@rekog/mcp-nest 1.9.10 → 2.0.0-alpha.0

package/dist/authz/services/client.service.js

@@ -1,81 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ClientService = void 0;
-const common_1 = require("@nestjs/common");
-const crypto_1 = require("crypto");
-let ClientService = class ClientService {
-    constructor(store, options) {
-        this.store = store;
-        this.options = options;
-    }
-    async registerClient(registrationDto) {
-        if (!registrationDto.redirect_uris ||
-            !Array.isArray(registrationDto.redirect_uris)) {
-            throw new common_1.BadRequestException('redirect_uris is required and must be an array');
-        }
-        const supportedAuthMethods = [
-            'client_secret_basic',
-            'client_secret_post',
-            'none',
-        ];
-        if (registrationDto.token_endpoint_auth_method &&
-            !supportedAuthMethods.includes(registrationDto.token_endpoint_auth_method)) {
-            throw new common_1.BadRequestException(`Unsupported token_endpoint_auth_method. Supported methods: ${supportedAuthMethods.join(', ')}`);
-        }
-        const defaultClientValues = {
-            grant_types: ['authorization_code', 'refresh_token'],
-            response_types: ['code'],
-            token_endpoint_auth_method: registrationDto.token_endpoint_auth_method || 'none',
-        };
-        await this.preRegistrationChecks(registrationDto);
-        const now = new Date();
-        const client_id = this.store.generateClientId(registrationDto);
-        const authMethod = registrationDto.token_endpoint_auth_method || 'none';
-        const client_secret = authMethod !== 'none' ? (0, crypto_1.randomBytes)(32).toString('hex') : undefined;
-        const newClient = {
-            ...defaultClientValues,
-            ...registrationDto,
-            client_id,
-            client_secret,
-            created_at: now,
-            updated_at: now,
-        };
-        const client = await this.store.storeClient(newClient);
-        const filteredClient = Object.fromEntries(Object.entries(client).filter(([, value]) => value !== null));
-        return filteredClient;
-    }
-    async preRegistrationChecks(_dto) {
-    }
-    async getClient(clientId) {
-        const client = await this.store.getClient(clientId);
-        if (!client) {
-            return null;
-        }
-        const filteredClient = Object.fromEntries(Object.entries(client).filter(([, value]) => value !== null));
-        return filteredClient;
-    }
-    async validateRedirectUri(clientId, redirectUri) {
-        const client = await this.getClient(clientId);
-        return client ? client.redirect_uris.includes(redirectUri) : false;
-    }
-};
-exports.ClientService = ClientService;
-exports.ClientService = ClientService = __decorate([
-    (0, common_1.Injectable)(),
-    __param(0, (0, common_1.Inject)('IOAuthStore')),
-    __param(1, (0, common_1.Inject)('OAUTH_MODULE_OPTIONS')),
-    __metadata("design:paramtypes", [Object, Object])
-], ClientService);
-//# sourceMappingURL=client.service.js.map

