@servicelabsco/slabs-access-manager 1.0.53 → 1.0.55

package/dist/access/services/device.auth.service.js

@@ -0,0 +1,177 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceAuthService = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_utility_services_1 = require("@servicelabsco/nestjs-utility-services");
+const crypto_1 = require("crypto");
+const typeorm_1 = require("typeorm");
+const device_code_entity_1 = require("../entities/device.code.entity");
+const access_business_entity_1 = require("../entities/access.business.entity");
+const create_user_business_secret_1 = require("../libraries/create.user.business.secret");
+const extract_client_credentials_1 = require("../libraries/extract.client.credentials");
+const access_business_service_1 = require("./access.business.service");
+const DEVICE_TTL_MS = 15 * 60_000;
+const POLL_INTERVAL_S = 5;
+const CODE_ALPHABET = 'BCDFGHJKMNPQRSTVWXYZ23456789';
+let DeviceAuthService = class DeviceAuthService {
+    constructor(accessBusinessService) {
+        this.accessBusinessService = accessBusinessService;
+    }
+    async start() {
+        const deviceCode = (0, crypto_1.randomBytes)(32).toString('hex');
+        const userCode = this.generateUserCode();
+        const row = device_code_entity_1.DeviceCodeEntity.create({
+            device_code_hash: this.hash(deviceCode),
+            user_code: userCode,
+            expires_at: new Date(Date.now() + DEVICE_TTL_MS),
+        });
+        await row.save();
+        const verificationUri = this.verificationUri();
+        return {
+            device_code: deviceCode,
+            user_code: userCode,
+            verification_uri: verificationUri,
+            verification_uri_complete: `${verificationUri}?code=${encodeURIComponent(userCode)}`,
+            expires_in: DEVICE_TTL_MS / 1000,
+            interval: POLL_INTERVAL_S,
+        };
+    }
+    async getForApproval(userCode) {
+        const row = await this.findByUserCode(userCode);
+        if (!row)
+            return { status: 'not_found' };
+        if (row.denied_at)
+            return { status: 'denied', user_code: row.user_code };
+        if (row.consumed_at || row.approved_at)
+            return { status: 'decided', user_code: row.user_code };
+        if (row.expires_at.getTime() <= Date.now())
+            return { status: 'expired', user_code: row.user_code };
+        return {
+            status: 'pending',
+            user_code: row.user_code,
+            expires_at: row.expires_at,
+        };
+    }
+    async decide(userCode, action, businessId) {
+        const user = nestjs_utility_services_1.Auth.user();
+        if (!user?.id)
+            throw new nestjs_utility_services_1.AccessException('Login required to approve device login.');
+        const row = await this.findByUserCode(userCode);
+        if (!row)
+            throw new nestjs_utility_services_1.OperationException('Unknown device code.');
+        if (row.expires_at.getTime() <= Date.now())
+            throw new nestjs_utility_services_1.OperationException('This login expired. Start again from the CLI.');
+        if (row.denied_at || row.approved_at)
+            return { status: 'already_decided' };
+        if (action === 'deny') {
+            const denied = await device_code_entity_1.DeviceCodeEntity.update({ id: row.id, approved_at: (0, typeorm_1.IsNull)(), denied_at: (0, typeorm_1.IsNull)() }, { denied_at: new Date(), approved_by_user_id: user.id });
+            return { status: denied.affected ? 'denied' : 'already_decided' };
+        }
+        const business = await this.resolveBusinessForApprove(businessId);
+        const claimed = await device_code_entity_1.DeviceCodeEntity.update({ id: row.id, approved_at: (0, typeorm_1.IsNull)(), denied_at: (0, typeorm_1.IsNull)() }, {
+            approved_at: new Date(),
+            approved_by_user_id: user.id,
+            business_id: business.id,
+        });
+        if (!claimed.affected)
+            return { status: 'already_decided' };
+        return { status: 'approved', business_id: business.id };
+    }
+    async poll(deviceCode) {
+        const row = await device_code_entity_1.DeviceCodeEntity.findOne({ where: { device_code_hash: this.hash(deviceCode) } });
+        if (!row)
+            return { status: 'expired' };
+        if (row.denied_at)
+            return { status: 'denied' };
