@taico/taico 0.0.2

package/dist/authorization-server/web-auth.controller.js

@@ -0,0 +1,271 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var WebAuthController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebAuthController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const identity_provider_service_1 = require("../identity-provider/identity-provider.service");
+const login_request_dto_1 = require("./dto/login-request.dto");
+const login_response_dto_1 = require("./dto/login-response.dto");
+const user_response_dto_1 = require("./dto/user-response.dto");
+const change_password_request_dto_1 = require("./dto/change-password-request.dto");
+const env_config_1 = require("../config/env.config");
+const cookie_keys_constant_1 = require("../auth/core/constants/cookie-keys.constant");
+const token_verifier_service_1 = require("../auth/crypto/token-verifier.service");
+const web_auth_service_1 = require("./web-auth.service");
+const actor_service_1 = require("../identity-provider/actor.service");
+let WebAuthController = WebAuthController_1 = class WebAuthController {
+    webAuthService;
+    tokenVerifierService;
+    identityProviderService;
+    actorService;
+    logger = new common_1.Logger(WebAuthController_1.name);
+    constructor(webAuthService, tokenVerifierService, identityProviderService, actorService) {
+        this.webAuthService = webAuthService;
+        this.tokenVerifierService = tokenVerifierService;
+        this.identityProviderService = identityProviderService;
+        this.actorService = actorService;
+    }
+    async login(loginDto, response) {
+        const { accessToken, refreshToken, expiresInSeconds, user, actor } = await this.webAuthService.login(loginDto.email, loginDto.password);
+        this.logger.log('Got access token');
+        const config = (0, env_config_1.getConfig)();
+        const isProduction = config.nodeEnv === 'production';
+        const cookieOptions = {
+            httpOnly: true,
+            secure: isProduction,
+            sameSite: 'lax',
+            path: '/',
+        };
+        response.cookie(cookie_keys_constant_1.COOKIE_KEYS.ACCESS_TOKEN, accessToken, {
+            ...cookieOptions,
+            maxAge: expiresInSeconds * 1000,
+        });
+        response.cookie(cookie_keys_constant_1.COOKIE_KEYS.REFRESH_TOKEN, refreshToken, {
+            ...cookieOptions,
+            maxAge: 24 * 60 * 60 * 1000,
+        });
+        return {
+            user: {
+                id: actor.id,
+                email: user.email,
+                displayName: actor.displayName,
+                role: user.role,
+                actorId: user.actorId,
+            },
+            expiresIn: expiresInSeconds,
+        };
+    }
+    async refresh(request, response) {
+        const refreshTokenFromCookie = request.cookies?.[cookie_keys_constant_1.COOKIE_KEYS.REFRESH_TOKEN];
+        if (!refreshTokenFromCookie) {
+            throw new common_1.UnauthorizedException('Refresh token not found');
+        }
+        const { accessToken, refreshToken, expiresIn, user, actor } = await this.webAuthService.refreshWebToken(refreshTokenFromCookie);
+        if (!user) {
+            throw new common_1.UnauthorizedException('User not found');
+        }
+        const config = (0, env_config_1.getConfig)();
+        const isProduction = config.nodeEnv === 'production';
+        const cookieOptions = {
+            httpOnly: true,
+            secure: isProduction,
+            sameSite: 'lax',
+            path: '/',
+        };
+        response.cookie(cookie_keys_constant_1.COOKIE_KEYS.ACCESS_TOKEN, accessToken, {
+            ...cookieOptions,
+            maxAge: expiresIn * 1000,
+        });
+        response.cookie(cookie_keys_constant_1.COOKIE_KEYS.REFRESH_TOKEN, refreshToken, {
+            ...cookieOptions,
+            maxAge: 24 * 60 * 60 * 1000,
+        });
+        return {
+            user: {
+                id: user.id,
+                email: user.email,
+                displayName: actor.displayName,
+                role: user.role,
+                actorId: user.actorId,
+            },
+            expiresIn,
+        };
+    }
+    async logout(request, response) {
+        const refreshTokenFromCookie = request.cookies?.[cookie_keys_constant_1.COOKIE_KEYS.REFRESH_TOKEN];
+        if (refreshTokenFromCookie) {
+            try {
+            }
+            catch (error) {
+            }
+        }
+        response.clearCookie(cookie_keys_constant_1.COOKIE_KEYS.ACCESS_TOKEN, { path: '/' });
+        response.clearCookie(cookie_keys_constant_1.COOKIE_KEYS.REFRESH_TOKEN, { path: '/' });
+        return { ok: true };
+    }
+    async me(request) {
+        const accessToken = request.cookies?.[cookie_keys_constant_1.COOKIE_KEYS.ACCESS_TOKEN];
+        if (!accessToken) {
+            throw new common_1.UnauthorizedException('Not authenticated');
+        }
+        const payload = await this.tokenVerifierService.verifyAndDecode(accessToken);
+        payload.actor_id;
+        const actor = await this.actorService.getActorById(payload.actor_id, true);
+        if (!actor) {
+            throw new common_1.UnauthorizedException('Actor not found');
+        }
+        if (!actor.user) {
+            this.logger.error('Actor returned no user. This should not happen');
