@taico/taico 0.0.2

package/dist/authorization-server/issued-access-token.service.js

@@ -0,0 +1,141 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var IssuedAccessTokenService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IssuedAccessTokenService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const crypto_1 = require("crypto");
+const issued_access_token_entity_1 = require("./entities/issued-access-token.entity");
+const token_signer_service_1 = require("../auth/crypto/token-signer.service");
+const env_config_1 = require("../config/env.config");
+let IssuedAccessTokenService = IssuedAccessTokenService_1 = class IssuedAccessTokenService {
+    tokenRepository;
+    tokenSignerService;
+    logger = new common_1.Logger(IssuedAccessTokenService_1.name);
+    constructor(tokenRepository, tokenSignerService) {
+        this.tokenRepository = tokenRepository;
+        this.tokenSignerService = tokenSignerService;
+    }
+    async issueToken(input) {
+        const config = (0, env_config_1.getConfig)();
+        const expirationDays = input.expirationDays ?? 30;
+        const jti = (0, crypto_1.randomBytes)(16).toString('hex');
+        const now = Math.floor(Date.now() / 1000);
+        const expiresAt = new Date();
+        expiresAt.setDate(expiresAt.getDate() + expirationDays);
+        const expSeconds = now + expirationDays * 24 * 60 * 60;
+        const claims = {
+            iss: config.issuerUrl,
+            sub: input.subjectActor.id,
+            actor_id: input.subjectActor.id,
+            actor_slug: input.subjectActor.slug,
+            actor_type: input.subjectActor.type,
+            displayName: input.subjectActor.displayName,
+            aud: config.issuerUrl,
+            exp: expSeconds,
+            iat: now,
+            jti,
+            client_id: 'issued-token',
+            scope: input.scopes,
+            resource: config.issuerUrl,
+            version: '1.0.0',
+            issued_by: input.issuedByActor.id,
+        };
+        const token = await this.tokenSignerService.signToken(claims);
+        const entity = this.tokenRepository.create({
+            subjectActorId: input.subjectActor.id,
+            issuedByActorId: input.issuedByActor.id,
+            jti,
+            name: input.name,
+            scopes: input.scopes,
+            expiresAt,
+            revokedAt: null,
+            lastUsedAt: null,
+        });
+        const savedEntity = await this.tokenRepository.save(entity);
+        this.logger.log(`Issued access token "${input.name}" for actor ${input.subjectActor.slug} ` +
+            `(expires: ${expiresAt.toISOString()})`);
+        return {
+            entity: savedEntity,
+            token,
+        };
+    }
+    async listTokensForSubject(subjectActorId) {
+        return this.tokenRepository.find({
+            where: { subjectActorId },
+            relations: ['subjectActor', 'issuedByActor'],
+            order: { createdAt: 'DESC' },
+        });
+    }
+    async getTokenById(tokenId) {
+        return this.tokenRepository.findOne({
+            where: { id: tokenId },
+            relations: ['subjectActor', 'issuedByActor'],
+        });
+    }
+    async revokeTokenById(tokenId) {
+        const token = await this.tokenRepository.findOne({
+            where: { id: tokenId },
+            relations: ['subjectActor', 'issuedByActor'],
+        });
+        if (!token) {
+            return null;
+        }
+        if (token.revokedAt) {
+            return token;
+        }
+        token.revokedAt = new Date();
+        const savedToken = await this.tokenRepository.save(token);
+        this.logger.log(`Revoked token "${token.name}" (id: ${tokenId})`);
+        return savedToken;
+    }
+    async revokeTokenByJti(jti) {
+        const token = await this.tokenRepository.findOne({
+            where: { jti },
+            relations: ['subjectActor', 'issuedByActor'],
+        });
+        if (!token) {
+            return null;
+        }
+        if (token.revokedAt) {
+            return token;
+        }
+        token.revokedAt = new Date();
+        const savedToken = await this.tokenRepository.save(token);
+        this.logger.log(`Revoked token by jti "${jti}"`);
+        return savedToken;
+    }
+    async isTokenRevoked(jti) {
+        const token = await this.tokenRepository.findOne({
+            where: { jti },
+        });
+        if (!token) {
+            return false;
+        }
+        return token.revokedAt !== null;
+    }
+    async updateLastUsed(jti) {
+        await this.tokenRepository.update({ jti }, { lastUsedAt: new Date() });
+    }
+};
+exports.IssuedAccessTokenService = IssuedAccessTokenService;
