@rekog/mcp-nest 1.9.10 → 2.0.0-alpha.0

package/src/authz/mcp-oauth.module.ts

@@ -1,384 +0,0 @@
-import { DynamicModule, Module } from '@nestjs/common';
-import { ConfigModule } from '@nestjs/config';
-import { JwtModule } from '@nestjs/jwt';
-import { PassportModule } from '@nestjs/passport';
-import { McpAuthJwtGuard } from './guards/jwt-auth.guard';
-import { createMcpOAuthController } from './mcp-oauth.controller';
-import type {
-  OAuthUserModuleOptions as AuthUserModuleOptions,
-  OAuthEndpointConfiguration,
-  OAuthModuleDefaults,
-  OAuthModuleOptions,
-} from './providers/oauth-provider.interface';
-import { ClientService } from './services/client.service';
-import { JwtTokenService } from './services/jwt-token.service';
-import { OAuthStrategyService } from './services/oauth-strategy.service';
-import { MemoryStore } from './stores/memory-store.service';
-import { normalizeEndpoint } from '../mcp/utils/normalize-endpoint';
-import { OAUTH_TYPEORM_CONNECTION_NAME } from './stores/typeorm/constants';
-
-let authInstanceIdCounter = 0;
-
-// Default configuration values
-export const DEFAULT_OPTIONS: OAuthModuleDefaults = {
-  serverUrl: 'http://localhost:3000',
-  resource: 'http://localhost:3000/mcp',
-  jwtIssuer: 'http://localhost:3000',
-  jwtAudience: 'mcp-client',
-  jwtAccessTokenExpiresIn: '1d',
-  jwtRefreshTokenExpiresIn: '30d',
-  enableRefreshTokens: true,
-  cookieMaxAge: 24 * 60 * 60 * 1000, // 24 hours
-  oauthSessionExpiresIn: 10 * 60 * 1000, // 10 minutes
-  authCodeExpiresIn: 10 * 60 * 1000, // 10 minutes
-  nodeEnv: 'development',
-  apiPrefix: '',
-  endpoints: {
-    wellKnownAuthorizationServerMetadata:
-      '/.well-known/oauth-authorization-server',
-    wellKnownProtectedResourceMetadata: '/.well-known/oauth-protected-resource',
-    register: '/register',
-    authorize: '/authorize',
-    callback: '/callback',
-    token: '/token',
-    revoke: '/revoke',
-  },
-  disableEndpoints: {
-    wellKnownAuthorizationServerMetadata: false,
-    wellKnownProtectedResourceMetadata: false,
-  },
-  protectedResourceMetadata: {
-    scopesSupported: ['offline_access'],
-    bearerMethodsSupported: ['header'],
-    mcpVersionsSupported: ['2025-06-18'],
-  },
-  authorizationServerMetadata: {
-    responseTypesSupported: ['code'],
-    responseModesSupported: ['query'],
-    grantTypesSupported: ['authorization_code', 'refresh_token'],
-    tokenEndpointAuthMethodsSupported: [
-      'client_secret_basic',
-      'client_secret_post',
-      'none',
-    ],
-    scopesSupported: ['offline_access'],
-    codeChallengeMethodsSupported: ['plain', 'S256'],
-  },
-};
-
-@Module({})
-export class McpAuthModule {
-  /**
-   * To avoid import circular dependency issues, we use a marker property.
