@rekog/mcp-nest 1.9.10 → 2.0.0-alpha.1

package/dist/authz/mcp-oauth.controller.js

@@ -1,540 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createMcpOAuthController = createMcpOAuthController;
-const common_1 = require("@nestjs/common");
-const crypto_1 = require("crypto");
-const passport_1 = __importDefault(require("passport"));
-const normalize_endpoint_1 = require("../mcp/utils/normalize-endpoint");
-const client_service_1 = require("./services/client.service");
-const jwt_token_service_1 = require("./services/jwt-token.service");
-const oauth_strategy_service_1 = require("./services/oauth-strategy.service");
-function createMcpOAuthController(endpoints = {}, options, authModuleId) {
-    var McpOAuthController_1;
-    const OptionalGet = (path, enabled) => {
-        return enabled && path
-            ? common_1.Get(path)
-            : (() => { });
-    };
-    const OptionalHeader = (name, value, enabled) => {
-        return enabled
-            ? common_1.Header(name, value)
-            : (() => { });
-    };
-    let McpOAuthController = McpOAuthController_1 = class McpOAuthController {
-        constructor(options, store, jwtTokenService, clientService, oauthStrategyService) {
-            this.store = store;
-            this.jwtTokenService = jwtTokenService;
-            this.clientService = clientService;
-            this.oauthStrategyService = oauthStrategyService;
-            this.logger = new common_1.Logger(McpOAuthController_1.name);
-            this.serverUrl = options.serverUrl;
-            this.isProduction = options.cookieSecure;
-            this.options = options;
-            this.strategyName = oauthStrategyService.getStrategyName();
-        }
-        parseRequestBody(body, req) {
-            if (body && typeof body === 'object' && Object.keys(body).length > 0) {
-                return body;
-            }
-            if (typeof body === 'string' && body.length > 0) {
-                const params = new URLSearchParams(body);
-                const parsedBody = {};
-                for (const [key, value] of params.entries()) {
-                    parsedBody[key] = value;
-                }
-                return parsedBody;
-            }
-            if (req?.textBody) {
-                const params = new URLSearchParams(req.textBody);
-                const parsedBody = {};
-                for (const [key, value] of params.entries()) {
-                    parsedBody[key] = value;
-                }
-                return parsedBody;
-            }
-            if (req?.rawBody) {
-                const bodyString = req.rawBody.toString('utf-8');
-                if (bodyString) {
-                    const params = new URLSearchParams(bodyString);
-                    const parsedBody = {};
-                    for (const [key, value] of params.entries()) {
-                        parsedBody[key] = value;
-                    }
-                    return parsedBody;
-                }
-            }
-            return {};
-        }
-        captureRawBody(req, res, next) {
-            if (req.headers['content-type']?.includes('application/x-www-form-urlencoded')) {
-                let rawBody = '';
-                req.on('data', (chunk) => {
-                    rawBody += chunk.toString('utf-8');
-                });
-                req.on('end', () => {
-                    req.textBody = rawBody;
-                    if (rawBody) {
-                        const params = new URLSearchParams(rawBody);
-                        const parsedBody = {};
-                        for (const [key, value] of params.entries()) {
-                            parsedBody[key] = value;
-                        }
-                        req.body = parsedBody;
-                    }
-                    next();
-                });
-                req.on('error', (err) => {
-                    this.logger.error('Error reading request body:', err);
-                    next(err);
-                });
-            }
-            else {
-                next();
-            }
-        }
-        getProtectedResourceMetadata() {
-            const authorizationServerIssuer = this.options.jwtIssuer;
-            const resourceIdentifier = this.options.resource;
-            const metadata = {
-                authorization_servers: [authorizationServerIssuer],
-                resource: resourceIdentifier,
-                scopes_supported: this.options.protectedResourceMetadata.scopesSupported,
-                bearer_methods_supported: this.options.protectedResourceMetadata.bearerMethodsSupported,
-                mcp_versions_supported: this.options.protectedResourceMetadata.mcpVersionsSupported,
-            };
-            return metadata;
-        }
-        getAuthorizationServerMetadata() {
-            return {
-                issuer: this.serverUrl,
-                authorization_endpoint: (0, normalize_endpoint_1.normalizeEndpoint)(`${this.serverUrl}/${endpoints.authorize}`),
-                token_endpoint: (0, normalize_endpoint_1.normalizeEndpoint)(`${this.serverUrl}/${endpoints.token}`),
-                registration_endpoint: (0, normalize_endpoint_1.normalizeEndpoint)(`${this.serverUrl}/${endpoints.register}`),
-                response_types_supported: this.options.authorizationServerMetadata.responseTypesSupported,
-                response_modes_supported: this.options.authorizationServerMetadata.responseModesSupported,
-                grant_types_supported: this.options.authorizationServerMetadata.grantTypesSupported,
-                token_endpoint_auth_methods_supported: this.options.authorizationServerMetadata
-                    .tokenEndpointAuthMethodsSupported,
-                scopes_supported: this.options.authorizationServerMetadata.scopesSupported,
-                revocation_endpoint: (0, normalize_endpoint_1.normalizeEndpoint)(`${this.serverUrl}/${endpoints?.revoke}`),
-                code_challenge_methods_supported: this.options.authorizationServerMetadata
-                    .codeChallengeMethodsSupported,
-            };
-        }
-        async registerClient(registrationDto) {
-            return await this.clientService.registerClient(registrationDto);
-        }
-        async authorize(query, req, res, next) {
-            const { response_type, client_id, redirect_uri, code_challenge, code_challenge_method, state, scope, } = query;
-            const resource = this.options.resource;
-            if (response_type !== 'code') {
-                throw new common_1.BadRequestException('Only response_type=code is supported');
-            }
-            if (!client_id) {
-                throw new common_1.BadRequestException('Missing required parameters');
-            }
-            const client = await this.clientService.getClient(client_id);
-            if (!client) {
-                throw new common_1.BadRequestException('Invalid client_id');
-            }
-            const validRedirect = await this.clientService.validateRedirectUri(client_id, redirect_uri);
-            if (!validRedirect) {
-                throw new common_1.BadRequestException('Invalid redirect_uri');
-            }
-            const sessionId = (0, crypto_1.randomBytes)(32).toString('base64url');
-            const sessionState = (0, crypto_1.randomBytes)(32).toString('base64url');
-            const oauthSession = {
-                sessionId,
-                state: sessionState,
-                clientId: client_id,
-                redirectUri: redirect_uri,
-                codeChallenge: code_challenge,
-                codeChallengeMethod: code_challenge_method || 'plain',
-                oauthState: state,
-                scope: scope,
-                resource,
-                expiresAt: Date.now() + this.options.oauthSessionExpiresIn,
-            };
-            await this.store.storeOAuthSession(sessionId, oauthSession);
-            res.cookie('oauth_session', sessionId, {
-                httpOnly: true,
-                secure: this.isProduction,
-                maxAge: this.options.oauthSessionExpiresIn,
-            });
-            res.cookie('oauth_state', sessionState, {
-                httpOnly: true,
-                secure: this.isProduction,
-                maxAge: this.options.oauthSessionExpiresIn,
-            });
-            passport_1.default.authenticate(this.strategyName, {
-                state: req.cookies?.oauth_state,
-            })(req, res, next);
-        }
-        handleProviderCallback(req, res, next) {
-            passport_1.default.authenticate(this.strategyName, { session: false }, async (err, user) => {
-                try {
-                    if (err) {
-                        this.logger.error('OAuth callback error:', err);
-                        throw new common_1.BadRequestException('Authentication failed');
-                    }