package/dist/authz/services/client.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.service.js","sourceRoot":"","sources":["../../../src/authz/services/client.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAyE;AAMzE,mCAAqC;AAI9B,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YAC0C,KAAkB,EAEzC,OAA2B;QAFJ,UAAK,GAAL,KAAK,CAAa;QAEzC,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IASJ,KAAK,CAAC,cAAc,CAClB,eAAsC;QAGtC,IACE,CAAC,eAAe,CAAC,aAAa;YAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,EAC7C,CAAC;YACD,MAAM,IAAI,4BAAmB,CAC3B,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAGD,MAAM,oBAAoB,GAAG;YAC3B,qBAAqB;YACrB,oBAAoB;YACpB,MAAM;SACP,CAAC;QACF,IACE,eAAe,CAAC,0BAA0B;YAC1C,CAAC,oBAAoB,CAAC,QAAQ,CAAC,eAAe,CAAC,0BAA0B,CAAC,EAC1E,CAAC;YACD,MAAM,IAAI,4BAAmB,CAC3B,8DAA8D,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChG,CAAC;QACJ,CAAC;QAGD,MAAM,mBAAmB,GAAG;YAC1B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EACxB,eAAe,CAAC,0BAA0B,IAAI,MAAM;SACvD,CAAC;QAGF,MAAM,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAGvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAC3C,eAA8B,CAC/B,CAAC;QAGF,MAAM,UAAU,GAAG,eAAe,CAAC,0BAA0B,IAAI,MAAM,CAAC;QACxE,MAAM,aAAa,GACjB,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtE,MAAM,SAAS,GAAgB;YAC7B,GAAG,mBAAmB;YACtB,GAAG,eAAe;YAClB,SAAS;YACT,aAAa;YACb,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SAChB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAC9C,CAAC;QAEjB,OAAO,cAAc,CAAC;IACxB,CAAC;IAQS,KAAK,CAAC,qBAAqB,CACnC,IAA2B;IAG7B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAC9C,CAAC;QAEjB,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,QAAgB,EAChB,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,CAAC;CACF,CAAA;AAlHY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,aAAa,CAAC,CAAA;IACrB,WAAA,IAAA,eAAM,EAAC,sBAAsB,CAAC,CAAA;;GAHtB,aAAa,CAkHzB","sourcesContent":["import { BadRequestException, Injectable, Inject } from '@nestjs/common';\nimport type {\n  ClientRegistrationDto,\n  IOAuthStore,\n  OAuthClient,\n} from '../stores/oauth-store.interface';\nimport { randomBytes } from 'crypto';\nimport type { OAuthModuleOptions } from '../providers/oauth-provider.interface';\n\n@Injectable()\nexport class ClientService {\n  constructor(\n    @Inject('IOAuthStore') private readonly store: IOAuthStore,\n    @Inject('OAUTH_MODULE_OPTIONS')\n    private readonly options: OAuthModuleOptions,\n  ) {}\n\n  /**\n   * Register a client application.\n   * Always creates a new client record. client_name is not treated as unique.\n   *\n   * Note: Left open for future enhancements (e.g., software statements,\n   * URL-based Client ID Metadata Documents) via preRegistrationChecks().\n   */\n  async registerClient(\n    registrationDto: ClientRegistrationDto,\n  ): Promise<OAuthClient> {\n    // Validate required fields\n    if (\n      !registrationDto.redirect_uris ||\n      !Array.isArray(registrationDto.redirect_uris)\n    ) {\n      throw new BadRequestException(\n        'redirect_uris is required and must be an array',\n      );\n    }\n\n    // Validate token_endpoint_auth_method if provided\n    const supportedAuthMethods = [\n      'client_secret_basic',\n      'client_secret_post',\n      'none',\n    ];\n    if (\n      registrationDto.token_endpoint_auth_method &&\n      !supportedAuthMethods.includes(registrationDto.token_endpoint_auth_method)\n    ) {\n      throw new BadRequestException(\n        `Unsupported token_endpoint_auth_method. Supported methods: ${supportedAuthMethods.join(', ')}`,\n      );\n    }\n\n    // Default values for new clients\n    const defaultClientValues = {\n      grant_types: ['authorization_code', 'refresh_token'],\n      response_types: ['code'],\n      token_endpoint_auth_method:\n        registrationDto.token_endpoint_auth_method || 'none',\n    };\n\n    // Future-proofing: hook for software statements / metadata URL validations\n    await this.preRegistrationChecks(registrationDto);\n\n    const now = new Date();\n\n    // Create new client - merge defaults with registration data\n    const client_id = this.store.generateClientId(\n      registrationDto as OAuthClient,\n    );\n\n    // Only generate client_secret for methods that require it\n    const authMethod = registrationDto.token_endpoint_auth_method || 'none';\n    const client_secret =\n      authMethod !== 'none' ? randomBytes(32).toString('hex') : undefined;\n\n    const newClient: OAuthClient = {\n      ...defaultClientValues,\n      ...registrationDto,\n      client_id,\n      client_secret,\n      created_at: now,\n      updated_at: now,\n    };\n    const client = await this.store.storeClient(newClient);\n    const filteredClient = Object.fromEntries(\n      Object.entries(client).filter(([, value]) => value !== null),\n    ) as OAuthClient;\n\n    return filteredClient;\n  }\n\n  /**\n   * Hook for future registration policies (e.g., software statements per RFC 7591/7592,\n   * or URL-based Client Registration using Client ID Metadata Documents).\n   * Currently a no-op to keep behavior: always create a new client.\n   */\n\n  protected async preRegistrationChecks(\n    _dto: ClientRegistrationDto,\n  ): Promise<void> {\n    // Intentionally left blank. Implement validations/attestations in the future.\n  }\n\n  async getClient(clientId: string): Promise<OAuthClient | null> {\n    const client = await this.store.getClient(clientId);\n    if (!client) {\n      return null;\n    }\n\n    // Remove null fields from the client object\n    const filteredClient = Object.fromEntries(\n      Object.entries(client).filter(([, value]) => value !== null),\n    ) as OAuthClient;\n\n    return filteredClient;\n  }\n\n  async validateRedirectUri(\n    clientId: string,\n    redirectUri: string,\n  ): Promise<boolean> {\n    const client = await this.getClient(clientId);\n    return client ? client.redirect_uris.includes(redirectUri) : false;\n  }\n}\n"]}

package/dist/authz/services/jwt-token.service.d.ts

@@ -1,37 +0,0 @@
-import type { OAuthModuleOptions } from '../providers/oauth-provider.interface';
-export interface JwtPayload {
-    sub: string;
-    azp?: string;
-    client_id?: string;
-    scope?: string;
-    resource?: string;
-    type: 'access' | 'refresh' | 'user';
-    user_data?: any;
-    user_profile_id?: string;
-    iat?: number;
-    exp?: number;
-}
-export interface TokenPair {
-    access_token: string;
-    token_type: string;
-    expires_in: number;
-    refresh_token?: string;
-    scope?: string;
-}
-export declare class JwtTokenService {
-    private jwtSecret;
-    private issuer;
-    private accessTokenExpiresIn;
-    private refreshTokenExpiresIn;
-    private enableRefreshTokens;
-    constructor(options: OAuthModuleOptions);
-    generateTokenPair(userId: string, clientId: string, scope?: string, resource?: string, extras?: {
-        user_profile_id?: string;
-        user_data?: any;
-    }): TokenPair;
-    validateToken(token: string): JwtPayload | null;
-    refreshAccessToken(refreshToken: string): TokenPair | null;
-    generateUserToken(userId: string, userData: any): string;
-    private parseDurationToSeconds;
-}
-//# sourceMappingURL=jwt-token.service.d.ts.map

package/dist/authz/services/jwt-token.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt-token.service.d.ts","sourceRoot":"","sources":["../../../src/authz/services/jwt-token.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IACpC,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBACa,eAAe;IAC1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,mBAAmB,CAAU;gBAEO,OAAO,EAAE,kBAAkB;IAgBvE,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,SAAK,EACV,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,GAAG,CAAA;KAAE,GACrD,SAAS;IA2DZ,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAU/C,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAuB1D,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,MAAM;IAmBxD,OAAO,CAAC,sBAAsB;CAoB/B"}

