@taico/taico 0.0.2

package/dist/authorization-server/authorization.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.controller.js","sourceRoot":"","sources":["../../src/authorization-server/authorization.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAawB;AACxB,6CASyB;AAEzB,mEAA+D;AAC/D,mDAA+C;AAC/C,qEAAgE;AAChE,+EAA0E;AAC1E,qEAAgE;AAChE,+DAA0D;AAC1D,iEAA4D;AAC5D,qFAA+E;AAC/E,uFAAiF;AACjF,iFAA2E;AAC3E,mFAA6E;AAC7E,qEAAgE;AAChE,mFAAgF;AAChF,uFAAoF;AACpF,iEAA6D;AAC7D,+DAA4D;AAE5D,iFAA4E;AAIrE,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAGf;IACA;IACA;IAJX,MAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAC1D,YACmB,oBAA0C,EAC1C,YAA0B,EAC1B,oBAA0C;QAF1C,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,iBAAY,GAAZ,YAAY,CAAc;QAC1B,yBAAoB,GAApB,oBAAoB,CAAsB;IAC1D,CAAC;IAkBE,AAAN,KAAK,CAAC,SAAS,CACJ,WAAoC,EAClB,gBAAwB,EACjC,OAAe,EAC1B,GAAa;QAEpB,IAAI,CAAC;YAEH,MAAM,MAAM,GACV,MAAM,IAAI,CAAC,oBAAoB,CAAC,2BAA2B,CACzD,WAAW,EACX,gBAAgB,EAChB,OAAO,CACR,CAAC;YAIJ,MAAM,UAAU,GAAG,IAAA,iCAAe,EAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,QAAQ,CAAC,mBAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBACnD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;gBACnD,QAAQ,CAAC,YAAY,CAAC,GAAG,CACvB,mBAAmB,EACnB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CACzD,CAAC;gBACF,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;oBACtB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxD,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC,mBAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,4BAAmB,CAC3B,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,8BAA8B,CACnC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAsBK,AAAN,KAAK,CAAC,gBAAgB,CACZ,eAAmC,EAChB,gBAAwB,EACjC,OAAe,EAC1B,GAAY,EACZ,GAAa;QAEpB,IAAI,CAAC;YACH,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,CACpD,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,GAAG,CACJ,CAAC;YAEJ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,WAAW,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,QAAQ,CAAC,mBAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,MAAM,IAAI,4BAAmB,CAC3B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IAmBK,AAAN,KAAK,CAAC,kBAAkB,CACb,MAAmC;QAE5C,MAAM,eAAe,GACnB,MAAM,IAAI,CAAC,oBAAoB,CAAC,4BAA4B,CAC1D,MAAM,CAAC,MAAM,CACd,CAAC;QACJ,OAAO,eAAe,CAAC;IACzB,CAAC;IAkBK,AAAN,KAAK,CAAC,KAAK,CACD,YAA6B,EACV,gBAAwB,EACjC,OAAe;QAEjC,OAAO,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACnE,CAAC;IAgBK,AAAN,KAAK,CAAC,UAAU,CACN,iBAA4C,EACzB,gBAAwB,EACjC,OAAe;QAEjC,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC9D,CAAC;IAyBK,AAAN,KAAK,CAAC,aAAa,CACT,oBAA6C,EAC1B,gBAAwB,EACjC,OAAe;QAEjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAC5C,oBAAoB,EACpB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAkBK,AAAN,KAAK,CAAC,QAAQ,CACH,eAAmC,EACrC,GAAa;QAEpB,IAAI,CAAC;YACH,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CACtD,eAAe,CAChB,CAAC;YACJ,GAAG,CAAC,QAAQ,CAAC,mBAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,MAAM,IAAI,4BAAmB,CAC3B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IAYK,AAAN,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,EAAE,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;CACF,CAAA;AA3QY,0DAAuB;AAwB5B;IAhBL,IAAA,YAAG,EAAC,0CAA0C,CAAC;IAC/C,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,yIAAyI;KAC5I,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,KAAK;QACxB,WAAW,EAAE,2DAA2D;KACzE,CAAC;IACD,IAAA,+BAAqB,EAAC;QACrB,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACD,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,gCAAgC;KAC9C,CAAC;IAEC,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,cAAK,EAAC,kBAAkB,CAAC,CAAA;IACzB,WAAA,IAAA,cAAK,EAAC,SAAS,CAAC,CAAA;IAChB,WAAA,IAAA,YAAG,GAAE,CAAA;;qCAHgB,mDAAuB;;wDAuC9C;AAsBK;IApBL,IAAA,aAAI,EAAC,0CAA0C,CAAC;IAChD,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,0KAA0K;KAC7K,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,KAAK;QACxB,WAAW,EACT,mEAAmE;KACtE,CAAC;IACD,IAAA,+BAAqB,EAAC;QACrB,WAAW,EAAE,wCAAwC;KACtD,CAAC;IACD,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,8BAA8B;KAC5C,CAAC;IACD,IAAA,iCAAuB,EAAC;QACvB,WAAW,EAAE,0CAA0C;KACxD,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,cAAK,EAAC,kBAAkB,CAAC,CAAA;IACzB,WAAA,IAAA,cAAK,EAAC,SAAS,CAAC,CAAA;IAChB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;;qCAJmB,yCAAkB;;+DAuB5C;AAmBK;IAjBL,IAAA,YAAG,EAAC,iBAAiB,CAAC;IACtB,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC3B,IAAA,uBAAa,EAAC,YAAY,CAAC;IAC3B,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EAAE,6DAA6D;KAC3E,CAAC;IACD,IAAA,uBAAa,EAAC;QACb,WAAW,EAAE,yCAAyC;QACtD,IAAI,EAAE,6DAA6B;KACpC,CAAC;IACD,IAAA,iCAAuB,EAAC;QACvB,WAAW,EAAE,oDAAoD;KAClE,CAAC;IACD,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,8BAA8B;KAC5C,CAAC;IAEC,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,yDAA2B;;iEAO7C;AAkBK;IAhBL,IAAA,aAAI,EAAC,sCAAsC,CAAC;IAC5C,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,gIAAgI;KACnI,CAAC;IACD,IAAA,uBAAa,EAAC;QACb,WAAW,EAAE,kCAAkC;QAC/C,IAAI,EAAE,qCAAgB;KACvB,CAAC;IACD,IAAA,+BAAqB,EAAC;QACrB,WAAW,EAAE,kCAAkC;KAChD,CAAC;IACD,IAAA,iCAAuB,EAAC;QACvB,WAAW,EAAE,4DAA4D;KAC1E,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,cAAK,EAAC,kBAAkB,CAAC,CAAA;IACzB,WAAA,IAAA,cAAK,EAAC,SAAS,CAAC,CAAA;;qCAFK,mCAAe;;oDAKtC;AAgBK;IAdL,IAAA,aAAI,EAAC,2CAA2C,CAAC;IACjD,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EACT,6IAA6I;KAChJ,CAAC;IACD,IAAA,uBAAa,EAAC;QACb,WAAW,EACT,gEAAgE;QAClE,IAAI,EAAE,0DAA0B;KACjC,CAAC;IACD,IAAA,+BAAqB,EAAC;QACrB,WAAW,EAAE,0CAA0C;KACxD,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,cAAK,EAAC,kBAAkB,CAAC,CAAA;IACzB,WAAA,IAAA,cAAK,EAAC,SAAS,CAAC,CAAA;;qCAFU,wDAAyB;;yDAKrD;AAyBK;IAvBL,IAAA,aAAI,EAAC,+CAA+C,CAAC;IACrD,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,kLAAkL;KACrL,CAAC;IACD,IAAA,uBAAa,EAAC;QACb,WAAW,EAAE,6DAA6D;QAC1E,IAAI,EAAE,sDAAwB;KAC/B,CAAC;IACD,IAAA,+BAAqB,EAAC;QACrB,WAAW,EAAE,2CAA2C;KACzD,CAAC;IACD,IAAA,iCAAuB,EAAC;QACvB,WAAW,EAAE,4BAA4B;KAC1C,