-                    if (!user) {
-                        throw new common_1.BadRequestException('Authentication failed');
-                    }
-                    req.user = user;
-                    await this.processAuthenticationSuccess(req, res);
-                }
-                catch (error) {
-                    next(error);
-                }
-            })(req, res, next);
-        }
-        async processAuthenticationSuccess(req, res) {
-            const user = req.user;
-            if (!user) {
-                throw new common_1.BadRequestException('Authentication failed');
-            }
-            const sessionId = req.cookies?.oauth_session;
-            if (!sessionId) {
-                throw new common_1.BadRequestException('Missing OAuth session');
-            }
-            const session = await this.store.getOAuthSession(sessionId);
-            if (!session) {
-                throw new common_1.BadRequestException('Invalid or expired OAuth session');
-            }
-            const stateFromCookie = req.cookies?.oauth_state;
-            if (session.state !== stateFromCookie) {
-                throw new common_1.BadRequestException('Invalid state parameter');
-            }
-            const jwt = this.jwtTokenService.generateUserToken(user.profile.username, user.profile);
-            res.cookie('auth_token', jwt, {
-                httpOnly: true,
-                secure: this.isProduction,
-                maxAge: this.options.cookieMaxAge,
-            });
-            res.clearCookie('oauth_session');
-            res.clearCookie('oauth_state');
-            const user_profile_id = await this.store.upsertUserProfile(user.profile, user.provider);
-            const authCode = (0, crypto_1.randomBytes)(32).toString('base64url');
-            await this.store.storeAuthCode({
-                code: authCode,
-                user_id: user.profile.username,
-                client_id: session.clientId,
-                redirect_uri: session.redirectUri,
-                code_challenge: session.codeChallenge,
-                code_challenge_method: session.codeChallengeMethod,
-                expires_at: Date.now() + this.options.authCodeExpiresIn,
-                resource: session.resource,
-                scope: session.scope,
-                user_profile_id,
-            });
-            const redirectUrl = new URL(session.redirectUri);
-            redirectUrl.searchParams.set('code', authCode);
-            if (session.oauthState) {
-                redirectUrl.searchParams.set('state', session.oauthState);
-            }
-            await this.store.removeOAuthSession(sessionId);
-            res.redirect(redirectUrl.toString());
-        }
-        async exchangeToken(body, req, res) {
-            const isFormUrlEncoded = req.headers['content-type']?.includes('application/x-www-form-urlencoded');
-            const isBodyEmpty = !body ||
-                (typeof body === 'object' &&
-                    Object.keys(body).length === 0);
-            if (isFormUrlEncoded && isBodyEmpty) {
-                return new Promise((resolve, reject) => {
-                    this.captureRawBody(req, res, (err) => {
-                        if (err) {
-                            reject(err instanceof Error ? err : new Error(String(err ?? 'error')));
-                            return;
-                        }
-                        void (async () => {
-                            try {
-                                const parsedBody = this.parseRequestBody(req.body || body, req);
-                                const result = await this.processTokenExchange(parsedBody, req);
-                                resolve(result);
-                            }
-                            catch (error) {
-                                reject(error instanceof Error
-                                    ? error
-                                    : new Error(String(error ?? 'error')));
-                            }
-                        })();
-                    });
-                });
-            }
-            const parsedBody = this.parseRequestBody(body, req);
-            return this.processTokenExchange(parsedBody, req);
-        }
-        async processTokenExchange(parsedBody, req) {
-            const { grant_type, code, code_verifier, redirect_uri, refresh_token } = parsedBody;
-            if (!grant_type) {
-                this.logger.error('Missing grant_type in request body:', {
-                    parsedBodyKeys: Object.keys(parsedBody),
-                    contentType: req.headers['content-type'],
-                    textBody: req.textBody,
-                    parsedBody,
-                });
-                throw new common_1.BadRequestException('Missing grant_type parameter');
-            }
-            switch (grant_type) {
-                case 'authorization_code': {
-                    const clientCredentials = this.extractClientCredentials(req, parsedBody);
-                    return await this.handleAuthorizationCodeGrant(typeof code === 'string' ? code : String(code ?? ''), typeof code_verifier === 'string'
-                        ? code_verifier
-                        : String(code_verifier ?? ''), typeof redirect_uri === 'string'
-                        ? redirect_uri
-                        : String(redirect_uri ?? ''), clientCredentials);
-                }
-                case 'refresh_token': {
-                    let clientCredentials;
-                    try {
-                        clientCredentials = this.extractClientCredentials(req, parsedBody);
-                    }
-                    catch {
-                        clientCredentials = { client_id: '' };
-                    }
-                    return await this.handleRefreshTokenGrant(typeof refresh_token === 'string'
-                        ? refresh_token
-                        : String(refresh_token ?? ''), clientCredentials);
-                }
-                default:
-                    throw new common_1.BadRequestException(`Unsupported grant_type: ${grant_type}`);
-            }
-        }
-        extractClientCredentials(req, body) {
-            const parsedBody = this.parseRequestBody(body, req);
-            const authHeader = req.headers?.authorization;
-            if (authHeader && authHeader.startsWith('Basic ')) {
-                const credentials = Buffer.from(authHeader.slice(6), 'base64').toString('utf-8');
-                const [client_id, client_secret] = credentials.split(':', 2);
-                if (client_id) {
-                    return { client_id, client_secret };
-                }
-            }
-            if (parsedBody.client_id) {
-                return {
-                    client_id: parsedBody.client_id,
-                    client_secret: parsedBody.client_secret,
-                };
-            }
-            throw new common_1.BadRequestException('Missing client credentials');
-        }
-        validateClientAuthentication(client, clientCredentials) {
-            if (!client) {
-                throw new common_1.BadRequestException('Invalid client_id');
-            }
-            const { token_endpoint_auth_method } = client;
-            switch (token_endpoint_auth_method) {
-                case 'client_secret_basic':
-                case 'client_secret_post':
-                    if (!clientCredentials.client_secret) {
-                        throw new common_1.BadRequestException('Client secret required for this authentication method');
-                    }
-                    if (client.client_secret !== clientCredentials.client_secret) {
-                        throw new common_1.BadRequestException('Invalid client credentials');
-                    }
-                    break;
-                case 'none':
-                    if (clientCredentials.client_secret) {
-                        throw new common_1.BadRequestException('Client secret not allowed for public clients');
-                    }
-                    break;
-                default:
-                    throw new common_1.BadRequestException(`Unsupported authentication method: ${token_endpoint_auth_method}`);
-            }
-        }
-        async handleAuthorizationCodeGrant(code, code_verifier, _redirect_uri, clientCredentials) {
-            this.logger.debug('handleAuthorizationCodeGrant - Params:', {
-                code,
-                client_id: clientCredentials.client_id,
-            });
-            const authCode = await this.store.getAuthCode(code);
-            if (!authCode) {
-                this.logger.error('handleAuthorizationCodeGrant - Invalid authorization code:', code);
-                throw new common_1.BadRequestException('Invalid authorization code');
-            }
-            if (authCode.expires_at < Date.now()) {
-                await this.store.removeAuthCode(code);