+        if (row.consumed_at)
+            return { status: 'expired' };
+        if (row.expires_at.getTime() <= Date.now())
+            return { status: 'expired' };
+        if (!row.approved_at)
+            return { status: 'pending' };
+        const claimed = await device_code_entity_1.DeviceCodeEntity.update({ id: row.id, consumed_at: (0, typeorm_1.IsNull)() }, { consumed_at: new Date() });
+        if (!claimed.affected)
+            return { status: 'expired' };
+        const minted = await this.mintPersonalKey(row);
+        return {
+            status: 'approved',
+            access_token: minted.access_token,
+            token_type: 'Bearer',
+            client_id: minted.client_id,
+            client_secret: minted.client_secret,
+        };
+    }
+    async mintPersonalKey(row) {
+        if (!row.approved_by_user_id || !row.business_id) {
+            throw new nestjs_utility_services_1.OperationException('Device login is missing approver or business.');
+        }
+        const business = await access_business_entity_1.AccessBusinessEntity.findOne({ where: { id: row.business_id } });
+        if (!business)
+            throw new nestjs_utility_services_1.OperationException('Business for device login no longer exists.');
+        const accessObject = { id: row.approved_by_user_id, auth_attributes: { business_id: business.id } };
+        nestjs_utility_services_1.Auth.login(accessObject);
+        const name = `CLI · device login · ${new Date().toISOString().slice(0, 16)}`;
+        const secret = await new create_user_business_secret_1.CreateUserBusinessSecret(business).process({ name });
+        row.user_secret_id = secret.id;
+        await row.save();
+        return {
+            client_id: secret.client_id,
+            client_secret: secret.client_secret,
+            access_token: extract_client_credentials_1.ExtractClientCredentials.formatPersonalAccessToken(secret.client_id, secret.client_secret),
+        };
+    }
+    async resolveBusinessForApprove(businessId) {
+        if (businessId) {
+            const business = await access_business_entity_1.AccessBusinessEntity.findOne({ where: { id: businessId } });
+            if (!business)
+                throw new nestjs_utility_services_1.OperationException('Unknown business_id.');
+            return business;
+        }
+        return this.accessBusinessService.validateAccess();
+    }
+    async findByUserCode(userCode) {
+        const formatted = this.normalizeUserCode(userCode);
+        if (!formatted)
+            return null;
+        return device_code_entity_1.DeviceCodeEntity.findOne({ where: { user_code: formatted } });
+    }
+    normalizeUserCode(userCode) {
+        const normalized = String(userCode || '')
+            .trim()
+            .toUpperCase()
+            .replace(/[^A-Z0-9]/g, '');
+        if (normalized.length !== 8)
+            return null;
+        return `${normalized.slice(0, 4)}-${normalized.slice(4)}`;
+    }
+    generateUserCode() {
+        let raw = '';
+        for (let i = 0; i < 8; i++) {
+            raw += CODE_ALPHABET[(0, crypto_1.randomBytes)(1)[0] % CODE_ALPHABET.length];
+        }
+        return `${raw.slice(0, 4)}-${raw.slice(4)}`;
+    }
+    hash(value) {
+        return (0, crypto_1.createHash)('sha256').update(value).digest('hex');
+    }
+    verificationUri() {
+        return (process.env.DEVICE_AUTH_VERIFICATION_URI ||
+            process.env.FRONTEND_DEVICE_URL ||
+            `${(process.env.SERVER_URL || 'http://localhost:4000').replace(/\/+$/, '')}/device`);
+    }
+};
+exports.DeviceAuthService = DeviceAuthService;
+exports.DeviceAuthService = DeviceAuthService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [access_business_service_1.AccessBusinessService])
+], DeviceAuthService);
+//# sourceMappingURL=device.auth.service.js.map

