, (0, common_1.Optional)()),
-    __param(1, (0, common_1.Optional)()),
-    __param(1, (0, common_1.Inject)('IOAuthStore')),
-    __param(3, (0, common_1.Optional)()),
-    __param(3, (0, common_1.Inject)('MCP_OPTIONS')),
-    __metadata("design:paramtypes", [Object, Object, core_1.ModuleRef, Object])
-], McpAuthJwtGuard);
-//# sourceMappingURL=jwt-auth.guard.js.map

package/dist/authz/guards/jwt-auth.guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../src/authz/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AAEzC,qEAA4E;AASrE,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YAC+B,eAAuC,EAGnD,KAAyB,EACzB,SAAoB,EAGpB,OAAoB;QAPR,oBAAe,GAAf,eAAe,CAAwB;QAGnD,UAAK,GAAL,KAAK,CAAoB;QACzB,cAAS,GAAT,SAAS,CAAW;QAGpB,YAAO,GAAP,OAAO,CAAa;IACpC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAwB,CAAC;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAGnD,MAAM,oBAAoB,GACxB,IAAI,CAAC,OAAO,EAAE,0BAA0B,IAAI,KAAK,CAAC;QAEpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,oBAAoB,EAAE,CAAC;gBAGzB,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBAEN,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAGD,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe;YACpB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,mCAAe,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,GACT,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,SAAS,CAAC,GAAG,CAAc,aAAa,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;QAC1E,CAAC;QAGD,MAAM,OAAO,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAGD,MAAM,QAAQ,GAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBACpD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAC5C,QAAQ,CAAC,eAAe,CACzB,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC;gBAC/B,CAAC;YACH,CAAC;YACD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;YAEpC,QAAQ,CAAC,QAAQ;gBACf,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC;YAC5D,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC;YAC5C,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,WAAW,CAAC;YAC9D,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC;YACxD,QAAQ,CAAC,IAAI;gBACX,QAAQ,CAAC,IAAI;oBACb,EAAE,CAAC,WAAW;oBACd,EAAE,CAAC,QAAQ;oBACX,EAAE,CAAC,KAAK;oBACR,QAAQ,CAAC,GAAG,CAAC;YAGf,IAAI,QAAQ,CAAC,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACzD,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,KAAK;qBAC7B,KAAK,CAAC,GAAG,CAAC;qBACV,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC5B,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;YACvB,CAAC;YAGD,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;YAC5B,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;QAED,OAAO,CAAC,IAAI,GAAG,QAAsB,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,OAAgB;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AA3GY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,aAAa,CAAC,CAAA;IAGrB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,aAAa,CAAC,CAAA;qDAFM,gBAAS;GAN5B,eAAe,CA2G3B","sourcesContent":["import {\n  Injectable,\n  CanActivate,\n  ExecutionContext,\n  UnauthorizedException,\n  Inject,\n  Optional,\n} from '@nestjs/common';\nimport { ModuleRef } from '@nestjs/core';\nimport { Request } from 'express';\nimport { JwtPayload, JwtTokenService } from '../services/jwt-token.service';\nimport type { IOAuthStore } from '../stores/oauth-store.interface';\nimport type { McpOptions } from '../../mcp';\n\nexport interface AuthenticatedRequest extends Request {\n  user: JwtPayload;\n}\n\n@Injectable()\nexport class McpAuthJwtGuard implements CanActivate {\n  constructor(\n    @Optional() private readonly jwtTokenService: JwtTokenService | null,\n    @Optional()\n    @Inject('IOAuthStore')\n    private readonly store: IOAuthStore | null,\n    private readonly moduleRef: ModuleRef,\n    @Optional()\n    @Inject('MCP_OPTIONS')\n    private readonly options?: McpOptions,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();\n    const token = this.extractTokenFromHeader(request);\n\n    // Check if unauthenticated access is allowed\n    const allowUnauthenticated =\n      this.options?.allowUnauthenticatedAccess ?? false;\n\n    if (!token) {\n      if (allowUnauthenticated) {\n        // Allow unauthenticated sessions\n        // Per-tool authorization will decide what's accessible (@PublicTool() tools only)\n        return true;\n      } else {\n        // Standard OAuth flow: Reject and trigger authorization\n        throw new UnauthorizedException('Access token required');\n      }\n    }\n\n    // Resolve services dynamically if not injected directly\n    const jwtTokenService =\n      this.jwtTokenService ||\n      this.moduleRef.get(JwtTokenService, { strict: false });\n    const store =\n      this.store ||\n      this.moduleRef.get<IOAuthStore>('IOAuthStore', { strict: false });\n\n    if (!jwtTokenService || !store) {\n      throw new UnauthorizedException('Authentication service not available');\n    }\n\n    // If a token is provided, it must be valid\n    const payload = jwtTokenService.validateToken(token);\n\n    if (!payload) {\n      throw new UnauthorizedException('Invalid or expired access token');\n    }\n\n    // Enrich request.user with friendly fields for tools\n    const enriched: any = { ...payload };\n    try {\n      if (!enriched.user_data && enriched.user_profile_id) {\n        const profile = await store.getUserProfileById(\n          enriched.user_profile_id,\n        );\n        if (profile) {\n          enriched.user_data = profile;\n        }\n      }\n      const ud = enriched.user_data || {};\n      // Provide convenient top-level fields commonly used by tools\n      enriched.username =\n        enriched.username || ud.username || ud.id || enriched.sub;\n      enriched.email = enriched.email || ud.email;\n      enriched.displayName = enriched.displayName || ud.displayName;\n      enriched.avatarUrl = enriched.avatarUrl || ud.avatarUrl;\n      enriched.name =\n        enriched.name ||\n        ud.displayName ||\n        ud.username ||\n        ud.email ||\n        enriched.sub;\n\n      // Parse scopes: OAuth 2.0 standard is space-delimited string in 'scope' field\n      if (enriched.scope && typeof enriched.scope === 'string') {\n        enriched.scopes = enriched.scope\n          .split(' ')\n          .filter((s: string) => s.length > 0);\n      } else if (!enriched.scopes) {\n        enriched.scopes = [];\n      }\n\n      // Extract roles from user_data if present\n      if (!enriched.roles && ud.roles && Array.isArray(ud.roles)) {\n        enriched.roles = ud.roles;\n      } else if (!enriched.roles) {\n        enriched.roles = [];\n      }\n    } catch {\n      // Non-fatal; proceed with raw payload\n    }\n\n    request.user = enriched as JwtPayload;\n    return true;\n  }\n\n  private extractTokenFromHeader(request: Request): string | undefined {\n    const authHeader = request.headers.authorization;\n    if (!authHeader) {\n      return undefined;\n    }\n\n    const [type, token] = authHeader.split(' ');\n    return type === 'Bearer' ? token : undefined;\n  }\n}\n"]}

