@taico/taico 0.0.2

package/dist/authorization-server/client-registration.service.js

@@ -0,0 +1,138 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ClientRegistrationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientRegistrationService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const registered_client_entity_1 = require("./entities/registered-client.entity");
+const enums_1 = require("./enums");
+const client_registration_errors_1 = require("./errors/client-registration.errors");
+const crypto_1 = require("crypto");
+const auth_journeys_service_1 = require("../auth-journeys/auth-journeys.service");
+const mcp_registry_service_1 = require("../mcp-registry/mcp-registry.service");
+const env_config_1 = require("../config/env.config");
+let ClientRegistrationService = ClientRegistrationService_1 = class ClientRegistrationService {
+    clientRepository;
+    authJourneyService;
+    mcpRegistryService;
+    logger = new common_1.Logger(ClientRegistrationService_1.name);
+    constructor(clientRepository, authJourneyService, mcpRegistryService) {
+        this.clientRepository = clientRepository;
+        this.authJourneyService = authJourneyService;
+        this.mcpRegistryService = mcpRegistryService;
+    }
+    async registerClient(dto, serverId) {
+        this.validateRequiredFields(dto);
+        this.validateGrantTypes(dto.grant_types);
+        this.validateRedirectUris(dto.redirect_uris);
+        const clientId = this.generateClientId();
+        const clientSecret = dto.token_endpoint_auth_method !== enums_1.TokenEndpointAuthMethod.NONE
+            ? this.generateClientSecret()
+            : null;
+        const mcpServer = await this.mcpRegistryService.getServerByProvidedId(serverId);
+        let scopes = [];
+        if (dto.scope && dto.scope.trim() != '') {
+            scopes = dto.scope.split(' ');
+        }
+        const client = this.clientRepository.create({
+            clientId,
+            clientSecret: clientSecret ? this.hashSecret(clientSecret) : null,
+            clientName: dto.client_name,
+            redirectUris: dto.redirect_uris,
+            grantTypes: dto.grant_types,
+            tokenEndpointAuthMethod: dto.token_endpoint_auth_method,
+            scopes: scopes,
+            contacts: dto.contacts || null,
+        });
+        const savedClient = await this.clientRepository.save(client);
+        const authJourney = await this.authJourneyService.createJourneyForMcpRegistration({
+            mcpServerId: mcpServer.id,
+            mcpClientId: savedClient.id,
+        });
+        return {
+            ...savedClient,
+            clientSecret,
+        };
+    }
+    async getClient(clientId) {
+        const client = await this.clientRepository.findOne({
+            where: { clientId },
+        });
+        if (!client) {
+            throw new client_registration_errors_1.ClientNotFoundError(clientId);
+        }
+        return client;
+    }
+    async listClients() {
+        return this.clientRepository.find({
+            order: { createdAt: 'DESC' },
+        });
+    }
+    validateRequiredFields(dto) {
+        if (!dto.client_name) {
+            throw new client_registration_errors_1.MissingRequiredFieldError('client_name');
+        }
+        if (!dto.redirect_uris || dto.redirect_uris.length === 0) {
+            throw new client_registration_errors_1.MissingRequiredFieldError('redirect_uris');
+        }
+        if (!dto.grant_types || dto.grant_types.length === 0) {
+            throw new client_registration_errors_1.MissingRequiredFieldError('grant_types');
+        }
+        if (!dto.token_endpoint_auth_method) {
+            throw new client_registration_errors_1.MissingRequiredFieldError('token_endpoint_auth_method');
+        }
+    }
+    validateGrantTypes(grantTypes) {
+        if (!grantTypes.includes(enums_1.GrantType.AUTHORIZATION_CODE)) {
+            throw new client_registration_errors_1.InvalidGrantTypeError('authorization_code grant type is required per MCP specification');
+        }
+        if (!grantTypes.includes(enums_1.GrantType.REFRESH_TOKEN)) {
+            throw new client_registration_errors_1.InvalidGrantTypeError('refresh_token grant type is required per MCP specification');
+        }
+    }
+    validateRedirectUris(redirectUris) {
+        if (redirectUris.length === 0) {
+            throw new client_registration_errors_1.InvalidRedirectUriError('At least one redirect URI is required');
+        }
+        for (const uri of redirectUris) {
+            try {
+                const url = new URL(uri);
+            }
+            catch {
+                throw new client_registration_errors_1.InvalidRedirectUriError(`Invalid URI format: ${uri}`);
+            }
+        }
+    }
+    generateClientId() {
+        return (0, crypto_1.randomBytes)(16).toString('hex');
+    }
+    generateClientSecret() {
+        const config = (0, env_config_1.getConfig)();
+        return (0, crypto_1.randomBytes)(config.clientSecretLength).toString('base64url');
+    }
+    hashSecret(secret) {
+        return secret;
+    }
+};
+exports.ClientRegistrationService = ClientRegistrationService;
+exports.ClientRegistrationService = ClientRegistrationService = ClientRegistrationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(registered_client_entity_1.RegisteredClientEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        auth_journeys_service_1.AuthJourneysService,
+        mcp_registry_service_1.McpRegistryService])
+], ClientRegistrationService);
+//# sourceMappingURL=client-registration.service.js.map