package/dist/authz/services/jwt-token.service.js

@@ -1,182 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JwtTokenService = void 0;
-const common_1 = require("@nestjs/common");
-const crypto_1 = require("crypto");
-const jwt = __importStar(require("jsonwebtoken"));
-let JwtTokenService = class JwtTokenService {
-    constructor(options) {
-        const jwtSecret = options.jwtSecret;
-        if (!jwtSecret) {
-            throw new Error('JWT_SECRET must be set in environment variables.');
-        }
-        this.jwtSecret = jwtSecret;
-        this.issuer =
-            options.jwtIssuer || options.serverUrl || 'https://localhost:3000';
-        this.accessTokenExpiresIn = options.jwtAccessTokenExpiresIn;
-        this.refreshTokenExpiresIn = options.jwtRefreshTokenExpiresIn;
-        this.enableRefreshTokens = options.enableRefreshTokens;
-    }
-    generateTokenPair(userId, clientId, scope = '', resource, extras) {
-        if (!resource) {
-            throw new Error('Resource is required for token generation');
-        }
-        const jti = (0, crypto_1.randomBytes)(16).toString('hex');
-        const accessTokenPayload = {
-            sub: userId,
-            azp: clientId,
-            iss: this.issuer,
-            aud: resource,
-            resource: resource,
-            type: 'access',
-        };
-        if (extras?.user_profile_id) {
-            accessTokenPayload.user_profile_id = extras.user_profile_id;
-        }
-        if (extras?.user_data) {
-            accessTokenPayload.user_data = extras.user_data;
-        }
-        accessTokenPayload.scope = scope || '';
-        const accessToken = jwt.sign(accessTokenPayload, this.jwtSecret, {
-            algorithm: 'HS256',
-            expiresIn: this.accessTokenExpiresIn,
-        });
-        let refreshToken = undefined;
-        if (this.enableRefreshTokens) {
-            const refreshTokenPayload = {
-                sub: userId,
-                client_id: clientId,
-                scope,
-                resource,
-                type: 'refresh',
-                jti: `refresh_${jti}`,
-                iss: this.issuer,
-                aud: resource,
-            };
-            if (extras?.user_profile_id) {
-                refreshTokenPayload.user_profile_id = extras.user_profile_id;
-            }
-            refreshToken = jwt.sign(refreshTokenPayload, this.jwtSecret, {
-                algorithm: 'HS256',
-                expiresIn: this.refreshTokenExpiresIn,
-            });
-        }
-        return {
-            access_token: accessToken,
-            token_type: 'bearer',
-            expires_in: this.parseDurationToSeconds(this.accessTokenExpiresIn),
-            ...(refreshToken ? { refresh_token: refreshToken } : {}),
-        };
-    }
-    validateToken(token) {
-        try {
-            return jwt.verify(token, this.jwtSecret, {
-                algorithms: ['HS256'],
-            });
-        }
-        catch {
-            return null;
-        }
-    }
-    refreshAccessToken(refreshToken) {
-        if (!this.enableRefreshTokens) {
-            return null;
-        }
-        const payload = this.validateToken(refreshToken);
-        if (!payload || payload.type !== 'refresh') {
-            return null;
-        }
-        return this.generateTokenPair(payload.sub, payload.client_id, payload.scope, payload.resource, {
-            user_profile_id: payload.user_profile_id,
-            user_data: payload.user_data,
-        });
-    }
-    generateUserToken(userId, userData) {
-        const jti = (0, crypto_1.randomBytes)(16).toString('hex');
-        const serverUrl = process.env.SERVER_URL || 'https://localhost:3000';
-        const payload = {
-            sub: userId,
-            type: 'user',
-            user_data: userData,
-            jti: `user_${jti}`,
-            iss: serverUrl,
-            aud: 'mcp-client',
-        };
-        return jwt.sign(payload, this.jwtSecret, {
-            algorithm: 'HS256',
-            expiresIn: '24h',
-        });
-    }
-    parseDurationToSeconds(duration) {
-        const match = duration.match(/^(\d+)([smhd])$/);
-        if (!match) {
-            throw new Error(`Invalid duration format: ${duration}`);
-        }
-        const value = parseInt(match[1], 10);
-        const unit = match[2];
-        switch (unit) {
-            case 's':
-                return value;
-            case 'm':
-                return value * 60;
-            case 'h':
-                return value * 60 * 60;
-            case 'd':
-                return value * 60 * 60 * 24;
-            default:
-                throw new Error(`Unsupported duration unit: ${unit}`);
-        }
-    }
-};
-exports.JwtTokenService = JwtTokenService;
-exports.JwtTokenService = JwtTokenService = __decorate([
-    (0, common_1.Injectable)(),
-    __param(0, (0, common_1.Inject)('OAUTH_MODULE_OPTIONS')),
-    __metadata("design:paramtypes", [Object])
-], JwtTokenService);
-//# sourceMappingURL=jwt-token.service.js.map