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,SAAS;QAC5B,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACD,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,sBAAsB;KACpC,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,cAAK,EAAC,kBAAkB,CAAC,CAAA;IACzB,WAAA,IAAA,cAAK,EAAC,SAAS,CAAC,CAAA;;qCAFa,oDAAuB;;4DAQtD;AAkBK;IAhBL,IAAA,YAAG,EAAC,UAAU,CAAC;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EACT,+IAA+I;KAClJ,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,KAAK;QACxB,WAAW,EAAE,kDAAkD;KAChE,CAAC;IACD,IAAA,+BAAqB,EAAC;QACrB,WAAW,EAAE,sCAAsC;KACpD,CAAC;IACD,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,8CAA8C;KAC5D,CAAC;IAEC,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADoB,yCAAkB;;uDAe7C;AAYK;IAVL,IAAA,YAAG,EAAC,QAAQ,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,mIAAmI;KACtI,CAAC;IACD,IAAA,uBAAa,EAAC;QACb,WAAW,EAAE,8BAA8B;QAC3C,IAAI,EAAE,sCAAiB;KACxB,CAAC;;;;wDAID;kCA1QU,uBAAuB;IAFnC,IAAA,iBAAO,EAAC,sBAAsB,CAAC;IAC/B,IAAA,mBAAU,EAAC,MAAM,CAAC;qCAIwB,4CAAoB;QAC5B,4BAAY;QACJ,6CAAoB;GALlD,uBAAuB,CA2QnC"}

package/dist/authorization-server/authorization.service.d.ts

@@ -0,0 +1,30 @@
+import { Repository } from 'typeorm';
+import type { Request } from 'express';
+import { RegisteredClientEntity } from './entities/registered-client.entity';
+import { AuthorizationRequestDto } from './dto/authorization-request.dto';
+import { ConsentDecisionDto } from './dto/consent-decision.dto';
+import { McpRegistryService } from '../mcp-registry/mcp-registry.service';
+import { AuthJourneysService } from '../auth-journeys/auth-journeys.service';
+import { CallbackRequestDto } from './dto/callback-request.dto';
+import { TokenService } from './token.service';
+import { TokenVerifierService } from '../auth/crypto/token-verifier.service';
+import { ConsentMetadata } from './dto/service/authorization.service.types';
+import { Scope } from 'src/auth/core/types/scope.type';
+export declare class AuthorizationService {
+    private readonly clientRepository;
+    private readonly authJourneysService;
+    private readonly mcpRegistryService;
+    private readonly tokenService;
+    private readonly tokenVerifierService;
+    private logger;
+    constructor(clientRepository: Repository<RegisteredClientEntity>, authJourneysService: AuthJourneysService, mcpRegistryService: McpRegistryService, tokenService: TokenService, tokenVerifierService: TokenVerifierService);
+    getAllAPIScopes(): Promise<Scope[]>;
+    processAuthorizationRequest(authRequest: AuthorizationRequestDto, serverIdentifier: string, version: string): Promise<string>;
+    getConsentMetadataFromFlowId(flowId: string): Promise<ConsentMetadata>;
+    processConsentDecision(consentDecision: ConsentDecisionDto, serverIdentifier: string, version: string, req: Request): Promise<string>;
+    private processNextDownstreamFlow;
+    private initiateConnectionOAuth;
+    private completeMcpAuthFlow;
+    handleDownstreamCallback(callbackRequest: CallbackRequestDto): Promise<string>;
+    private exchangeCodeForToken;
+}

package/dist/authorization-server/authorization.service.js

@@ -0,0 +1,311 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const crypto_1 = require("crypto");
+const registered_client_entity_1 = require("./entities/registered-client.entity");
+const mcp_registry_service_1 = require("../mcp-registry/mcp-registry.service");
+const auth_journeys_service_1 = require("../auth-journeys/auth-journeys.service");
+const mcp_authorization_flow_status_enum_1 = require("../auth-journeys/enums/mcp-authorization-flow-status.enum");
+const env_config_1 = require("../config/env.config");
+const token_service_1 = require("./token.service");
+const cookie_keys_constant_1 = require("../auth/core/constants/cookie-keys.constant");
+const authorization_errors_1 = require("./errors/authorization.errors");
+const token_verifier_service_1 = require("../auth/crypto/token-verifier.service");
+const auth_journey_status_enum_1 = require("../auth-journeys/enums/auth-journey-status.enum");
+const connection_authorization_flow_status_enum_1 = require("../auth-journeys/enums/connection-authorization-flow-status.enum");
+const all_api_scopes_1 = require("../auth/core/scopes/all-api.scopes");
+let AuthorizationService = class AuthorizationService {
+    clientRepository;
+    authJourneysService;
+    mcpRegistryService;
+    tokenService;
+    tokenVerifierService;
+    logger = new common_1.Logger(auth_journeys_service_1.AuthJourneysService.name);
+    constructor(clientRepository, authJourneysService, mcpRegistryService, tokenService, tokenVerifierService) {
+        this.clientRepository = clientRepository;
+        this.authJourneysService = authJourneysService;
+        this.mcpRegistryService = mcpRegistryService;
+        this.tokenService = tokenService;
+        this.tokenVerifierService = tokenVerifierService;
+    }
+    async getAllAPIScopes() {
+        return all_api_scopes_1.ALL_API_SCOPES;
+    }
+    async processAuthorizationRequest(authRequest, serverIdentifier, version) {
+        const mcpServer = await this.mcpRegistryService.getServerByProvidedId(serverIdentifier);
+        if (!mcpServer) {
+            throw new authorization_errors_1.McpServerNotFoundError(serverIdentifier);
+        }
+        const client = await this.clientRepository.findOne({
+            where: { clientId: authRequest.client_id },
+        });
+        if (!client) {
+            throw new authorization_errors_1.McpClientNotFoundError(authRequest.client_id);
+        }
+        if (!client.redirectUris.includes(authRequest.redirect_uri)) {
+            throw new authorization_errors_1.InvalidRedirectUriError(authRequest.redirect_uri, authRequest.client_id);
+        }
+        let scopes = [];
+        if (authRequest.scope) {
+            const requestedScopes = authRequest.scope.split(' ');
+            const allowedScopes = mcpServer.scopes.map((s) => s.id);
+            scopes = requestedScopes.filter((s) => allowedScopes.includes(s));
