@rekog/mcp-nest 1.9.10 → 2.0.0-alpha.0

package/src/authz/services/client.service.ts

@@ -1,125 +0,0 @@
-import { BadRequestException, Injectable, Inject } from '@nestjs/common';
-import type {
-  ClientRegistrationDto,
-  IOAuthStore,
-  OAuthClient,
-} from '../stores/oauth-store.interface';
-import { randomBytes } from 'crypto';
-import type { OAuthModuleOptions } from '../providers/oauth-provider.interface';
-
-@Injectable()
-export class ClientService {
-  constructor(
-    @Inject('IOAuthStore') private readonly store: IOAuthStore,
-    @Inject('OAUTH_MODULE_OPTIONS')
-    private readonly options: OAuthModuleOptions,
-  ) {}
-
-  /**
-   * Register a client application.
-   * Always creates a new client record. client_name is not treated as unique.
-   *
-   * Note: Left open for future enhancements (e.g., software statements,
-   * URL-based Client ID Metadata Documents) via preRegistrationChecks().
-   */
-  async registerClient(
-    registrationDto: ClientRegistrationDto,
-  ): Promise<OAuthClient> {
-    // Validate required fields
-    if (
-      !registrationDto.redirect_uris ||
-      !Array.isArray(registrationDto.redirect_uris)
-    ) {
-      throw new BadRequestException(
-        'redirect_uris is required and must be an array',
-      );
-    }
-
-    // Validate token_endpoint_auth_method if provided
-    const supportedAuthMethods = [
-      'client_secret_basic',
-      'client_secret_post',
-      'none',
-    ];
-    if (
-      registrationDto.token_endpoint_auth_method &&
-      !supportedAuthMethods.includes(registrationDto.token_endpoint_auth_method)
-    ) {
-      throw new BadRequestException(
-        `Unsupported token_endpoint_auth_method. Supported methods: ${supportedAuthMethods.join(', ')}`,
-      );
-    }
-
-    // Default values for new clients
-    const defaultClientValues = {
-      grant_types: ['authorization_code', 'refresh_token'],
-      response_types: ['code'],
-      token_endpoint_auth_method:
-        registrationDto.token_endpoint_auth_method || 'none',
-    };
-
-    // Future-proofing: hook for software statements / metadata URL validations
-    await this.preRegistrationChecks(registrationDto);
-
-    const now = new Date();
-
-    // Create new client - merge defaults with registration data
-    const client_id = this.store.generateClientId(
-      registrationDto as OAuthClient,
-    );
-
-    // Only generate client_secret for methods that require it
-    const authMethod = registrationDto.token_endpoint_auth_method || 'none';
-    const client_secret =
-      authMethod !== 'none' ? randomBytes(32).toString('hex') : undefined;
-
-    const newClient: OAuthClient = {
-      ...defaultClientValues,
-      ...registrationDto,
-      client_id,
-      client_secret,
-      created_at: now,
-      updated_at: now,
-    };
-    const client = await this.store.storeClient(newClient);
-    const filteredClient = Object.fromEntries(
-      Object.entries(client).filter(([, value]) => value !== null),
-    ) as OAuthClient;
-
-    return filteredClient;
-  }
-
-  /**
-   * Hook for future registration policies (e.g., software statements per RFC 7591/7592,
-   * or URL-based Client Registration using Client ID Metadata Documents).
-   * Currently a no-op to keep behavior: always create a new client.
-   */
-
-  protected async preRegistrationChecks(
-    _dto: ClientRegistrationDto,
-  ): Promise<void> {
-    // Intentionally left blank. Implement validations/attestations in the future.
-  }
-
-  async getClient(clientId: string): Promise<OAuthClient | null> {
-    const client = await this.store.getClient(clientId);
-    if (!client) {
-      return null;
-    }
-
-    // Remove null fields from the client object
-    const filteredClient = Object.fromEntries(
-      Object.entries(client).filter(([, value]) => value !== null),
-    ) as OAuthClient;
-
-    return filteredClient;
-  }
-
-  async validateRedirectUri(
-    clientId: string,
-    redirectUri: string,
-  ): Promise<boolean> {
-    const client = await this.getClient(clientId);
-    return client ? client.redirect_uris.includes(redirectUri) : false;
-  }
-}