package/dist/authorization-server/client-registration.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-registration.service.js","sourceRoot":"","sources":["../../src/authorization-server/client-registration.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,6CAAmD;AACnD,qCAAqC;AACrC,kFAA6E;AAE7E,mCAA6D;AAC7D,oFAK6C;AAC7C,mCAAqC;AACrC,kFAA8E;AAC9E,+EAA2E;AAC3E,qDAAkD;AAG3C,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IAKjB;IAEA;IACA;IAPX,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;IAE5D,YAEmB,gBAAoD,EAEpD,kBAAuC,EACvC,kBAAsC;QAHtC,qBAAgB,GAAhB,gBAAgB,CAAoC;QAEpD,uBAAkB,GAAlB,kBAAkB,CAAqB;QACvC,uBAAkB,GAAlB,kBAAkB,CAAoB;IACtD,CAAC;IAMJ,KAAK,CAAC,cAAc,CAClB,GAAsB,EACtB,QAAgB;QAKhB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAGjC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAGzC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAG7C,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzC,MAAM,YAAY,GAChB,GAAG,CAAC,0BAA0B,KAAK,+BAAuB,CAAC,IAAI;YAC7D,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE;YAC7B,CAAC,CAAC,IAAI,CAAC;QAGX,MAAM,SAAS,GACb,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAGhE,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC1C,QAAQ;YACR,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YACjE,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,uBAAuB,EAAE,GAAG,CAAC,0BAA0B;YACvD,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;SAC/B,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAG7D,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,kBAAkB,CAAC,+BAA+B,CAAC;YAC5D,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,WAAW,EAAE,WAAW,CAAC,EAAE;SAC5B,CAAC,CAAC;QAGL,OAAO;YACL,GAAG,WAAW;YACd,YAAY;SACb,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,gDAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAKD,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAChC,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAIO,sBAAsB,CAAC,GAAsB;QACnD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,sDAAyB,CAAC,aAAa,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,sDAAyB,CAAC,eAAe,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,sDAAyB,CAAC,aAAa,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC;YACpC,MAAM,IAAI,sDAAyB,CAAC,4BAA4B,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,UAAuB;QAEhD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAS,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,kDAAqB,CAC7B,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,kDAAqB,CAC7B,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,YAAsB;QACjD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,oDAAuB,CAC/B,uCAAuC,CACxC,CAAC;QACJ,CAAC;QAGD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAI3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,oDAAuB,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAIO,gBAAgB;QACtB,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEO,oBAAoB;QAC1B,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,OAAO,IAAA,oBAAW,EAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtE,CAAC;IAEO,UAAU,CAAC,MAAc;QAI/B,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAtKY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,0BAAgB,EAAC,iDAAsB,CAAC,CAAA;qCACN,oBAAU;QAER,2CAAmB;QACnB,yCAAkB;GAR9C,yBAAyB,CAsKrC"}