package/dist/access/services/device.auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.auth.service.js","sourceRoot":"","sources":["../../../src/access/services/device.auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,oFAAmG;AACnG,mCAAiD;AACjD,qCAAiC;AACjC,uEAAkE;AAClE,+EAA0E;AAC1E,0FAAoF;AACpF,wFAAmF;AACnF,uEAAkE;AAElE,MAAM,aAAa,GAAG,EAAE,GAAG,MAAM,CAAC;AAClC,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,aAAa,GAAG,8BAA8B,CAAC;AAS9C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC1B,YAA6B,qBAA4C;QAA5C,0BAAqB,GAArB,qBAAqB,CAAuB;IAAG,CAAC;IAK7E,KAAK,CAAC,KAAK;QACP,MAAM,UAAU,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAEzC,MAAM,GAAG,GAAG,qCAAgB,CAAC,MAAM,CAAC;YAChC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YACvC,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjB,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/C,OAAO;YACH,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,eAAe;YACjC,yBAAyB,EAAE,GAAG,eAAe,SAAS,kBAAkB,CAAC,QAAQ,CAAC,EAAE;YACpF,UAAU,EAAE,aAAa,GAAG,IAAI;YAChC,QAAQ,EAAE,eAAe;SAC5B,CAAC;IACN,CAAC;IAKD,KAAK,CAAC,cAAc,CAAC,QAAgB;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC;QAClD,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAClF,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QACxG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAE5G,OAAO;YACH,MAAM,EAAE,SAAkB;YAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC7B,CAAC;IACN,CAAC;IAKD,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,MAA0B,EAAE,UAAmB;QAC1E,MAAM,IAAI,GAAG,8BAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,EAAE;YAAE,MAAM,IAAI,yCAAe,CAAC,yCAAyC,CAAC,CAAC;QAEpF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,4CAAkB,CAAC,sBAAsB,CAAC,CAAC;QAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,4CAAkB,CAAC,+CAA+C,CAAC,CAAC;QAC1H,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,iBAA0B,EAAE,CAAC;QAEpF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,qCAAgB,CAAC,MAAM,CACxC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAA,gBAAM,GAAE,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EAC1D,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE,CAC1D,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,QAAkB,CAAC,CAAC,CAAE,iBAA2B,EAAE,CAAC;QAC5F,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,MAAM,qCAAgB,CAAC,MAAM,CACzC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAA,gBAAM,GAAE,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EAC1D;YACI,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,mBAAmB,EAAE,IAAI,CAAC,EAAE;YAC5B,WAAW,EAAE,QAAQ,CAAC,EAAE;SAC3B,CACJ,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,iBAA0B,EAAE,CAAC;QAErE,OAAO,EAAE,MAAM,EAAE,UAAmB,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACrE,CAAC;IAKD,KAAK,CAAC,IAAI,CAAC,UAAkB;QACzB,MAAM,GAAG,GAAG,MAAM,qCAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,SAAoC,EAAE,CAAC;QAClE,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAmC,EAAE,CAAC;QAC1E,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,SAAoC,EAAE,CAAC;QAC7E,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,SAAoC,EAAE,CAAC;QACpG,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,SAAoC,EAAE,CAAC;QAE9E,MAAM,OAAO,GAAG,MAAM,qCAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,SAAoC,EAAE,CAAC;QAE/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO;YACH,MAAM,EAAE,UAAqC;YAC7C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;SACtC,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAqB;QAC/C,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAC/C,MAAM,IAAI,4CAAkB,CAAC,+CAA+C,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,6CAAoB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,4CAAkB,CAAC,6CAA6C,CAAC,CAAC;QAE3F,MAAM,YAAY,GAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,mBAAmB,EAAE,eAAe,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;QACzG,8BAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAEzB,MAAM,IAAI,GAAG,wBAAwB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,sDAAwB,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9E,GAAG,CAAC,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjB,OAAO;YACH,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,YAAY,EAAE,qDAAwB,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC;SAC3G,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,UAAmB;QACvD,IAAI,UAAU,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,6CAAoB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,4CAAkB,CAAC,sBAAsB,CAAC,CAAC;YAEpE,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,QAAgB;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,OAAO,qCAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IAEO,iBAAiB,CAAC,QAAgB;QACtC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;aACpC,IAAI,EAAE;aACN,WAAW,EAAE;aACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC/B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzC,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IAEO,gBAAgB;QACpB,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACzB,GAAG,IAAI,aAAa,CAAC,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC;IAEO,IAAI,CAAC,KAAa;QACtB,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAEO,eAAe;QACnB,OAAO,CACH,OAAO,CAAC,GAAG,CAAC,4BAA4B;YACxC,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC/B,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CACtF,CAAC;IACN,CAAC;CACJ,CAAA;AA/KY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAE2C,+CAAqB;GADhE,iBAAiB,CA+K7B"}