+exports.IssuedAccessTokenService = IssuedAccessTokenService = IssuedAccessTokenService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(issued_access_token_entity_1.IssuedAccessTokenEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        token_signer_service_1.TokenSignerService])
+], IssuedAccessTokenService);
+//# sourceMappingURL=issued-access-token.service.js.map

package/dist/authorization-server/issued-access-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issued-access-token.service.js","sourceRoot":"","sources":["../../src/authorization-server/issued-access-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,6CAAmD;AACnD,qCAAqC;AACrC,mCAAqC;AACrC,sFAAgF;AAChF,8EAAyE;AAGzE,qDAAiD;AAoC1C,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAKhB;IACA;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAEpE,YAEmB,eAAoD,EACpD,kBAAsC;QADtC,oBAAe,GAAf,eAAe,CAAqC;QACpD,uBAAkB,GAAlB,kBAAkB,CAAoB;IACtD,CAAC;IAMJ,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrC,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;QAGlD,MAAM,GAAG,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAG5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,GAAG,GAAG,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAGvD,MAAM,MAAM,GAAsB;YAChC,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;YAC1B,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;YAC/B,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI;YACnC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI;YACnC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;YAC3C,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,GAAG;YACR,GAAG;YACH,SAAS,EAAE,cAAc;YACzB,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAEhB,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE;SAClC,CAAC;QAGF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAG9D,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACzC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;YACrC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE;YACvC,GAAG;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS;YACT,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5D,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,wBAAwB,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG;YACzE,aAAa,SAAS,CAAC,WAAW,EAAE,GAAG,CAC1C,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,KAAK;SACN,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,oBAAoB,CACxB,cAAsB;QAEtB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC/B,KAAK,EAAE,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;YAC5C,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAKD,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;YACtB,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAKD,KAAK,CAAC,eAAe,CACnB,OAAe;QAEf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;YACtB,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;SAC7C,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAEpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;QAElE,OAAO,UAAU,CAAC;IACpB,CAAC;IAKD,KAAK,CAAC,gBAAgB,CAAC,GAAW;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,GAAG,EAAE;YACd,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;SAC7C,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC;QAEjD,OAAO,UAAU,CAAC;IACpB,CAAC;IAKD,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,GAAG,EAAE;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YAEX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC;IAClC,CAAC;IAKD,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;CACF,CAAA;AA5KY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,0BAAgB,EAAC,oDAAuB,CAAC,CAAA;qCACR,oBAAU;QACP,yCAAkB;GAN9C,wBAAwB,CA4KpC"}

package/dist/authorization-server/token-exchange.service.d.ts

@@ -0,0 +1,26 @@
+import { Repository } from 'typeorm';
+import { McpConnectionEntity } from '../mcp-registry/entities/mcp-connection.entity';
+import { McpScopeMappingEntity } from '../mcp-registry/entities/mcp-scope-mapping.entity';
+import { ConnectionAuthorizationFlowEntity } from '../auth-journeys/entities/connection-authorization-flow.entity';
+import { McpRegistryService } from '../mcp-registry/mcp-registry.service';
+import { TokenExchangeRequestDto } from './dto/token-exchange-request.dto';
+import { TokenExchangeResponseDto } from './dto/token-exchange-response.dto';
+import { TokenVerifierService } from 'src/auth/crypto/token-verifier.service';
+export declare class TokenExchangeService {
+    private readonly mcpConnectionRepository;
+    private readonly mcpScopeMappingRepository;
+    private readonly connectionAuthorizationFlowRepository;
+    private readonly mcpRegistryService;