-   */
-  readonly __isMcpAuthModule = true;
-
-  static forRoot(options: AuthUserModuleOptions): DynamicModule {
-    // Create a unique instance ID for this auth module
-    const authModuleId = `mcp-auth-module-${authInstanceIdCounter++}`;
-
-    // Merge user options with defaults and validate
-    const resolvedOptions = this.mergeAndValidateOptions(
-      DEFAULT_OPTIONS,
-      options,
-    );
-
-    resolvedOptions.endpoints = prepareEndpoints(
-      resolvedOptions.apiPrefix,
-      DEFAULT_OPTIONS.endpoints,
-      options.endpoints || {},
-    );
-
-    // Use instance-scoped token for OAuth options
-    const oauthModuleOptionsToken = `OAUTH_MODULE_OPTIONS_${authModuleId}`;
-    const oauthModuleOptions = {
-      provide: oauthModuleOptionsToken,
-      useValue: resolvedOptions,
-    };
-
-    // Determine imports based on configuration
-    const imports = [
-      ConfigModule,
-      PassportModule.register({
-        defaultStrategy: 'jwt',
-        session: false,
-      }),
-      JwtModule.register({
-        secret: resolvedOptions.jwtSecret,
-        signOptions: {
-          issuer: resolvedOptions.jwtIssuer,
-          audience: resolvedOptions.jwtAudience,
-        },
-      }),
-    ];
-
-    // Add TypeORM configuration if using TypeORM store
-    const storeConfig = resolvedOptions.storeConfiguration;
-    const isTypeOrmStore = storeConfig?.type === 'typeorm';
-    if (isTypeOrmStore) {
-      const typeormOptions = storeConfig.options;
-      try {
-        // Require TypeORM-related modules only when needed
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const { TypeOrmModule } = require('@nestjs/typeorm');
-        const {
-          OAuthClientEntity,
-          AuthorizationCodeEntity,
-          OAuthSessionEntity,
-          OAuthUserProfileEntity,
-          // eslint-disable-next-line @typescript-eslint/no-require-imports
-        } = require('./stores/typeorm/entities');
-
-        imports.push(
-          TypeOrmModule.forRoot({
-            ...typeormOptions,
-            // Use a unique connection name for the OAuth store to avoid clashes
-            name: OAUTH_TYPEORM_CONNECTION_NAME,
-            entities: [
-              OAuthClientEntity,
-              AuthorizationCodeEntity,
-              OAuthSessionEntity,
-              OAuthUserProfileEntity,
-            ],
-          }),
-          TypeOrmModule.forFeature(
-            [
-              OAuthClientEntity,
-              AuthorizationCodeEntity,
-              OAuthSessionEntity,
-              OAuthUserProfileEntity,
-            ],
-            OAUTH_TYPEORM_CONNECTION_NAME,
-          ),
-        );
-      } catch (err) {
-        throw new Error(
-          "To use the TypeORM store, please install '@nestjs/typeorm' and 'typeorm'.",
-        );
-      }
-    }
-
-    // Create store provider based on configuration with instance-scoped token
-    const oauthStoreToken = `IOAuthStore_${authModuleId}`;
-    const oauthStoreProvider = this.createStoreProvider(
-      resolvedOptions.storeConfiguration,
-      oauthStoreToken,
-    );
-
-    // Create alias for compatibility with injection
-    const oauthStoreAliasProvider = {
-      provide: MemoryStore,
-      useExisting: oauthStoreToken,
-    };
-
-    const providers: any[] = [
-      {
-        provide: 'OAUTH_MODULE_ID',
-        useValue: authModuleId,
-      },
-      oauthModuleOptions,
-      oauthStoreProvider,
-      oauthStoreAliasProvider,
-      // Provide backward-compatible tokens as aliases
-      {
-        provide: 'OAUTH_MODULE_OPTIONS',
-        useExisting: oauthModuleOptionsToken,
-      },
-      {
-        provide: 'IOAuthStore',
-        useExisting: oauthStoreToken,
-      },
-      // Provide services using their class tokens
-      OAuthStrategyService,
-      ClientService,
-      JwtTokenService,
-      McpAuthJwtGuard,
-    ];
-
-    // No additional providers needed for TypeORM store - provider is created dynamically
-
-    // Create controller with apiPrefix, passing the instance-scoped tokens
-    const OAuthControllerClass = createMcpOAuthController(
-      resolvedOptions.endpoints,
-      {
-        disableWellKnownAuthorizationServerMetadata:
-          resolvedOptions.disableEndpoints
-            .wellKnownAuthorizationServerMetadata ?? false,
-        disableWellKnownProtectedResourceMetadata:
-          resolvedOptions.disableEndpoints.wellKnownProtectedResourceMetadata ??