package/dist/authz/index.d.ts

@@ -1,11 +0,0 @@
-export * from './mcp-oauth.controller';
-export * from './mcp-oauth.module';
-export * from './providers/oauth-provider.interface';
-export * from './providers/google.provider';
-export * from './providers/github.provider';
-export * from './providers/azure-ad.provider';
-export * from './stores/oauth-store.interface';
-export * from './stores/memory-store.service';
-export * from './interfaces/request-with-user';
-export * from './guards/jwt-auth.guard';
-//# sourceMappingURL=index.d.ts.map

package/dist/authz/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sCAAsC,CAAC;AACrD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC"}

package/dist/authz/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,qDAAmC;AACnC,uEAAqD;AACrD,8DAA4C;AAC5C,8DAA4C;AAC5C,gEAA8C;AAC9C,iEAA+C;AAC/C,gEAA8C;AAC9C,iEAA+C;AAC/C,0DAAwC","sourcesContent":["export * from './mcp-oauth.controller';\nexport * from './mcp-oauth.module';\nexport * from './providers/oauth-provider.interface';\nexport * from './providers/google.provider';\nexport * from './providers/github.provider';\nexport * from './providers/azure-ad.provider';\nexport * from './stores/oauth-store.interface';\nexport * from './stores/memory-store.service';\nexport * from './interfaces/request-with-user';\nexport * from './guards/jwt-auth.guard';\n"]}

package/dist/authz/interfaces/oauth-common.interface.d.ts

@@ -1,21 +0,0 @@
-export interface OAuthUserProfile {
-    id: string;
-    username: string;
-    email?: string;
-    displayName?: string;
-    avatarUrl?: string;
-    raw?: any;
-}
-export interface OAuthSession {
-    sessionId: string;
-    state: string;
-    clientId?: string;
-    redirectUri?: string;
-    codeChallenge?: string;
-    codeChallengeMethod?: string;
-    oauthState?: string;
-    scope?: string;
-    resource?: string;
-    expiresAt: number;
-}
-//# sourceMappingURL=oauth-common.interface.d.ts.map