+    private readonly tokenVerifierService;
+    private readonly logger;
+    constructor(mcpConnectionRepository: Repository<McpConnectionEntity>, mcpScopeMappingRepository: Repository<McpScopeMappingEntity>, connectionAuthorizationFlowRepository: Repository<ConnectionAuthorizationFlowEntity>, mcpRegistryService: McpRegistryService, tokenVerifierService: TokenVerifierService);
+    exchangeToken(request: TokenExchangeRequestDto, serverIdentifier: string): Promise<TokenExchangeResponseDto>;
+    private validateMcpJwt;
+    private findConnection;
+    private isUuid;
+    private resolveDownstreamScopes;
+    private validateScopeEntitlement;
+    private getDownstreamToken;
+    private refreshDownstreamToken;
+    private calculateExpiresIn;
+}

package/dist/authorization-server/token-exchange.service.js

@@ -0,0 +1,204 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var TokenExchangeService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenExchangeService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const mcp_connection_entity_1 = require("../mcp-registry/entities/mcp-connection.entity");
+const mcp_scope_mapping_entity_1 = require("../mcp-registry/entities/mcp-scope-mapping.entity");
+const connection_authorization_flow_entity_1 = require("../auth-journeys/entities/connection-authorization-flow.entity");
+const mcp_registry_service_1 = require("../mcp-registry/mcp-registry.service");
+const token_exchange_response_dto_1 = require("./dto/token-exchange-response.dto");
+const token_verifier_service_1 = require("../auth/crypto/token-verifier.service");
+const connection_authorization_flow_status_enum_1 = require("../auth-journeys/enums/connection-authorization-flow-status.enum");
+let TokenExchangeService = TokenExchangeService_1 = class TokenExchangeService {
+    mcpConnectionRepository;
+    mcpScopeMappingRepository;
+    connectionAuthorizationFlowRepository;
+    mcpRegistryService;
+    tokenVerifierService;
+    logger = new common_1.Logger(TokenExchangeService_1.name);
+    constructor(mcpConnectionRepository, mcpScopeMappingRepository, connectionAuthorizationFlowRepository, mcpRegistryService, tokenVerifierService) {
+        this.mcpConnectionRepository = mcpConnectionRepository;
+        this.mcpScopeMappingRepository = mcpScopeMappingRepository;
+        this.connectionAuthorizationFlowRepository = connectionAuthorizationFlowRepository;
+        this.mcpRegistryService = mcpRegistryService;
+        this.tokenVerifierService = tokenVerifierService;
+    }
+    async exchangeToken(request, serverIdentifier) {
+        this.logger.debug(`Processing token exchange for resource: ${request.resource}`);
+        const serverId = await this.mcpRegistryService.resolveServerIdFromProvidedId(serverIdentifier);
+        if (!serverId) {
+            this.logger.warn(`MCP Server not found: ${serverIdentifier}`);
+            throw new common_1.NotFoundException('MCP Server not found');
+        }
+        const mcpTokenPayload = await this.validateMcpJwt(request.subject_token, serverIdentifier);
+        const mcpScopes = mcpTokenPayload.scope;
+        const connection = await this.findConnection(request.resource, serverId);
+        if (!connection) {
+            this.logger.warn(`Connection not found: ${request.resource}`);
+            throw new common_1.NotFoundException('Connection not found');
+        }
+        const entitledDownstreamScopes = await this.resolveDownstreamScopes(mcpScopes, connection.id);
+        const requestedScopes = request.scope
+            ? request.scope.split(' ')
+            : entitledDownstreamScopes;
+        this.validateScopeEntitlement(requestedScopes, entitledDownstreamScopes);
+        const downstreamToken = await this.getDownstreamToken(connection, mcpTokenPayload.client_id, requestedScopes);
+        return new token_exchange_response_dto_1.TokenExchangeResponseDto(downstreamToken.accessToken, 'urn:ietf:params:oauth:token-type:access_token', 'Bearer', this.calculateExpiresIn(downstreamToken.expiresAt), requestedScopes.join(' '));
+    }
+    async validateMcpJwt(token, expectedAudience) {
+        let claims;
+        try {
+            claims = await this.tokenVerifierService.verifyAndDecode(token);
+        }
+        catch (error) {
+            throw new common_1.UnauthorizedException('Token validation failed');
+        }
+        if (claims.aud !== expectedAudience) {
+            this.logger.warn(`MCP JWT audience mismatch: expected ${expectedAudience}, got ${claims.aud}`);
+            throw new common_1.UnauthorizedException('MCP JWT audience mismatch');
+        }
+        return claims;
+    }