+        }
+        const mcpAuthFlow = await this.authJourneysService.findMcpAuthFlowByClientAndServer(client.id, mcpServer.id, ['authJourney']);
+        if (!mcpAuthFlow) {
+            throw new authorization_errors_1.AuthFlowNotFoundError(`client: ${authRequest.client_id}, server: ${serverIdentifier}`);
+        }
+        mcpAuthFlow.status =
+            mcp_authorization_flow_status_enum_1.McpAuthorizationFlowStatus.AUTHORIZATION_REQUEST_STARTED;
+        mcpAuthFlow.codeChallenge = authRequest.code_challenge;
+        mcpAuthFlow.codeChallengeMethod = authRequest.code_challenge_method;
+        mcpAuthFlow.state = authRequest.state;
+        mcpAuthFlow.redirectUri = authRequest.redirect_uri;
+        mcpAuthFlow.resource = authRequest.resource;
+        mcpAuthFlow.scopes = scopes;
+        await this.authJourneysService.saveMcpAuthFlow(mcpAuthFlow);
+        await this.authJourneysService.updateAuthJourneyStatus(mcpAuthFlow.authorizationJourneyId, auth_journey_status_enum_1.AuthJourneyStatus.MCP_AUTH_FLOW_STARTED);
+        return mcpAuthFlow.id;
+    }
+    async getConsentMetadataFromFlowId(flowId) {
+        const mcpAuthFlow = await this.authJourneysService.findMcpAuthFlowById(flowId, ['server', 'client', 'authJourney']);
+        if (!mcpAuthFlow) {
+            throw new authorization_errors_1.AuthFlowNotFoundError(flowId);
+        }
+        const consentMetadata = {
+            id: mcpAuthFlow.id,
+            status: mcpAuthFlow.status,
+            scopes: mcpAuthFlow.scopes,
+            resource: mcpAuthFlow.resource,
+            server: {
+                providedId: mcpAuthFlow.server.providedId,
+                name: mcpAuthFlow.server.name,
+                description: mcpAuthFlow.server.description,
+            },
+            client: {
+                clientId: mcpAuthFlow.client.clientId,
+                clientName: mcpAuthFlow.client.clientName,
+            },
+            redirectUri: mcpAuthFlow.redirectUri,
+            createdAt: mcpAuthFlow.createdAt,
+        };
+        return consentMetadata;
+    }
+    async processConsentDecision(consentDecision, serverIdentifier, version, req) {
+        const mcpAuthFlow = await this.authJourneysService.findMcpAuthFlowById(consentDecision.flow_id, ['server', 'client', 'authJourney']);
+        if (!mcpAuthFlow) {
+            throw new authorization_errors_1.AuthFlowNotFoundError(consentDecision.flow_id);
+        }
+        if (mcpAuthFlow.authorizationCode) {
+            throw new authorization_errors_1.AuthFlowAlreadyCompletedError(consentDecision.flow_id);
+        }
+        if (mcpAuthFlow.server.providedId !== serverIdentifier) {
+            throw new authorization_errors_1.ServerIdentifierMismatchError(serverIdentifier, mcpAuthFlow.server.providedId);
+        }
+        if (!mcpAuthFlow.codeChallenge ||
+            !mcpAuthFlow.redirectUri ||
+            !mcpAuthFlow.state) {
+            throw new authorization_errors_1.InvalidFlowStateError('missing required parameters');
+        }
+        if (!consentDecision.approved) {
+            mcpAuthFlow.status = mcp_authorization_flow_status_enum_1.McpAuthorizationFlowStatus.USER_CONSENT_REJECTED;
+            await this.authJourneysService.saveMcpAuthFlow(mcpAuthFlow);
+            await this.authJourneysService.updateAuthJourneyStatus(mcpAuthFlow.authorizationJourneyId, auth_journey_status_enum_1.AuthJourneyStatus.USER_CONSENT_REJECTED);
+            const errorUrl = new URL(mcpAuthFlow.redirectUri);
+            errorUrl.searchParams.set('error', 'access_denied');
+            errorUrl.searchParams.set('error_description', 'User denied the authorization request');
+            errorUrl.searchParams.set('state', mcpAuthFlow.state);
+            return errorUrl.toString();
+        }
+        const accessToken = req.cookies?.[cookie_keys_constant_1.COOKIE_KEYS.ACCESS_TOKEN];
+        if (accessToken && mcpAuthFlow.authJourney) {
+            try {
+                const payload = await this.tokenVerifierService.verifyAndDecode(accessToken);
+                mcpAuthFlow.authJourney.actorId = payload.sub;
+                await this.authJourneysService.saveAuthJourney(mcpAuthFlow.authJourney);
+            }
+            catch (error) {
+                this.logger.warn(`Failed to extract user ID from access token: ${error}`);
+            }
+        }
+        mcpAuthFlow.status = mcp_authorization_flow_status_enum_1.McpAuthorizationFlowStatus.USER_CONSENT_OK;
+        await this.authJourneysService.saveMcpAuthFlow(mcpAuthFlow);
+        await this.authJourneysService.updateAuthJourneyStatus(mcpAuthFlow.authorizationJourneyId, auth_journey_status_enum_1.AuthJourneyStatus.MCP_AUTH_FLOW_COMPLETED);
+        return this.processNextDownstreamFlow(mcpAuthFlow.authorizationJourneyId);
+    }
+    async processNextDownstreamFlow(journeyId) {
+        const connectionFlows = await this.authJourneysService.getConnectionFlowsForJourney(journeyId, [
+            'mcpConnection',
+            'mcpConnection.mappings',
+            'authJourney',
+            'authJourney.mcpAuthorizationFlow',
+        ]);
+        if (connectionFlows.length === 0) {
+            this.logger.log('No downstream connections to authorize, completing MCP auth');
+            return this.completeMcpAuthFlow(journeyId);
+        }
+        const mcpAuthFlow = connectionFlows[0]?.authJourney?.mcpAuthorizationFlow;
+        const hasRequestedScopes = mcpAuthFlow?.scopes && mcpAuthFlow.scopes.length > 0;
+        if (!hasRequestedScopes) {
+            this.logger.log('No scopes requested, skipping downstream OAuth flows and completing MCP auth');
+            return this.completeMcpAuthFlow(journeyId);
+        }
+        const nextPendingFlow = connectionFlows.find((flow) => flow.status === connection_authorization_flow_status_enum_1.ConnectionAuthorizationFlowStatus.PENDING);
+        if (nextPendingFlow) {
