@taico/taico 0.0.2

package/dist/auth-journeys/entities/mcp-authorization-flow.entity.js

@@ -0,0 +1,138 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpAuthorizationFlowEntity = void 0;
+const typeorm_1 = require("typeorm");
+const mcp_server_entity_1 = require("../../mcp-registry/entities/mcp-server.entity");
+const registered_client_entity_1 = require("../../authorization-server/entities/registered-client.entity");
+const auth_journey_entity_1 = require("./auth-journey.entity");
+const mcp_authorization_flow_status_enum_1 = require("../enums/mcp-authorization-flow-status.enum");
+let McpAuthorizationFlowEntity = class McpAuthorizationFlowEntity {
+    id;
+    authorizationJourneyId;
+    serverId;
+    clientId;
+    status;
+    codeChallenge;
+    codeChallengeMethod;
+    state;
+    redirectUri;
+    scopes;
+    resource;
+    authorizationCode;
+    authorizationCodeExpiresAt;
+    authorizationCodeUsed;
+    authJourney;
+    server;
+    client;
+    createdAt;
+    updatedAt;
+};
+exports.McpAuthorizationFlowEntity = McpAuthorizationFlowEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], McpAuthorizationFlowEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid', name: 'authorization_journey_id' }),
+    __metadata("design:type", String)
+], McpAuthorizationFlowEntity.prototype, "authorizationJourneyId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid', name: 'server_id' }),
+    __metadata("design:type", String)
+], McpAuthorizationFlowEntity.prototype, "serverId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid', name: 'client_id' }),
+    __metadata("design:type", String)
+], McpAuthorizationFlowEntity.prototype, "clientId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'text',
+        default: mcp_authorization_flow_status_enum_1.McpAuthorizationFlowStatus.CLIENT_NOT_REGISTERED,
+    }),
+    __metadata("design:type", String)
+], McpAuthorizationFlowEntity.prototype, "status", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', name: 'code_challenge', nullable: true }),
+    __metadata("design:type", String)
+], McpAuthorizationFlowEntity.prototype, "codeChallenge", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'varchar',
+        length: 10,
+        name: 'code_challenge_method',
+        nullable: true,
+    }),
+    __metadata("design:type", String)
+], McpAuthorizationFlowEntity.prototype, "codeChallengeMethod", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', name: 'state', nullable: true }),
+    __metadata("design:type", String)
+], McpAuthorizationFlowEntity.prototype, "state", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', name: 'redirect_uri', nullable: true }),
+    __metadata("design:type", String)
+], McpAuthorizationFlowEntity.prototype, "redirectUri", void 0);
+__decorate([
+    (0, typeorm_1.Column)('simple-array', { name: 'scopes', nullable: true }),
+    __metadata("design:type", Array)
+], McpAuthorizationFlowEntity.prototype, "scopes", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', name: 'resource', nullable: true }),
+    __metadata("design:type", String)
+], McpAuthorizationFlowEntity.prototype, "resource", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', name: 'authorization_code', nullable: true }),
+    __metadata("design:type", String)
+], McpAuthorizationFlowEntity.prototype, "authorizationCode", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'datetime',
+        name: 'authorization_code_expires_at',
+        nullable: true,
+    }),
+    __metadata("design:type", Date)
+], McpAuthorizationFlowEntity.prototype, "authorizationCodeExpiresAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'boolean', name: 'authorization_code_used', default: false }),
+    __metadata("design:type", Boolean)
+], McpAuthorizationFlowEntity.prototype, "authorizationCodeUsed", void 0);
+__decorate([
+    (0, typeorm_1.OneToOne)(() => auth_journey_entity_1.AuthJourneyEntity),
+    (0, typeorm_1.JoinColumn)({ name: 'authorization_journey_id' }),
+    __metadata("design:type", auth_journey_entity_1.AuthJourneyEntity)
+], McpAuthorizationFlowEntity.prototype, "authJourney", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => mcp_server_entity_1.McpServerEntity, {
+        onDelete: 'RESTRICT',
+    }),
+    (0, typeorm_1.JoinColumn)({ name: 'server_id' }),
+    __metadata("design:type", mcp_server_entity_1.McpServerEntity)
+], McpAuthorizationFlowEntity.prototype, "server", void 0);
+__decorate([
+    (0, typeorm_1.OneToOne)(() => registered_client_entity_1.RegisteredClientEntity, {
+        onDelete: 'CASCADE',
+    }),
+    (0, typeorm_1.JoinColumn)({ name: 'client_id' }),
+    __metadata("design:type", registered_client_entity_1.RegisteredClientEntity)
+], McpAuthorizationFlowEntity.prototype, "client", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at' }),
+    __metadata("design:type", Date)
+], McpAuthorizationFlowEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ name: 'updated_at' }),
+    __metadata("design:type", Date)
+], McpAuthorizationFlowEntity.prototype, "updatedAt", void 0);
+exports.McpAuthorizationFlowEntity = McpAuthorizationFlowEntity = __decorate([
+    (0, typeorm_1.Entity)('mcp_authorization_flows')
+], McpAuthorizationFlowEntity);
+//# sourceMappingURL=mcp-authorization-flow.entity.js.map