+    async findConnection(resource, serverId) {
+        if (this.isUuid(resource)) {
+            const conn = await this.mcpConnectionRepository.findOne({
+                where: { id: resource, serverId: serverId },
+            });
+            if (conn)
+                return conn;
+        }
+        return await this.mcpConnectionRepository.findOne({
+            where: { providedId: resource, serverId: serverId },
+        });
+    }
+    isUuid(str) {
+        const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+        return uuidRegex.test(str);
+    }
+    async resolveDownstreamScopes(mcpScopes, connectionId) {
+        const mappings = await this.mcpScopeMappingRepository.find({
+            where: {
+                connectionId: connectionId,
+                scopeId: (0, typeorm_2.In)(mcpScopes),
+            },
+        });
+        const downstreamScopes = [
+            ...new Set(mappings.map((m) => m.downstreamScope)),
+        ];
+        return downstreamScopes;
+    }
+    validateScopeEntitlement(requestedScopes, entitledScopes) {
+        const entitledSet = new Set(entitledScopes);
+        for (const requestedScope of requestedScopes) {
+            if (!entitledSet.has(requestedScope)) {
+                this.logger.warn(`Scope escalation attempt: '${requestedScope}' not entitled`);
+                throw new common_1.ForbiddenException(`Insufficient scope: '${requestedScope}' not entitled. ` +
+                    `Entitled scopes: ${entitledScopes.join(', ')}`);
+            }
+        }
+    }
+    async getDownstreamToken(connection, clientId, requestedScopes) {
+        const authFlow = await this.connectionAuthorizationFlowRepository.findOne({
+            where: {
+                mcpConnectionId: connection.id,
+                status: connection_authorization_flow_status_enum_1.ConnectionAuthorizationFlowStatus.AUTHORIZED,
+            },
+            relations: ['authJourney', 'authJourney.mcpAuthorizationFlow'],
+        });
+        if (!authFlow || !authFlow.accessToken) {
+            this.logger.warn(`No authorized connection found for connection: ${connection.id}`);
+            throw new common_1.UnauthorizedException('No authorized connection found for this client');
+        }
+        const now = new Date();
+        const expiresAt = authFlow.tokenExpiresAt;
+        const bufferMinutes = 5;
+        if (expiresAt &&
+            now >= new Date(expiresAt.getTime() - bufferMinutes * 60 * 1000)) {
+            this.logger.debug(`Token expired or expiring soon, refreshing...`);
+            return await this.refreshDownstreamToken(authFlow, connection);
+        }
+        return {
+            accessToken: authFlow.accessToken,
+            expiresAt: authFlow.tokenExpiresAt,
+        };
+    }
+    async refreshDownstreamToken(authFlow, connection) {
+        if (!authFlow.refreshToken) {
+            this.logger.warn('No refresh token available for downstream token refresh');
+            throw new common_1.UnauthorizedException('No refresh token available');
+        }
+        try {
+            const body = new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: authFlow.refreshToken,
+                client_id: connection.clientId,
+                client_secret: connection.clientSecret,
+            });
+            const response = await fetch(connection.tokenUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: body.toString(),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                this.logger.error(`Token refresh failed: ${response.status} - ${errorText}`);
+                throw new Error(`Token refresh failed with status ${response.status}`);
+            }
+            const data = await response.json();
+            const { access_token, expires_in, refresh_token } = data;
+            authFlow.accessToken = access_token;
+            authFlow.tokenExpiresAt = new Date(Date.now() + expires_in * 1000);
+            if (refresh_token) {
+                authFlow.refreshToken = refresh_token;
+            }
+            await this.connectionAuthorizationFlowRepository.save(authFlow);
+            this.logger.log(`Successfully refreshed downstream token`);
+            return {
+                accessToken: access_token,
+                expiresAt: authFlow.tokenExpiresAt,
+            };
+        }
+        catch (error) {
+            this.logger.error(`Failed to refresh downstream token: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            throw new common_1.InternalServerErrorException('Failed to refresh downstream token');
+        }
+    }
+    calculateExpiresIn(expiresAt) {
+        if (!expiresAt) {