-                this.logger.error('handleAuthorizationCodeGrant - Authorization code expired:', code);
-                throw new common_1.BadRequestException('Authorization code has expired');
-            }
-            if (authCode.client_id !== clientCredentials.client_id) {
-                this.logger.error('handleAuthorizationCodeGrant - Client ID mismatch:', { expected: authCode.client_id, got: clientCredentials.client_id });
-                throw new common_1.BadRequestException('Client ID mismatch');
-            }
-            const client = await this.clientService.getClient(clientCredentials.client_id);
-            this.validateClientAuthentication(client, clientCredentials);
-            if (authCode.code_challenge) {
-                const isValid = this.validatePKCE(code_verifier, authCode.code_challenge, authCode.code_challenge_method);
-                if (!isValid) {
-                    this.logger.error('handleAuthorizationCodeGrant - Invalid PKCE verification');
-                    throw new common_1.BadRequestException('Invalid PKCE verification');
-                }
-            }
-            if (!authCode.resource) {
-                this.logger.error('handleAuthorizationCodeGrant - No resource associated with code');
-                throw new common_1.BadRequestException('Authorization code is not associated with a resource');
-            }
-            let userData = undefined;
-            if (authCode.user_profile_id) {
-                try {
-                    const profile = await this.store.getUserProfileById(authCode.user_profile_id);
-                    if (profile) {
-                        userData = { ...profile };
-                    }
-                }
-                catch (e) {
-                    this.logger.warn('Failed to load user profile for token payload', e);
-                }
-            }
-            const tokens = this.jwtTokenService.generateTokenPair(authCode.user_id, clientCredentials.client_id, authCode.scope, authCode.resource, {
-                user_profile_id: authCode.user_profile_id,
-                user_data: userData,
-            });
-            await this.store.removeAuthCode(code);
-            this.logger.debug('handleAuthorizationCodeGrant - Token pair generated for user:', authCode.user_id);
-            return tokens;
-        }
-        async handleRefreshTokenGrant(refresh_token, clientCredentials) {
-            const payload = this.jwtTokenService.validateToken(refresh_token);
-            if (!payload || payload.type !== 'refresh') {
-                throw new common_1.BadRequestException('Invalid or expired refresh token');
-            }
-            const clientId = clientCredentials.client_id || payload.client_id;
-            if (!clientId) {
-                throw new common_1.BadRequestException('Unable to determine client_id');
-            }
-            const client = await this.clientService.getClient(clientId);
-            if (client?.token_endpoint_auth_method !== 'none') {
-                this.validateClientAuthentication(client, {
-                    ...clientCredentials,
-                    client_id: clientId,
-                });
-            }
-            if (payload.client_id !== clientId) {
-                throw new common_1.BadRequestException('Invalid refresh token or token does not belong to this client');
-            }
-            let newTokens = null;
-            try {
-                const payload = this.jwtTokenService.validateToken(refresh_token);
-                if (!payload || payload.type !== 'refresh') {
-                    throw new common_1.BadRequestException('Invalid or expired refresh token');
-                }
-                let userData = undefined;
-                if (payload.user_profile_id) {
-                    try {
-                        const profile = await this.store.getUserProfileById(payload.user_profile_id);
-                        if (profile)
-                            userData = { ...profile };
-                    }
-                    catch (e) {
-                        this.logger.warn('Failed to load user profile for refreshed token payload', e);
-                    }
-                }
-                newTokens = this.jwtTokenService.generateTokenPair(payload.sub, clientId, payload.scope, payload.resource, {
-                    user_profile_id: payload.user_profile_id,
-                    user_data: userData,
-                });
-            }
-            catch (e) {
-                this.logger.warn('Refresh flow failed using enriched path, fallback', e);
-                newTokens = this.jwtTokenService.refreshAccessToken(refresh_token);
-            }
-            if (!newTokens)
-                throw new common_1.BadRequestException('Failed to refresh token');
-            return newTokens;
-        }
-        validatePKCE(code_verifier, code_challenge, method) {
-            if (method === 'plain') {
-                return code_verifier === code_challenge;
-            }
-            else if (method === 'S256') {
-                const hash = (0, crypto_1.createHash)('sha256')
-                    .update(code_verifier)
-                    .digest('base64url');
-                return hash === code_challenge;
-            }
-            return false;
-        }
-    };
-    __decorate([
-        OptionalGet(endpoints.wellKnownProtectedResourceMetadata, !options?.disableWellKnownProtectedResourceMetadata),
-        OptionalHeader('content-type', 'application/json', !options?.disableWellKnownProtectedResourceMetadata),
-        __metadata("design:type", Function),
-        __metadata("design:paramtypes", []),
-        __metadata("design:returntype", void 0)
-    ], McpOAuthController.prototype, "getProtectedResourceMetadata", null);
-    __decorate([
-        OptionalGet(endpoints.wellKnownAuthorizationServerMetadata, !options?.disableWellKnownAuthorizationServerMetadata),
-        OptionalHeader('content-type', 'application/json', !options?.disableWellKnownAuthorizationServerMetadata),
-        __metadata("design:type", Function),
-        __metadata("design:paramtypes", []),
-        __metadata("design:returntype", void 0)
-    ], McpOAuthController.prototype, "getAuthorizationServerMetadata", null);
-    __decorate([
-        (0, common_1.Post)(endpoints.register),
-        __param(0, (0, common_1.Body)()),
-        __metadata("design:type", Function),
-        __metadata("design:paramtypes", [Object]),
-        __metadata("design:returntype", Promise)
-    ], McpOAuthController.prototype, "registerClient", null);
-    __decorate([
-        (0, common_1.Get)(endpoints.authorize),
-        __param(0, (0, common_1.Query)()),
-        __param(1, (0, common_1.Req)()),
-        __param(2, (0, common_1.Res)()),
-        __param(3, (0, common_1.Next)()),
-        __metadata("design:type", Function),
-        __metadata("design:paramtypes", [Object, Object, Object, Function]),
-        __metadata("design:returntype", Promise)
-    ], McpOAuthController.prototype, "authorize", null);
-    __decorate([
-        (0, common_1.Get)(endpoints.callback),
-        __param(0, (0, common_1.Req)()),
-        __param(1, (0, common_1.Res)()),
-        __param(2, (0, common_1.Next)()),
-        __metadata("design:type", Function),
-        __metadata("design:paramtypes", [Object, Object, Function]),
-        __metadata("design:returntype", void 0)
-    ], McpOAuthController.prototype, "handleProviderCallback", null);
-    __decorate([
-        (0, common_1.Post)(endpoints.token),
-        (0, common_1.Header)('content-type', 'application/json'),
-        (0, common_1.Header)('Cache-Control', 'no-store'),
-        (0, common_1.Header)('Pragma', 'no-cache'),
-        (0, common_1.HttpCode)(200),
-        __param(0, (0, common_1.Body)()),
-        __param(1, (0, common_1.Req)()),
-        __param(2, (0, common_1.Res)({ passthrough: true })),
-        __metadata("design:type", Function),
-        __metadata("design:paramtypes", [Object, Object, Object]),
-        __metadata("design:returntype", Promise)
-    ], McpOAuthController.prototype, "exchangeToken", null);
-    McpOAuthController = McpOAuthController_1 = __decorate([
-        (0, common_1.Controller)(),
-        __param(0, (0, common_1.Inject)(authModuleId
-            ? `OAUTH_MODULE_OPTIONS_${authModuleId}`
-            : 'OAUTH_MODULE_OPTIONS')),
-        __param(1, (0, common_1.Inject)(authModuleId ? `IOAuthStore_${authModuleId}` : 'IOAuthStore')),
-        __metadata("design:paramtypes", [Object, Object, jwt_token_service_1.JwtTokenService,
-            client_service_1.ClientService,
-            oauth_strategy_service_1.OAuthStrategyService])
-    ], McpOAuthController);
-    return McpOAuthController;
-}
-//# sourceMappingURL=mcp-oauth.controller.js.map