package/dist/authz/services/jwt-token.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt-token.service.js","sourceRoot":"","sources":["../../../src/authz/services/jwt-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,mCAAqC;AACrC,kDAAoC;AAyB7B,IAAM,eAAe,GAArB,MAAM,eAAe;IAO1B,YAA4C,OAA2B;QAErE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAEpC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM;YACT,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,wBAAwB,CAAC;QACrE,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;QAC5D,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC;QAC9D,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IACzD,CAAC;IAED,iBAAiB,CACf,MAAc,EACd,QAAgB,EAChB,KAAK,GAAG,EAAE,EACV,QAAiB,EACjB,MAAsD;QAEtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,GAAG,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE5C,MAAM,kBAAkB,GAAQ;YAC9B,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,IAAI,CAAC,MAAM;YAChB,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,QAAiB;SACxB,CAAC;QACF,IAAI,MAAM,EAAE,eAAe,EAAE,CAAC;YAC5B,kBAAkB,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;YACtB,kBAAkB,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClD,CAAC;QAGD,kBAAkB,CAAC,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC;QAEvC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,EAAE;YAC/D,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,IAAI,CAAC,oBAAoB;SACrC,CAAC,CAAC;QAEH,IAAI,YAAY,GAAuB,SAAS,CAAC;QACjD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,mBAAmB,GAAQ;gBAC/B,GAAG,EAAE,MAAM;gBACX,SAAS,EAAE,QAAQ;gBACnB,KAAK;gBACL,QAAQ;gBACR,IAAI,EAAE,SAAkB;gBACxB,GAAG,EAAE,WAAW,GAAG,EAAE;gBACrB,GAAG,EAAE,IAAI,CAAC,MAAM;gBAChB,GAAG,EAAE,QAAQ;aACd,CAAC;YACF,IAAI,MAAM,EAAE,eAAe,EAAE,CAAC;gBAC5B,mBAAmB,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;YAC/D,CAAC;YACD,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE;gBAC3D,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,IAAI,CAAC,qBAAqB;aACtC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,CAAC;YAClE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,KAAa;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBACvC,UAAU,EAAE,CAAC,OAAO,CAAC;aACtB,CAAe,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,YAAoB;QACrC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,iBAAiB,CAC3B,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,SAAU,EAClB,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,EAChB;YACE,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CACF,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,QAAa;QAC7C,MAAM,GAAG,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,wBAAwB,CAAC;QAErE,MAAM,OAAO,GAAG;YACd,GAAG,EAAE,MAAM;YACX,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,QAAQ;YACnB,GAAG,EAAE,QAAQ,GAAG,EAAE;YAClB,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,YAAY;SAClB,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE;YACvC,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IAEO,sBAAsB,CAAC,QAAgB;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,KAAK,CAAC;YACf,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,CAAC;YACzB,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAC9B;gBACE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;CACF,CAAA;AAhKY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAQE,WAAA,IAAA,eAAM,EAAC,sBAAsB,CAAC,CAAA;;GAPhC,eAAe,CAgK3B","sourcesContent":["import { Inject, Injectable } from '@nestjs/common';\nimport { randomBytes } from 'crypto';\nimport * as jwt from 'jsonwebtoken';\nimport type { OAuthModuleOptions } from '../providers/oauth-provider.interface';\n\nexport interface JwtPayload {\n  sub: string; // user_id\n  azp?: string; // authorized party (client_id for access tokens)\n  client_id?: string; // only for refresh tokens\n  scope?: string;\n  resource?: string; // MCP server resource identifier\n  type: 'access' | 'refresh' | 'user';\n  user_data?: any;\n  user_profile_id?: string;\n  iat?: number;\n  exp?: number;\n}\n\nexport interface TokenPair {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token?: string;\n  scope?: string;\n}\n\n@Injectable()\nexport class JwtTokenService {\n  private jwtSecret: string;\n  private issuer: string;\n  private accessTokenExpiresIn: string;\n  private refreshTokenExpiresIn: string;\n  private enableRefreshTokens: boolean;\n\n  constructor(@Inject('OAUTH_MODULE_OPTIONS') options: OAuthModuleOptions) {\n    // Use JWT secret from environment variable\n    const jwtSecret = options.jwtSecret;\n\n    if (!jwtSecret) {\n      throw new Error('JWT_SECRET must be set in environment variables.');\n    }\n\n    this.jwtSecret = jwtSecret;\n    this.issuer =\n      options.jwtIssuer || options.serverUrl || 'https://localhost:3000';\n    this.accessTokenExpiresIn = options.jwtAccessTokenExpiresIn;\n    this.refreshTokenExpiresIn = options.jwtRefreshTokenExpiresIn;\n    this.enableRefreshTokens = options.enableRefreshTokens;\n  }\n\n  generateTokenPair(\n    userId: string,\n    clientId: string,\n    scope = '',\n    resource?: string,\n    extras?: { user_profile_id?: string; user_data?: any },\n  ): TokenPair {\n    if (!resource) {\n      throw new Error('Resource is required for token generation');\n    }\n\n    const jti = randomBytes(16).toString('hex'); // JWT ID for tracking\n\n    const accessTokenPayload: any = {\n      sub: userId,\n      azp: clientId, // Use azp instead of client_id\n      iss: this.issuer,\n      aud: resource,\n      resource: resource, // Always include resource\n      type: 'access' as const,\n    };\n    if (extras?.user_profile_id) {\n      accessTokenPayload.user_profile_id = extras.user_profile_id;\n    }\n    if (extras?.user_data) {\n      accessTokenPayload.user_data = extras.user_data;\n    }\n\n    // Always include scope to ensure parity with refresh token claims\n    accessTokenPayload.scope = scope || '';\n\n    const accessToken = jwt.sign(accessTokenPayload, this.jwtSecret, {\n      algorithm: 'HS256',\n      expiresIn: this.accessTokenExpiresIn,\n    });\n\n    let refreshToken: string | undefined = undefined;\n    if (this.enableRefreshTokens) {\n      const refreshTokenPayload: any = {\n        sub: userId,\n        client_id: clientId,\n        scope,\n        resource,\n        type: 'refresh' as const,\n        jti: `refresh_${jti}`,\n        iss: this.issuer,\n        aud: resource,\n      };\n      if (extras?.user_profile_id) {\n        refreshTokenPayload.user_profile_id = extras.user_profile_id;\n      }\n      refreshToken = jwt.sign(refreshTokenPayload, this.jwtSecret, {\n        algorithm: 'HS256',\n        expiresIn: this.refreshTokenExpiresIn,\n      });\n    }\n\n    return {\n      access_token: accessToken,\n      token_type: 'bearer',\n      expires_in: this.parseDurationToSeconds(this.accessTokenExpiresIn),\n      ...(refreshToken ? { refresh_token: refreshToken } : {}),\n    };\n  }\n\n  validateToken(token: string): JwtPayload | null {\n    try {\n      return jwt.verify(token, this.jwtSecret, {\n        algorithms: ['HS256'],\n      }) as JwtPayload;\n    } catch {\n      return null;\n    }\n  }\n\n  refreshAccessToken(refreshToken: string): TokenPair | null {\n    if (!this.enableRefreshTokens) {\n      return null;\n    }\n\n    const payload = this.validateToken(refreshToken);\n\n    if (!payload || payload.type !== 'refresh') {\n      return null;\n    }\n\n    return this.generateTokenPair(\n      payload.sub,\n      payload.client_id!,\n      payload.scope,\n      payload.resource,\n      {\n        user_profile_id: payload.user_profile_id,\n        user_data: payload.user_data,\n      },\n    );\n  }\n\n  generateUserToken(userId: string, userData: any): string {\n    const jti = randomBytes(16).toString('hex');\n    const serverUrl = process.env.SERVER_URL || 'https://localhost:3000';\n\n    const payload = {\n      sub: userId,\n      type: 'user',\n      user_data: userData,\n      jti: `user_${jti}`,\n      iss: serverUrl,\n      aud: 'mcp-client',\n    };\n\n    return jwt.sign(payload, this.jwtSecret, {\n      algorithm: 'HS256',\n      expiresIn: '24h',\n    });\n  }\n\n  private parseDurationToSeconds(duration: string): number {\n    const match = duration.match(/^(\\d+)([smhd])$/);\n    if (!match) {\n      throw new Error(`Invalid duration format: ${duration}`);\n    }\n    const value = parseInt(match[1], 10);\n    const unit = match[2];\n    switch (unit) {\n      case 's':\n        return value;\n      case 'm':\n        return value * 60;\n      case 'h':\n        return value * 60 * 60;\n      case 'd':\n        return value * 60 * 60 * 24;\n      default:\n        throw new Error(`Unsupported duration unit: ${unit}`);\n    }\n  }\n}\n"]}