package/dist/auth-journeys/entities/mcp-authorization-flow.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-authorization-flow.entity.js","sourceRoot":"","sources":["../../../src/auth-journeys/entities/mcp-authorization-flow.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCASiB;AACjB,qFAAgF;AAChF,2GAAsG;AACtG,+DAA0D;AAC1D,oGAAyF;AAGlF,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAErC,EAAE,CAAU;IAGZ,sBAAsB,CAAU;IAGhC,QAAQ,CAAU;IAGlB,QAAQ,CAAU;IAMlB,MAAM,CAA8B;IAIpC,aAAa,CAAU;IAQvB,mBAAmB,CAAU;IAI7B,KAAK,CAAU;IAIf,WAAW,CAAU;IAIrB,MAAM,CAAY;IAIlB,QAAQ,CAAU;IAIlB,iBAAiB,CAAU;IAQ3B,0BAA0B,CAAQ;IAIlC,qBAAqB,CAAW;IAKhC,WAAW,CAAqB;IAOhC,MAAM,CAAmB;IAOzB,MAAM,CAA0B;IAGhC,SAAS,CAAQ;IAGjB,SAAS,CAAQ;CAClB,CAAA;AAvFY,gEAA0B;AAErC;IADC,IAAA,gCAAsB,EAAC,MAAM,CAAC;;sDACnB;AAGZ;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;;0EAC3B;AAGhC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;;4DAC1B;AAGlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;;4DAC1B;AAMlB;IAJC,IAAA,gBAAM,EAAC;QACN,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,+DAA0B,CAAC,qBAAqB;KAC1D,CAAC;;0DACkC;AAIpC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iEAC1C;AAQvB;IANC,IAAA,gBAAM,EAAC;QACN,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,IAAI;KACf,CAAC;;uEAC2B;AAI7B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yDACzC;AAIf;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+DAC1C;AAIrB;IADC,IAAA,gBAAM,EAAC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0DACzC;AAIlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;4DACzC;AAIlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qEAC1C;AAQ3B;IALC,IAAA,gBAAM,EAAC;QACN,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,IAAI;KACf,CAAC;8BAC2B,IAAI;8EAAC;AAIlC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;yEAC7C;AAKhC;IAFC,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,uCAAiB,CAAC;IACjC,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;8BACnC,uCAAiB;+DAAC;AAOhC;IAJC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,mCAAe,EAAE;QAChC,QAAQ,EAAE,UAAU;KACrB,CAAC;IACD,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACzB,mCAAe;0DAAC;AAOzB;IAJC,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,iDAAsB,EAAE;QACtC,QAAQ,EAAE,SAAS;KACpB,CAAC;IACD,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACzB,iDAAsB;0DAAC;AAGhC;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;8BAC7B,IAAI;6DAAC;AAGjB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;8BAC7B,IAAI;6DAAC;qCAtFN,0BAA0B;IADtC,IAAA,gBAAM,EAAC,yBAAyB,CAAC;GACrB,0BAA0B,CAuFtC"}

package/dist/auth-journeys/enums/auth-journey-status.enum.d.ts

@@ -0,0 +1,10 @@
+export declare enum AuthJourneyStatus {
+    NOT_STARTED = "not_started",
+    USER_CONSENT_REJECTED = "USER_CONSENT_REJECTED",
+    MCP_AUTH_FLOW_STARTED = "mcp_auth_flow_started",
+    MCP_AUTH_FLOW_COMPLETED = "mcp_auth_flow_completed",
+    CONNECTIONS_FLOW_STARTED = "connections_flow_started",
+    CONNECTIONS_FLOW_COMPLETED = "connections_flow_completed",
+    AUTHORIZATION_CODE_ISSUED = "authorization_code_issued",
+    AUTHORIZATION_CODE_EXCHANGED = "authorization_code_exchanged"
+}