package/dist/authz/mcp-oauth.controller.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-oauth.controller.js","sourceRoot":"","sources":["../../src/authz/mcp-oauth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAgDA,4DA2yBC;AA31BD,2CAcwB;AACxB,mCAAiD;AAMjD,wDAAgC;AAChC,wEAAoE;AAOpE,8DAA0D;AAC1D,oEAA0E;AAC1E,8EAAyE;AAiBzE,SAAgB,wBAAwB,CACtC,YAAwC,EAAE,EAC1C,OAGC,EACD,YAAqB;;IAGrB,MAAM,WAAW,GAAG,CAClB,IAAmC,EACnC,OAAgB,EACC,EAAE;QACnB,OAAO,OAAO,IAAI,IAAI;YACpB,CAAC,CAAE,YAA+C,CAAC,IAAI,CAAC;YACxD,CAAC,CAAE,CAAC,GAAG,EAAE,GAAE,CAAC,CAAgC,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,CACrB,IAAY,EACZ,KAAa,EACb,OAAgB,EACC,EAAE;QACnB,OAAO,OAAO;YACZ,CAAC,CAAE,eAA+D,CAC9D,IAAI,EACJ,KAAK,CACN;YACH,CAAC,CAAE,CAAC,GAAG,EAAE,GAAE,CAAC,CAAgC,CAAC;IACjD,CAAC,CAAC;IAEF,IACM,kBAAkB,0BADxB,MACM,kBAAkB;QAOtB,YAME,OAA2B,EAE3B,KAA2B,EAClB,eAAgC,EAChC,aAA4B,EAC5B,oBAA0C;YAH1C,UAAK,GAAL,KAAK,CAAa;YAClB,oBAAe,GAAf,eAAe,CAAiB;YAChC,kBAAa,GAAb,aAAa,CAAe;YAC5B,yBAAoB,GAApB,oBAAoB,CAAsB;YAjB5C,WAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;YAmBpD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACnC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC,eAAe,EAAE,CAAC;QAC7D,CAAC;QAMD,gBAAgB,CAAC,IAAS,EAAE,GAAwB;YAElD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;YAGD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;gBACzC,MAAM,UAAU,GAAwB,EAAE,CAAC;gBAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC5C,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC1B,CAAC;gBACD,OAAO,UAAU,CAAC;YACpB,CAAC;YAGD,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjD,MAAM,UAAU,GAAwB,EAAE,CAAC;gBAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC5C,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC1B,CAAC;gBACD,OAAO,UAAU,CAAC;YACpB,CAAC;YAGD,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;oBAC/C,MAAM,UAAU,GAAwB,EAAE,CAAC;oBAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;wBAC5C,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;oBAC1B,CAAC;oBACD,OAAO,UAAU,CAAC;gBACpB,CAAC;YACH,CAAC;YAGD,OAAO,EAAE,CAAC;QACZ,CAAC;QAMD,cAAc,CAAC,GAAuB,EAAE,GAAa,EAAE,IAAkB;YACvE,IACE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CACnC,mCAAmC,CACpC,EACD,CAAC;gBACD,IAAI,OAAO,GAAG,EAAE,CAAC;gBAEjB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACrC,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;oBAEvB,IAAI,OAAO,EAAE,CAAC;wBACZ,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;wBAC5C,MAAM,UAAU,GAAQ,EAAE,CAAC;wBAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;4BAC5C,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;wBAC1B,CAAC;wBACA,GAAW,CAAC,IAAI,GAAG,UAAU,CAAC;oBACjC,CAAC;oBACD,IAAI,EAAE,CAAC;gBACT,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;oBACtD,IAAI,CAAC,GAAG,CAAC,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,EAAE,CAAC;YACT,CAAC;QACH,CAAC;QAWD,4BAA4B;YAE1B,MAAM,yBAAyB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAGzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAEjD,MAAM,QAAQ,GAAG;gBAKf,qBAAqB,EAAE,CAAC,yBAAyB,CAAC;gBAMlD,QAAQ,EAAE,kBAAkB;gBAM5B,gBAAgB,EACd,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,eAAe;gBAMxD,wBAAwB,EACtB,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,sBAAsB;gBAM/D,sBAAsB,EACpB,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,oBAAoB;aAC9D,CAAC;YAEF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAYD,8BAA8B;YAC5B,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,SAAS;gBACtB,sBAAsB,EAAE,IAAA,sCAAiB,EACvC,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,CAC3C;gBACD,cAAc,EAAE,IAAA,sCAAiB,EAC/B,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,EAAE,CACvC;gBACD,qBAAqB,EAAE,IAAA,sCAAiB,EACtC,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,EAAE,CAC1C;gBACD,wBAAwB,EACtB,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,sBAAsB;gBACjE,wBAAwB,EACtB,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,sBAAsB;gBACjE,qBAAqB,EACnB,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,mBAAmB;gBAC9D,qCAAqC,EACnC,IAAI,CAAC,OAAO,CAAC,2BAA2B;qBACrC,iCAAiC;gBACtC,gBAAgB,EACd,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,eAAe;gBAC1D,mBAAmB,EAAE,IAAA,sCAAiB,EACpC,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,EAAE,MAAM,EAAE,CACzC;gBACD,gCAAgC,EAC9B,IAAI,CAAC,OAAO,CAAC,2BAA2B;qBACrC,6BAA6B;aACnC,CAAC;QACJ,CAAC;QAGK,AAAN,KAAK,CAAC,cAAc,CAAS,eAAoB;YAC/C,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAClE,CAAC;QAGK,AAAN,KAAK,CAAC,SAAS,CACJ,KAAU,EAEnB,GAAQ,EACD,GAAa,EACZ,IAAkB;YAE1B,MAAM,EACJ,aAAa,EACb,SAAS,EACT,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,KAAK,EACL,KAAK,GACN,GAAG,KAAK,CAAC;YACV,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACvC,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;YAC/D,CAAC;YAGD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,4BAAmB,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAChE,SAAS,EACT,YAAY,CACb,CAAC;YACF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;YACxD,CAAC;YAGD,MAAM,SAAS,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxD,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAE3D,MAAM,YAAY,GAAiB;gBACjC,SAAS;gBACT,KAAK,EAAE,YAAY;gBACnB,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE,YAAY;gBACzB,aAAa,EAAE,cAAc;gBAC7B,mBAAmB,EAAE,qBAAqB,IAAI,OAAO;gBACrD,UAAU,EAAE,KAAK;gBACjB,KAAK,EAAE,KAAK;gBACZ,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB;aAC3D,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAG5D,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,EAAE;gBACrC,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAGH,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE;gBACtC,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAGH,kBAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE;gBACvC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW;aAChC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC;QAGD,sBAAsB,CACb,GAAyB,EACzB,GAAa,EACZ,IAAkB;YAG1B,kBAAQ,CAAC,YAAY,CACnB,IAAI,CAAC,YAAY,EACjB,EAAE,OAAO,EAAE,KAAK,EAAE,EAClB,KAAK,EAAE,GAAQ,EAAE,IAAS,EAAE,EAAE;gBAC5B,IAAI,CAAC;oBACH,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;wBAChD,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;oBACzD,CAAC;oBAED,IAAI,CAAC,IAAI,EAAE,CAAC;wBACV,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;oBACzD,CAAC;oBAED,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;oBAChB,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,KAAK,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CACF,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,4BAA4B,CAChC,GAAyB,EACzB,GAAa;YAEb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;YAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;YACpE,CAAC;YAGD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC;YACjD,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBACtC,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;YAC3D,CAAC;YAGD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,EACrB,IAAI,CAAC,OAAO,CACb,CAAC;YAGF,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;gBAC5B,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;aAClC,CAAC,CAAC;YAGH,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YACjC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YAG/B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CACxD,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,CACd,CAAC;YAGF,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAGvD,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBAC7B,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC9B,SAAS,EAAE,OAAO,CAAC,QAAS;gBAC5B,YAAY,EAAE,OAAO,CAAC,WAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,aAAc;gBACtC,qBAAqB,EAAE,OAAO,CAAC,mBAAoB;gBACnD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB;gBACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,eAAe;aAChB,CAAC,CAAC;YAGH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAY,CAAC,CAAC;YAClD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAC5D,CAAC;YAGD,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAE/C,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvC,CAAC;QAOK,AAAN,KAAK,CAAC,aAAa,CACT,IAAS,EACV,GAAuB,EACF,GAAa;YAGzC,MAAM,gBAAgB,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAC5D,mCAAmC,CACpC,CAAC;YACF,MAAM,WAAW,GACf,CAAC,IAAI;gBACL,CAAC,OAAO,IAAI,KAAK,QAAQ;oBACvB,MAAM,CAAC,IAAI,CAAC,IAA+B,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;YAE/D,IAAI,gBAAgB,IAAI,WAAW,EAAE,CAAC;gBACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBACrC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAS,EAAE,EAAE;wBAC1C,IAAI,GAAG,EAAE,CAAC;4BACR,MAAM,CACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAC/D,CAAC;4BACF,OAAO;wBACT,CAAC;wBAGD,KAAK,CAAC,KAAK,IAAI,EAAE;4BACf,IAAI,CAAC;gCAEH,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC;gCAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gCAChE,OAAO,CAAC,MAAM,CAAC,CAAC;4BAClB,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,MAAM,CACJ,KAAK,YAAY,KAAK;oCACpB,CAAC,CAAC,KAAK;oCACP,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,CACxC,CAAC;4BACJ,CAAC;