+            return 3600;
+        }
+        const now = new Date();
+        const expiresInMs = expiresAt.getTime() - now.getTime();
+        return Math.max(0, Math.floor(expiresInMs / 1000));
+    }
+};
+exports.TokenExchangeService = TokenExchangeService;
+exports.TokenExchangeService = TokenExchangeService = TokenExchangeService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(mcp_connection_entity_1.McpConnectionEntity)),
+    __param(1, (0, typeorm_1.InjectRepository)(mcp_scope_mapping_entity_1.McpScopeMappingEntity)),
+    __param(2, (0, typeorm_1.InjectRepository)(connection_authorization_flow_entity_1.ConnectionAuthorizationFlowEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        mcp_registry_service_1.McpRegistryService,
+        token_verifier_service_1.TokenVerifierService])
+], TokenExchangeService);
+//# sourceMappingURL=token-exchange.service.js.map

package/dist/authorization-server/token-exchange.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.service.js","sourceRoot":"","sources":["../../src/authorization-server/token-exchange.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,6CAAmD;AACnD,qCAAyC;AACzC,0FAAqF;AACrF,gGAA0F;AAC1F,yHAAmH;AACnH,+EAA0E;AAG1E,mFAA6E;AAE7E,kFAA8E;AAE9E,gIAAsH;AAQ/G,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAKZ;IAEA;IAEA;IACA;IACA;IAVF,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEhE,YAEmB,uBAAwD,EAExD,yBAA4D,EAE5D,qCAAoF,EACpF,kBAAsC,EACtC,oBAA0C;QAN1C,4BAAuB,GAAvB,uBAAuB,CAAiC;QAExD,8BAAyB,GAAzB,yBAAyB,CAAmC;QAE5D,0CAAqC,GAArC,qCAAqC,CAA+C;QACpF,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,yBAAoB,GAApB,oBAAoB,CAAsB;IAC1D,CAAC;IAKJ,KAAK,CAAC,aAAa,CACjB,OAAgC,EAChC,gBAAwB;QAExB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2CAA2C,OAAO,CAAC,QAAQ,EAAE,CAC9D,CAAC;QAGF,MAAM,QAAQ,GACZ,MAAM,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,CACzD,gBAAgB,CACjB,CAAC;QACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,gBAAgB,EAAE,CAAC,CAAC;YAC9D,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAGD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,OAAO,CAAC,aAAa,EACrB,gBAAgB,CACjB,CAAC;QAGF,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC;QAGxC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9D,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAGD,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACjE,SAAS,EACT,UAAU,CAAC,EAAE,CACd,CAAC;QAGF,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK;YACnC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,wBAAwB,CAAC;QAC7B,IAAI,CAAC,wBAAwB,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QAGzE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CACnD,UAAU,EACV,eAAe,CAAC,SAAS,EACzB,eAAe,CAChB,CAAC;QAGF,OAAO,IAAI,sDAAwB,CACjC,eAAe,CAAC,WAAW,EAC3B,+CAA+C,EAC/C,QAAQ,EACR,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,EAClD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAC1B,CAAC;IACJ,CAAC;IAKO,KAAK,CAAC,cAAc,CAC1B,KAAa,EACb,gBAAwB;QAExB,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAGD,IAAI,MAAM,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uCAAuC,gBAAgB,SAAS,MAAM,CAAC,GAAG,EAAE,CAC7E,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAKO,KAAK,CAAC,cAAc,CAC1B,QAAgB,EAChB,QAAgB;QAGhB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;gBACtD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;aAC5C,CAAC,CAAC;YACH,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QAGD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;YAChD,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAKO,MAAM,CAAC,GAAW;QACxB,MAAM,SAAS,GACb,iEAAiE,CAAC;QACpE,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAKO,KAAK,CAAC,uBAAuB,CACnC,SAAmB,EACnB,YAAoB;QAGpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;YACzD,KAAK,EAAE;gBACL,YAAY,EAAE,YAAY;gBAC1B,OAAO,EAAE,IAAA,YAAE,EAAC,SAAS,CAAC;aACvB;SACF,CAAC,CAAC;QAGH,MAAM,gBAAgB,GAAG;YACvB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;SACnD,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAKO,wBAAwB,CAC9B,eAAyB,EACzB,cAAwB;QAExB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAE5C,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8BAA8B,cAAc,gBAAgB,CAC7D,CAAC;gBACF,MAAM,IAAI,2BAAkB,CAC1B,wBAAwB,cAAc,kBAAkB;oBACtD,oBAAoB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAKO,KAAK,CAAC,kBAAkB,CAC9B,UAA+B,EAC/B,QAAgB,EAChB,eAAyB;QAGzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qCAAqC,CAAC,OAAO,CAAC;YACxE,KAAK,EAAE;gBACL,eAAe,EAAE,UAAU,CAAC,EAAE;gBAC9B,MAAM,EAAE,6EAAiC,CAAC,UAAU;aACrD;YACD,SAAS,EAAE,CAAC,aAAa,EAAE,kCAAkC,CAAC;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kDAAkD,UAAU,CAAC,EAAE,EAAE,CAClE,CAAC;YACF,MAAM,IAAI,8BAAqB,CAC7B,