+            throw new common_1.InternalServerErrorException('Failed to retrieve actor');
+        }
+        return {
+            id: actor.id,
+            email: actor.user.email,
+            displayName: actor.displayName,
+            role: actor.user.role,
+            actorId: actor.user.actorId,
+        };
+    }
+    async changePassword(request, changePasswordDto) {
+        const accessToken = request.cookies?.[cookie_keys_constant_1.COOKIE_KEYS.ACCESS_TOKEN];
+        if (!accessToken) {
+            throw new common_1.UnauthorizedException('Not authenticated');
+        }
+        const payload = await this.tokenVerifierService.verifyAndDecode(accessToken);
+        const actor = await this.actorService.getActorById(payload.actor_id, true);
+        if (!actor) {
+            throw new common_1.UnauthorizedException('Actor not found');
+        }
+        if (!actor.user) {
+            this.logger.error('Actor returned no user. This should not happen');
+            throw new common_1.InternalServerErrorException('Failed to retrieve actor');
+        }
+        await this.identityProviderService.changePassword(actor.user.id, changePasswordDto.currentPassword, changePasswordDto.newPassword);
+        this.logger.log(`Password changed for user: ${actor.user.email}`);
+        return { ok: true };
+    }
+};
+exports.WebAuthController = WebAuthController;
+__decorate([
+    (0, common_1.Post)('login'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({ summary: 'Login with email and password' }),
+    (0, swagger_1.ApiBody)({ type: login_request_dto_1.LoginRequestDto }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Login successful, tokens set in httpOnly cookies',
+        type: login_response_dto_1.LoginResponseDto,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 401,
+        description: 'Invalid credentials',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [login_request_dto_1.LoginRequestDto, Object]),
+    __metadata("design:returntype", Promise)
+], WebAuthController.prototype, "login", null);
+__decorate([
+    (0, common_1.Post)('refresh'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({ summary: 'Refresh access token using refresh token' }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Token refreshed successfully, new tokens set in cookies',
+        type: login_response_dto_1.LoginResponseDto,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 401,
+        description: 'Invalid or expired refresh token',
+    }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], WebAuthController.prototype, "refresh", null);
+__decorate([
+    (0, common_1.Post)('logout'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({ summary: 'Logout and revoke refresh token' }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Logout successful, cookies cleared',
+        schema: {
+            type: 'object',
+            properties: {
+                ok: { type: 'boolean', example: true },
+            },
+        },
+    }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], WebAuthController.prototype, "logout", null);
+__decorate([
+    (0, common_1.Get)('me'),
+    (0, swagger_1.ApiOperation)({ summary: 'Get current authenticated user' }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Current user information',
+        type: user_response_dto_1.UserResponseDto,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 401,
+        description: 'Not authenticated',
+    }),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], WebAuthController.prototype, "me", null);
+__decorate([
+    (0, common_1.Post)('change-password'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({ summary: 'Change password for authenticated user' }),
+    (0, swagger_1.ApiBody)({ type: change_password_request_dto_1.ChangePasswordRequestDto }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Password changed successfully',
+        schema: {
+            type: 'object',
+            properties: {
+                ok: { type: 'boolean', example: true },
+            },
+        },
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 401,
+        description: 'Not authenticated or current password is incorrect',
+    }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, change_password_request_dto_1.ChangePasswordRequestDto]),
+    __metadata("design:returntype", Promise)
+], WebAuthController.prototype, "changePassword", null);
+exports.WebAuthController = WebAuthController = WebAuthController_1 = __decorate([
+    (0, swagger_1.ApiTags)('Web Authentication'),
+    (0, common_1.Controller)('auth'),
+    __metadata("design:paramtypes", [web_auth_service_1.WebAuthService,
+        token_verifier_service_1.TokenVerifierService,
+        identity_provider_service_1.IdentityProviderService,
+        actor_service_1.ActorService])
+], WebAuthController);
+//# sourceMappingURL=web-auth.controller.js.map