package/dist/authorization-server/dto/authorization-request.dto.d.ts

@@ -0,0 +1,11 @@
+import { ResponseType } from '../enums';
+export declare class AuthorizationRequestDto {
+    response_type: ResponseType;
+    scope?: string;
+    client_id: string;
+    code_challenge: string;
+    code_challenge_method: string;
+    redirect_uri: string;
+    state: string;
+    resource: string;
+}

package/dist/authorization-server/dto/authorization-request.dto.js

@@ -0,0 +1,104 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationRequestDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+const enums_1 = require("../enums");
+class AuthorizationRequestDto {
+    response_type;
+    scope;
+    client_id;
+    code_challenge;
+    code_challenge_method;
+    redirect_uri;
+    state;
+    resource;
+}
+exports.AuthorizationRequestDto = AuthorizationRequestDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'OAuth 2.0 response type (must be "code" for authorization code flow)',
+        example: 'code',
+        enum: enums_1.ResponseType,
+    }),
+    (0, class_validator_1.IsEnum)(enums_1.ResponseType),
+    __metadata("design:type", String)
+], AuthorizationRequestDto.prototype, "response_type", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Space-delimited list of scopes being requested',
+        example: 'tasks:read tasks:write',
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], AuthorizationRequestDto.prototype, "scope", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Client identifier issued during registration',
+        example: '0bab273987a2e163c3abb40c631ec0a4',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthorizationRequestDto.prototype, "client_id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'PKCE code challenge derived from the code verifier',
+        example: 'SVDkCojJ1edZzG47VFce6y2o5ieCQG19ueoYMQ_xloo',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.Length)(43, 128),
+    (0, class_validator_1.Matches)(/^[A-Za-z0-9_-]+$/),
+    __metadata("design:type", String)
+], AuthorizationRequestDto.prototype, "code_challenge", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'PKCE code challenge method (S256 for SHA-256)',
+        example: 'S256',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.Matches)(/^S256$/),
+    __metadata("design:type", String)
+], AuthorizationRequestDto.prototype, "code_challenge_method", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Redirect URI where the authorization response will be sent',
+        example: 'http://localhost:6274/oauth/callback/debug',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsUrl)({ require_tld: false, require_protocol: true }),
+    __metadata("design:type", String)
+], AuthorizationRequestDto.prototype, "redirect_uri", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Opaque state value for CSRF protection',
+        example: 'c5d4fa797d8c0a9025237aafb780ef7e9c38a721a00530372bc26c89572b1833',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthorizationRequestDto.prototype, "state", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Resource server URL that the client wants to access',
+        example: 'http://localhost:4001/',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsUrl)({ require_tld: false, require_protocol: true }),
+    __metadata("design:type", String)
+], AuthorizationRequestDto.prototype, "resource", void 0);
+//# sourceMappingURL=authorization-request.dto.js.map

package/dist/authorization-server/dto/authorization-request.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-request.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/authorization-request.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAQyB;AACzB,6CAAmE;AACnE,oCAAwC;AAMxC,MAAa,uBAAuB;IAQlC,aAAa,CAAgB;IAQ7B,KAAK,CAAU;IAQf,SAAS,CAAU;IAUnB,cAAc,CAAU;IASxB,qBAAqB,CAAU;IAS/B,YAAY,CAAU;IAQtB,KAAK,CAAU;IASf,QAAQ,CAAU;CACnB;AAtED,0DAsEC;AA9DC;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,sEAAsE;QACxE,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,oBAAY;KACnB,CAAC;IACD,IAAA,wBAAM,EAAC,oBAAY,CAAC;;8DACQ;AAQ7B;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,gDAAgD;QAC7D,OAAO,EAAE,wBAAwB;KAClC,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;sDACI;AAQf;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;0DACM;AAUnB;IARC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,6CAA6C;KACvD,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,EAAE,EAAE,GAAG,CAAC;IACf,IAAA,yBAAO,EAAC,kBAAkB,CAAC;;+DACJ;AASxB;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,MAAM;KAChB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,EAAC,QAAQ,CAAC;;sEACa;AAS/B;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,4CAA4C;KACtD,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,EAAC,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;;6DAChC;AAQtB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,kEAAkE;KAC5E,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sDACE;AASf;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,wBAAwB;KAClC,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,EAAC,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;;yDACpC"}