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAGD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC;QAC1C,MAAM,aAAa,GAAG,CAAC,CAAC;QAExB,IACE,SAAS;YACT,GAAG,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,EAChE,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjE,CAAC;QAGD,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAKO,KAAK,CAAC,sBAAsB,CAClC,QAA2C,EAC3C,UAA+B;QAE/B,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yDAAyD,CAC1D,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YAEH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,QAAQ,CAAC,YAAY;gBACpC,SAAS,EAAE,UAAU,CAAC,QAAQ;gBAC9B,aAAa,EAAE,UAAU,CAAC,YAAY;aACvC,CAAC,CAAC;YAGH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yBAAyB,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAC1D,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;YAGzD,QAAQ,CAAC,WAAW,GAAG,YAAY,CAAC;YACpC,QAAQ,CAAC,cAAc,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;YACnE,IAAI,aAAa,EAAE,CAAC;gBAClB,QAAQ,CAAC,YAAY,GAAG,aAAa,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEhE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAE3D,OAAO;gBACL,WAAW,EAAE,YAAY;gBACzB,SAAS,EAAE,QAAQ,CAAC,cAAc;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAClG,CAAC;YACF,MAAM,IAAI,qCAA4B,CACpC,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAKO,kBAAkB,CAAC,SAAgB;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;CACF,CAAA;AAlTY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,0BAAgB,EAAC,2CAAmB,CAAC,CAAA;IAErC,WAAA,IAAA,0BAAgB,EAAC,gDAAqB,CAAC,CAAA;IAEvC,WAAA,IAAA,0BAAgB,EAAC,wEAAiC,CAAC,CAAA;qCAHV,oBAAU;QAER,oBAAU;QAEE,oBAAU;QAC7B,yCAAkB;QAChB,6CAAoB;GAXlD,oBAAoB,CAkThC"}

package/dist/authorization-server/token-exchange.service.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/authorization-server/token-exchange.service.spec.js

@@ -0,0 +1,246 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const testing_1 = require("@nestjs/testing");
+const typeorm_1 = require("@nestjs/typeorm");
+const common_1 = require("@nestjs/common");
+const token_exchange_service_1 = require("./token-exchange.service");
+const mcp_connection_entity_1 = require("../mcp-registry/entities/mcp-connection.entity");
+const mcp_scope_mapping_entity_1 = require("../mcp-registry/entities/mcp-scope-mapping.entity");
+const connection_authorization_flow_entity_1 = require("../auth-journeys/entities/connection-authorization-flow.entity");
+const jwks_service_1 = require("../auth/crypto/jwks.service");
+const connection_authorization_flow_status_enum_1 = require("../auth-journeys/enums/connection-authorization-flow-status.enum");
+describe('TokenExchangeService', () => {
+    let service;
+    let mcpConnectionRepository;
+    let mcpScopeMappingRepository;
+    let connectionAuthorizationFlowRepository;
+    let jwksService;
+    const mockConnection = {
+        id: 'connection-uuid',
+        serverId: 'server-uuid',
+        friendlyName: 'Test Connection',
+        providedId: 'test-connection',
+        clientId: 'test-client-id',
+        clientSecret: 'test-client-secret',
+        authorizeUrl: 'https://example.com/authorize',
+        tokenUrl: 'https://example.com/token',
+        createdAt: new Date(),
+        updatedAt: new Date(),
+    };
+    const mockAuthFlow = {
+        id: 'flow-uuid',
+        mcpConnectionId: 'connection-uuid',
+        status: connection_authorization_flow_status_enum_1.ConnectionAuthorizationFlowStatus.AUTHORIZED,
+        accessToken: 'downstream-access-token',
+        refreshToken: 'downstream-refresh-token',
+        tokenExpiresAt: new Date(Date.now() + 3600000),
+        createdAt: new Date(),
+        updatedAt: new Date(),
+    };
+    beforeEach(async () => {
+        const module = await testing_1.Test.createTestingModule({
+            providers: [
+                token_exchange_service_1.TokenExchangeService,
+                {
+                    provide: (0, typeorm_1.getRepositoryToken)(mcp_connection_entity_1.McpConnectionEntity),
+                    useValue: {
+                        findOne: jest.fn(),
+                    },
+                },
+                {
+                    provide: (0, typeorm_1.getRepositoryToken)(mcp_scope_mapping_entity_1.McpScopeMappingEntity),
+                    useValue: {
+                        find: jest.fn(),
+                    },
+                },
+                {
+                    provide: (0, typeorm_1.getRepositoryToken)(connection_authorization_flow_entity_1.ConnectionAuthorizationFlowEntity),
+                    useValue: {
+                        findOne: jest.fn(),
+                        save: jest.fn(),
+                    },