+            await this.authJourneysService.updateAuthJourneyStatus(journeyId, auth_journey_status_enum_1.AuthJourneyStatus.CONNECTIONS_FLOW_STARTED);
+            return this.initiateConnectionOAuth(nextPendingFlow);
+        }
+        const allAuthorized = connectionFlows.every((flow) => flow.status === connection_authorization_flow_status_enum_1.ConnectionAuthorizationFlowStatus.AUTHORIZED);
+        const anyFailed = connectionFlows.some((flow) => flow.status === connection_authorization_flow_status_enum_1.ConnectionAuthorizationFlowStatus.FAILED);
+        if (allAuthorized) {
+            this.logger.log('All downstream connections authorized, completing MCP auth');
+            await this.authJourneysService.updateAuthJourneyStatus(journeyId, auth_journey_status_enum_1.AuthJourneyStatus.CONNECTIONS_FLOW_COMPLETED);
+            return this.completeMcpAuthFlow(journeyId);
+        }
+        else if (anyFailed) {
+            throw new authorization_errors_1.DownstreamAuthFailedError('One or more downstream connections failed to authorize');
+        }
+        else {
+            throw new authorization_errors_1.NoPendingConnectionFlowsError();
+        }
+    }
+    async initiateConnectionOAuth(connectionFlow) {
+        const config = (0, env_config_1.getConfig)();
+        const callbackUrl = config.callbackUrl;
+        const state = (0, crypto_1.randomBytes)(32).toString('base64url');
+        connectionFlow.state = state;
+        connectionFlow.status = connection_authorization_flow_status_enum_1.ConnectionAuthorizationFlowStatus.PENDING;
+        await this.authJourneysService.saveConnectionFlow(connectionFlow);
+        const authUrl = new URL(connectionFlow.mcpConnection.authorizeUrl);
+        authUrl.searchParams.set('client_id', connectionFlow.mcpConnection.clientId);
+        authUrl.searchParams.set('redirect_uri', callbackUrl);
+        authUrl.searchParams.set('response_type', 'code');
+        authUrl.searchParams.set('state', state);
+        authUrl.searchParams.set('access_type', 'offline');
+        authUrl.searchParams.set('prompt', 'consent');
+        const mcpAuthFlow = connectionFlow.authJourney?.mcpAuthorizationFlow;
+        if (mcpAuthFlow?.scopes && connectionFlow.mcpConnection.mappings) {
+            const requestedScopes = mcpAuthFlow.scopes;
+            const relevantMappings = connectionFlow.mcpConnection.mappings.filter((mapping) => requestedScopes.includes(mapping.scopeId));
+            const downstreamScopes = relevantMappings.map((m) => m.downstreamScope);
+            if (downstreamScopes.length > 0) {
+                authUrl.searchParams.set('scope', downstreamScopes.join(' '));
+            }
+            else {
+                this.logger.warn('No downstream scopes mapped for requested MCP scopes!');
+            }
+        }
+        else {
+            this.logger.warn(`Scope mapping skipped - mcpAuthFlow.scope: ${!!mcpAuthFlow?.scopes}, mappings: ${!!connectionFlow.mcpConnection.mappings}`);
+        }
+        this.logger.log(`Initiating downstream OAuth flow for connection ${connectionFlow.mcpConnection.friendlyName}`);
+        this.logger.log(`Authorization URL: ${authUrl.toString()}`);
+        return authUrl.toString();
+    }
+    async completeMcpAuthFlow(journeyId) {
+        this.logger.debug(`Finishing auth flow for journey ${journeyId}`);
+        const mcpAuthFlow = await this.authJourneysService.findMcpAuthFlowByJourneyId(journeyId);
+        if (!mcpAuthFlow) {
+            throw new authorization_errors_1.AuthFlowNotFoundError(journeyId);
+        }
+        if (!mcpAuthFlow.redirectUri || !mcpAuthFlow.state) {
+            throw new authorization_errors_1.InvalidFlowStateError('missing redirect URI or state');
+        }
+        const authorizationCode = (0, crypto_1.randomBytes)(32).toString('base64url');
+        const expiresAt = new Date();
+        expiresAt.setMinutes(expiresAt.getMinutes() + 10);
+        mcpAuthFlow.authorizationCode = authorizationCode;
+        mcpAuthFlow.authorizationCodeExpiresAt = expiresAt;
+        mcpAuthFlow.authorizationCodeUsed = false;
+        mcpAuthFlow.status = mcp_authorization_flow_status_enum_1.McpAuthorizationFlowStatus.AUTHORIZATION_CODE_ISSUED;
+        await this.authJourneysService.saveMcpAuthFlow(mcpAuthFlow);
+        await this.authJourneysService.updateAuthJourneyStatus(mcpAuthFlow.authorizationJourneyId, auth_journey_status_enum_1.AuthJourneyStatus.AUTHORIZATION_CODE_ISSUED);
+        const redirectUrl = new URL(mcpAuthFlow.redirectUri);
+        redirectUrl.searchParams.set('code', authorizationCode);
+        redirectUrl.searchParams.set('state', mcpAuthFlow.state);
+        this.logger.debug(`redirectUrl: ${redirectUrl}`);
+        return redirectUrl.toString();
+    }
+    async handleDownstreamCallback(callbackRequest) {
+        if (callbackRequest.error) {
+            this.logger.error(`Downstream auth failed: ${callbackRequest.error} - ${callbackRequest.error_description}`);
+            throw new authorization_errors_1.DownstreamAuthFailedError(callbackRequest.error_description || callbackRequest.error);
+        }
+        const connectionFlow = await this.authJourneysService.findConnectionFlowByState(callbackRequest.state, ['mcpConnection', 'authJourney', 'authJourney.mcpAuthorizationFlow']);
+        if (!connectionFlow) {
+            throw new authorization_errors_1.ConnectionFlowNotFoundError(callbackRequest.state);
+        }
+        connectionFlow.authorizationCode = callbackRequest.code;
+        await this.exchangeCodeForToken(connectionFlow);
+        return this.processNextDownstreamFlow(connectionFlow.authorizationJourneyId);
+    }
+    async exchangeCodeForToken(connectionFlow) {
+        const config = (0, env_config_1.getConfig)();
+        const callbackUrl = config.callbackUrl;
+        try {
+            const tokenResponse = await fetch(connectionFlow.mcpConnection.tokenUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: new URLSearchParams({
+                    grant_type: 'authorization_code',