package/dist/authorization-server/dto/callback-request.dto.d.ts

@@ -0,0 +1,7 @@
+export declare class CallbackRequestDto {
+    code: string;
+    state: string;
+    error?: string;
+    scope?: string;
+    error_description?: string;
+}

package/dist/authorization-server/dto/callback-request.dto.js

@@ -0,0 +1,68 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CallbackRequestDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+class CallbackRequestDto {
+    code;
+    state;
+    error;
+    scope;
+    error_description;
+}
+exports.CallbackRequestDto = CallbackRequestDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Authorization code from downstream OAuth provider',
+        example: 'abc123xyz',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CallbackRequestDto.prototype, "code", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'State parameter that identifies the connection flow',
+        example: 'xyz789abc',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CallbackRequestDto.prototype, "state", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Error code if authorization failed',
+        example: 'access_denied',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsOptional)(),
+    __metadata("design:type", String)
+], CallbackRequestDto.prototype, "error", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Space-delimited list of scopes that were granted',
+        example: 'tasks:read tasks:write',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsOptional)(),
+    __metadata("design:type", String)
+], CallbackRequestDto.prototype, "scope", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Error description if authorization failed',
+        example: 'User denied the authorization request',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsOptional)(),
+    __metadata("design:type", String)
+], CallbackRequestDto.prototype, "error_description", void 0);
+//# sourceMappingURL=callback-request.dto.js.map

package/dist/authorization-server/dto/callback-request.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-request.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/callback-request.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAmE;AACnE,6CAAmE;AAEnE,MAAa,kBAAkB;IAO7B,IAAI,CAAU;IAQd,KAAK,CAAU;IAQf,KAAK,CAAU;IAQf,KAAK,CAAU;IAQf,iBAAiB,CAAU;CAC5B;AAxCD,gDAwCC;AAjCC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,WAAW;KACrB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;gDACC;AAQd;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,WAAW;KACrB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;iDACE;AAQf;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,eAAe;KACzB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;iDACE;AAQf;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,wBAAwB;KAClC,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;iDACE;AAQf;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,uCAAuC;KACjD,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;6DACc"}

package/dist/authorization-server/dto/change-password-request.dto.d.ts

@@ -0,0 +1,4 @@
+export declare class ChangePasswordRequestDto {
+    currentPassword: string;
+    newPassword: string;
+}

package/dist/authorization-server/dto/change-password-request.dto.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChangePasswordRequestDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+class ChangePasswordRequestDto {
+    currentPassword;
+    newPassword;
+}
+exports.ChangePasswordRequestDto = ChangePasswordRequestDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Current password',
+        example: 'currentPassword123',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ChangePasswordRequestDto.prototype, "currentPassword", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'New password (minimum 8 characters)',
+        example: 'newPassword456',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MinLength)(2, { message: 'Password must be at least 2 characters long' }),
+    __metadata("design:type", String)
+], ChangePasswordRequestDto.prototype, "newPassword", void 0);
+//# sourceMappingURL=change-password-request.dto.js.map

package/dist/authorization-server/dto/change-password-request.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-password-request.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/change-password-request.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAkE;AAClE,6CAA8C;AAE9C,MAAa,wBAAwB;IAOnC,eAAe,CAAU;IASzB,WAAW,CAAU;CACtB;AAjBD,4DAiBC;AAVC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,kBAAkB;QAC/B,OAAO,EAAE,oBAAoB;KAC9B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;iEACY;AASzB;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,gBAAgB;KAC1B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;;6DACpD"}

package/dist/authorization-server/dto/client-registration-response.dto.d.ts

@@ -0,0 +1,11 @@
+import { GrantType, TokenEndpointAuthMethod } from '../enums';
+export declare class ClientRegistrationResponseDto {
+    client_id: string;
+    client_name: string;
+    redirect_uris: string[];
+    grant_types: GrantType[];
+    token_endpoint_auth_method: TokenEndpointAuthMethod;
+    scope?: string | null;
+    contacts?: string[] | null;
+    client_id_issued_at: number;
+}