+                },
+                {
+                    provide: jwks_service_1.JwksService,
+                    useValue: {
+                        getPublicKeys: jest.fn(),
+                    },
+                },
+            ],
+        }).compile();
+        service = module.get(token_exchange_service_1.TokenExchangeService);
+        mcpConnectionRepository = module.get((0, typeorm_1.getRepositoryToken)(mcp_connection_entity_1.McpConnectionEntity));
+        mcpScopeMappingRepository = module.get((0, typeorm_1.getRepositoryToken)(mcp_scope_mapping_entity_1.McpScopeMappingEntity));
+        connectionAuthorizationFlowRepository = module.get((0, typeorm_1.getRepositoryToken)(connection_authorization_flow_entity_1.ConnectionAuthorizationFlowEntity));
+        jwksService = module.get(jwks_service_1.JwksService);
+    });
+    it('should be defined', () => {
+        expect(service).toBeDefined();
+    });
+    describe('exchangeToken - validation', () => {
+        it('should throw NotFoundException when connection is not found', async () => {
+            const request = {
+                grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+                subject_token: 'invalid-jwt',
+                subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',
+                resource: 'non-existent-connection',
+            };
+            mcpConnectionRepository.findOne.mockResolvedValue(null);
+            jwksService.getPublicKeys.mockResolvedValue([
+                {
+                    kid: 'test-key',
+                    kty: 'RSA',
+                    alg: 'RS256',
+                    use: 'sig',
+                    n: 'test-n',
+                    e: 'test-e',
+                },
+            ]);
+            await expect(service.exchangeToken(request, 'test-server')).rejects.toThrow(common_1.UnauthorizedException);
+        });
+        it('should throw ForbiddenException when requested scope is not entitled', async () => {
+            expect(true).toBe(true);
+        });
+    });
+    describe('scope resolution', () => {
+        it('should resolve downstream scopes from MCP scopes', async () => {
+            const mockMappings = [
+                {
+                    id: 'mapping-1',
+                    scopeId: 'tasks:read',
+                    connectionId: 'connection-uuid',
+                    serverId: 'server-uuid',
+                    downstreamScope: 'https://www.googleapis.com/auth/tasks.readonly',
+                },
+                {
+                    id: 'mapping-2',
+                    scopeId: 'tasks:write',
+                    connectionId: 'connection-uuid',
+                    serverId: 'server-uuid',
+                    downstreamScope: 'https://www.googleapis.com/auth/tasks',
+                },
+            ];
+            mcpScopeMappingRepository.find.mockResolvedValue(mockMappings);
+            const resolveMethod = service.resolveDownstreamScopes.bind(service);
+            const result = await resolveMethod(['tasks:read', 'tasks:write'], 'connection-uuid');
+            expect(result).toEqual([
+                'https://www.googleapis.com/auth/tasks.readonly',
+                'https://www.googleapis.com/auth/tasks',
+            ]);
+        });
+        it('should remove duplicate downstream scopes', async () => {
+            const mockMappings = [
+                {
+                    id: 'mapping-1',
+                    scopeId: 'tasks:read',
+                    connectionId: 'connection-uuid',
+                    serverId: 'server-uuid',
+                    downstreamScope: 'https://www.googleapis.com/auth/tasks',
+                },
+                {
+                    id: 'mapping-2',
+                    scopeId: 'tasks:write',
+                    connectionId: 'connection-uuid',
+                    serverId: 'server-uuid',
+                    downstreamScope: 'https://www.googleapis.com/auth/tasks',
+                },
+            ];
+            mcpScopeMappingRepository.find.mockResolvedValue(mockMappings);
+            const resolveMethod = service.resolveDownstreamScopes.bind(service);
+            const result = await resolveMethod(['tasks:read', 'tasks:write'], 'connection-uuid');
+            expect(result).toEqual(['https://www.googleapis.com/auth/tasks']);
+            expect(result.length).toBe(1);
+        });
+    });
+    describe('scope validation', () => {
+        it('should allow subset of entitled scopes', () => {
+            const validateMethod = service.validateScopeEntitlement.bind(service);
+            const requestedScopes = ['scope1'];