package/dist/authz/services/oauth-strategy.service.d.ts

@@ -1,13 +0,0 @@
-import { OnModuleInit } from '@nestjs/common';
-import type { OAuthModuleOptions } from '../providers/oauth-provider.interface';
-export declare const STRATEGY_NAME = "oauth-provider";
-export declare class OAuthStrategyService implements OnModuleInit {
-    private options;
-    private authModuleId?;
-    private strategyName;
-    constructor(options: OAuthModuleOptions, authModuleId?: string | undefined);
-    onModuleInit(): void;
-    private registerStrategy;
-    getStrategyName(): string;
-}
-//# sourceMappingURL=oauth-strategy.service.d.ts.map

package/dist/authz/services/oauth-strategy.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-strategy.service.d.ts","sourceRoot":"","sources":["../../../src/authz/services/oauth-strategy.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAoB,MAAM,gBAAgB,CAAC;AAE5E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,eAAO,MAAM,aAAa,mBAAmB,CAAC;AAE9C,qBACa,oBAAqB,YAAW,YAAY;IAIrB,OAAO,CAAC,OAAO;IACR,OAAO,CAAC,YAAY,CAAC;IAJ9D,OAAO,CAAC,YAAY,CAAS;gBAGa,OAAO,EAAE,kBAAkB,EACpB,YAAY,CAAC,EAAE,MAAM,YAAA;IAQtE,YAAY;IAIZ,OAAO,CAAC,gBAAgB;IAoCxB,eAAe,IAAI,MAAM;CAG1B"}

package/dist/authz/services/oauth-strategy.service.js

@@ -1,71 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthStrategyService = exports.STRATEGY_NAME = void 0;
-const common_1 = require("@nestjs/common");
-const passport_1 = __importDefault(require("passport"));
-exports.STRATEGY_NAME = 'oauth-provider';
-let OAuthStrategyService = class OAuthStrategyService {
-    constructor(options, authModuleId) {
-        this.options = options;
-        this.authModuleId = authModuleId;
-        this.strategyName = authModuleId
-            ? `${exports.STRATEGY_NAME}-${authModuleId}`
-            : exports.STRATEGY_NAME;
-    }
-    onModuleInit() {
-        this.registerStrategy();
-    }
-    registerStrategy() {
-        const provider = this.options.provider;
-        const clientId = this.options.clientId;
-        const clientSecret = this.options.clientSecret;
-        const serverUrl = this.options.serverUrl;
-        const strategyOptions = provider.strategyOptions({
-            serverUrl,
-            clientId,
-            clientSecret,
-            callbackPath: this.options.endpoints.callback,
-        });
-        const strategy = new provider.strategy(strategyOptions, (accessToken, refreshToken, profile, done) => {
-            try {
-                const mappedProfile = provider.profileMapper(profile);
-                return done(null, {
-                    profile: mappedProfile,
-                    accessToken,
-                    provider: provider.name,
-                });
-            }
-            catch (error) {
-                return done(error, null);
-            }
-        });
-        passport_1.default.use(this.strategyName, strategy);
-    }
-    getStrategyName() {
-        return this.strategyName;
-    }
-};
-exports.OAuthStrategyService = OAuthStrategyService;
-exports.OAuthStrategyService = OAuthStrategyService = __decorate([
-    (0, common_1.Injectable)(),
-    __param(0, (0, common_1.Inject)('OAUTH_MODULE_OPTIONS')),
-    __param(1, (0, common_1.Optional)()),
-    __param(1, (0, common_1.Inject)('OAUTH_MODULE_ID')),
-    __metadata("design:paramtypes", [Object, String])
-], OAuthStrategyService);
-//# sourceMappingURL=oauth-strategy.service.js.map