package/dist/authz/interfaces/oauth-common.interface.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-common.interface.d.ts","sourceRoot":"","sources":["../../../src/authz/interfaces/oauth-common.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/authz/interfaces/oauth-common.interface.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-common.interface.js","sourceRoot":"","sources":["../../../src/authz/interfaces/oauth-common.interface.ts"],"names":[],"mappings":"","sourcesContent":["export interface OAuthUserProfile {\n  id: string;\n  username: string;\n  email?: string;\n  displayName?: string;\n  avatarUrl?: string;\n  raw?: any; // Original profile data\n}\n\nexport interface OAuthSession {\n  sessionId: string;\n  state: string;\n  clientId?: string;\n  redirectUri?: string;\n  codeChallenge?: string;\n  codeChallengeMethod?: string;\n  oauthState?: string;\n  scope?: string;\n  resource?: string;\n  expiresAt: number;\n}\n"]}

package/dist/authz/interfaces/request-with-user.d.ts

@@ -1,13 +0,0 @@
-import type { Request } from 'express';
-import type { JwtPayload } from '../services/jwt-token.service';
-export type McpUserPayload = JwtPayload & {
-    name?: string;
-    username?: string;
-    email?: string;
-    displayName?: string;
-    avatarUrl?: string;
-};
-export type McpRequestWithUser = Request & {
-    user: McpUserPayload;
-};
-//# sourceMappingURL=request-with-user.d.ts.map

package/dist/authz/interfaces/request-with-user.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-with-user.d.ts","sourceRoot":"","sources":["../../../src/authz/interfaces/request-with-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAGhE,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAGF,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG;IACzC,IAAI,EAAE,cAAc,CAAC;CACtB,CAAC"}

package/dist/authz/interfaces/request-with-user.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-with-user.js","sourceRoot":"","sources":["../../../src/authz/interfaces/request-with-user.ts"],"names":[],"mappings":"","sourcesContent":["import type { Request } from 'express';\nimport type { JwtPayload } from '../services/jwt-token.service';\n\n// Enriched user payload placed on request.user by McpAuthJwtGuard\nexport type McpUserPayload = JwtPayload & {\n  name?: string;\n  username?: string;\n  email?: string;\n  displayName?: string;\n  avatarUrl?: string;\n};\n\n// Express Request with enriched user information\nexport type McpRequestWithUser = Request & {\n  user: McpUserPayload;\n};\n"]}

package/dist/authz/mcp-oauth.controller.d.ts

@@ -1,81 +0,0 @@
-import { Logger } from '@nestjs/common';
-import type { Request as ExpressRequest, NextFunction, Response } from 'express';
-import type { OAuthEndpointConfiguration, OAuthModuleOptions, OAuthUserProfile } from './providers/oauth-provider.interface';
-import { ClientService } from './services/client.service';
-import { JwtTokenService, TokenPair } from './services/jwt-token.service';
-import { OAuthStrategyService } from './services/oauth-strategy.service';
-import type { IOAuthStore } from './stores/oauth-store.interface';
-interface OAuthCallbackRequest extends ExpressRequest {
-    user?: {
-        profile: OAuthUserProfile;
-        accessToken: string;
-        provider: string;
-    };
-}
-interface RequestWithRawBody extends ExpressRequest {
-    rawBody?: Buffer;
-    textBody?: string;
-}
-export declare function createMcpOAuthController(endpoints?: OAuthEndpointConfiguration, options?: {
-    disableWellKnownProtectedResourceMetadata?: boolean;
-    disableWellKnownAuthorizationServerMetadata?: boolean;
-}, authModuleId?: string): {
-    new (options: OAuthModuleOptions, store: IOAuthStore, jwtTokenService: JwtTokenService, clientService: ClientService, oauthStrategyService: OAuthStrategyService): {
-        readonly logger: Logger;
-        readonly serverUrl: string;
-        readonly isProduction: boolean;
-        readonly options: OAuthModuleOptions;
-        readonly strategyName: string;
-        readonly store: IOAuthStore;
-        readonly jwtTokenService: JwtTokenService;
-        readonly clientService: ClientService;
-        readonly oauthStrategyService: OAuthStrategyService;
-        parseRequestBody(body: any, req?: RequestWithRawBody): Record<string, any>;
-        captureRawBody(req: RequestWithRawBody, res: Response, next: NextFunction): void;
-        getProtectedResourceMetadata(): {
-            authorization_servers: string[];
-            resource: string;
-            scopes_supported: string[];
-            bearer_methods_supported: string[];
-            mcp_versions_supported: string[];
-        };
-        getAuthorizationServerMetadata(): {
-            issuer: string;
-            authorization_endpoint: string;
-            token_endpoint: string;
-            registration_endpoint: string;
-            response_types_supported: string[];
-            response_modes_supported: string[];
-            grant_types_supported: string[];
-            token_endpoint_auth_methods_supported: string[];
-            scopes_supported: string[];
-            revocation_endpoint: string;
-            code_challenge_methods_supported: string[];
-        };
-        registerClient(registrationDto: any): Promise<import("./stores/oauth-store.interface").OAuthClient>;
-        authorize(query: any, req: any, res: Response, next: NextFunction): Promise<void>;
-        handleProviderCallback(req: OAuthCallbackRequest, res: Response, next: NextFunction): void;
-        processAuthenticationSuccess(req: OAuthCallbackRequest, res: Response): Promise<void>;
-        exchangeToken(body: any, req: RequestWithRawBody, res: Response): Promise<TokenPair>;
-        processTokenExchange(parsedBody: Record<string, any>, req: RequestWithRawBody): Promise<TokenPair>;
-        extractClientCredentials(req: RequestWithRawBody, body: any): {
-            client_id: string;
-            client_secret?: string;
-        };
-        validateClientAuthentication(client: any, clientCredentials: {
-            client_id: string;
-            client_secret?: string;
-        }): void;
-        handleAuthorizationCodeGrant(code: string, code_verifier: string, _redirect_uri: string, clientCredentials: {
-            client_id: string;
-            client_secret?: string;
-        }): Promise<TokenPair>;
-        handleRefreshTokenGrant(refresh_token: string, clientCredentials: {
-            client_id: string;
-            client_secret?: string;
-        }): Promise<TokenPair>;
-        validatePKCE(code_verifier: string, code_challenge: string, method: string): boolean;
-    };
-};
-export {};
-//# sourceMappingURL=mcp-oauth.controller.d.ts.map