+                    code: connectionFlow.authorizationCode,
+                    redirect_uri: callbackUrl,
+                    client_id: connectionFlow.mcpConnection.clientId,
+                    client_secret: connectionFlow.mcpConnection.clientSecret,
+                }),
+            });
+            if (!tokenResponse.ok) {
+                const errorText = await tokenResponse.text();
+                this.logger.error(`Token exchange failed: ${errorText}`);
+                connectionFlow.status = connection_authorization_flow_status_enum_1.ConnectionAuthorizationFlowStatus.FAILED;
+                await this.authJourneysService.saveConnectionFlow(connectionFlow);
+                throw new authorization_errors_1.TokenExchangeFailedError(errorText);
+            }
+            const tokenData = await tokenResponse.json();
+            connectionFlow.accessToken = tokenData.access_token;
+            connectionFlow.refreshToken = tokenData.refresh_token;
+            if (tokenData.expires_in) {
+                const expiresAt = new Date();
+                expiresAt.setSeconds(expiresAt.getSeconds() + tokenData.expires_in);
+                connectionFlow.tokenExpiresAt = expiresAt;
+            }
+            connectionFlow.status = connection_authorization_flow_status_enum_1.ConnectionAuthorizationFlowStatus.AUTHORIZED;
+            await this.authJourneysService.saveConnectionFlow(connectionFlow);
+            this.logger.log(`Successfully exchanged token for connection ${connectionFlow.mcpConnection.friendlyName}`);
+        }
+        catch (error) {
+            this.logger.error(`Error exchanging token: ${error}`);
+            connectionFlow.status = connection_authorization_flow_status_enum_1.ConnectionAuthorizationFlowStatus.FAILED;
+            await this.authJourneysService.saveConnectionFlow(connectionFlow);
+            throw error;
+        }
+    }
+};
+exports.AuthorizationService = AuthorizationService;
+exports.AuthorizationService = AuthorizationService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(registered_client_entity_1.RegisteredClientEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        auth_journeys_service_1.AuthJourneysService,
+        mcp_registry_service_1.McpRegistryService,
+        token_service_1.TokenService,
+        token_verifier_service_1.TokenVerifierService])
+], AuthorizationService);
+//# sourceMappingURL=authorization.service.js.map

package/dist/authorization-server/authorization.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.service.js","sourceRoot":"","sources":["../../src/authorization-server/authorization.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,6CAAmD;AACnD,qCAAqC;AACrC,mCAAqC;AAErC,kFAA6E;AAG7E,+EAA0E;AAC1E,kFAA6E;AAE7E,kHAAuG;AAEvG,qDAAkD;AAClD,mDAA+C;AAC/C,sFAA0E;AAC1E,wEAYuC;AACvC,kFAA6E;AAE7E,8FAAqF;AACrF,gIAAsH;AAEtH,uEAAqE;AAG9D,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAIZ;IACA;IACA;IACA;IACA;IAPX,MAAM,GAAG,IAAI,eAAM,CAAC,2CAAmB,CAAC,IAAI,CAAC,CAAC;IACtD,YAEmB,gBAAoD,EACpD,mBAAwC,EACxC,kBAAsC,EACtC,YAA0B,EAC1B,oBAA0C;QAJ1C,qBAAgB,GAAhB,gBAAgB,CAAoC;QACpD,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,yBAAoB,GAApB,oBAAoB,CAAsB;IAC1D,CAAC;IAEJ,KAAK,CAAC,eAAe;QACnB,OAAO,+BAAc,CAAC;IACxB,CAAC;IAMD,KAAK,CAAC,2BAA2B,CAC/B,WAAoC,EACpC,gBAAwB,EACxB,OAAe;QAGf,MAAM,SAAS,GACb,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,6CAAsB,CAAC,gBAAgB,CAAC,CAAC;QACrD,CAAC;QAGD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,6CAAsB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAGD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,8CAAuB,CAC/B,WAAW,CAAC,YAAY,EACxB,WAAW,CAAC,SAAS,CACtB,CAAC;QACJ,CAAC;QAMD,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrD,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QAGD,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,mBAAmB,CAAC,gCAAgC,CAC7D,MAAM,CAAC,EAAE,EACT,SAAS,CAAC,EAAE,EACZ,CAAC,aAAa,CAAC,CAChB,CAAC;QAEJ,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,4CAAqB,CAC7B,WAAW,WAAW,CAAC,SAAS,aAAa,gBAAgB,EAAE,CAChE,CAAC;QACJ,CAAC;QAGD,WAAW,CAAC,MAAM;YAChB,+DAA0B,CAAC,6BAA6B,CAAC;QAG3D,WAAW,CAAC,aAAa,GAAG,WAAW,CAAC,cAAc,CAAC;QACvD,WAAW,CAAC,mBAAmB,GAAG,WAAW,CAAC,qBAAqB,CAAC;QACpE,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QACtC,WAAW,CAAC,WAAW,GAAG,WAAW,CAAC,YAAY,CAAC;QACnD,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;QAC5C,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;QAE5B,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CACpD,WAAW,CAAC,sBAAsB,EAClC,4CAAiB,CAAC,qBAAqB,CACxC,CAAC;QAGF,OAAO,WAAW,CAAC,EAAE,CAAC;IACxB,CAAC;IAMD,KAAK,CAAC,4BAA4B,CAAC,MAAc;QAC/C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CACpE,MAAM,EACN,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CACpC,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,4CAAqB,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,eAAe,GAAoB;YACvC,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE;gBACN,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU;gBACzC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI;gBAC7B,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,WAAW;aAC5C;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ;gBACrC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU;aAC1C;YACD,WAAW,EAAE,WAAW,CAAC,WAAY;YACrC,SAAS,EAAE,WAAW,CAAC,SAAS;SACjC,CAAC;QACF,OAAO,eAAe,CAAC;IACzB,CAAC;IAMD,KAAK,CAAC,sBAAsB,CAC1B,eAAmC,EACnC,gBAAwB,EACxB,OAAe,EACf,GAAY;QAGZ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CACpE,eAAe,CAAC,OAAO,EACvB,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CACpC,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,4CAAqB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAGD,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAClC,MAAM,IAAI,oDAA6B,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC;QAGD,IAAI,WAAW,CAAC,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YACvD,MAAM,IAAI,oDAA6B,CACrC,gBAAgB,EAChB,WAAW,CAAC,MAAM,CAAC,UAAU,CAC9B,CAAC;QACJ,CAAC;QAGD,IACE,CAAC,WAAW,CAAC,aAAa;YAC1B,CAAC,WAAW,CAAC,WAAW;YACxB,CAAC,WAAW,CAAC,KAAK,EAClB,CAAC;YACD,MAAM,IAAI,4CAAqB,CAAC,6BAA6B,CAAC,CAAC;QACjE,CAAC;QAGD,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;YAE9B,WAAW,CAAC,MAAM,GAAG,+DAA0B,CAAC,qBAAqB,CAAC;YACtE,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CACpD,WAAW,CAAC,sBAAsB,EAClC,4CAAiB,CAAC,qBAAqB,CACxC,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAClD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACpD,QAAQ,CAAC,YAAY,CAAC,GAAG,CACvB,mBAAmB,EACnB,uCAAuC,CACxC,CAAC;YACF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC;QAGD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,kCAAW,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,WAAW,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,OAAO,GACX,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC/D,WAAW,CAAC,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;gBAC9C,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,KAAK,EAAE,CACxD,CAAC;YAEJ,CAAC;QACH,CAAC;QAGD,WAAW,CAAC,MAAM,GAAG,+DAA0B,CAAC,eAAe,CAAC;QAChE,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CACpD,WAAW,CAAC,sBAAsB,EAClC,4CAAiB,CAAC,uBAAuB,CAC1C,CAAC;QAGF,OAAO,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IAC5E,CAAC;IAMO,KAAK,CAAC,yBAAyB,CAAC,SAAiB;QAEvD,MAAM,eAAe,GACnB,MAAM,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,SAAS,EAAE;YACrE,eAAe;YACf,wBAAwB;YACxB,aAAa;YACb,kCAAkC;SACnC,CAAC,CAAC;QAGL,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,6DAA6D,CAC9D,CAAC;YACF,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAGD,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,oBAAoB,CAAC;QAC1E,MAAM,kBAAkB,GACtB,WAAW,EAAE,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAGvD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,8EAA8E,CAC/E,CAAC;YACF,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAGD,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,6EAAiC,CAAC,OAAO,CACpE,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CACpD,SAAS,EACT,4CAAiB,CAAC,wBAAwB,CAC3C,CAAC;YAEF,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;QACvD,CAAC;QAGD,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CACzC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,6EAAiC,CAAC,UAAU,CACvE,CAAC;QACF,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,6EAAiC,CAAC,MAAM,CACnE,CAAC;QAEF,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,4DAA4D,CAC7D,CAAC;YACF,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CACpD,SAAS,EACT,4CAAiB,CAAC,0BAA0B,CAC7C,CAAC;YACF,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,gDAAyB,CACjC,wDAAwD,CACzD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,oDAA6B,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAKO,KAAK,CAAC,uBAAuB,CACnC,cAAiD;QAEjD,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAGvC,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,cAAc,CAAC,KAAK,GAAG,KAAK,CAAC;QAC7B,cAAc,CAAC,MAAM,GAAG,6EAAiC,CAAC,OAAO,CAAC;QAElE,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAGlE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACnE,OAAO,CAAC,YAAY,CAAC,GAAG,CACtB,WAAW,EACX,cAAc,CAAC,aAAa,CAAC,QAAQ,CACtC,CAAC;QACF,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAGzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAGnD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAG9C,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,EAAE,oBAAoB,CAAC;QAErE,IAAI,WAAW,EAAE,MAAM,IAAI,cAAc,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAEjE,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC;YAG3C,MAAM,gBAAgB,GAAG,cAAc,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CACnE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CACvD,CAAC;YAGF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YAExE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAEhC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uDAAuD,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8CAA8C,CAAC,CAAC,WAAW,EAAE,MAAM,eAAe,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,QAAQ,EAAE,CAC5H,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,mDAAmD,cAAc,CAAC,aAAa,CAAC,YAAY,EAAE,CAC/F,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAG5D,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAKO,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACjD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC;QAElE,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,mBAAmB,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAEvE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,4CAAqB,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACnD,MAAM,IAAI,4CAAqB,CAAC,+BAA+B,CAAC,CAAC;QACnE,CAAC;QAGD,MAAM,iBAAiB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAElD,WAAW,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAClD,WAAW,CAAC,0BAA0B,GAAG,SAAS,CAAC;QACnD,WAAW,CAAC,qBAAqB,GAAG,KAAK,CAAC;QAC1C,WAAW,CAAC,MAAM,GAAG,+DAA0B,CAAC,yBAAyB,CAAC;QAE1E,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CACpD,WAAW,CAAC,sBAAsB,EAClC,4CAAiB,CAAC,yBAAyB,CAC5C,CAAC;QAGF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACxD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,WAAW,EAAE,CAAC,CAAC;QAEjD,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAKD,KAAK,CAAC,wBAAwB,CAC5B,eAAmC;QAGnC,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2BAA2B,eAAe,CAAC,KAAK,MAAM,eAAe,CAAC,iBAAiB,EAAE,CAC1F,CAAC;YACF,MAAM,IAAI,gDAAyB,CACjC,eAAe,CAAC,iBAAiB,IAAI,eAAe,CAAC,KAAK,CAC3D,CAAC;QACJ,CAAC;QAGD,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,mBAAmB,CAAC,yBAAyB,CACtD,eAAe,CAAC,KAAK,EACrB,CAAC,eAAe,EAAE,aAAa,EAAE,kCAAkC,CAAC,CACrE,CAAC;QAEJ,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,kDAA2B,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAGD,cAAc,CAAC,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC;QAGxD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAGhD,OAAO,IAAI,CAAC,yBAAyB,CACnC,cAAc,CAAC,sBAAsB,CACtC,CAAC;IACJ,CAAC;IAKO,KAAK,CAAC,oBAAoB,CAChC,cAAiD;QAEjD,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAEvC,IAAI,CAAC;YAEH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,aAAa,CAAC,QAAQ,EAAE;gBACvE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,oBAAoB;oBAChC,IAAI,EAAE,cAAc,CAAC,iBAAkB;oBACvC,YAAY,EAAE,WAAW;oBACzB,SAAS,EAAE,cAAc,CAAC,aAAa,CAAC,QAAQ;oBAChD,aAAa,EAAE,cAAc,CAAC,aAAa,CAAC,YAAY;iBACzD,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,SAAS,EAAE,CAAC,CAAC;gBACzD,cAAc,CAAC,MAAM,GAAG,6EAAiC,CAAC,MAAM,CAAC;gBACjE,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBAClE,MAAM,IAAI,+CAAwB,CAAC,SAAS,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YAG7C,cAAc,CAAC,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC;YACpD,cAAc,CAAC,YAAY,GAAG,SAAS,CAAC,aAAa,CAAC;YAEtD,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;gBACzB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC7B,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBACpE,cAAc,CAAC,cAAc,GAAG,SAAS,CAAC;YAC5C,CAAC;YAED,cAAc,CAAC,MAAM,GAAG,6EAAiC,CAAC,UAAU,CAAC;YACrE,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;YAElE,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,+CAA+C,cAAc,CAAC,aAAa,CAAC,YAAY,EAAE,CAC3F,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;YACtD,cAAc,CAAC,MAAM,GAAG,6EAAiC,CAAC,MAAM,CAAC;YACjE,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AArfY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,0BAAgB,EAAC,iDAAsB,CAAC,CAAA;qCACN,oBAAU;QACP,2CAAmB;QACpB,yCAAkB;QACxB,4BAAY;QACJ,6CAAoB;GARlD,oBAAoB,CAqfhC"}

package/dist/authorization-server/client-registration.controller.d.ts

@@ -0,0 +1,11 @@
+import { ClientRegistrationService } from './client-registration.service';
+import { RegisterClientDto } from './dto/register-client.dto';
+import { ClientRegistrationResponseDto } from './dto/client-registration-response.dto';
+export declare class ClientRegistrationController {
+    private readonly clientRegistrationService;
+    constructor(clientRegistrationService: ClientRegistrationService);
+    private mapToClientRegistrationResponseDto;
+    registerClient(dto: RegisterClientDto, serverId: string, version: string): Promise<ClientRegistrationResponseDto>;
+    getClient(clientId: string): Promise<ClientRegistrationResponseDto>;
+    listClients(): Promise<ClientRegistrationResponseDto[]>;
+}

package/dist/authorization-server/client-registration.controller.js

@@ -0,0 +1,124 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientRegistrationController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const client_registration_service_1 = require("./client-registration.service");
+const register_client_dto_1 = require("./dto/register-client.dto");
+const client_registration_response_dto_1 = require("./dto/client-registration-response.dto");
+const access_token_guard_1 = require("../auth/guards/guards/access-token.guard");
+const scopes_guard_1 = require("../auth/guards/guards/scopes.guard");
+const require_scopes_decorator_1 = require("../auth/guards/decorators/require-scopes.decorator");
+const user_scopes_1 = require("../auth/core/scopes/user.scopes");
+let ClientRegistrationController = class ClientRegistrationController {
+    clientRegistrationService;
+    constructor(clientRegistrationService) {
+        this.clientRegistrationService = clientRegistrationService;
+    }
+    mapToClientRegistrationResponseDto(client) {
+        const response = {
+            client_id: client.clientId,
+            client_name: client.clientName,
+            redirect_uris: client.redirectUris,
+            grant_types: client.grantTypes,
+            token_endpoint_auth_method: client.tokenEndpointAuthMethod,
+            client_id_issued_at: Math.floor(client.createdAt.getTime() / 1000),
+        };
+        if (client.contacts && client.contacts.length > 0)
+            response.contacts = client.contacts;
+        return response;
+    }
+    async registerClient(dto, serverId, version) {
+        const client = await this.clientRegistrationService.registerClient(dto, serverId);
+        return this.mapToClientRegistrationResponseDto(client);
+    }
+    async getClient(clientId) {
+        const client = await this.clientRegistrationService.getClient(clientId);
+        return this.mapToClientRegistrationResponseDto(client);
+    }
+    async listClients() {
+        const clients = await this.clientRegistrationService.listClients();
+        return clients.map(this.mapToClientRegistrationResponseDto);
+    }
+};
+exports.ClientRegistrationController = ClientRegistrationController;
+__decorate([
+    (0, common_1.Post)('register/mcp/:serverId/:version'),
+    (0, common_1.HttpCode)(201),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Register a new OAuth 2.0 client (Dynamic Client Registration)',
+        description: 'Implements RFC 7591 Dynamic Client Registration for OAuth 2.0. Validates client metadata, generates credentials, and persists the client configuration. Requires authorization_code and refresh_token grant types with PKCE support per MCP specification.',
+    }),
+    (0, swagger_1.ApiCreatedResponse)({
+        type: client_registration_response_dto_1.ClientRegistrationResponseDto,
+        description: 'Client registered successfully with generated credentials',
+    }),
+    (0, swagger_1.ApiBadRequestResponse)({
+        description: 'Invalid client metadata (missing fields, invalid redirect URIs, unsupported grant types, or PKCE not configured)',
+    }),
+    (0, swagger_1.ApiConflictResponse)({
+        description: 'A client with this name is already registered',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Param)('serverId')),
+    __param(2, (0, common_1.Param)('version')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [register_client_dto_1.RegisterClientDto, String, String]),
+    __metadata("design:returntype", Promise)
+], ClientRegistrationController.prototype, "registerClient", null);
+__decorate([
+    (0, common_1.Get)(':clientId'),
+    (0, swagger_1.ApiCookieAuth)('JWT-Cookie'),