-          false,
-      },
-      authModuleId,
-    );
-
-    return {
-      module: McpAuthModule,
-      imports,
-      controllers: [OAuthControllerClass],
-      providers,
-      exports: [
-        'OAUTH_MODULE_ID',
-        'OAUTH_MODULE_OPTIONS',
-        'IOAuthStore',
-        JwtTokenService,
-        ClientService,
-        OAuthStrategyService,
-        McpAuthJwtGuard,
-        MemoryStore,
-      ],
-    };
-  }
-
-  private static mergeAndValidateOptions(
-    defaults: OAuthModuleDefaults,
-    options: AuthUserModuleOptions,
-  ): OAuthModuleOptions {
-    // Validate required options first
-    this.validateRequiredOptions(options);
-
-    // Merge with defaults
-    const resolvedOptions: OAuthModuleOptions = {
-      ...defaults,
-      ...options,
-      // Ensure jwtIssuer defaults to serverUrl if not provided
-      jwtIssuer:
-        options.jwtIssuer || options.serverUrl || DEFAULT_OPTIONS.jwtIssuer,
-      cookieSecure:
-        options.cookieSecure || process.env.NODE_ENV === 'production',
-      // Merge protectedResourceMetadata with defaults
-      protectedResourceMetadata: {
-        ...defaults.protectedResourceMetadata,
-        ...options.protectedResourceMetadata,
-      },
-      // Merge authorizationServerMetadata with defaults
-      authorizationServerMetadata: {
-        ...defaults.authorizationServerMetadata,
-        ...options.authorizationServerMetadata,
-      },
-      // Merge disableEndpoints with defaults
-      disableEndpoints: {
-        ...defaults.disableEndpoints,
-        ...(options.disableEndpoints || {}),
-      },
-    };
-
-    if (!resolvedOptions.enableRefreshTokens) {
-      resolvedOptions.authorizationServerMetadata.grantTypesSupported =
-        resolvedOptions.authorizationServerMetadata.grantTypesSupported.filter(
-          (g) => g !== 'refresh_token',
-        );
-      resolvedOptions.protectedResourceMetadata.scopesSupported =
-        resolvedOptions.protectedResourceMetadata.scopesSupported.filter(
-          (s) => s !== 'offline_access',
-        );
-    }
-
-    // Final validation of resolved options
-    this.validateResolvedOptions(resolvedOptions);
-
-    return resolvedOptions;
-  }
-
-  private static validateRequiredOptions(options: AuthUserModuleOptions): void {
-    const requiredFields: (keyof AuthUserModuleOptions)[] = [
-      'provider',
-      'clientId',
-      'clientSecret',
-      'jwtSecret',
-    ];
-
-    for (const field of requiredFields) {
-      if (!options[field]) {
-        throw new Error(
-          `OAuthModuleOptions: ${String(field)} is required and must be provided by the user`,
-        );
-      }
-    }
-  }
-
-  private static validateResolvedOptions(options: OAuthModuleOptions): void {
-    // Validate JWT secret is strong enough
-    if (options.jwtSecret.length < 32) {
-      throw new Error(
-        'OAuthModuleOptions: jwtSecret must be at least 32 characters long',
-      );
-    }
-
-    // Validate URLs are proper format
-    try {
-      new URL(options.serverUrl);
-      new URL(options.jwtIssuer);
-    } catch {