package/dist/access/services/index.d.ts

@@ -8,8 +8,10 @@ export * from './business.preference.service';
 export * from './business.property.service';
 export * from './business.script.service';
 export * from './business.user.role.service';
+export * from './credential.resolve.service';
 export * from './currency.service';
 export * from './custom.field.service';
+export * from './device.auth.service';
 export * from './gchat.service';
 export * from './gmail.integration.service';
 export * from './gpt.service';
@@ -18,6 +20,7 @@ export * from './listing.service';
 export * from './load.entity.service';
 export * from './lock.script.service';
 export * from './notification.service';
+export * from './oauth.as.service';
 export * from './overriding.script.service';
 export * from './platform.service';
 export * from './request.log.service';

package/dist/access/services/index.js

@@ -24,8 +24,10 @@ __exportStar(require("./business.preference.service"), exports);
 __exportStar(require("./business.property.service"), exports);
 __exportStar(require("./business.script.service"), exports);
 __exportStar(require("./business.user.role.service"), exports);
+__exportStar(require("./credential.resolve.service"), exports);
 __exportStar(require("./currency.service"), exports);
 __exportStar(require("./custom.field.service"), exports);
+__exportStar(require("./device.auth.service"), exports);
 __exportStar(require("./gchat.service"), exports);
 __exportStar(require("./gmail.integration.service"), exports);
 __exportStar(require("./gpt.service"), exports);
@@ -34,6 +36,7 @@ __exportStar(require("./listing.service"), exports);
 __exportStar(require("./load.entity.service"), exports);
 __exportStar(require("./lock.script.service"), exports);
 __exportStar(require("./notification.service"), exports);
+__exportStar(require("./oauth.as.service"), exports);
 __exportStar(require("./overriding.script.service"), exports);
 __exportStar(require("./platform.service"), exports);
 __exportStar(require("./request.log.service"), exports);

package/dist/access/services/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/access/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4DAA0C;AAAA,0DAAwC;AAAA,wDAAsC;AAAA,4DAA0C;AAAA,sDAAoC;AAAA,2DAAyC;AAAA,gEAA8C;AAAA,8DAA4C;AAAA,4DAA0C;AAAA,+DAA6C;AAAA,qDAAmC;AAAA,yDAAuC;AAAA,kDAAgC;AAAA,8DAA4C;AAAA,gDAA8B;AAAA,+DAA6C;AAAA,oDAAkC;AAAA,wDAAsC;AAAA,wDAAsC;AAAA,yDAAuC;AAAA,8DAA4C;AAAA,qDAAmC;AAAA,wDAAsC;AAAA,6DAA2C;AAAA,uDAAqC;AAAA,kDAAgC;AAAA,kDAAgC;AAAA,iEAA+C;AAAA,8DAA4C;AAAA,4DAA0C;AAAA,oDAAkC;AAAA,oDAAkC;AAAA,qDAAkC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/access/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4DAA0C;AAAA,0DAAwC;AAAA,wDAAsC;AAAA,4DAA0C;AAAA,sDAAoC;AAAA,2DAAyC;AAAA,gEAA8C;AAAA,8DAA4C;AAAA,4DAA0C;AAAA,+DAA6C;AAAA,+DAA6C;AAAA,qDAAmC;AAAA,yDAAuC;AAAA,wDAAsC;AAAA,kDAAgC;AAAA,8DAA4C;AAAA,gDAA8B;AAAA,+DAA6C;AAAA,oDAAkC;AAAA,wDAAsC;AAAA,wDAAsC;AAAA,yDAAuC;AAAA,qDAAmC;AAAA,8DAA4C;AAAA,qDAAmC;AAAA,wDAAsC;AAAA,6DAA2C;AAAA,uDAAqC;AAAA,kDAAgC;AAAA,kDAAgC;AAAA,iEAA+C;AAAA,8DAA4C;AAAA,4DAA0C;AAAA,oDAAkC;AAAA,oDAAkC;AAAA,qDAAkC"}

package/dist/access/services/oauth.as.service.d.ts

@@ -0,0 +1,96 @@
+import { OauthRegisterDto } from '../dtos/oauth.register.dto';
+import { AccessBusinessService } from './access.business.service';
+export declare class OauthProtocolError extends Error {
+    readonly error: string;
+    readonly status: number;
+    constructor(error: string, message?: string, status?: number);
+}
+export declare class OauthAsService {
+    private readonly accessBusinessService;
+    constructor(accessBusinessService: AccessBusinessService);
+    issuer(): string;
+    scopesSupported(): string[];
+    authorizationServerMetadata(): {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        registration_endpoint: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        token_endpoint_auth_methods_supported: string[];