+    (0, common_1.UseGuards)(access_token_guard_1.AccessTokenGuard, scopes_guard_1.ScopesGuard),
+    (0, require_scopes_decorator_1.RequireScopes)(user_scopes_1.UserScopes.ADMIN.id),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Retrieve client registration information',
+        description: 'Returns the registration metadata for a client. The client_secret is NOT included in the response for security reasons.',
+    }),
+    (0, swagger_1.ApiOkResponse)({
+        type: client_registration_response_dto_1.ClientRegistrationResponseDto,
+        description: 'Client registration information retrieved successfully',
+    }),
+    (0, swagger_1.ApiNotFoundResponse)({
+        description: 'Client not found',
+    }),
+    __param(0, (0, common_1.Param)('clientId')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], ClientRegistrationController.prototype, "getClient", null);
+__decorate([
+    (0, common_1.Get)(),
+    (0, swagger_1.ApiCookieAuth)('JWT-Cookie'),
+    (0, common_1.UseGuards)(access_token_guard_1.AccessTokenGuard, scopes_guard_1.ScopesGuard),
+    (0, require_scopes_decorator_1.RequireScopes)(user_scopes_1.UserScopes.ADMIN.id),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List all registered clients (Admin)',
+        description: 'Returns a list of all registered OAuth clients. Intended for administrative purposes. Client secrets are not included.',
+    }),
+    (0, swagger_1.ApiOkResponse)({
+        type: [client_registration_response_dto_1.ClientRegistrationResponseDto],
+        description: 'List of registered clients',
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], ClientRegistrationController.prototype, "listClients", null);
+exports.ClientRegistrationController = ClientRegistrationController = __decorate([
+    (0, swagger_1.ApiTags)('Authorization Server'),
+    (0, common_1.Controller)('auth/clients'),
+    __metadata("design:paramtypes", [client_registration_service_1.ClientRegistrationService])
+], ClientRegistrationController);
+//# sourceMappingURL=client-registration.controller.js.map

package/dist/authorization-server/client-registration.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-registration.controller.js","sourceRoot":"","sources":["../../src/authorization-server/client-registration.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6CASyB;AACzB,+EAA0E;AAC1E,mEAA8D;AAC9D,6FAAuF;AAEvF,iFAA4E;AAC5E,qEAAiE;AACjE,iGAAmF;AACnF,iEAA6D;AAItD,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAEpB;IADnB,YACmB,yBAAoD;QAApD,8BAAyB,GAAzB,yBAAyB,CAA2B;IACpE,CAAC;IAEI,kCAAkC,CACxC,MAA8B;QAE9B,MAAM,QAAQ,GAAkC;YAC9C,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;YAC1D,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;SACnE,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC/C,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACtC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAoBK,AAAN,KAAK,CAAC,cAAc,CACV,GAAsB,EACX,QAAgB,EACjB,OAAe;QAEjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAChE,GAAG,EACH,QAAQ,CACT,CAAC;QAEF,OAAO,IAAI,CAAC,kCAAkC,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAkBK,AAAN,KAAK,CAAC,SAAS,CACM,QAAgB;QAEnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAExE,OAAO,IAAI,CAAC,kCAAkC,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAeK,AAAN,KAAK,CAAC,WAAW;QACf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,CAAC;QAEnE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AA9FY,oEAA4B;AAuCjC;IAlBL,IAAA,aAAI,EAAC,iCAAiC,CAAC;IACvC,IAAA,iBAAQ,EAAC,GAAG,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,4PAA4P;KAC/P,CAAC;IACD,IAAA,4BAAkB,EAAC;QAClB,IAAI,EAAE,gEAA6B;QACnC,WAAW,EAAE,2DAA2D;KACzE,CAAC;IACD,IAAA,+BAAqB,EAAC;QACrB,WAAW,EACT,kHAAkH;KACrH,CAAC;IACD,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,+CAA+C;KAC7D,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,SAAS,CAAC,CAAA;;qCAFJ,uCAAiB;;kEAU/B;AAkBK;IAhBL,IAAA,YAAG,EAAC,WAAW,CAAC;IAChB,IAAA,uBAAa,EAAC,YAAY,CAAC;IAC3B,IAAA,kBAAS,EAAC,qCAAgB,EAAE,0BAAW,CAAC;IACxC,IAAA,wCAAa,EAAC,wBAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAClC,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,yHAAyH;KAC5H,CAAC;IACD,IAAA,uBAAa,EAAC;QACb,IAAI,EAAE,gEAA6B;QACnC,WAAW,EAAE,wDAAwD;KACtE,CAAC;IACD,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,kBAAkB;KAChC,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;;;;6DAKnB;AAeK;IAbL,IAAA,YAAG,GAAE;IACL,IAAA,uBAAa,EAAC,YAAY,CAAC;IAC3B,IAAA,kBAAS,EAAC,qCAAgB,EAAE,0BAAW,CAAC;IACxC,IAAA,wCAAa,EAAC,wBAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAClC,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EACT,wHAAwH;KAC3H,CAAC;IACD,IAAA,uBAAa,EAAC;QACb,IAAI,EAAE,CAAC,gEAA6B,CAAC;QACrC,WAAW,EAAE,4BAA4B;KAC1C,CAAC;;;;+DAKD;uCA7FU,4BAA4B;IAFxC,IAAA,iBAAO,EAAC,sBAAsB,CAAC;IAC/B,IAAA,mBAAU,EAAC,cAAc,CAAC;qCAGqB,uDAAyB;GAF5D,4BAA4B,CA8FxC"}

package/dist/authorization-server/client-registration.service.d.ts

@@ -0,0 +1,21 @@
+import { Repository } from 'typeorm';
+import { RegisteredClientEntity } from './entities/registered-client.entity';
+import { RegisterClientDto } from './dto/register-client.dto';
+import { AuthJourneysService } from 'src/auth-journeys/auth-journeys.service';
+import { McpRegistryService } from 'src/mcp-registry/mcp-registry.service';
+export declare class ClientRegistrationService {
+    private readonly clientRepository;
+    private readonly authJourneyService;
+    private readonly mcpRegistryService;
+    private logger;
+    constructor(clientRepository: Repository<RegisteredClientEntity>, authJourneyService: AuthJourneysService, mcpRegistryService: McpRegistryService);
+    registerClient(dto: RegisterClientDto, serverId: string): Promise<RegisteredClientEntity>;
+    getClient(clientId: string): Promise<RegisteredClientEntity>;
+    listClients(): Promise<RegisteredClientEntity[]>;
+    private validateRequiredFields;
+    private validateGrantTypes;
+    private validateRedirectUris;
+    private generateClientId;
+    private generateClientSecret;
+    private hashSecret;
+}