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;YAGD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,UAA+B,EAC/B,GAAuB;YAEvB,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,GACpE,UAAU,CAAC;YAGb,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;oBACvD,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;oBACvC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;oBACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;YAChE,CAAC;YAED,QAAQ,UAAU,EAAE,CAAC;gBACnB,KAAK,oBAAoB,CAAC,CAAC,CAAC;oBAE1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CACrD,GAAG,EACH,UAAU,CACX,CAAC;oBACF,OAAO,MAAM,IAAI,CAAC,4BAA4B,CAC5C,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EACpD,OAAO,aAAa,KAAK,QAAQ;wBAC/B,CAAC,CAAC,aAAa;wBACf,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,EAC/B,OAAO,YAAY,KAAK,QAAQ;wBAC9B,CAAC,CAAC,YAAY;wBACd,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAC9B,iBAAiB,CAClB,CAAC;gBACJ,CAAC;gBACD,KAAK,eAAe,CAAC,CAAC,CAAC;oBAErB,IAAI,iBAAgE,CAAC;oBACrE,IAAI,CAAC;wBACH,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;oBACrE,CAAC;oBAAC,MAAM,CAAC;wBAEP,iBAAiB,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;oBACxC,CAAC;oBACD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CACvC,OAAO,aAAa,KAAK,QAAQ;wBAC/B,CAAC,CAAC,aAAa;wBACf,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,EAC/B,iBAAiB,CAClB,CAAC;gBACJ,CAAC;gBACD;oBACE,MAAM,IAAI,4BAAmB,CAC3B,2BAA2B,UAAU,EAAE,CACxC,CAAC;YACN,CAAC;QACH,CAAC;QAKD,wBAAwB,CACtB,GAAuB,EACvB,IAAS;YAGT,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAGpD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CACrE,OAAO,CACR,CAAC;gBACF,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC7D,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;gBACtC,CAAC;YACH,CAAC;YAGD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;gBACzB,OAAO;oBACL,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;iBACxC,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAKD,4BAA4B,CAC1B,MAAW,EACX,iBAAgE;YAEhE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,4BAAmB,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,CAAC;YAE9C,QAAQ,0BAA0B,EAAE,CAAC;gBACnC,KAAK,qBAAqB,CAAC;gBAC3B,KAAK,oBAAoB;oBACvB,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC;wBACrC,MAAM,IAAI,4BAAmB,CAC3B,uDAAuD,CACxD,CAAC;oBACJ,CAAC;oBACD,IAAI,MAAM,CAAC,aAAa,KAAK,iBAAiB,CAAC,aAAa,EAAE,CAAC;wBAC7D,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;oBAC9D,CAAC;oBACD,MAAM;gBAER,KAAK,MAAM;oBAET,IAAI,iBAAiB,CAAC,aAAa,EAAE,CAAC;wBACpC,MAAM,IAAI,4BAAmB,CAC3B,8CAA8C,CAC/C,CAAC;oBACJ,CAAC;oBACD,MAAM;gBAER;oBACE,MAAM,IAAI,4BAAmB,CAC3B,sCAAsC,0BAA0B,EAAE,CACnE,CAAC;YACN,CAAC;QACH,CAAC;QAED,KAAK,CAAC,4BAA4B,CAChC,IAAY,EACZ,aAAqB,EACrB,aAAqB,EACrB,iBAAgE;YAEhE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;gBAC1D,IAAI;gBACJ,SAAS,EAAE,iBAAiB,CAAC,SAAS;aACvC,CAAC,CAAC;YAGH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4DAA4D,EAC5D,IAAI,CACL,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4DAA4D,EAC5D,IAAI,CACL,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAAC,gCAAgC,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,QAAQ,CAAC,SAAS,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,oDAAoD,EACpD,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,EAAE,CACnE,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;YACtD,CAAC;YAGD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAC/C,iBAAiB,CAAC,SAAS,CAC5B,CAAC;YACF,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAC7D,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAC/B,aAAa,EACb,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,qBAAqB,CAC/B,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0DAA0D,CAC3D,CAAC;oBACF,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,iEAAiE,CAClE,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAC3B,sDAAsD,CACvD,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,GAAwC,SAAS,CAAC;YAC9D,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CACjD,QAAQ,CAAC,eAAe,CACzB,CAAC;oBACF,IAAI,OAAO,EAAE,CAAC;wBAEZ,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CACnD,QAAQ,CAAC,OAAO,EAChB,iBAAiB,CAAC,SAAS,EAC3B,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,QAAQ,EACjB;gBACE,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,SAAS,EAAE,QAAQ;aACpB,CACF,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+DAA+D,EAC/D,QAAQ,CAAC,OAAO,CACjB,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,uBAAuB,CAC3B,aAAqB,EACrB,iBAAgE;YAGhE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;YACpE,CAAC;YAGD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC;YAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;YACjE,CAAC;YAGD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAI5D,IAAI,MAAM,EAAE,0BAA0B,KAAK,MAAM,EAAE,CAAC;gBAClD,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE;oBACxC,GAAG,iBAAiB;oBACpB,SAAS,EAAE,QAAQ;iBACpB,CAAC,CAAC;YACL,CAAC;YAGD,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,IAAI,4BAAmB,CAC3B,+DAA+D,CAChE,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,GAAqB,IAAI,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;gBAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;gBACpE,CAAC;gBAED,IAAI,QAAQ,GAAwC,SAAS,CAAC;gBAC9D,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;oBAC5B,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CACjD,OAAO,CAAC,eAAe,CACxB,CAAC;wBACF,IAAI,OAAO;4BAAE,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;oBACzC,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yDAAyD,EACzD,CAAC,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAChD,OAAO,CAAC,GAAG,EACX,QAAQ,EACR,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,EAChB;oBACE,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,SAAS,EAAE,QAAQ;iBACpB,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mDAAmD,EACnD,CAAC,CACF,CAAC;gBACF,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YACrE,CAAC;YAED,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,YAAY,CACV,aAAqB,EACrB,cAAsB,EACtB,MAAc;YAEd,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO,aAAa,KAAK,cAAc,CAAC;YAC1C,CAAC;iBAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;qBAC9B,MAAM,CAAC,aAAa,CAAC;qBACrB,MAAM,CAAC,WAAW,CAAC,CAAC;gBACvB,OAAO,IAAI,KAAK,cAAc,CAAC;YACjC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAA;IAhpBC;QATC,WAAW,CACV,SAAS,CAAC,kCAAkC,EAC5C,CAAC,OAAO,EAAE,yCAAyC,CACpD;QACA,cAAc,CACb,cAAc,EACd,kBAAkB,EAClB,CAAC,OAAO,EAAE,yCAAyC,CACpD;;;;0EA4CA;IAYD;QATC,WAAW,CACV,SAAS,CAAC,oCAAoC,EAC9C,CAAC,OAAO,EAAE,2CAA2C,CACtD;QACA,cAAc,CACb,cAAc,EACd,kBAAkB,EAClB,CAAC,OAAO,EAAE,2CAA2C,CACtD;;;;4EA+BA;IAGK;QADL,IAAA,aAAI,EAAC,SAAS,CAAC,QAAQ,CAAC;QACH,WAAA,IAAA,aAAI,GAAE,CAAA;;;;4DAE3B;IAGK;QADL,IAAA,YAAG,EAAC,SAAS,CAAC,SAAS,CAAC;QAEtB,WAAA,IAAA,cAAK,GAAE,CAAA;QACP,WAAA,IAAA,YAAG,GAAE,CAAA;QAEL,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,aAAI,GAAE,CAAA;;;;uDAuER;IAGD;QADC,IAAA,YAAG,EAAC,SAAS,CAAC,QAAQ,CAAC;QAErB,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,aAAI,GAAE,CAAA;;;;oEAwBR;IAqFK;QALL,IAAA,aAAI,EAAC,SAAS,CAAC,KAAK,CAAC;QACrB,IAAA,eAAM,EAAC,cAAc,EAAE,kBAAkB,CAAC;QAC1C,IAAA,eAAM,EAAC,eAAe,EAAE,UAAU,CAAC;QACnC,IAAA,eAAM,EAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAA,iBAAQ,EAAC,GAAG,CAAC;QAEX,WAAA,IAAA,aAAI,GAAE,CAAA;QACN,WAAA,IAAA,YAAG,GAAE,CAAA;QACL,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;2DA2C5B;IAncG,kBAAkB;QADvB,IAAA,mBAAU,GAAE;QASR,WAAA,IAAA,eAAM,EACL,YAAY;YACV,CAAC,CAAC,wBAAwB,YAAY,EAAE;YACxC,CAAC,CAAC,sBAAsB,CAC3B,CAAA;QAEA,WAAA,IAAA,eAAM,EAAC,YAAY,CAAC,CAAC,CAAC,eAAe,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;yDAE3C,mCAAe;YACjB,8BAAa;YACN,6CAAoB;OAlBjD,kBAAkB,CAywBvB;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import {\n  BadRequestException,\n  Body,\n  Controller,\n  Get,\n  Header,\n  HttpCode,\n  Inject,\n  Logger,\n  Next,\n  Post,\n  Query,\n  Req,\n  Res,\n} from '@nestjs/common';\nimport { createHash, randomBytes } from 'crypto';\nimport type {\n  Request as ExpressRequest,\n  NextFunction,\n  Response,\n} from 'express';\nimport passport from 'passport';\nimport { normalizeEndpoint } from '../mcp/utils/normalize-endpoint';\nimport type {\n  OAuthEndpointConfiguration,\n  OAuthModuleOptions,\n  OAuthSession,\n  OAuthUserProfile,\n} from './providers/oauth-provider.interface';\nimport { ClientService } from './services/client.service';\nimport { JwtTokenService, TokenPair } from './services/jwt-token.service';\nimport { OAuthStrategyService } from './services/oauth-strategy.service';\nimport type { IOAuthStore } from './stores/oauth-store.interface';\n\ninterface OAuthCallbackRequest extends ExpressRequest {\n  user?: {\n    profile: OAuthUserProfile;\n    accessToken: string;\n    provider: string;\n  };\n}\n\n// Add this interface to properly type the Express request with raw body\ninterface RequestWithRawBody extends ExpressRequest {\n  rawBody?: Buffer;\n  textBody?: string;\n}\n\nexport function createMcpOAuthController(\n  endpoints: OAuthEndpointConfiguration = {},\n  options?: {\n    disableWellKnownProtectedResourceMetadata?: boolean;\n    disableWellKnownAuthorizationServerMetadata?: boolean;\n  },\n  authModuleId?: string,\n) {\n  // Optional decorator helpers\n  const OptionalGet = (\n    path: string | string[] | undefined,\n    enabled: boolean,\n  ): MethodDecorator => {\n    return enabled && path\n      ? (Get as unknown as (p?: any) => MethodDecorator)(path)\n      : ((() => {}) as unknown as MethodDecorator);\n  };\n  const OptionalHeader = (\n    name: string,\n    value: string,\n    enabled: boolean,\n  ): MethodDecorator => {\n    return enabled\n      ? (Header as unknown as (n: string, v: string) => MethodDecorator)(\n          name,\n          value,\n        )\n      : ((() => {}) as unknown as MethodDecorator);\n  };\n\n  @Controller()\n  class McpOAuthController {\n    readonly logger = new Logger(McpOAuthController.name);\n    readonly serverUrl: string;\n    readonly isProduction: boolean;\n    readonly options: OAuthModuleOptions;\n    readonly strategyName: string;\n\n    constructor(\n      @Inject(\n        authModuleId\n          ? `OAUTH_MODULE_OPTIONS_${authModuleId}`\n          : 'OAUTH_MODULE_OPTIONS',\n      )\n      options: OAuthModuleOptions,\n      @Inject(authModuleId ? `IOAuthStore_${authModuleId}` : 'IOAuthStore')\n      readonly store: IOAuthStore,\n      readonly jwtTokenService: JwtTokenService,\n      readonly clientService: ClientService,\n      readonly oauthStrategyService: OAuthStrategyService,\n    ) {\n      this.serverUrl = options.serverUrl;\n      this.isProduction = options.cookieSecure;\n      this.options = options;\n      this.strategyName = oauthStrategyService.getStrategyName();\n    }\n\n    /**\n     * Utility function to parse form-encoded or JSON bodies\n     * Handles both string (raw form data) and object bodies\n     */\n    parseRequestBody(body: any, req?: RequestWithRawBody): Record<string, any> {\n      // If body is already a parsed object with properties, return it\n      if (body && typeof body === 'object' && Object.keys(body).length > 0) {\n        return body;\n      }\n\n      // If body is a string (raw form data), parse it\n      if (typeof body === 'string' && body.length > 0) {\n        const params = new URLSearchParams(body);\n        const parsedBody: Record<string, any> = {};\n        for (const [key, value] of params.entries()) {\n          parsedBody[key] = value;\n        }\n        return parsedBody;\n      }\n\n      // Check if we have a text body stored on the request (from our middleware)\n      if (req?.textBody) {\n        const params = new URLSearchParams(req.textBody);\n        const parsedBody: Record<string, any> = {};\n        for (const [key, value] of params.entries()) {\n          parsedBody[key] = value;\n        }\n        return parsedBody;\n      }\n\n      // Check if we have a raw body buffer stored on the request\n      if (req?.rawBody) {\n        const bodyString = req.rawBody.toString('utf-8');\n        if (bodyString) {\n          const params = new URLSearchParams(bodyString);\n          const parsedBody: Record<string, any> = {};\n          for (const [key, value] of params.entries()) {\n            parsedBody[key] = value;\n          }\n          return parsedBody;\n        }\n      }\n\n      // Return empty object if no valid body\n      return {};\n    }\n\n    /**\n     * Middleware to capture raw body for form-encoded requests\n     * This is needed when bodyParser is disabled in the main app\n     */\n    captureRawBody(req: RequestWithRawBody, res: Response, next: NextFunction) {\n      if (\n        req.headers['content-type']?.includes(\n          'application/x-www-form-urlencoded',\n        )\n      ) {\n        let rawBody = '';\n\n        req.on('data', (chunk: Buffer) => {\n          rawBody += chunk.toString('utf-8');\n        });\n\n        req.on('end', () => {\n          req.textBody = rawBody;\n          // Also parse and set it as body for NestJS\n          if (rawBody) {\n            const params = new URLSearchParams(rawBody);\n            const parsedBody: any = {};\n            for (const [key, value] of params.entries()) {\n              parsedBody[key] = value;\n            }\n            (req as any).body = parsedBody;\n          }\n          next();\n        });\n\n        req.on('error', (err) => {\n          this.logger.error('Error reading request body:', err);\n          next(err);\n        });\n      } else {\n        next();\n      }\n    }\n\n    @OptionalGet(\n      endpoints.wellKnownProtectedResourceMetadata,\n      !options?.disableWellKnownProtectedResourceMetadata,\n    )\n    @OptionalHeader(\n      'content-type',\n      'application/json',\n      !options?.disableWellKnownProtectedResourceMetadata,\n    )\n    getProtectedResourceMetadata() {\n      // The issuer URL of your authorization server.\n      const authorizationServerIssuer = this.options.jwtIssuer;\n\n      // The canonical URI of the MCP server resource itself.\n      const resourceIdentifier = this.options.resource;\n\n      const metadata = {\n        /**\n         * REQUIRED by MCP Spec.\n         * A list of authorization server issuer URLs that can issue tokens for this resource.\n         */\n        authorization_servers: [authorizationServerIssuer],\n\n        /**\n         * RECOMMENDED by RFC 9728.\n         * The identifier for this resource server.\n         */\n        resource: resourceIdentifier,\n\n        /**\n         * RECOMMENDED by RFC 9728.\n         * A list of scopes that this resource server understands.\n         */\n        scopes_supported:\n          this.options.protectedResourceMetadata.scopesSupported,\n\n        /**\n         * RECOMMENDED by RFC 9728.\n         * A list of methods clients can use to present the access token.\n         */\n        bearer_methods_supported:\n          this.options.protectedResourceMetadata.bearerMethodsSupported,\n\n        /**\n         * OPTIONAL but helpful custom metadata.\n         * Declares which version of the MCP spec this server supports.\n         */\n        mcp_versions_supported:\n          this.options.protectedResourceMetadata.mcpVersionsSupported,\n      };\n\n      return metadata;\n    }\n\n    // OAuth endpoints\n    @OptionalGet(\n      endpoints.wellKnownAuthorizationServerMetadata,\n      !options?.disableWellKnownAuthorizationServerMetadata,\n    )\n    @OptionalHeader(\n      'content-type',\n      'application/json',\n      !options?.disableWellKnownAuthorizationServerMetadata,\n    )\n    getAuthorizationServerMetadata() {\n      return {\n        issuer: this.serverUrl,\n        authorization_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints.authorize}`,\n        ),\n        token_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints.token}`,\n        ),\n        registration_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints.register}`,\n        ),\n        response_types_supported:\n          this.options.authorizationServerMetadata.responseTypesSupported,\n        response_modes_supported:\n          this.options.authorizationServerMetadata.responseModesSupported,\n        grant_types_supported:\n          this.options.authorizationServerMetadata.grantTypesSupported,\n        token_endpoint_auth_methods_supported:\n          this.options.authorizationServerMetadata\n            .tokenEndpointAuthMethodsSupported,\n        scopes_supported:\n          this.options.authorizationServerMetadata.scopesSupported,\n        revocation_endpoint: normalizeEndpoint(\n          `${this.serverUrl}/${endpoints?.revoke}`,\n        ),\n        code_challenge_methods_supported:\n          this.options.authorizationServerMetadata\n            .codeChallengeMethodsSupported,\n      };\n    }\n\n    @Post(endpoints.register)\n    async registerClient(@Body() registrationDto: any) {\n      return await this.clientService.registerClient(registrationDto);\n    }\n\n    @Get(endpoints.authorize)\n    async authorize(\n      @Query() query: any,\n      @Req()\n      req: any,\n      @Res() res: Response,\n      @Next() next: NextFunction,\n    ) {\n      const {\n        response_type,\n        client_id,\n        redirect_uri,\n        code_challenge,\n        code_challenge_method,\n        state,\n        scope,\n      } = query;\n      const resource = this.options.resource;\n      if (response_type !