package/dist/auth-journeys/enums/auth-journey-status.enum.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthJourneyStatus = void 0;
+var AuthJourneyStatus;
+(function (AuthJourneyStatus) {
+    AuthJourneyStatus["NOT_STARTED"] = "not_started";
+    AuthJourneyStatus["USER_CONSENT_REJECTED"] = "USER_CONSENT_REJECTED";
+    AuthJourneyStatus["MCP_AUTH_FLOW_STARTED"] = "mcp_auth_flow_started";
+    AuthJourneyStatus["MCP_AUTH_FLOW_COMPLETED"] = "mcp_auth_flow_completed";
+    AuthJourneyStatus["CONNECTIONS_FLOW_STARTED"] = "connections_flow_started";
+    AuthJourneyStatus["CONNECTIONS_FLOW_COMPLETED"] = "connections_flow_completed";
+    AuthJourneyStatus["AUTHORIZATION_CODE_ISSUED"] = "authorization_code_issued";
+    AuthJourneyStatus["AUTHORIZATION_CODE_EXCHANGED"] = "authorization_code_exchanged";
+})(AuthJourneyStatus || (exports.AuthJourneyStatus = AuthJourneyStatus = {}));
+//# sourceMappingURL=auth-journey-status.enum.js.map

package/dist/auth-journeys/enums/auth-journey-status.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-journey-status.enum.js","sourceRoot":"","sources":["../../../src/auth-journeys/enums/auth-journey-status.enum.ts"],"names":[],"mappings":";;;AAGA,IAAY,iBASX;AATD,WAAY,iBAAiB;IAC3B,gDAA2B,CAAA;IAC3B,oEAA+C,CAAA;IAC/C,oEAA+C,CAAA;IAC/C,wEAAmD,CAAA;IACnD,0EAAqD,CAAA;IACrD,8EAAyD,CAAA;IACzD,4EAAuD,CAAA;IACvD,kFAA6D,CAAA;AAC/D,CAAC,EATW,iBAAiB,iCAAjB,iBAAiB,QAS5B"}

package/dist/auth-journeys/enums/connection-authorization-flow-status.enum.d.ts

@@ -0,0 +1,5 @@
+export declare enum ConnectionAuthorizationFlowStatus {
+    PENDING = "PENDING",
+    AUTHORIZED = "AUTHORIZED",
+    FAILED = "FAILED"
+}

package/dist/auth-journeys/enums/connection-authorization-flow-status.enum.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectionAuthorizationFlowStatus = void 0;
+var ConnectionAuthorizationFlowStatus;
+(function (ConnectionAuthorizationFlowStatus) {
+    ConnectionAuthorizationFlowStatus["PENDING"] = "PENDING";
+    ConnectionAuthorizationFlowStatus["AUTHORIZED"] = "AUTHORIZED";
+    ConnectionAuthorizationFlowStatus["FAILED"] = "FAILED";
+})(ConnectionAuthorizationFlowStatus || (exports.ConnectionAuthorizationFlowStatus = ConnectionAuthorizationFlowStatus = {}));
+//# sourceMappingURL=connection-authorization-flow-status.enum.js.map

package/dist/auth-journeys/enums/connection-authorization-flow-status.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-authorization-flow-status.enum.js","sourceRoot":"","sources":["../../../src/auth-journeys/enums/connection-authorization-flow-status.enum.ts"],"names":[],"mappings":";;;AAGA,IAAY,iCAIX;AAJD,WAAY,iCAAiC;IAC3C,wDAAmB,CAAA;IACnB,8DAAyB,CAAA;IACzB,sDAAiB,CAAA;AACnB,CAAC,EAJW,iCAAiC,iDAAjC,iCAAiC,QAI5C"}

package/dist/auth-journeys/enums/mcp-authorization-flow-status.enum.d.ts

@@ -0,0 +1,10 @@
+export declare enum McpAuthorizationFlowStatus {
+    CLIENT_NOT_REGISTERED = "CLIENT_NOT_REGISTERED",
+    CLIENT_REGISTERED = "CLIENT_REGISTERED",
+    AUTHORIZATION_REQUEST_STARTED = "AUTHORIZATION_REQUEST_STARTED",
+    USER_CONSENT_OK = "USER_CONSENT_OK",
+    USER_CONSENT_REJECTED = "USER_CONSENT_REJECTED",
+    WAITING_ON_DOWNSTREAM_AUTH = "WAITING_ON_DOWNSTREAM_AUTH",
+    AUTHORIZATION_CODE_ISSUED = "AUTHORIZATION_CODE_ISSUED",
+    AUTHORIZATION_CODE_EXCHANGED = "AUTHORIZATION_CODE_EXCHANGED"
+}