+            const entitledScopes = ['scope1', 'scope2', 'scope3'];
+            expect(() => validateMethod(requestedScopes, entitledScopes)).not.toThrow();
+        });
+        it('should throw ForbiddenException for scope escalation', () => {
+            const validateMethod = service.validateScopeEntitlement.bind(service);
+            const requestedScopes = ['scope1', 'scope2', 'scope-not-entitled'];
+            const entitledScopes = ['scope1', 'scope2'];
+            expect(() => validateMethod(requestedScopes, entitledScopes)).toThrow(common_1.ForbiddenException);
+        });
+        it('should allow empty requested scopes', () => {
+            const validateMethod = service.validateScopeEntitlement.bind(service);
+            const requestedScopes = [];
+            const entitledScopes = ['scope1', 'scope2'];
+            expect(() => validateMethod(requestedScopes, entitledScopes)).not.toThrow();
+        });
+    });
+    describe('connection lookup', () => {
+        it('should find connection by UUID', async () => {
+            mcpConnectionRepository.findOne.mockResolvedValue(mockConnection);
+            const findMethod = service.findConnection.bind(service);
+            const result = await findMethod('connection-uuid', 'server-uuid');
+            expect(result).toEqual(mockConnection);
+            expect(mcpConnectionRepository.findOne).toHaveBeenCalledWith({
+                where: { id: 'connection-uuid', serverId: 'server-uuid' },
+            });
+        });
+        it('should find connection by providedId', async () => {
+            mcpConnectionRepository.findOne
+                .mockResolvedValueOnce(null)
+                .mockResolvedValueOnce(mockConnection);
+            const findMethod = service.findConnection.bind(service);
+            const result = await findMethod('test-connection', 'server-uuid');
+            expect(result).toEqual(mockConnection);
+            expect(mcpConnectionRepository.findOne).toHaveBeenCalledTimes(2);
+        });
+        it('should return null when connection is not found', async () => {
+            mcpConnectionRepository.findOne.mockResolvedValue(null);
+            const findMethod = service.findConnection.bind(service);
+            const result = await findMethod('non-existent', 'server-uuid');
+            expect(result).toBeNull();
+        });
+    });
+    describe('UUID validation', () => {
+        it('should identify valid UUIDs', () => {
+            const isUuidMethod = service.isUuid.bind(service);
+            expect(isUuidMethod('550e8400-e29b-41d4-a716-446655440000')).toBe(true);
+            expect(isUuidMethod('123e4567-e89b-12d3-a456-426614174000')).toBe(true);
+        });
+        it('should reject invalid UUIDs', () => {
+            const isUuidMethod = service.isUuid.bind(service);
+            expect(isUuidMethod('test-connection')).toBe(false);
+            expect(isUuidMethod('not-a-uuid')).toBe(false);
+            expect(isUuidMethod('123456')).toBe(false);
+            expect(isUuidMethod('')).toBe(false);
+        });
+    });
+    describe('expires_in calculation', () => {
+        it('should calculate correct expires_in from future date', () => {
+            const calculateMethod = service.calculateExpiresIn.bind(service);
+            const futureDate = new Date(Date.now() + 3600000);
+            const result = calculateMethod(futureDate);
+            expect(result).toBeGreaterThan(3590);
+            expect(result).toBeLessThanOrEqual(3600);
+        });
+        it('should return 0 for past dates', () => {
+            const calculateMethod = service.calculateExpiresIn.bind(service);
+            const pastDate = new Date(Date.now() - 3600000);
+            const result = calculateMethod(pastDate);
+            expect(result).toBe(0);
+        });
+        it('should return default 3600 when no expiration date provided', () => {
+            const calculateMethod = service.calculateExpiresIn.bind(service);
+            const result = calculateMethod(undefined);
+            expect(result).toBe(3600);
+        });
+    });
+    describe('token refresh', () => {
+        it('should throw UnauthorizedException when no refresh token available', async () => {
+            const authFlowWithoutRefreshToken = {
+                ...mockAuthFlow,
+                refreshToken: undefined,
+            };
+            const refreshMethod = service.refreshDownstreamToken.bind(service);
+            await expect(refreshMethod(authFlowWithoutRefreshToken, mockConnection)).rejects.toThrow(common_1.UnauthorizedException);
+        });
+    });
+});
+//# sourceMappingURL=token-exchange.service.spec.js.map