package/dist/authorization-server/dto/client-registration-response.dto.js

@@ -0,0 +1,90 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientRegistrationResponseDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const enums_1 = require("../enums");
+class ClientRegistrationResponseDto {
+    client_id;
+    client_name;
+    redirect_uris;
+    grant_types;
+    token_endpoint_auth_method;
+    scope;
+    contacts;
+    client_id_issued_at;
+}
+exports.ClientRegistrationResponseDto = ClientRegistrationResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Unique client identifier',
+        example: '8f7a9c2e-4b1d-4e6f-9a2b-3c4d5e6f7a8b',
+    }),
+    __metadata("design:type", String)
+], ClientRegistrationResponseDto.prototype, "client_id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Human-readable name of the client',
+        example: 'My OAuth Client',
+    }),
+    __metadata("design:type", String)
+], ClientRegistrationResponseDto.prototype, "client_name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Array of redirect URIs for authorization callbacks (supports http and localhost for MCP clients)',
+        example: ['http://localhost:3000/callback', 'https://example.com/callback'],
+        type: [String],
+    }),
+    __metadata("design:type", Array)
+], ClientRegistrationResponseDto.prototype, "redirect_uris", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Grant types the client is authorized to use',
+        example: ['authorization_code', 'refresh_token'],
+        enum: enums_1.GrantType,
+        isArray: true,
+    }),
+    __metadata("design:type", Array)
+], ClientRegistrationResponseDto.prototype, "grant_types", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Authentication method for the token endpoint (MCP clients use "none")',
+        example: enums_1.TokenEndpointAuthMethod.NONE,
+        enum: enums_1.TokenEndpointAuthMethod,
+    }),
+    __metadata("design:type", String)
+], ClientRegistrationResponseDto.prototype, "token_endpoint_auth_method", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Scopes granted to the client',
+        example: 'openid profile email',
+        type: String,
+        nullable: true,
+    }),
+    __metadata("design:type", Object)
+], ClientRegistrationResponseDto.prototype, "scope", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Contact emails for the client',
+        example: ['admin@example.com'],
+        type: [String],
+        nullable: true,
+    }),
+    __metadata("design:type", Object)
+], ClientRegistrationResponseDto.prototype, "contacts", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Time at which the client identifier was issued. The time is represented as the number of seconds from 1970-01-01T00:00:00Z as measured in UTC until the date/time of issuance.',
+        example: '604846800',
+    }),
+    __metadata("design:type", Number)
+], ClientRegistrationResponseDto.prototype, "client_id_issued_at", void 0);
+//# sourceMappingURL=client-registration-response.dto.js.map

package/dist/authorization-server/dto/client-registration-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-registration-response.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/client-registration-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,oCAA8D;AAE9D,MAAa,6BAA6B;IAKxC,SAAS,CAAU;IAMnB,WAAW,CAAU;IAQrB,aAAa,CAAY;IAQzB,WAAW,CAAe;IAQ1B,0BAA0B,CAA2B;IAQrD,KAAK,CAAiB;IAQtB,QAAQ,CAAmB;IAO3B,mBAAmB,CAAU;CAC9B;AA3DD,sEA2DC;AAtDC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,0BAA0B;QACvC,OAAO,EAAE,sCAAsC;KAChD,CAAC;;gEACiB;AAMnB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,mCAAmC;QAChD,OAAO,EAAE,iBAAiB;KAC3B,CAAC;;kEACmB;AAQrB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,kGAAkG;QACpG,OAAO,EAAE,CAAC,gCAAgC,EAAE,8BAA8B,CAAC;QAC3E,IAAI,EAAE,CAAC,MAAM,CAAC;KACf,CAAC;;oEACuB;AAQzB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAChD,IAAI,EAAE,iBAAS;QACf,OAAO,EAAE,IAAI;KACd,CAAC;;kEACwB;AAQ1B;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,uEAAuE;QACzE,OAAO,EAAE,+BAAuB,CAAC,IAAI;QACrC,IAAI,EAAE,+BAAuB;KAC9B,CAAC;;iFACmD;AAQrD;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,sBAAsB;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,IAAI;KACf,CAAC;;4DACoB;AAQtB;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,IAAI;KACf,CAAC;;+DACyB;AAO3B;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,gLAAgL;QAClL,OAAO,EAAE,WAAW;KACrB,CAAC;;0EAC2B"}