== 'code') {\n        throw new BadRequestException('Only response_type=code is supported');\n      }\n\n      if (!client_id) {\n        throw new BadRequestException('Missing required parameters');\n      }\n\n      // Validate client and redirect URI\n      const client = await this.clientService.getClient(client_id);\n      if (!client) {\n        throw new BadRequestException('Invalid client_id');\n      }\n\n      const validRedirect = await this.clientService.validateRedirectUri(\n        client_id,\n        redirect_uri,\n      );\n      if (!validRedirect) {\n        throw new BadRequestException('Invalid redirect_uri');\n      }\n\n      // Create OAuth session\n      const sessionId = randomBytes(32).toString('base64url');\n      const sessionState = randomBytes(32).toString('base64url');\n\n      const oauthSession: OAuthSession = {\n        sessionId,\n        state: sessionState,\n        clientId: client_id,\n        redirectUri: redirect_uri,\n        codeChallenge: code_challenge,\n        codeChallengeMethod: code_challenge_method || 'plain',\n        oauthState: state,\n        scope: scope,\n        resource,\n        expiresAt: Date.now() + this.options.oauthSessionExpiresIn,\n      };\n\n      await this.store.storeOAuthSession(sessionId, oauthSession);\n\n      // Set session cookie\n      res.cookie('oauth_session', sessionId, {\n        httpOnly: true,\n        secure: this.isProduction,\n        maxAge: this.options.oauthSessionExpiresIn,\n      });\n\n      // Store state for passport\n      res.cookie('oauth_state', sessionState, {\n        httpOnly: true,\n        secure: this.isProduction,\n        maxAge: this.options.oauthSessionExpiresIn,\n      });\n\n      // Redirect to the provider's auth endpoint\n      passport.authenticate(this.strategyName, {\n        state: req.cookies?.oauth_state,\n      })(req, res, next);\n    }\n\n    @Get(endpoints.callback)\n    handleProviderCallback(\n      @Req() req: OAuthCallbackRequest,\n      @Res() res: Response,\n      @Next() next: NextFunction,\n    ) {\n      // Use a custom callback to handle the authentication result\n      passport.authenticate(\n        this.strategyName,\n        { session: false },\n        async (err: any, user: any) => {\n          try {\n            if (err) {\n              this.logger.error('OAuth callback error:', err);\n              throw new BadRequestException('Authentication failed');\n            }\n\n            if (!user) {\n              throw new BadRequestException('Authentication failed');\n            }\n\n            req.user = user;\n            await this.processAuthenticationSuccess(req, res);\n          } catch (error) {\n            next(error);\n          }\n        },\n      )(req, res, next);\n    }\n\n    async processAuthenticationSuccess(\n      req: OAuthCallbackRequest,\n      res: Response,\n    ) {\n      const user = req.user;\n      if (!user) {\n        throw new BadRequestException('Authentication failed');\n      }\n\n      const sessionId = req.cookies?.oauth_session;\n      if (!sessionId) {\n        throw new BadRequestException('Missing OAuth session');\n      }\n\n      const session = await this.store.getOAuthSession(sessionId);\n      if (!session) {\n        throw new BadRequestException('Invalid or expired OAuth session');\n      }\n\n      // Verify state\n      const stateFromCookie = req.cookies?.oauth_state;\n      if (session.state !== stateFromCookie) {\n        throw new BadRequestException('Invalid state parameter');\n      }\n\n      // Generate JWT for UI access\n      const jwt = this.jwtTokenService.generateUserToken(\n        user.profile.username,\n        user.profile,\n      );\n\n      // Set JWT token as cookie for UI endpoints\n      res.cookie('auth_token', jwt, {\n        httpOnly: true,\n        secure: this.isProduction,\n        maxAge: this.options.cookieMaxAge,\n      });\n\n      // Clear temporary cookies\n      res.clearCookie('oauth_session');\n      res.clearCookie('oauth_state');\n\n      // Persist user profile and get stable profile_id\n      const user_profile_id = await this.store.upsertUserProfile(\n        user.profile,\n        user.provider,\n      );\n\n      // Generate authorization code\n      const authCode = randomBytes(32).toString('base64url');\n\n      // Store the auth code\n      await this.store.storeAuthCode({\n        code: authCode,\n        user_id: user.profile.username,\n        client_id: session.clientId!,\n        redirect_uri: session.redirectUri!,\n        code_challenge: session.codeChallenge!,\n        code_challenge_method: session.codeChallengeMethod!,\n        expires_at: Date.now() + this.options.authCodeExpiresIn,\n        resource: session.resource,\n        scope: session.scope,\n        user_profile_id,\n      });\n\n      // Build redirect URL with authorization code\n      const redirectUrl = new URL(session.redirectUri!);\n      redirectUrl.searchParams.set('code', authCode);\n      if (session.oauthState) {\n        redirectUrl.searchParams.set('state', session.oauthState);\n      }\n\n      // Clean up session\n      await this.store.removeOAuthSession(sessionId);\n\n      res.redirect(redirectUrl.toString());\n    }\n\n    @Post(endpoints.token)\n    @Header('content-type', 'application/json')\n    @Header('Cache-Control', 'no-store')\n    @Header('Pragma', 'no-cache')\n    @HttpCode(200)\n    async exchangeToken(\n      @Body() body: any,\n      @Req() req: RequestWithRawBody,\n      @Res({ passthrough: true }) res: Response,\n    ): Promise<TokenPair> {\n      // Apply middleware to capture raw body if needed\n      const isFormUrlEncoded = req.headers['content-type']?.includes(\n        'application/x-www-form-urlencoded',\n      );\n      const isBodyEmpty =\n        !body ||\n        (typeof body === 'object' &&\n          Object.keys(body as Record<string, unknown>).length === 0);\n\n      if (isFormUrlEncoded && isBodyEmpty) {\n        return new Promise((resolve, reject) => {\n          this.captureRawBody(req, res, (err?: any) => {\n            if (err) {\n              reject(\n                err instanceof Error ? err : new Error(String(err ?? 'error')),\n              );\n              return;\n            }\n\n            // Avoid returning a Promise from the callback; use an IIFE\n            void (async () => {\n              try {\n                // Re-parse the body after middleware has captured it\n                const parsedBody = this.parseRequestBody(req.body || body, req);\n                const result = await this.processTokenExchange(parsedBody, req);\n                resolve(result);\n              } catch (error) {\n                reject(\n                  error instanceof Error\n                    ? error\n                    : new Error(String(error ?? 'error')),\n                );\n              }\n            })();\n          });\n        });\n      }\n\n      // Body is already parsed, process directly\n      const parsedBody = this.parseRequestBody(body, req);\n      return this.processTokenExchange(parsedBody, req);\n    }\n\n    async processTokenExchange(\n      parsedBody: Record<string, any>,\n      req: RequestWithRawBody,\n    ): Promise<TokenPair> {\n      const { grant_type, code, code_verifier, redirect_uri, refresh_token } =\n        parsedBody;\n\n      // Add debugging to help identify issues\n      if (!grant_type) {\n        this.logger.error('Missing grant_type in request body:', {\n          parsedBodyKeys: Object.keys(parsedBody),\n          contentType: req.headers['content-type'],\n          textBody: req.textBody,\n          parsedBody,\n        });\n        throw new BadRequestException('Missing grant_type parameter');\n      }\n\n      switch (grant_type) {\n        case 'authorization_code': {\n          // Extract client credentials based on authentication method\n          const clientCredentials = this.extractClientCredentials(\n            req,\n            parsedBody,\n          );\n          return await this.handleAuthorizationCodeGrant(\n            typeof code === 'string' ? code : String(code ?? ''),\n            typeof code_verifier === 'string'\n              ? code_verifier\n              : String(code_verifier ?? ''),\n            typeof redirect_uri === 'string'\n              ? redirect_uri\n              : String(redirect_uri ?? ''),\n            clientCredentials,\n          );\n        }\n        case 'refresh_token': {\n          // For refresh tokens, try to extract client credentials, but allow fallback to token-based extraction\n          let clientCredentials: { client_id: string; client_secret?: string };\n          try {\n            clientCredentials = this.extractClientCredentials(req, parsedBody);\n          } catch {\n            // If we can't extract credentials, we'll try to get them from the refresh token\n            clientCredentials = { client_id: '' }; // Will be filled from token\n          }\n          return await this.handleRefreshTokenGrant(\n            typeof refresh_token === 'string'\n              ? refresh_token\n              : String(refresh_token ?? ''),\n            clientCredentials,\n          );\n        }\n        default:\n          throw new BadRequestException(\n            `Unsupported grant_type: ${grant_type}`,\n          );\n      }\n    }\n\n    /**\n     * Extract client credentials from request based on authentication method\n     */\n    