package/src/authz/services/jwt-token.service.spec.ts

@@ -1,67 +0,0 @@
-import { Test, TestingModule } from '@nestjs/testing';
-import * as jwt from 'jsonwebtoken';
-import { JwtTokenService } from './jwt-token.service';
-
-describe('JwtTokenService', () => {
-  const baseOptions = {
-    jwtSecret: 'a'.repeat(32),
-    jwtIssuer: 'http://localhost',
-    serverUrl: 'http://localhost',
-    jwtAccessTokenExpiresIn: '2h',
-    jwtRefreshTokenExpiresIn: '3d',
-    enableRefreshTokens: true,
-  } as any;
-
-  let service: JwtTokenService;
-
-  beforeEach(async () => {
-    const module: TestingModule = await Test.createTestingModule({
-      providers: [
-        JwtTokenService,
-        {
-          provide: 'OAUTH_MODULE_OPTIONS',
-          useValue: baseOptions,
-        },
-      ],
-    }).compile();
-
-    service = module.get(JwtTokenService);
-  });
-
-  it('generates tokens with configured expirations', () => {
-    const tokens = service.generateTokenPair(
-      'user1',
-      'client1',
-      '',
-      'resource1',
-    );
-    expect(tokens.refresh_token).toBeDefined();
-    const decoded = jwt.decode(tokens.access_token) as jwt.JwtPayload;
-    const decodedRefresh = jwt.decode(tokens.refresh_token!) as jwt.JwtPayload;
-    expect(decoded.exp! - decoded.iat!).toBe(2 * 60 * 60);
-    expect(decodedRefresh.exp! - decodedRefresh.iat!).toBe(3 * 24 * 60 * 60);
-    expect(tokens.expires_in).toBe(2 * 60 * 60);
-  });
-
-  it('can disable refresh tokens', async () => {
-    const module: TestingModule = await Test.createTestingModule({
-      providers: [
-        JwtTokenService,
-        {
-          provide: 'OAUTH_MODULE_OPTIONS',
-          useValue: { ...baseOptions, enableRefreshTokens: false },
-        },
-      ],
-    }).compile();
-
-    const serviceNoRefresh = module.get(JwtTokenService);
-    const tokens = serviceNoRefresh.generateTokenPair(
-      'user1',
-      'client1',
-      '',
-      'resource1',
-    );
-    expect(tokens.refresh_token).toBeUndefined();
-    expect(tokens.expires_in).toBe(2 * 60 * 60);
-  });
-});

package/src/authz/services/jwt-token.service.ts

@@ -1,188 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import { randomBytes } from 'crypto';
-import * as jwt from 'jsonwebtoken';
-import type { OAuthModuleOptions } from '../providers/oauth-provider.interface';
-
-export interface JwtPayload {
-  sub: string; // user_id
-  azp?: string; // authorized party (client_id for access tokens)
-  client_id?: string; // only for refresh tokens
-  scope?: string;
-  resource?: string; // MCP server resource identifier
-  type: 'access' | 'refresh' | 'user';
-  user_data?: any;
-  user_profile_id?: string;
-  iat?: number;
-  exp?: number;
-}
-
-export interface TokenPair {
-  access_token: string;
-  token_type: string;
-  expires_in: number;
-  refresh_token?: string;
-  scope?: string;
-}
-
-@Injectable()
-export class JwtTokenService {
-  private jwtSecret: string;
-  private issuer: string;
-  private accessTokenExpiresIn: string;
-  private refreshTokenExpiresIn: string;
-  private enableRefreshTokens: boolean;
-
-  constructor(@Inject('OAUTH_MODULE_OPTIONS') options: OAuthModuleOptions) {
-    // Use JWT secret from environment variable
-    const jwtSecret = options.jwtSecret;
-
-    if (!jwtSecret) {
-      throw new Error('JWT_SECRET must be set in environment variables.');
-    }
-
-    this.jwtSecret = jwtSecret;
-    this.issuer =
-      options.jwtIssuer || options.serverUrl || 'https://localhost:3000';
-    this.accessTokenExpiresIn = options.jwtAccessTokenExpiresIn;
-    this.refreshTokenExpiresIn = options.jwtRefreshTokenExpiresIn;
-    this.enableRefreshTokens = options.enableRefreshTokens;
-  }
-
-  generateTokenPair(
-    userId: string,
-    clientId: string,
-    scope = '',
-    resource?: string,
-    extras?: { user_profile_id?: string; user_data?: any },
-  ): TokenPair {
-    if (!resource) {
-      throw new Error('Resource is required for token generation');
-    }
-
-    const jti = randomBytes(16).toString('hex'); // JWT ID for tracking
-
-    const accessTokenPayload: any = {
-      sub: userId,
-      azp: clientId, // Use azp instead of client_id
-      iss: this.issuer,
-      aud: resource,
-      resource: resource, // Always include resource
-      type: 'access' as const,
-    };
-    if (extras?.user_profile_id) {
-      accessTokenPayload.user_profile_id = extras.user_profile_id;
-    }
-    if (extras?.user_data) {
-      accessTokenPayload.user_data = extras.user_data;
-    }
-
-    // Always include scope to ensure parity with refresh token claims
-    accessTokenPayload.scope = scope || '';
-
-    const accessToken = jwt.sign(accessTokenPayload, this.jwtSecret, {
-      algorithm: 'HS256',
-      expiresIn: this.accessTokenExpiresIn,
-    });
-
-    let refreshToken: string | undefined = undefined;
-    if (this.enableRefreshTokens) {
-      const refreshTokenPayload: any = {
-        sub: userId,
-        client_id: clientId,
-        scope,
-        resource,
-        type: 'refresh' as const,
-        jti: `refresh_${jti}`,
-        iss: this.issuer,
-        aud: resource,
-      };
-      if (extras?.user_profile_id) {
-        refreshTokenPayload.user_profile_id = extras.user_profile_id;
-      }
-      refreshToken = jwt.sign(refreshTokenPayload, this.jwtSecret, {
-        algorithm: 'HS256',
-        expiresIn: this.refreshTokenExpiresIn,
-      });
-    }
-
-    return {
-      access_token: accessToken,
-      token_type: 'bearer',
-      expires_in: this.parseDurationToSeconds(this.accessTokenExpiresIn),
-      ...(refreshToken ? { refresh_token: refreshToken } : {}),
-    };
-  }
-
-  validateToken(token: string): JwtPayload | null {
-    try {
-      return jwt.verify(token, this.jwtSecret, {
-        algorithms: ['HS256'],
-      }) as JwtPayload;
-    } catch {
-      return null;
-    }
-  }
-
-  refreshAccessToken(refreshToken: string): TokenPair | null {
-    if (!this.enableRefreshTokens) {
-      return null;
-    }
-
-    const payload = this.validateToken(refreshToken);
-
-    if (!payload || payload.type !== 'refresh') {
-      return null;
-    }
-
-    return this.generateTokenPair(
-      payload.sub,
-      payload.client_id!,
-      payload.scope,
-      payload.resource,
-      {
-        user_profile_id: payload.user_profile_id,
-        user_data: payload.user_data,
-      },
-    );
-  }
-
-  generateUserToken(userId: string, userData: any): string {
-    const jti = randomBytes(16).toString('hex');
-    const serverUrl = process.env.SERVER_URL || 'https://localhost:3000';
-
-    const payload = {
-      sub: userId,
-      type: 'user',
-      user_data: userData,
-      jti: `user_${jti}`,
-      iss: serverUrl,
-      aud: 'mcp-client',
-    };
-
-    return jwt.sign(payload, this.jwtSecret, {
-      algorithm: 'HS256',
-      expiresIn: '24h',
-    });
-  }
-
-  private parseDurationToSeconds(duration: string): number {
-    const match = duration.match(/^(\d+)([smhd])$/);
-    if (!match) {
-      throw new Error(`Invalid duration format: ${duration}`);
-    }
-    const value = parseInt(match[1], 10);
-    const unit = match[2];
-    switch (unit) {
-      case 's':
-        return value;
-      case 'm':
-        return value * 60;
-      case 'h':
-        return value * 60 * 60;
-      case 'd':
-        return value * 60 * 60 * 24;
-      default:
-        throw new Error(`Unsupported duration unit: ${unit}`);
-    }
-  }
-}