+        scopes_supported: string[];
+    };
+    register(dto: OauthRegisterDto): Promise<{
+        client_id: string;
+        client_name: string;
+        redirect_uris: string[];
+        grant_types: string[];
+        response_types: string[];
+        token_endpoint_auth_method: string;
+        client_id_issued_at: number;
+    }>;
+    beginAuthorize(query: Record<string, string | undefined>): Promise<{
+        kind: 'error_page';
+        error: string;
+        message: string;
+    } | {
+        kind: 'login_redirect';
+        url: string;
+    } | {
+        kind: 'consent_redirect';
+        url: string;
+    } | {
+        kind: 'protocol_redirect';
+        url: string;
+    }>;
+    getConsent(authorizationId: number): Promise<{
+        status: "not_found";
+        authorization_id?: undefined;
+        client_name?: undefined;
+        redirect_host?: undefined;
+        scope?: undefined;
+        expires_at?: undefined;
+    } | {
+        status: "decided";
+        authorization_id: number;
+        client_name?: undefined;
+        redirect_host?: undefined;
+        scope?: undefined;
+        expires_at?: undefined;
+    } | {
+        status: "expired";
+        authorization_id: number;
+        client_name?: undefined;
+        redirect_host?: undefined;
+        scope?: undefined;
+        expires_at?: undefined;
+    } | {
+        status: "pending";
+        authorization_id: number;
+        client_name: string;
+        redirect_host: string;
+        scope: string;
+        expires_at: Date;
+    }>;
+    decideConsent(authorizationId: number, action: 'approve' | 'deny', businessId?: number): Promise<{
+        status: "already_decided";
+        redirect_to: string;
+    } | {
+        status: "denied";
+        redirect_to: string;
+    } | {
+        status: "approved";
+        redirect_to: string;
+    }>;
+    exchangeToken(body: Record<string, string | undefined>): Promise<{
+        access_token: string;
+        token_type: string;
+        scope: string;
+    }>;
+    private mintPersonalKey;
+    private resolveBusiness;
+    private errorRedirect;
+    private frontendBase;
+    private buildAuthorizeReturnUrl;
+}

package/dist/access/services/oauth.as.service.js

@@ -0,0 +1,299 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OauthAsService = exports.OauthProtocolError = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_utility_services_1 = require("@servicelabsco/nestjs-utility-services");
+const typeorm_1 = require("typeorm");
+const access_business_entity_1 = require("../entities/access.business.entity");
+const oauth_authorization_entity_1 = require("../entities/oauth.authorization.entity");
+const oauth_client_entity_1 = require("../entities/oauth.client.entity");
+const create_user_business_secret_1 = require("../libraries/create.user.business.secret");
+const extract_client_credentials_1 = require("../libraries/extract.client.credentials");
+const oauth_pkce_1 = require("../libraries/oauth.pkce");
+const access_business_service_1 = require("./access.business.service");
+const PENDING_TTL_MS = 10 * 60_000;
+const CODE_TTL_MS = 2 * 60_000;
+const DEFAULT_SCOPE = 'mcp';
+class OauthProtocolError extends Error {
+    constructor(error, message, status = 400) {
+        super(message || error);
+        this.error = error;
+        this.status = status;
+    }
+}
+exports.OauthProtocolError = OauthProtocolError;
+let OauthAsService = class OauthAsService {
+    constructor(accessBusinessService) {
+        this.accessBusinessService = accessBusinessService;
+    }
+    issuer() {
+        return (process.env.MCP_AUTHORIZATION_SERVER || process.env.SERVER_URL || `http://127.0.0.1:${process.env.SERVER_PORT || 4000}`).replace(/\/+$/, '');
+    }
+    scopesSupported() {
+        return (process.env.MCP_SCOPES_SUPPORTED || 'mcp,reporting:read')
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean);
+    }
+    authorizationServerMetadata() {
+        const issuer = this.issuer();
+        return {
+            issuer,
+            authorization_endpoint: `${issuer}/oauth/authorize`,
+            token_endpoint: `${issuer}/oauth/token`,
+            registration_endpoint: `${issuer}/oauth/register`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code'],