extractClientCredentials(\n      req: RequestWithRawBody,\n      body: any,\n    ): { client_id: string; client_secret?: string } {\n      // Parse the body using the shared utility function\n      const parsedBody = this.parseRequestBody(body, req);\n\n      // Try client_secret_basic first (Authorization header)\n      const authHeader = req.headers?.authorization;\n      if (authHeader && authHeader.startsWith('Basic ')) {\n        const credentials = Buffer.from(authHeader.slice(6), 'base64').toString(\n          'utf-8',\n        );\n        const [client_id, client_secret] = credentials.split(':', 2);\n        if (client_id) {\n          return { client_id, client_secret };\n        }\n      }\n\n      // Try client_secret_post (body parameters)\n      if (parsedBody.client_id) {\n        return {\n          client_id: parsedBody.client_id,\n          client_secret: parsedBody.client_secret,\n        };\n      }\n\n      throw new BadRequestException('Missing client credentials');\n    }\n\n    /**\n     * Validate client authentication based on the client's configured method\n     */\n    validateClientAuthentication(\n      client: any,\n      clientCredentials: { client_id: string; client_secret?: string },\n    ): void {\n      if (!client) {\n        throw new BadRequestException('Invalid client_id');\n      }\n\n      const { token_endpoint_auth_method } = client;\n\n      switch (token_endpoint_auth_method) {\n        case 'client_secret_basic':\n        case 'client_secret_post':\n          if (!clientCredentials.client_secret) {\n            throw new BadRequestException(\n              'Client secret required for this authentication method',\n            );\n          }\n          if (client.client_secret !== clientCredentials.client_secret) {\n            throw new BadRequestException('Invalid client credentials');\n          }\n          break;\n\n        case 'none':\n          // Public client - no secret required\n          if (clientCredentials.client_secret) {\n            throw new BadRequestException(\n              'Client secret not allowed for public clients',\n            );\n          }\n          break;\n\n        default:\n          throw new BadRequestException(\n            `Unsupported authentication method: ${token_endpoint_auth_method}`,\n          );\n      }\n    }\n\n    async handleAuthorizationCodeGrant(\n      code: string,\n      code_verifier: string,\n      _redirect_uri: string,\n      clientCredentials: { client_id: string; client_secret?: string },\n    ): Promise<TokenPair> {\n      this.logger.debug('handleAuthorizationCodeGrant - Params:', {\n        code,\n        client_id: clientCredentials.client_id,\n      });\n\n      // Get and validate the authorization code\n      const authCode = await this.store.getAuthCode(code);\n      if (!authCode) {\n        this.logger.error(\n          'handleAuthorizationCodeGrant - Invalid authorization code:',\n          code,\n        );\n        throw new BadRequestException('Invalid authorization code');\n      }\n      if (authCode.expires_at < Date.now()) {\n        await this.store.removeAuthCode(code);\n        this.logger.error(\n          'handleAuthorizationCodeGrant - Authorization code expired:',\n          code,\n        );\n        throw new BadRequestException('Authorization code has expired');\n      }\n      if (authCode.client_id !== clientCredentials.client_id) {\n        this.logger.error(\n          'handleAuthorizationCodeGrant - Client ID mismatch:',\n          { expected: authCode.client_id, got: clientCredentials.client_id },\n        );\n        throw new BadRequestException('Client ID mismatch');\n      }\n\n      // Get client and validate authentication\n      const client = await this.clientService.getClient(\n        clientCredentials.client_id,\n      );\n      this.validateClientAuthentication(client, clientCredentials);\n      if (authCode.code_challenge) {\n        const isValid = this.validatePKCE(\n          code_verifier,\n          authCode.code_challenge,\n          authCode.code_challenge_method,\n        );\n        if (!isValid) {\n          this.logger.error(\n            'handleAuthorizationCodeGrant - Invalid PKCE verification',\n          );\n          throw new BadRequestException('Invalid PKCE verification');\n        }\n      }\n      if (!authCode.resource) {\n        this.logger.error(\n          'handleAuthorizationCodeGrant - No resource associated with code',\n        );\n        throw new BadRequestException(\n          'Authorization code is not associated with a resource',\n        );\n      }\n\n      let userData: Record<string, unknown> | undefined = undefined;\n      if (authCode.user_profile_id) {\n        try {\n          const profile = await this.store.getUserProfileById(\n            authCode.user_profile_id,\n          );\n          if (profile) {\n            // Avoid circular/large raw payloads if present\n            userData = { ...profile };\n          }\n        } catch (e) {\n          this.logger.warn('Failed to load user profile for token payload', e);\n        }\n      }\n\n      const tokens = this.jwtTokenService.generateTokenPair(\n        authCode.user_id,\n        clientCredentials.client_id,\n        authCode.scope,\n        authCode.resource,\n        {\n          user_profile_id: authCode.user_profile_id,\n          user_data: userData,\n        },\n      );\n      await this.store.removeAuthCode(code);\n      this.logger.debug(\n        'handleAuthorizationCodeGrant - Token pair generated for user:',\n        authCode.user_id,\n      );\n      return tokens;\n    }\n\n    async handleRefreshTokenGrant(\n      refresh_token: string,\n      clientCredentials: { client_id: string; client_secret?: string },\n    ): Promise<TokenPair> {\n      // Verify the refresh token first to get client_id from token if not provided\n      const payload = this.jwtTokenService.validateToken(refresh_token);\n      if (!payload || payload.type !== 'refresh') {\n        throw new BadRequestException('Invalid or expired refresh token');\n      }\n\n      // Use client_id from token if not provided in credentials\n      const clientId = clientCredentials.client_id || payload.client_id;\n      if (!clientId) {\n        throw new BadRequestException('Unable to determine client_id');\n      }\n\n      // Get client and validate authentication\n      const client = await this.clientService.getClient(clientId);\n\n      // For refresh token grants, we can be more lenient with client authentication\n      // if the token already contains the client_id and the client is public\n      if (client?.token_endpoint_auth_method !== 'none') {\n        this.validateClientAuthentication(client, {\n          ...clientCredentials,\n          client_id: clientId,\n        });\n      }\n\n      // Verify the refresh token belongs to the client\n      if (payload.client_id !== clientId) {\n        throw new BadRequestException(\n          'Invalid refresh token or token does not belong to this client',\n        );\n      }\n\n      let newTokens: TokenPair | null = null;\n      try {\n        const payload = this.jwtTokenService.validateToken(refresh_token);\n        if (!payload || payload.type !== 'refresh') {\n          throw new BadRequestException('Invalid or expired refresh token');\n        }\n\n        let userData: Record<string, unknown> | undefined = undefined;\n        if (payload.user_profile_id) {\n          try {\n            const profile = await this.store.getUserProfileById(\n              payload.user_profile_id,\n            );\n            if (profile) userData = { ...profile };\n          } catch (e) {\n            this.logger.warn(\n              'Failed to load user profile for refreshed token payload',\n              e,\n            );\n          }\n        }\n\n        newTokens = this.jwtTokenService.generateTokenPair(\n          payload.sub,\n          clientId,\n          payload.scope,\n          payload.resource,\n          {\n            user_profile_id: payload.user_profile_id,\n            user_data: userData,\n          },\n        );\n      } catch (e) {\n        this.logger.warn(\n          'Refresh flow failed using enriched path, fallback',\n          e,\n        );\n        newTokens = this.jwtTokenService.refreshAccessToken(refresh_token);\n      }\n\n      if (!newTokens) throw new BadRequestException('Failed to refresh token');\n      return newTokens;\n    }\n\n    validatePKCE(\n      code_verifier: string,\n      code_challenge: string,\n      method: string,\n    ): boolean {\n      if (method === 'plain') {\n        return code_verifier === code_challenge;\n      } else if (method === 'S256') {\n        const hash = createHash('sha256')\n          .update(code_verifier)\n          .digest('base64url');\n        return hash === code_challenge;\n      }\n      return false;\n    }\n  }\n\n  return McpOAuthController;\n}\n"]}