package/src/authz/services/oauth-strategy.service.ts

@@ -1,64 +0,0 @@
-import { Injectable, OnModuleInit, Inject, Optional } from '@nestjs/common';
-import passport from 'passport';
-import type { OAuthModuleOptions } from '../providers/oauth-provider.interface';
-
-export const STRATEGY_NAME = 'oauth-provider';
-
-@Injectable()
-export class OAuthStrategyService implements OnModuleInit {
-  private strategyName: string;
-
-  constructor(
-    @Inject('OAUTH_MODULE_OPTIONS') private options: OAuthModuleOptions,
-    @Optional() @Inject('OAUTH_MODULE_ID') private authModuleId?: string,
-  ) {
-    // Use instance-specific strategy name if authModuleId is provided
-    this.strategyName = authModuleId
-      ? `${STRATEGY_NAME}-${authModuleId}`
-      : STRATEGY_NAME;
-  }
-
-  onModuleInit() {
-    this.registerStrategy();
-  }
-
-  private registerStrategy() {
-    const provider = this.options.provider;
-
-    // Use client credentials from resolved options
-    const clientId = this.options.clientId;
-    const clientSecret = this.options.clientSecret;
-
-    // Use resolved serverUrl (no fallbacks needed)
-    const serverUrl = this.options.serverUrl;
-
-    const strategyOptions = provider.strategyOptions({
-      serverUrl,
-      clientId,
-      clientSecret,
-      callbackPath: this.options.endpoints.callback,
-    });
-
-    const strategy = new provider.strategy(
-      strategyOptions,
-      (accessToken: string, refreshToken: string, profile: any, done: any) => {
-        try {
-          const mappedProfile = provider.profileMapper(profile);
-          return done(null, {
-            profile: mappedProfile,
-            accessToken,
-            provider: provider.name,
-          });
-        } catch (error) {
-          return done(error, null);
-        }
-      },
-    );
-
-    passport.use(this.strategyName, strategy);
-  }
-
-  getStrategyName(): string {
-    return this.strategyName;
-  }
-}