package/dist/authz/services/oauth-strategy.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-strategy.service.js","sourceRoot":"","sources":["../../../src/authz/services/oauth-strategy.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,2CAA4E;AAC5E,wDAAgC;AAGnB,QAAA,aAAa,GAAG,gBAAgB,CAAC;AAGvC,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAG/B,YAC0C,OAA2B,EACpB,YAAqB;QAD5B,YAAO,GAAP,OAAO,CAAoB;QACpB,iBAAY,GAAZ,YAAY,CAAS;QAGpE,IAAI,CAAC,YAAY,GAAG,YAAY;YAC9B,CAAC,CAAC,GAAG,qBAAa,IAAI,YAAY,EAAE;YACpC,CAAC,CAAC,qBAAa,CAAC;IACpB,CAAC;IAED,YAAY;QACV,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAEO,gBAAgB;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAGvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAG/C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAEzC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;YAC/C,SAAS;YACT,QAAQ;YACR,YAAY;YACZ,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ;SAC9C,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,QAAQ,CACpC,eAAe,EACf,CAAC,WAAmB,EAAE,YAAoB,EAAE,OAAY,EAAE,IAAS,EAAE,EAAE;YACrE,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACtD,OAAO,IAAI,CAAC,IAAI,EAAE;oBAChB,OAAO,EAAE,aAAa;oBACtB,WAAW;oBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC,CACF,CAAC;QAEF,kBAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF,CAAA;AAxDY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,sBAAsB,CAAC,CAAA;IAC9B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAL7B,oBAAoB,CAwDhC","sourcesContent":["import { Injectable, OnModuleInit, Inject, Optional } from '@nestjs/common';\nimport passport from 'passport';\nimport type { OAuthModuleOptions } from '../providers/oauth-provider.interface';\n\nexport const STRATEGY_NAME = 'oauth-provider';\n\n@Injectable()\nexport class OAuthStrategyService implements OnModuleInit {\n  private strategyName: string;\n\n  constructor(\n    @Inject('OAUTH_MODULE_OPTIONS') private options: OAuthModuleOptions,\n    @Optional() @Inject('OAUTH_MODULE_ID') private authModuleId?: string,\n  ) {\n    // Use instance-specific strategy name if authModuleId is provided\n    this.strategyName = authModuleId\n      ? `${STRATEGY_NAME}-${authModuleId}`\n      : STRATEGY_NAME;\n  }\n\n  onModuleInit() {\n    this.registerStrategy();\n  }\n\n  private registerStrategy() {\n    const provider = this.options.provider;\n\n    // Use client credentials from resolved options\n    const clientId = this.options.clientId;\n    const clientSecret = this.options.clientSecret;\n\n    // Use resolved serverUrl (no fallbacks needed)\n    const serverUrl = this.options.serverUrl;\n\n    const strategyOptions = provider.strategyOptions({\n      serverUrl,\n      clientId,\n      clientSecret,\n      callbackPath: this.options.endpoints.callback,\n    });\n\n    const strategy = new provider.strategy(\n      strategyOptions,\n      (accessToken: string, refreshToken: string, profile: any, done: any) => {\n        try {\n          const mappedProfile = provider.profileMapper(profile);\n          return done(null, {\n            profile: mappedProfile,\n            accessToken,\n            provider: provider.name,\n          });\n        } catch (error) {\n          return done(error, null);\n        }\n      },\n    );\n\n    passport.use(this.strategyName, strategy);\n  }\n\n  getStrategyName(): string {\n    return this.strategyName;\n  }\n}\n"]}

package/dist/authz/stores/memory-store.service.d.ts

@@ -1,27 +0,0 @@
-import { OAuthSession, OAuthUserProfile } from '../providers/oauth-provider.interface';
-import type { AuthorizationCode, IOAuthStore, OAuthClient } from './oauth-store.interface';
-export declare class MemoryStore implements IOAuthStore {
-    private clients;
-    private authCodes;
-    private oauthSessions;
-    private userProfiles;
-    private providerUserIndex;
-    storeClient(client: OAuthClient): Promise<OAuthClient>;
-    getClient(client_id: string): Promise<OAuthClient | undefined>;
-    findClient(client_name: string): Promise<OAuthClient | undefined>;
-    storeAuthCode(code: AuthorizationCode): Promise<void>;
-    getAuthCode(code: string): Promise<AuthorizationCode | undefined>;
-    removeAuthCode(code: string): Promise<void>;
-    storeOAuthSession(sessionId: string, session: OAuthSession): Promise<void>;
-    getOAuthSession(sessionId: string): Promise<OAuthSession | undefined>;
-    removeOAuthSession(sessionId: string): Promise<void>;
-    generateClientId(client: OAuthClient): string;
-    private normalizeClientObject;
-    upsertUserProfile(profile: OAuthUserProfile, provider: string): Promise<string>;
-    getUserProfileById(profileId: string): Promise<(OAuthUserProfile & {
-        profile_id: string;
-        provider: string;
-    }) | undefined>;
-    private generateProfileId;
-}
-//# sourceMappingURL=memory-store.service.d.ts.map