-      throw new Error(
-        'OAuthModuleOptions: serverUrl and jwtIssuer must be valid URLs',
-      );
-    }
-
-    // Validate provider configuration
-    if (!options.provider.name || !options.provider.strategy) {
-      throw new Error(
-        'OAuthModuleOptions: provider must have name and strategy',
-      );
-    }
-  }
-
-  private static createStoreProvider(
-    storeConfiguration: OAuthModuleOptions['storeConfiguration'],
-    provideToken: string,
-  ) {
-    if (!storeConfiguration || storeConfiguration.type === 'memory') {
-      // Default memory store
-      return {
-        provide: provideToken,
-        useValue: new MemoryStore(),
-      };
-    }
-
-    if (storeConfiguration.type === 'typeorm') {
-      // TypeORM store
-      const {
-        TypeOrmStore,
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-      } = require('./stores/typeorm/typeorm-store.service');
-      return {
-        provide: provideToken,
-        useClass: TypeOrmStore,
-      };
-    }
-
-    if (storeConfiguration.type === 'custom') {
-      // Custom store
-      return {
-        provide: provideToken,
-        useValue: storeConfiguration.store,
-      };
-    }
-
-    throw new Error(
-      `Unknown store configuration type: ${(storeConfiguration as any).type}`,
-    );
-  }
-}
-
-function prepareEndpoints(
-  apiPrefix: string,
-  defaultEndpoints: OAuthEndpointConfiguration,
-  configuredEndpoints: OAuthEndpointConfiguration,
-) {
-  const updatedDefaultEndpoints = {
-    wellKnownAuthorizationServerMetadata:
-      defaultEndpoints.wellKnownAuthorizationServerMetadata,
-    wellKnownProtectedResourceMetadata:
-      defaultEndpoints.wellKnownProtectedResourceMetadata,
-    callback: normalizeEndpoint(`/${apiPrefix}/${defaultEndpoints.callback}`),
-    token: normalizeEndpoint(`/${apiPrefix}/${defaultEndpoints.token}`),
-    revoke: normalizeEndpoint(`/${apiPrefix}/${defaultEndpoints.revoke}`),
-    authorize: normalizeEndpoint(`/${apiPrefix}/${defaultEndpoints.authorize}`),
-    register: normalizeEndpoint(`/${apiPrefix}/${defaultEndpoints.register}`),
-  } as OAuthEndpointConfiguration;
-
-  return {
-    ...updatedDefaultEndpoints,
-    ...configuredEndpoints,
-  };
-}

package/src/authz/providers/azure-ad.provider.ts

@@ -1,40 +0,0 @@
-import { Strategy } from 'passport-azure-ad-oauth2';
-import { normalizeEndpoint } from '../../mcp/utils/normalize-endpoint';
-import { OAuthProviderConfig } from './oauth-provider.interface';
-
-export const AzureADOAuthProvider: OAuthProviderConfig = {
-  name: 'azure-ad',
-  displayName: 'Microsoft Azure AD',
-  strategy: Strategy,
-  strategyOptions: ({ serverUrl, clientId, clientSecret, callbackPath }) => ({
-    clientID: clientId,
-    clientSecret: clientSecret,
-    callbackURL: normalizeEndpoint(`${serverUrl}/${callbackPath}`),
-    tenant: 'common', // Can be overridden via custom configuration
-    resource: 'https://graph.microsoft.com/', // Microsoft Graph API
-  }),
-  scope: ['openid', 'profile', 'email', 'User.Read'],
-  profileMapper: (profile) => {