package/dist/authz/mcp-oauth.controller.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-oauth.controller.d.ts","sourceRoot":"","sources":["../../src/authz/mcp-oauth.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,MAAM,EAMP,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EACV,OAAO,IAAI,cAAc,EACzB,YAAY,EACZ,QAAQ,EACT,MAAM,SAAS,CAAC;AAGjB,OAAO,KAAK,EACV,0BAA0B,EAC1B,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAElE,UAAU,oBAAqB,SAAQ,cAAc;IACnD,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,gBAAgB,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAGD,UAAU,kBAAmB,SAAQ,cAAc;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,wBAAwB,CACtC,SAAS,GAAE,0BAA+B,EAC1C,OAAO,CAAC,EAAE;IACR,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,2CAA2C,CAAC,EAAE,OAAO,CAAC;CACvD,EACD,YAAY,CAAC,EAAE,MAAM;kBAsCR,kBAAkB,SAEX,WAAW,mBACD,eAAe,iBACjB,aAAa,wBACN,oBAAoB;;4BAhBjC,MAAM;+BACH,OAAO;0BACZ,kBAAkB;+BACb,MAAM;wBAUX,WAAW;kCACD,eAAe;gCACjB,aAAa;uCACN,oBAAoB;+BAY9B,GAAG,QAAQ,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;4BA+CtD,kBAAkB,OAAO,QAAQ,QAAQ,YAAY;;;;;;;;;;;;;;;;;;;;;wCAoI3B,GAAG;yBAM/B,GAAG,OAEd,GAAG,OACI,QAAQ,QACN,YAAY;oCA2Ed,oBAAoB,OACpB,QAAQ,QACN,YAAY;0CA2BrB,oBAAoB,OACpB,QAAQ;4BAkFC,GAAG,OACL,kBAAkB,OACG,QAAQ,GACxC,OAAO,CAAC,SAAS,CAAC;yCA6CP,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,OAC1B,kBAAkB,GACtB,OAAO,CAAC,SAAS,CAAC;sCA4Dd,kBAAkB,QACjB,GAAG,GACR;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE;6CA+BtC,GAAG,qBACQ;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,IAAI;2CAqCC,MAAM,iBACG,MAAM,iBACN,MAAM,qBACF;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,OAAO,CAAC,SAAS,CAAC;+CA4FJ,MAAM,qBACF;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAC/D,OAAO,CAAC,SAAS,CAAC;oCA6EJ,MAAM,kBACL,MAAM,UACd,MAAM,GACb,OAAO;;EAcb"}