package/dist/auth-journeys/enums/mcp-authorization-flow-status.enum.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpAuthorizationFlowStatus = void 0;
+var McpAuthorizationFlowStatus;
+(function (McpAuthorizationFlowStatus) {
+    McpAuthorizationFlowStatus["CLIENT_NOT_REGISTERED"] = "CLIENT_NOT_REGISTERED";
+    McpAuthorizationFlowStatus["CLIENT_REGISTERED"] = "CLIENT_REGISTERED";
+    McpAuthorizationFlowStatus["AUTHORIZATION_REQUEST_STARTED"] = "AUTHORIZATION_REQUEST_STARTED";
+    McpAuthorizationFlowStatus["USER_CONSENT_OK"] = "USER_CONSENT_OK";
+    McpAuthorizationFlowStatus["USER_CONSENT_REJECTED"] = "USER_CONSENT_REJECTED";
+    McpAuthorizationFlowStatus["WAITING_ON_DOWNSTREAM_AUTH"] = "WAITING_ON_DOWNSTREAM_AUTH";
+    McpAuthorizationFlowStatus["AUTHORIZATION_CODE_ISSUED"] = "AUTHORIZATION_CODE_ISSUED";
+    McpAuthorizationFlowStatus["AUTHORIZATION_CODE_EXCHANGED"] = "AUTHORIZATION_CODE_EXCHANGED";
+})(McpAuthorizationFlowStatus || (exports.McpAuthorizationFlowStatus = McpAuthorizationFlowStatus = {}));
+//# sourceMappingURL=mcp-authorization-flow-status.enum.js.map

package/dist/auth-journeys/enums/mcp-authorization-flow-status.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-authorization-flow-status.enum.js","sourceRoot":"","sources":["../../../src/auth-journeys/enums/mcp-authorization-flow-status.enum.ts"],"names":[],"mappings":";;;AAGA,IAAY,0BAcX;AAdD,WAAY,0BAA0B;IAEpC,6EAA+C,CAAA;IAC/C,qEAAuC,CAAA;IAGvC,6FAA+D,CAAA;IAC/D,iEAAmC,CAAA;IACnC,6EAA+C,CAAA;IAC/C,uFAAyD,CAAA;IACzD,qFAAuD,CAAA;IAGvD,2FAA6D,CAAA;AAC/D,CAAC,EAdW,0BAA0B,0CAA1B,0BAA0B,QAcrC"}

package/dist/authorization-server/authorization-server.module.d.ts

@@ -0,0 +1,2 @@
+export declare class AuthorizationServerModule {
+}

package/dist/authorization-server/authorization-server.module.js

@@ -0,0 +1,76 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationServerModule = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const client_registration_service_1 = require("./client-registration.service");
+const client_registration_controller_1 = require("./client-registration.controller");
+const authorization_service_1 = require("./authorization.service");
+const authorization_controller_1 = require("./authorization.controller");
+const token_service_1 = require("./token.service");
+const token_exchange_service_1 = require("./token-exchange.service");
+const issued_access_token_service_1 = require("./issued-access-token.service");
+const registered_client_entity_1 = require("./entities/registered-client.entity");
+const refresh_token_entity_1 = require("./entities/refresh-token.entity");
+const mcp_refresh_token_entity_1 = require("./entities/mcp-refresh-token.entity");
+const issued_access_token_entity_1 = require("./entities/issued-access-token.entity");
+const web_auth_controller_1 = require("./web-auth.controller");
+const auth_journeys_module_1 = require("../auth-journeys/auth-journeys.module");
+const mcp_registry_module_1 = require("../mcp-registry/mcp-registry.module");
+const identity_provider_module_1 = require("../identity-provider/identity-provider.module");
+const auth_guards_module_1 = require("../auth/guards/auth-guards.module");
+const mcp_connection_entity_1 = require("../mcp-registry/entities/mcp-connection.entity");
+const mcp_scope_mapping_entity_1 = require("../mcp-registry/entities/mcp-scope-mapping.entity");
+const connection_authorization_flow_entity_1 = require("../auth-journeys/entities/connection-authorization-flow.entity");
+const auth_crypto_module_1 = require("../auth/crypto/auth-crypto.module");
+const web_auth_service_1 = require("./web-auth.service");
+let AuthorizationServerModule = class AuthorizationServerModule {
+};
+exports.AuthorizationServerModule = AuthorizationServerModule;
+exports.AuthorizationServerModule = AuthorizationServerModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            typeorm_1.TypeOrmModule.forFeature([
+                registered_client_entity_1.RegisteredClientEntity,
+                refresh_token_entity_1.RefreshTokenEntity,
+                mcp_refresh_token_entity_1.McpRefreshTokenEntity,
+                issued_access_token_entity_1.IssuedAccessTokenEntity,
+                mcp_connection_entity_1.McpConnectionEntity,
+                mcp_scope_mapping_entity_1.McpScopeMappingEntity,
+                connection_authorization_flow_entity_1.ConnectionAuthorizationFlowEntity,
+            ]),
+            auth_journeys_module_1.AuthJourneysModule,
+            mcp_registry_module_1.McpRegistryModule,
+            identity_provider_module_1.IdentityProviderModule,
+            auth_crypto_module_1.AuthCryptoModule,
+            auth_guards_module_1.AuthGuardsModule,
+        ],
+        providers: [
+            client_registration_service_1.ClientRegistrationService,
+            authorization_service_1.AuthorizationService,
+            token_service_1.TokenService,
+            token_exchange_service_1.TokenExchangeService,
+            issued_access_token_service_1.IssuedAccessTokenService,
+            web_auth_service_1.WebAuthService,
+        ],
+        controllers: [
+            client_registration_controller_1.ClientRegistrationController,
+            authorization_controller_1.AuthorizationController,
+            web_auth_controller_1.WebAuthController,
+        ],
+        exports: [
+            client_registration_service_1.ClientRegistrationService,
+            authorization_service_1.AuthorizationService,
+            token_service_1.TokenService,
+            token_exchange_service_1.TokenExchangeService,
+            issued_access_token_service_1.IssuedAccessTokenService,
+        ],
+    })
+], AuthorizationServerModule);
+//# sourceMappingURL=authorization-server.module.js.map