-    // Azure AD profile structure from Microsoft Graph
-    const azureProfile = profile._json || profile;
-
-    return {
-      id: azureProfile.id || azureProfile.oid || profile.id,
-      username:
-        azureProfile.preferred_username ||
-        azureProfile.userPrincipalName ||
-        azureProfile.mail ||
-        azureProfile.email ||
-        profile.username,
-      email:
-        azureProfile.mail ||
-        azureProfile.userPrincipalName ||
-        azureProfile.email ||
-        profile.emails?.[0]?.value,
-      displayName:
-        azureProfile.displayName || azureProfile.name || profile.displayName,
-      avatarUrl: azureProfile.photo || profile.photos?.[0]?.value,
-      raw: profile,
-    };
-  },
-};

package/src/authz/providers/github.provider.ts

@@ -1,22 +0,0 @@
-import { normalizeEndpoint } from '../../mcp/utils/normalize-endpoint';
-import { OAuthProviderConfig } from './oauth-provider.interface';
-import { Strategy } from 'passport-github';
-
-export const GitHubOAuthProvider: OAuthProviderConfig = {
-  name: 'github',
-  strategy: Strategy,
-  strategyOptions: ({ serverUrl, clientId, clientSecret, callbackPath }) => ({
-    clientID: clientId,
-    clientSecret: clientSecret,
-    callbackURL: normalizeEndpoint(`${serverUrl}/${callbackPath}`),
-  }),
-  scope: ['user:email'],
-  profileMapper: (profile) => ({
-    id: profile.id,
-    username: profile.username || profile.login,
-    email: profile.emails?.[0]?.value,
-    displayName: profile.displayName || profile.name,
-    avatarUrl: profile.photos?.[0]?.value || profile.avatar_url,
-    raw: profile,
-  }),
-};

package/src/authz/providers/google.provider.ts

@@ -1,23 +0,0 @@
-import { Strategy } from 'passport-google-oauth20';
-import { normalizeEndpoint } from '../../mcp/utils/normalize-endpoint';
-import { OAuthProviderConfig } from './oauth-provider.interface';
-
-export const GoogleOAuthProvider: OAuthProviderConfig = {
-  name: 'google',
-  strategy: Strategy,
-  strategyOptions: ({ serverUrl, clientId, clientSecret, callbackPath }) => ({
-    clientID: clientId,
-    clientSecret: clientSecret,
-    callbackURL: normalizeEndpoint(`${serverUrl}/${callbackPath}`),
-    scope: ['profile', 'email'],
-  }),
-  scope: ['profile', 'email'],
-  profileMapper: (profile) => ({
-    id: profile.id,
-    username: profile.emails?.[0]?.value?.split('@')[0] || profile.id,
-    email: profile.emails?.[0]?.value,
-    displayName: profile.displayName,
-    avatarUrl: profile.photos?.[0]?.value,
-    raw: profile,
-  }),
-};

package/src/authz/providers/oauth-provider.interface.ts

@@ -1,147 +0,0 @@
-import type { IOAuthStore } from '../stores/oauth-store.interface';
-import type {
-  OAuthSession,
-  OAuthUserProfile,
-} from '../interfaces/oauth-common.interface';
-
-// Re-export common interfaces
-export type { OAuthSession, OAuthUserProfile };
-
-// Define a minimal placeholder for TypeORM options so the type remains
-// available without requiring the optional `@nestjs/typeorm` package.
-// Consumers who use the TypeORM store should install the package to get
-// the full type definitions.