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: ['none'],
+            scopes_supported: this.scopesSupported(),
+        };
+    }
+    async register(dto) {
+        const redirectUris = (dto.redirect_uris || []).map((u) => String(u).trim()).filter(Boolean);
+        if (!redirectUris.length)
+            throw new OauthProtocolError('invalid_client_metadata', 'redirect_uris is required');
+        for (const uri of redirectUris) {
+            try {
+                new URL(uri);
+            }
+            catch {
+                throw new OauthProtocolError('invalid_redirect_uri', `Invalid redirect_uri: ${uri}`);
+            }
+        }
+        if (dto.token_endpoint_auth_method && dto.token_endpoint_auth_method !== 'none') {
+            throw new OauthProtocolError('invalid_client_metadata', 'Only token_endpoint_auth_method=none is supported');
+        }
+        const clientId = oauth_pkce_1.OauthPkce.randomToken(16);
+        const row = oauth_client_entity_1.OauthClientEntity.create({
+            client_id: clientId,
+            client_name: dto.client_name || 'MCP client',
+            redirect_uris: redirectUris,
+            token_endpoint_auth_method: 'none',
+            grant_types: dto.grant_types?.length ? dto.grant_types : ['authorization_code'],
+            response_types: dto.response_types?.length ? dto.response_types : ['code'],
+        });
+        await row.save();
+        return {
+            client_id: row.client_id,
+            client_name: row.client_name,
+            redirect_uris: row.redirect_uris,
+            grant_types: row.grant_types,
+            response_types: row.response_types,
+            token_endpoint_auth_method: 'none',
+            client_id_issued_at: Math.floor(Date.now() / 1000),
+        };
+    }
+    async beginAuthorize(query) {
+        const clientId = query.client_id?.trim();
+        if (!clientId)
+            return { kind: 'error_page', error: 'invalid_request', message: 'client_id is required' };
+        const client = await oauth_client_entity_1.OauthClientEntity.findOne({ where: { client_id: clientId } });
+        if (!client)
+            return { kind: 'error_page', error: 'invalid_client', message: 'Unknown client_id' };
+        const redirectUri = query.redirect_uri?.trim();
+        if (!redirectUri || !client.redirect_uris.includes(redirectUri)) {
+            return { kind: 'error_page', error: 'invalid_request', message: 'redirect_uri is not registered for this client' };
+        }
+        const state = query.state;
+        const back = (error, description) => {
+            const url = new URL(redirectUri);
+            url.searchParams.set('error', error);
+            if (description)
+                url.searchParams.set('error_description', description);
+            if (state)
+                url.searchParams.set('state', state);
+            return { kind: 'protocol_redirect', url: url.toString() };
+        };
+        if (query.response_type !== 'code')
+            return back('unsupported_response_type', 'Only response_type=code is supported');
+        if (!query.code_challenge || query.code_challenge_method !== 'S256') {
+            return back('invalid_request', 'PKCE S256 is required');
+        }
+        const requestedScope = (query.scope || DEFAULT_SCOPE).trim() || DEFAULT_SCOPE;
+        const allowed = this.scopesSupported();
+        if (!requestedScope.split(/\s+/).every((s) => allowed.includes(s))) {
+            return back('invalid_scope', `Supported scopes: ${allowed.join(' ')}`);
+        }
+        if (!nestjs_utility_services_1.Auth.check()) {
+            const authorizeUrl = this.buildAuthorizeReturnUrl(query);
+            const loginBase = process.env.OAUTH_LOGIN_URI || process.env.FRONTEND_LOGIN_URL || `${this.frontendBase()}/login`;
+            const url = new URL(loginBase);
+            url.searchParams.set('return_to', authorizeUrl);
+            return { kind: 'login_redirect', url: url.toString() };
+        }
+        const pending = oauth_authorization_entity_1.OauthAuthorizationEntity.create({
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            scope: requestedScope,
+            state: state || null,
+            code_challenge: query.code_challenge,
+            code_challenge_method: 'S256',
+            resource: query.resource || null,