package/dist/authorization-server/authorization-server.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-server.module.js","sourceRoot":"","sources":["../../src/authorization-server/authorization-server.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,6CAAgD;AAChD,+EAA0E;AAC1E,qFAAgF;AAChF,mEAA+D;AAC/D,yEAAqE;AACrE,mDAA+C;AAC/C,qEAAgE;AAChE,+EAAyE;AACzE,kFAA6E;AAC7E,0EAAqE;AACrE,kFAA4E;AAC5E,sFAAgF;AAChF,+DAA0D;AAC1D,gFAA2E;AAC3E,6EAAwE;AACxE,4FAAuF;AACvF,0EAAqE;AACrE,0FAAqF;AACrF,gGAA0F;AAC1F,yHAAmH;AACnH,0EAAqE;AACrE,yDAAoD;AAwC7C,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;CAAG,CAAA;AAA5B,8DAAyB;oCAAzB,yBAAyB;IAtCrC,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,uBAAa,CAAC,UAAU,CAAC;gBACvB,iDAAsB;gBACtB,yCAAkB;gBAClB,gDAAqB;gBACrB,oDAAuB;gBACvB,2CAAmB;gBACnB,gDAAqB;gBACrB,wEAAiC;aAClC,CAAC;YACF,yCAAkB;YAClB,uCAAiB;YACjB,iDAAsB;YACtB,qCAAgB;YAChB,qCAAgB;SACjB;QACD,SAAS,EAAE;YACT,uDAAyB;YACzB,4CAAoB;YACpB,4BAAY;YACZ,6CAAoB;YACpB,sDAAwB;YACxB,iCAAc;SACf;QACD,WAAW,EAAE;YACX,6DAA4B;YAC5B,kDAAuB;YACvB,uCAAiB;SAClB;QACD,OAAO,EAAE;YACP,uDAAyB;YACzB,4CAAoB;YACpB,4BAAY;YACZ,6CAAoB;YACpB,sDAAwB;SACzB;KACF,CAAC;GACW,yBAAyB,CAAG"}