package/dist/authorization-server/dto/consent-decision.dto.d.ts

@@ -0,0 +1,4 @@
+export declare class ConsentDecisionDto {
+    flow_id: string;
+    approved: boolean;
+}

package/dist/authorization-server/dto/consent-decision.dto.js

@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConsentDecisionDto = void 0;
+const class_validator_1 = require("class-validator");
+const class_transformer_1 = require("class-transformer");
+const swagger_1 = require("@nestjs/swagger");
+class ConsentDecisionDto {
+    flow_id;
+    approved;
+}
+exports.ConsentDecisionDto = ConsentDecisionDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Authorization flow ID (serves as CSRF protection token)',
+        example: '550e8400-e29b-41d4-a716-446655440000',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ConsentDecisionDto.prototype, "flow_id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Whether the user approved the authorization request',
+        example: true,
+    }),
+    (0, class_transformer_1.Transform)(({ value }) => {
+        if (typeof value === 'boolean')
+            return value;
+        if (typeof value === 'string') {
+            return value.toLowerCase() === 'true';
+        }
+        return value;
+    }),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], ConsentDecisionDto.prototype, "approved", void 0);
+//# sourceMappingURL=consent-decision.dto.js.map

package/dist/authorization-server/dto/consent-decision.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-decision.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/consent-decision.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAkE;AAClE,yDAA8C;AAC9C,6CAA8C;AAK9C,MAAa,kBAAkB;IAO7B,OAAO,CAAU;IAcjB,QAAQ,CAAW;CACpB;AAtBD,gDAsBC;AAfC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,sCAAsC;KAChD,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;mDACI;AAcjB;IAZC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,IAAI;KACd,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACD,IAAA,2BAAS,GAAE;;oDACO"}

package/dist/authorization-server/dto/consent-metadata-params.dto.d.ts

@@ -0,0 +1,3 @@
+export declare class GetConsentMetadataParamsDto {
+    flowId: string;
+}

package/dist/authorization-server/dto/consent-metadata-params.dto.js

@@ -0,0 +1,27 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetConsentMetadataParamsDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+class GetConsentMetadataParamsDto {
+    flowId;
+}
+exports.GetConsentMetadataParamsDto = GetConsentMetadataParamsDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Unique identifier of the authorization flow',
+        example: 'b15e8a76-5b6d-4bde-9a3b-26fdbaab5b4c',
+    }),
+    (0, class_validator_1.IsUUID)(),
+    __metadata("design:type", String)
+], GetConsentMetadataParamsDto.prototype, "flowId", void 0);
+//# sourceMappingURL=consent-metadata-params.dto.js.map

package/dist/authorization-server/dto/consent-metadata-params.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-metadata-params.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/consent-metadata-params.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAyC;AACzC,6CAA8C;AAK9C,MAAa,2BAA2B;IAMtC,MAAM,CAAU;CACjB;AAPD,kEAOC;AADC;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,sCAAsC;KAChD,CAAC;IACD,IAAA,wBAAM,GAAE;;2DACO"}

package/dist/authorization-server/dto/consent-metadata-response.dto.d.ts

@@ -0,0 +1,20 @@
+import { McpAuthorizationFlowStatus } from '../../auth-journeys/enums/mcp-authorization-flow-status.enum';
+export declare class FlowServerDto {
+    providedId: string;
+    name: string;
+    description: string;
+}
+export declare class FlowClientDto {
+    clientId: string;
+    clientName: string;
+}
+export declare class GetConsentMetadataResponseDto {
+    id: string;
+    status: McpAuthorizationFlowStatus;
+    scopes?: string[];
+    resource?: string;
+    server: FlowServerDto;
+    client: FlowClientDto;
+    redirectUri: string;
+    createdAt: Date;
+}