package/dist/authz/stores/memory-store.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory-store.service.d.ts","sourceRoot":"","sources":["../../../src/authz/stores/memory-store.service.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,YAAY,EACZ,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACX,WAAW,EACZ,MAAM,yBAAyB,CAAC;AAGjC,qBACa,WAAY,YAAW,WAAW;IAC7C,OAAO,CAAC,OAAO,CAAkC;IACjD,OAAO,CAAC,SAAS,CAAwC;IACzD,OAAO,CAAC,aAAa,CAAmC;IACxD,OAAO,CAAC,YAAY,CAGhB;IACJ,OAAO,CAAC,iBAAiB,CAA6B;IAEhD,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAKtD,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAI9D,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IASjE,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAIjE,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3C,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAIV,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IASrE,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM;IAa7C,OAAO,CAAC,qBAAqB;IAqBvB,iBAAiB,CACrB,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAgBZ,kBAAkB,CACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CACR,CAAC,gBAAgB,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAC1E;IAID,OAAO,CAAC,iBAAiB;CAI1B"}

package/dist/authz/stores/memory-store.service.js

@@ -1,107 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MemoryStore = void 0;
-const common_1 = require("@nestjs/common");
-const crypto_1 = require("crypto");
-let MemoryStore = class MemoryStore {
-    constructor() {
-        this.clients = new Map();
-        this.authCodes = new Map();
-        this.oauthSessions = new Map();
-        this.userProfiles = new Map();
-        this.providerUserIndex = new Map();
-    }
-    async storeClient(client) {
-        this.clients.set(client.client_id, client);
-        return client;
-    }
-    async getClient(client_id) {
-        return this.clients.get(client_id);
-    }
-    async findClient(client_name) {
-        for (const client of this.clients.values()) {
-            if (client.client_name === client_name) {
-                return client;
-            }
-        }
-        return undefined;
-    }
-    async storeAuthCode(code) {
-        this.authCodes.set(code.code, code);
-    }
-    async getAuthCode(code) {
-        return this.authCodes.get(code);
-    }
-    async removeAuthCode(code) {
-        this.authCodes.delete(code);
-    }
-    async storeOAuthSession(sessionId, session) {
-        this.oauthSessions.set(sessionId, session);
-    }
-    async getOAuthSession(sessionId) {
-        const session = this.oauthSessions.get(sessionId);
-        if (session && session.expiresAt < Date.now()) {
-            this.oauthSessions.delete(sessionId);
-            return undefined;
-        }
-        return session;
-    }
-    async removeOAuthSession(sessionId) {
-        this.oauthSessions.delete(sessionId);
-    }
-    generateClientId(client) {
-        const normalizedClient = this.normalizeClientObject(client);
-        const clientString = JSON.stringify(normalizedClient);
-        const hash = (0, crypto_1.createHash)('sha256').update(clientString).digest('hex');
-        const normalizedName = client.client_name
-            .toLowerCase()
-            .replace(/[^a-z0-9]/g, '');
-        return `${normalizedName}_${hash.substring(0, 16)}`;
-    }
-    normalizeClientObject(client) {
-        const normalized = {};
-        const sortedKeys = Object.keys(client).sort();
-        for (const key of sortedKeys) {
-            const value = client[key];
-            if (Array.isArray(value)) {
-                normalized[key] = [...value].sort();
-            }
-            else {
-                normalized[key] = value;
-            }
-        }
-        return normalized;
-    }
-    async upsertUserProfile(profile, provider) {
-        const key = `${provider}:${profile.id}`;
-        let profileId = this.providerUserIndex.get(key);
-        if (!profileId) {
-            profileId = this.generateProfileId(provider, profile.id);
-            this.providerUserIndex.set(key, profileId);
-        }
-        this.userProfiles.set(profileId, {
-            profile_id: profileId,
-            provider,
-            ...profile,
-        });
-        return profileId;
-    }
-    async getUserProfileById(profileId) {
-        return this.userProfiles.get(profileId);
-    }
-    generateProfileId(provider, providerUserId) {
-        const input = `${provider}:${providerUserId}`;
-        return (0, crypto_1.createHash)('sha256').update(input).digest('hex').slice(0, 24);
-    }
-};
-exports.MemoryStore = MemoryStore;
-exports.MemoryStore = MemoryStore = __decorate([
-    (0, common_1.Injectable)()
-], MemoryStore);
-//# sourceMappingURL=memory-store.service.js.map