package/dist/authorization-server/authorization.controller.d.ts

@@ -0,0 +1,31 @@
+import type { Request, Response } from 'express';
+import { AuthorizationService } from './authorization.service';
+import { TokenService } from './token.service';
+import { TokenExchangeService } from './token-exchange.service';
+import { AuthorizationRequestDto } from './dto/authorization-request.dto';
+import { ConsentDecisionDto } from './dto/consent-decision.dto';
+import { TokenRequestDto } from './dto/token-request.dto';
+import { TokenResponseDto } from './dto/token-response.dto';
+import { IntrospectTokenRequestDto } from './dto/introspect-token-request.dto';
+import { IntrospectTokenResponseDto } from './dto/introspect-token-response.dto';
+import { TokenExchangeRequestDto } from './dto/token-exchange-request.dto';
+import { TokenExchangeResponseDto } from './dto/token-exchange-response.dto';
+import { CallbackRequestDto } from './dto/callback-request.dto';
+import { GetConsentMetadataParamsDto } from './dto/consent-metadata-params.dto';
+import { GetConsentMetadataResponseDto } from './dto/consent-metadata-response.dto';
+import { ScopesResponseDto } from './dto/scope-response.dto';
+export declare class AuthorizationController {
+    private readonly authorizationService;
+    private readonly tokenService;
+    private readonly tokenExchangeService;
+    private logger;
+    constructor(authorizationService: AuthorizationService, tokenService: TokenService, tokenExchangeService: TokenExchangeService);
+    authorize(authRequest: AuthorizationRequestDto, serverIdentifier: string, version: string, res: Response): Promise<void>;
+    authorizeConsent(consentDecision: ConsentDecisionDto, serverIdentifier: string, version: string, req: Request, res: Response): Promise<void>;
+    getConsentMetadata(params: GetConsentMetadataParamsDto): Promise<GetConsentMetadataResponseDto>;
+    token(tokenRequest: TokenRequestDto, serverIdentifier: string, version: string): Promise<TokenResponseDto>;
+    introspect(introspectRequest: IntrospectTokenRequestDto, serverIdentifier: string, version: string): Promise<IntrospectTokenResponseDto>;
+    tokenExchange(tokenExchangeRequest: TokenExchangeRequestDto, serverIdentifier: string, version: string): Promise<TokenExchangeResponseDto>;
+    callback(callbackRequest: CallbackRequestDto, res: Response): Promise<void>;
+    getScopes(): Promise<ScopesResponseDto>;
+}