+            expires_at: new Date(Date.now() + PENDING_TTL_MS),
+        });
+        await pending.save();
+        const consentBase = process.env.OAUTH_CONSENT_URI || `${this.frontendBase()}/oauth/consent`;
+        const consentUrl = new URL(consentBase);
+        consentUrl.searchParams.set('authorization_id', String(pending.id));
+        return { kind: 'consent_redirect', url: consentUrl.toString() };
+    }
+    async getConsent(authorizationId) {
+        if (!nestjs_utility_services_1.Auth.check())
+            throw new nestjs_utility_services_1.AccessException('Login required.');
+        const row = await oauth_authorization_entity_1.OauthAuthorizationEntity.findOne({ where: { id: authorizationId } });
+        if (!row)
+            return { status: 'not_found' };
+        const client = await oauth_client_entity_1.OauthClientEntity.findOne({ where: { client_id: row.client_id } });
+        if (row.denied_at)
+            return { status: 'decided', authorization_id: row.id };
+        if (row.approved_at)
+            return { status: 'decided', authorization_id: row.id };
+        if (row.expires_at.getTime() <= Date.now())
+            return { status: 'expired', authorization_id: row.id };
+        return {
+            status: 'pending',
+            authorization_id: row.id,
+            client_name: client?.client_name || row.client_id,
+            redirect_host: oauth_pkce_1.OauthPkce.safeRedirectHost(row.redirect_uri),
+            scope: row.scope,
+            expires_at: row.expires_at,
+        };
+    }
+    async decideConsent(authorizationId, action, businessId) {
+        const user = nestjs_utility_services_1.Auth.user();
+        if (!user?.id)
+            throw new nestjs_utility_services_1.AccessException('Login required to approve MCP connect.');
+        const row = await oauth_authorization_entity_1.OauthAuthorizationEntity.findOne({ where: { id: authorizationId } });
+        if (!row)
+            throw new nestjs_utility_services_1.OperationException('Unknown authorization.');
+        if (row.expires_at.getTime() <= Date.now())
+            throw new nestjs_utility_services_1.OperationException('This authorization expired. Start Connect again.');
+        if (row.denied_at || row.approved_at) {
+            return { status: 'already_decided', redirect_to: this.errorRedirect(row, 'access_denied', 'Already decided') };
+        }
+        if (action === 'deny') {
+            const denied = await oauth_authorization_entity_1.OauthAuthorizationEntity.update({ id: row.id, approved_at: (0, typeorm_1.IsNull)(), denied_at: (0, typeorm_1.IsNull)() }, { denied_at: new Date(), approved_by_user_id: user.id });
+            if (!denied.affected) {
+                return { status: 'already_decided', redirect_to: this.errorRedirect(row, 'access_denied', 'Already decided') };
+            }
+            return { status: 'denied', redirect_to: this.errorRedirect(row, 'access_denied') };
+        }
+        const business = await this.resolveBusiness(businessId);
+        const code = oauth_pkce_1.OauthPkce.randomToken(32);
+        const claimed = await oauth_authorization_entity_1.OauthAuthorizationEntity.update({ id: row.id, approved_at: (0, typeorm_1.IsNull)(), denied_at: (0, typeorm_1.IsNull)() }, {
+            approved_at: new Date(),
+            approved_by_user_id: user.id,
+            business_id: business.id,
+            code_hash: oauth_pkce_1.OauthPkce.sha256Hex(code),
+            expires_at: new Date(Date.now() + CODE_TTL_MS),
+        });
+        if (!claimed.affected) {
+            return { status: 'already_decided', redirect_to: this.errorRedirect(row, 'access_denied', 'Already decided') };
+        }
+        const url = new URL(row.redirect_uri);
+        url.searchParams.set('code', code);
+        if (row.state)
+            url.searchParams.set('state', row.state);
+        url.searchParams.set('iss', this.issuer());
+        return { status: 'approved', redirect_to: url.toString() };
+    }
+    async exchangeToken(body) {
+        if (body.grant_type !== 'authorization_code') {
+            throw new OauthProtocolError('unsupported_grant_type', 'Only authorization_code is supported');
+        }
+        const code = body.code?.trim();
+        const redirectUri = body.redirect_uri?.trim();
+        const codeVerifier = body.code_verifier?.trim();
+        if (!code || !redirectUri || !codeVerifier) {