-type TypeOrmModuleOptions = Record<string, unknown>;
-
-export interface OAuthProviderConfig {
-  name: string;
-  displayName?: string;
-  strategy: any; // Passport Strategy constructor
-  strategyOptions: (options: {
-    serverUrl: string;
-    clientId: string;
-    clientSecret: string;
-    callbackPath?: string; // Optional custom callback path
-  }) => any;
-  scope?: string[];
-  profileMapper: (profile: any) => OAuthUserProfile;
-}
-
-// Store configuration union type
-export type StoreConfiguration =
-  | { type: 'typeorm'; options: TypeOrmModuleOptions }
-  | { type: 'custom'; store: IOAuthStore }
-  | { type: 'memory' }
-  | undefined; // Default to memory store
-
-export interface OAuthEndpointConfiguration {
-  wellKnownAuthorizationServerMetadata?: string; // Default: '/.well-known/oauth-authorization-server'
-  wellKnownProtectedResourceMetadata?: string | string[]; // Default: '/.well-known/oauth-protected-resource'
-  register?: string; // Default: '/register'
-  authorize?: string; // Default: '/authorize'
-  callback?: string; // Default: '/callback'
-  token?: string; // Default: '/token'
-  revoke?: string; // Default: '/revoke'
-}
-
-export interface OAuthEndpointDisableOptions {
-  wellKnownAuthorizationServerMetadata?: boolean;
-  wellKnownProtectedResourceMetadata?: boolean;
-}
-
-export interface OAuthUserModuleOptions {
-  provider: OAuthProviderConfig;
-
-  // Required OAuth Provider Credentials
-  clientId: string;
-  clientSecret: string;
-
-  // Required JWT Configuration
-  jwtSecret: string;
-
-  // Server Configuration
-  serverUrl?: string;
-  resource?: string; // should be the endpoint clients connect to, e.g.: 'https://localhost:3000/mcp'
-  // JWT Configuration
-  jwtIssuer?: string;
-  jwtAudience?: string;
-  jwtAccessTokenExpiresIn?: string;
-  jwtRefreshTokenExpiresIn?: string;
-  enableRefreshTokens?: boolean;
-
-  // Cookie Configuration
-  cookieSecure?: boolean;
-  cookieMaxAge?: number;
-
-  // OAuth Session Configuration
-  oauthSessionExpiresIn?: number; // in milliseconds
-  authCodeExpiresIn?: number; // in milliseconds
-
-  // Protected Resource Metadata Configuration
-  protectedResourceMetadata?: {
-    scopesSupported?: string[];
-    bearerMethodsSupported?: string[];
-    mcpVersionsSupported?: string[];
-  };
-
-  // Authorization Server Metadata Configuration
-  authorizationServerMetadata?: {
-    responseTypesSupported?: string[];
-    responseModesSupported?: string[];
-    grantTypesSupported?: string[];
-    tokenEndpointAuthMethodsSupported?: string[];
-    scopesSupported?: string[];
-    codeChallengeMethodsSupported?: string[];
-  };
-
-  // Storage Configuration - single property for all storage options
-  storeConfiguration?: StoreConfiguration;
-  apiPrefix?: string;
-
-  // Endpoint Configuration
-  endpoints?: OAuthEndpointConfiguration;
-  disableEndpoints?: OAuthEndpointDisableOptions;
-}
-
-export interface OAuthModuleDefaults {
-  serverUrl: string;
-  resource: string; // Default resource URL
-  jwtIssuer: string;
-  jwtAudience: string;
-  jwtAccessTokenExpiresIn: string;
-  jwtRefreshTokenExpiresIn: string;
-  enableRefreshTokens: boolean;
-  cookieMaxAge: number;
-  oauthSessionExpiresIn: number;
-  authCodeExpiresIn: number;
-  nodeEnv: string;
-  apiPrefix: string;
-  endpoints: OAuthEndpointConfiguration;
-  disableEndpoints: OAuthEndpointDisableOptions;
-  protectedResourceMetadata: {
-    scopesSupported: string[];
-    bearerMethodsSupported: string[];
-    mcpVersionsSupported: string[];
-  };
-  authorizationServerMetadata: {
-    responseTypesSupported: string[];
-    responseModesSupported: string[];
-    grantTypesSupported: string[];
-    tokenEndpointAuthMethodsSupported: string[];
-    scopesSupported: string[];
-    codeChallengeMethodsSupported: string[];
-  };
-}
-
-// Resolved options after merging with defaults
-export type OAuthModuleOptions = Required<
-  Pick<
-    OAuthUserModuleOptions,
-    'provider' | 'clientId' | 'clientSecret' | 'jwtSecret'
-  >
-> &
-  Required<OAuthModuleDefaults> & {
-    // Optional fields that may remain undefined
-    cookieSecure: boolean;
-    storeConfiguration?: StoreConfiguration;
-  };