package/dist/authorization-server/authorization.controller.js

@@ -0,0 +1,298 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthorizationController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const authorization_service_1 = require("./authorization.service");
+const token_service_1 = require("./token.service");
+const token_exchange_service_1 = require("./token-exchange.service");
+const authorization_request_dto_1 = require("./dto/authorization-request.dto");
+const consent_decision_dto_1 = require("./dto/consent-decision.dto");
+const token_request_dto_1 = require("./dto/token-request.dto");
+const token_response_dto_1 = require("./dto/token-response.dto");
+const introspect_token_request_dto_1 = require("./dto/introspect-token-request.dto");
+const introspect_token_response_dto_1 = require("./dto/introspect-token-response.dto");
+const token_exchange_request_dto_1 = require("./dto/token-exchange-request.dto");
+const token_exchange_response_dto_1 = require("./dto/token-exchange-response.dto");
+const callback_request_dto_1 = require("./dto/callback-request.dto");
+const consent_metadata_params_dto_1 = require("./dto/consent-metadata-params.dto");
+const consent_metadata_response_dto_1 = require("./dto/consent-metadata-response.dto");
+const scope_response_dto_1 = require("./dto/scope-response.dto");
+const frontend_config_1 = require("../config/frontend.config");
+const access_token_guard_1 = require("../auth/guards/guards/access-token.guard");
+let AuthorizationController = AuthorizationController_1 = class AuthorizationController {
+    authorizationService;
+    tokenService;
+    tokenExchangeService;
+    logger = new common_1.Logger(AuthorizationController_1.name);
+    constructor(authorizationService, tokenService, tokenExchangeService) {
+        this.authorizationService = authorizationService;
+        this.tokenService = tokenService;
+        this.tokenExchangeService = tokenExchangeService;
+    }
+    async authorize(authRequest, serverIdentifier, version, res) {
+        try {
+            const flowId = await this.authorizationService.processAuthorizationRequest(authRequest, serverIdentifier, version);
+            const consentUrl = (0, frontend_config_1.getFrontendPath)(`/consent?flow=${flowId}`);
+            res.redirect(common_1.HttpStatus.FOUND, consentUrl);
+        }
+        catch (error) {
+            if (authRequest.redirect_uri) {
+                const errorUrl = new URL(authRequest.redirect_uri);
+                errorUrl.searchParams.set('error', 'server_error');
+                errorUrl.searchParams.set('error_description', error instanceof Error ? error.message : 'Unknown error');
+                if (authRequest.state) {
+                    errorUrl.searchParams.set('state', authRequest.state);
+                }
+                res.redirect(common_1.HttpStatus.FOUND, errorUrl.toString());
+            }
+            else {
+                throw new common_1.BadRequestException(error instanceof Error
+                    ? error.message
+                    : 'Authorization request failed');
+            }
+        }
+    }
+    async authorizeConsent(consentDecision, serverIdentifier, version, req, res) {
+        try {
+            const redirectUrl = await this.authorizationService.processConsentDecision(consentDecision, serverIdentifier, version, req);
+            this.logger.debug(`controller redirecting to ${redirectUrl}`);
+            res.redirect(common_1.HttpStatus.FOUND, redirectUrl);
+        }
+        catch (error) {
+            throw new common_1.BadRequestException(error instanceof Error ? error.message : 'Consent processing failed');
+        }
+    }
+    async getConsentMetadata(params) {
+        const consentMetadata = await this.authorizationService.getConsentMetadataFromFlowId(params.flowId);
+        return consentMetadata;
+    }
+    async token(tokenRequest, serverIdentifier, version) {
+        return this.tokenService.exchangeAuthorizationCode(tokenRequest);
+    }
+    async introspect(introspectRequest, serverIdentifier, version) {
+        return this.tokenService.introspectToken(introspectRequest);
+    }
+    async tokenExchange(tokenExchangeRequest, serverIdentifier, version) {
+        return this.tokenExchangeService.exchangeToken(tokenExchangeRequest, serverIdentifier);
+    }
+    async callback(callbackRequest, res) {
+        try {
+            const redirectUrl = await this.authorizationService.handleDownstreamCallback(callbackRequest);
+            res.redirect(common_1.HttpStatus.FOUND, redirectUrl);
+        }
+        catch (error) {
+            throw new common_1.BadRequestException(error instanceof Error ? error.message : 'Callback processing failed');
+        }
+    }
+    async getScopes() {
+        const scopes = await this.authorizationService.getAllAPIScopes();
+        return { scopes };
+    }
+};
+exports.AuthorizationController = AuthorizationController;
+__decorate([
+    (0, common_1.Get)('authorize/mcp/:serverIdentifier/:version'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'OAuth 2.0 Authorization Endpoint',
+        description: 'Handles authorization requests from MCP clients. Validates the request, stores PKCE parameters, and redirects to the consent screen UI.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: common_1.HttpStatus.FOUND,
+        description: 'Redirects to consent screen with authorization request ID',
+    }),
+    (0, swagger_1.ApiBadRequestResponse)({
+        description: 'Invalid authorization request parameters',
+    }),
+    (0, swagger_1.ApiNotFoundResponse)({
+        description: 'MCP server or client not found',
+    }),
+    __param(0, (0, common_1.Query)()),
+    __param(1, (0, common_1.Param)('serverIdentifier')),
+    __param(2, (0, common_1.Param)('version')),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [authorization_request_dto_1.AuthorizationRequestDto, String, String, Object]),
+    __metadata("design:returntype", Promise)
+], AuthorizationController.prototype, "authorize", null);
+__decorate([
+    (0, common_1.Post)('authorize/mcp/:serverIdentifier/:version'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'OAuth 2.0 Authorization Consent Handler',
+        description: 'Handles user consent decision. Validates the flow ID (CSRF token), generates an authorization code if approved, and redirects back to the client with the code or error.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: common_1.HttpStatus.FOUND,
+        description: 'Redirects to client redirect_uri with authorization code or error',
+    }),
+    (0, swagger_1.ApiBadRequestResponse)({
+        description: 'Invalid consent decision or flow state',
+    }),
+    (0, swagger_1.ApiNotFoundResponse)({
+        description: 'Authorization flow not found',
+    }),
+    (0, swagger_1.ApiUnauthorizedResponse)({