+            throw new OauthProtocolError('invalid_request', 'code, redirect_uri, and code_verifier are required');
+        }
+        const row = await oauth_authorization_entity_1.OauthAuthorizationEntity.findOne({ where: { code_hash: oauth_pkce_1.OauthPkce.sha256Hex(code) } });
+        if (!row || !row.approved_at || !row.approved_by_user_id) {
+            throw new OauthProtocolError('invalid_grant', 'Invalid authorization code');
+        }
+        if (row.consumed_at)
+            throw new OauthProtocolError('invalid_grant', 'Authorization code already used');
+        if (row.expires_at.getTime() <= Date.now())
+            throw new OauthProtocolError('invalid_grant', 'Authorization code expired');
+        if (redirectUri !== row.redirect_uri)
+            throw new OauthProtocolError('invalid_grant', 'redirect_uri mismatch');
+        if (body.client_id && body.client_id !== row.client_id) {
+            throw new OauthProtocolError('invalid_grant', 'client_id mismatch');
+        }
+        if (oauth_pkce_1.OauthPkce.s256Base64Url(codeVerifier) !== row.code_challenge) {
+            throw new OauthProtocolError('invalid_grant', 'PKCE verification failed');
+        }
+        const claimed = await oauth_authorization_entity_1.OauthAuthorizationEntity.update({ id: row.id, consumed_at: (0, typeorm_1.IsNull)() }, { consumed_at: new Date() });
+        if (!claimed.affected)
+            throw new OauthProtocolError('invalid_grant', 'Authorization code already used');
+        const minted = await this.mintPersonalKey(row);
+        return {
+            access_token: minted.access_token,
+            token_type: 'Bearer',
+            scope: row.scope || DEFAULT_SCOPE,
+        };
+    }
+    async mintPersonalKey(row) {
+        if (!row.approved_by_user_id || !row.business_id) {
+            throw new OauthProtocolError('server_error', 'Authorization missing approver or business', 500);
+        }
+        const business = await access_business_entity_1.AccessBusinessEntity.findOne({ where: { id: row.business_id } });
+        if (!business)
+            throw new OauthProtocolError('server_error', 'Business no longer exists', 500);
+        nestjs_utility_services_1.Auth.login({ id: row.approved_by_user_id, auth_attributes: { business_id: business.id } });
+        const name = `MCP · browser connect · ${new Date().toISOString().slice(0, 16)}`;
+        const secret = await new create_user_business_secret_1.CreateUserBusinessSecret(business).process({ name });
+        row.user_secret_id = secret.id;
+        await row.save();
+        return {
+            access_token: extract_client_credentials_1.ExtractClientCredentials.formatPersonalAccessToken(secret.client_id, secret.client_secret),
+            client_id: secret.client_id,
+            client_secret: secret.client_secret,
+        };
+    }
+    async resolveBusiness(businessId) {
+        if (businessId) {
+            const business = await access_business_entity_1.AccessBusinessEntity.findOne({ where: { id: businessId } });
+            if (!business)
+                throw new nestjs_utility_services_1.OperationException('Unknown business_id.');
+            return business;
+        }
+        return this.accessBusinessService.validateAccess();
+    }
+    errorRedirect(row, error, description) {
+        const url = new URL(row.redirect_uri);
+        url.searchParams.set('error', error);
+        if (description)
+            url.searchParams.set('error_description', description);
+        if (row.state)
+            url.searchParams.set('state', row.state);
+        return url.toString();
+    }
+    frontendBase() {
+        return (process.env.FRONTEND_URL || process.env.SERVER_URL || 'http://localhost:3000').replace(/\/+$/, '');
+    }
+    buildAuthorizeReturnUrl(query) {
+        const url = new URL(`${this.issuer()}/oauth/authorize`);
+        for (const [key, value] of Object.entries(query)) {
+            if (value !== undefined && value !== null && value !== '')
+                url.searchParams.set(key, value);
+        }
+        return url.toString();
+    }
+};
+exports.OauthAsService = OauthAsService;
+exports.OauthAsService = OauthAsService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [access_business_service_1.AccessBusinessService])
+], OauthAsService);
+//# sourceMappingURL=oauth.as.service.js.map