package/dist/authz/stores/memory-store.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory-store.service.js","sourceRoot":"","sources":["../../../src/authz/stores/memory-store.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAC5C,mCAAoC;AAa7B,IAAM,WAAW,GAAjB,MAAM,WAAW;IAAjB;QACG,YAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QACzC,cAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;QACjD,kBAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;QAChD,iBAAY,GAAG,IAAI,GAAG,EAG3B,CAAC;QACI,sBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAsHxD,CAAC;IApHC,KAAK,CAAC,WAAW,CAAC,MAAmB;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAuB;QACzC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAGD,KAAK,CAAC,iBAAiB,CACrB,SAAiB,EACjB,OAAqB;QAErB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,SAAiB;QACxC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,gBAAgB,CAAC,MAAmB;QAElC,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAGrE,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW;aACtC,WAAW,EAAE;aACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7B,OAAO,GAAG,cAAc,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACtD,CAAC;IAEO,qBAAqB,CAAC,MAAmB;QAE/C,MAAM,UAAU,GAAQ,EAAE,CAAC;QAG3B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAE9C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAI,MAAc,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAEzB,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAGD,KAAK,CAAC,iBAAiB,CACrB,OAAyB,EACzB,QAAgB;QAEhB,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YAEf,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE;YAC/B,UAAU,EAAE,SAAS;YACrB,QAAQ;YACR,GAAG,OAAO;SACX,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB;QAIjB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEO,iBAAiB,CAAC,QAAgB,EAAE,cAAsB;QAChE,MAAM,KAAK,GAAG,GAAG,QAAQ,IAAI,cAAc,EAAE,CAAC;QAC9C,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;CACF,CAAA;AA9HY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;GACA,WAAW,CA8HvB","sourcesContent":["import { Injectable } from '@nestjs/common';\nimport { createHash } from 'crypto';\nimport {\n  OAuthSession,\n  OAuthUserProfile,\n} from '../providers/oauth-provider.interface';\nimport type {\n  AuthorizationCode,\n  IOAuthStore,\n  OAuthClient,\n} from './oauth-store.interface';\n\n// In-memory storage (in production, use a database)\n@Injectable()\nexport class MemoryStore implements IOAuthStore {\n  private clients = new Map<string, OAuthClient>();\n  private authCodes = new Map<string, AuthorizationCode>();\n  private oauthSessions = new Map<string, OAuthSession>();\n  private userProfiles = new Map<\n    string,\n    OAuthUserProfile & { profile_id: string; provider: string }\n  >(); // profile_id -> profile\n  private providerUserIndex = new Map<string, string>(); // key(provider:userId) -> profile_id\n\n  async storeClient(client: OAuthClient): Promise<OAuthClient> {\n    this.clients.set(client.client_id, client);\n    return client;\n  }\n\n  async getClient(client_id: string): Promise<OAuthClient | undefined> {\n    return this.clients.get(client_id);\n  }\n\n  async findClient(client_name: string): Promise<OAuthClient | undefined> {\n    for (const client of this.clients.values()) {\n      if (client.client_name === client_name) {\n        return client;\n      }\n    }\n    return undefined;\n  }\n\n  async storeAuthCode(code: AuthorizationCode): Promise<void> {\n    this.authCodes.set(code.code, code);\n  }\n\n  async getAuthCode(code: string): Promise<AuthorizationCode | undefined> {\n    return this.authCodes.get(code);\n  }\n\n  async removeAuthCode(code: string): Promise<void> {\n    this.authCodes.delete(code);\n  }\n\n  // New OAuth session methods for provider-agnostic flow\n  async storeOAuthSession(\n    sessionId: string,\n    session: OAuthSession,\n  ): Promise<void> {\n    this.oauthSessions.set(sessionId, session);\n  }\n\n  async getOAuthSession(sessionId: string): Promise<OAuthSession | undefined> {\n    const session = this.oauthSessions.get(sessionId);\n    if (session && session.expiresAt < Date.now()) {\n      this.oauthSessions.delete(sessionId);\n      return undefined;\n    }\n    return session;\n  }\n\n  async removeOAuthSession(sessionId: string): Promise<void> {\n    this.oauthSessions.delete(sessionId);\n  }\n\n  generateClientId(client: OAuthClient): string {\n    // Create deterministic client ID based on entire client object\n    const normalizedClient = this.normalizeClientObject(client);\n    const clientString = JSON.stringify(normalizedClient);\n    const hash = createHash('sha256').update(clientString).digest('hex');\n\n    // Use first 16 characters of hash with client name prefix for readability\n    const normalizedName = client.client_name\n      .toLowerCase()\n      .replace(/[^a-z0-9]/g, '');\n    return `${normalizedName}_${hash.substring(0, 16)}`;\n  }\n\n  private normalizeClientObject(client: OAuthClient): any {\n    // Create a normalized version of the client object for consistent hashing\n    const normalized: any = {};\n\n    // Sort object keys to ensure consistent ordering\n    const sortedKeys = Object.keys(client).sort();\n\n    for (const key of sortedKeys) {\n      const value = (client as any)[key];\n      if (Array.isArray(value)) {\n        // Sort arrays to ensure consistent ordering\n        normalized[key] = [...value].sort();\n      } else {\n        normalized[key] = value;\n      }\n    }\n\n    return normalized;\n  }\n\n  // User profile management\n  async upsertUserProfile(\n    profile: OAuthUserProfile,\n    provider: string,\n  ): Promise<string> {\n    const key = `${provider}:${profile.id}`;\n    let profileId = this.providerUserIndex.get(key);\n    if (!profileId) {\n      // create new\n      profileId = this.generateProfileId(provider, profile.id);\n      this.providerUserIndex.set(key, profileId);\n    }\n    this.userProfiles.set(profileId, {\n      profile_id: profileId,\n      provider,\n      ...profile,\n    });\n    return profileId;\n  }\n\n  async getUserProfileById(\n    profileId: string,\n  ): Promise<\n    (OAuthUserProfile & { profile_id: string; provider: string }) | undefined\n  > {\n    return this.userProfiles.get(profileId);\n  }\n\n  private generateProfileId(provider: string, providerUserId: string): string {\n    const input = `${provider}:${providerUserId}`;\n    return createHash('sha256').update(input).digest('hex').slice(0, 24);\n  }\n}\n"]}