+        description: 'Authorization flow has already been used',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Param)('serverIdentifier')),
+    __param(2, (0, common_1.Param)('version')),
+    __param(3, (0, common_1.Req)()),
+    __param(4, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [consent_decision_dto_1.ConsentDecisionDto, String, String, Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthorizationController.prototype, "authorizeConsent", null);
+__decorate([
+    (0, common_1.Get)('consent/:flowId'),
+    (0, common_1.UseGuards)(access_token_guard_1.AccessTokenGuard),
+    (0, swagger_1.ApiCookieAuth)('JWT-Cookie'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Get metadata for the consent screen from flow ID',
+        description: 'Retrieves authorization flow details for the consent screen',
+    }),
+    (0, swagger_1.ApiOkResponse)({
+        description: 'Consent metadata retrieved successfully',
+        type: consent_metadata_response_dto_1.GetConsentMetadataResponseDto,
+    }),
+    (0, swagger_1.ApiUnauthorizedResponse)({
+        description: 'Authentication required to access consent metadata',
+    }),
+    (0, swagger_1.ApiNotFoundResponse)({
+        description: 'Authorization flow not found',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [consent_metadata_params_dto_1.GetConsentMetadataParamsDto]),
+    __metadata("design:returntype", Promise)
+], AuthorizationController.prototype, "getConsentMetadata", null);
+__decorate([
+    (0, common_1.Post)('token/mcp/:serverIdentifier/:version'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'OAuth 2.0 Token Endpoint',
+        description: 'Exchanges authorization code for access token. Validates PKCE code_verifier, issues signed JWT access token and refresh token.',
+    }),
+    (0, swagger_1.ApiOkResponse)({
+        description: 'Access token issued successfully',
+        type: token_response_dto_1.TokenResponseDto,
+    }),
+    (0, swagger_1.ApiBadRequestResponse)({
+        description: 'Invalid token request parameters',
+    }),
+    (0, swagger_1.ApiUnauthorizedResponse)({
+        description: 'Invalid authorization code, code_verifier, or expired code',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Param)('serverIdentifier')),
+    __param(2, (0, common_1.Param)('version')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [token_request_dto_1.TokenRequestDto, String, String]),
+    __metadata("design:returntype", Promise)
+], AuthorizationController.prototype, "token", null);
+__decorate([
+    (0, common_1.Post)('introspect/mcp/:serverIdentifier/:version'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'OAuth 2.0 Token Introspection Endpoint',
+        description: 'Introspects an access token to validate it and retrieve its metadata. Verifies JWT signature, expiration, and claims according to RFC 7662.',
+    }),
+    (0, swagger_1.ApiOkResponse)({
+        description: 'Token introspection response (active true/false with metadata)',
+        type: introspect_token_response_dto_1.IntrospectTokenResponseDto,
+    }),
+    (0, swagger_1.ApiBadRequestResponse)({
+        description: 'Invalid introspection request parameters',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Param)('serverIdentifier')),
+    __param(2, (0, common_1.Param)('version')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [introspect_token_request_dto_1.IntrospectTokenRequestDto, String, String]),
+    __metadata("design:returntype", Promise)
+], AuthorizationController.prototype, "introspect", null);
+__decorate([
+    (0, common_1.Post)('token-exchange/mcp/:serverIdentifier/:version'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'RFC 8693 Token Exchange Endpoint',
+        description: 'Exchanges MCP JWT access token for downstream system tokens. Validates MCP token, resolves scope mappings, and returns downstream access token with automatic refresh if needed.',
+    }),
+    (0, swagger_1.ApiOkResponse)({
+        description: 'Token exchange successful - returns downstream access token',
+        type: token_exchange_response_dto_1.TokenExchangeResponseDto,
+    }),
+    (0, swagger_1.ApiBadRequestResponse)({
+        description: 'Invalid token exchange request parameters',
+    }),
+    (0, swagger_1.ApiUnauthorizedResponse)({
+        description: 'Invalid or expired MCP JWT',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: common_1.HttpStatus.FORBIDDEN,
+        description: 'Insufficient scope - requested scope not entitled',
+    }),
+    (0, swagger_1.ApiNotFoundResponse)({
+        description: 'Connection not found',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Param)('serverIdentifier')),
+    __param(2, (0, common_1.Param)('version')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [token_exchange_request_dto_1.TokenExchangeRequestDto, String, String]),
+    __metadata("design:returntype", Promise)
+], AuthorizationController.prototype, "tokenExchange", null);
+__decorate([
+    (0, common_1.Get)('callback'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'OAuth 2.0 Callback Endpoint for Downstream Systems',
+        description: 'Handles callbacks from downstream OAuth providers. Validates the state, exchanges authorization code for tokens, and continues the auth flow.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: common_1.HttpStatus.FOUND,
+        description: 'Redirects to next step in the authorization flow',
+    }),
+    (0, swagger_1.ApiBadRequestResponse)({
+        description: 'Invalid callback parameters or state',
+    }),
+    (0, swagger_1.ApiNotFoundResponse)({
+        description: 'Connection flow not found for provided state',
+    }),
+    __param(0, (0, common_1.Query)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [callback_request_dto_1.CallbackRequestDto, Object]),
+    __metadata("design:returntype", Promise)
+], AuthorizationController.prototype, "callback", null);
+__decorate([
+    (0, common_1.Get)('scopes'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List All Available Scopes',
+        description: 'Returns a list of all scopes available in the system. Each scope includes its identifier string and a human-readable description.',
+    }),
+    (0, swagger_1.ApiOkResponse)({
+        description: 'List of all available scopes',
+        type: scope_response_dto_1.ScopesResponseDto,
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], AuthorizationController.prototype, "getScopes", null);
+exports.AuthorizationController = AuthorizationController = AuthorizationController_1 = __decorate([
+    (0, swagger_1.ApiTags)('Authorization Server'),
+    (0, common_1.Controller)('auth'),
+    __metadata("design:paramtypes", [authorization_service_1.AuthorizationService,
+        token_service_1.TokenService,
+        token_exchange_service_1.TokenExchangeService])
+], AuthorizationController);
+//# sourceMappingURL=authorization.controller.js.map