package/dist/authorization-server/web-auth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-auth.controller.js","sourceRoot":"","sources":["../../src/authorization-server/web-auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAYwB;AACxB,6CAA8E;AAE9E,8FAAyF;AACzF,+DAA0D;AAC1D,iEAA4D;AAC5D,+DAA0D;AAC1D,mFAA6E;AAC7E,qDAAiD;AACjD,sFAA0E;AAC1E,kFAA6E;AAC7E,yDAAoD;AACpD,sEAAmE;AAI5D,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAIT;IACA;IACA;IACA;IANX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAEpD,YACmB,cAA8B,EAC9B,oBAA0C,EAC1C,uBAAgD,EAChD,YAA0B;QAH1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAeE,AAAN,KAAK,CAAC,KAAK,CACD,QAAyB,EACL,QAAkB;QAG9C,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,GAChE,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAGpC,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,KAAK,YAAY,CAAC;QAGrD,MAAM,aAAa,GAAG;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,KAAc;YACxB,IAAI,EAAE,GAAG;SACV,CAAC;QAEF,QAAQ,CAAC,MAAM,CAAC,kCAAW,CAAC,YAAY,EAAE,WAAW,EAAE;YACrD,GAAG,aAAa;YAChB,MAAM,EAAE,gBAAgB,GAAG,IAAI;SAChC,CAAC,CAAC;QAEH,QAAQ,CAAC,MAAM,CAAC,kCAAW,CAAC,aAAa,EAAE,YAAY,EAAE;YACvD,GAAG,aAAa;YAChB,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;SAC5B,CAAC,CAAC;QAGH,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB;YACD,SAAS,EAAE,gBAAgB;SAC5B,CAAC;IACJ,CAAC;IAcK,AAAN,KAAK,CAAC,OAAO,CACJ,OAAgB,EACK,QAAkB;QAG9C,MAAM,sBAAsB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,kCAAW,CAAC,aAAa,CAAC,CAAC;QAE5E,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAGD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,GACzD,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAGD,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,KAAK,YAAY,CAAC;QAGrD,MAAM,aAAa,GAAG;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,KAAc;YACxB,IAAI,EAAE,GAAG;SACV,CAAC;QAEF,QAAQ,CAAC,MAAM,CAAC,kCAAW,CAAC,YAAY,EAAE,WAAW,EAAE;YACrD,GAAG,aAAa;YAChB,MAAM,EAAE,SAAS,GAAG,IAAI;SACzB,CAAC,CAAC;QAEH,QAAQ,CAAC,MAAM,CAAC,kCAAW,CAAC,aAAa,EAAE,YAAY,EAAE;YACvD,GAAG,aAAa;YAChB,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;SAC5B,CAAC,CAAC;QAGH,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB;YACD,SAAS;SACV,CAAC;IACJ,CAAC;IAeK,AAAN,KAAK,CAAC,MAAM,CACH,OAAgB,EACK,QAAkB;QAG9C,MAAM,sBAAsB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,kCAAW,CAAC,aAAa,CAAC,CAAC;QAK5E,IAAI,sBAAsB,EAAE,CAAC;YAC3B,IAAI,CAAC;YAKL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;YAGjB,CAAC;QACH,CAAC;QAGD,QAAQ,CAAC,WAAW,CAAC,kCAAW,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9D,QAAQ,CAAC,WAAW,CAAC,kCAAW,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAE/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAaK,AAAN,KAAK,CAAC,EAAE,CAAQ,OAAgB;QAE9B,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,kCAAW,CAAC,YAAY,CAAC,CAAC;QAEhE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAGD,MAAM,OAAO,GACX,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAE/D,OAAO,CAAC,QAAQ,CAAC;QAEjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,MAAM,IAAI,qCAA4B,CAAC,0BAA0B,CAAC,CAAC;QACrE,CAAC;QAGD,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;YACrB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;SAC5B,CAAC;IACJ,CAAC;IAoBK,AAAN,KAAK,CAAC,cAAc,CACX,OAAgB,EACf,iBAA2C;QAGnD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,kCAAW,CAAC,YAAY,CAAC,CAAC;QAEhE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAGD,MAAM,OAAO,GACX,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAG/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,MAAM,IAAI,qCAA4B,CAAC,0BAA0B,CAAC,CAAC;QACrE,CAAC;QAGD,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,EACb,iBAAiB,CAAC,eAAe,EACjC,iBAAiB,CAAC,WAAW,CAC9B,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,8BAA8B,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAElE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAA;AAlRY,8CAAiB;AAuBtB;IAbL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;IAC1D,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,mCAAe,EAAE,CAAC;IAClC,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kDAAkD;QAC/D,IAAI,EAAE,qCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,qBAAqB;KACnC,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;qCADT,mCAAe;;8CA0ClC;AAcK;IAZL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IACrE,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,yDAAyD;QACtE,IAAI,EAAE,qCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kCAAkC;KAChD,CAAC;IAEC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;gDAkD5B;AAeK;IAbL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;IAC5D,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,oCAAoC;QACjD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;aACvC;SACF;KACF,CAAC;IAEC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;+CAyB5B;AAaK;IAXL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IAC3D,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,mCAAe;KACtB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,mBAAmB;KACjC,CAAC;IACQ,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2CA+Bd;AAoBK;IAlBL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACnE,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAAwB,EAAE,CAAC;IAC3C,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+BAA+B;QAC5C,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;aACvC;SACF;KACF,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,oDAAoD;KAClE,CAAC;IAEC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAoB,sDAAwB;;uDAiCpD;4BAjRU,iBAAiB;IAF7B,IAAA,iBAAO,EAAC,oBAAoB,CAAC;IAC7B,IAAA,mBAAU,EAAC,MAAM,CAAC;qCAKkB,iCAAc;QACR,6CAAoB;QACjB,mDAAuB;QAClC,4BAAY;GAPlC,iBAAiB,CAkR7B"}

package/dist/authorization-server/web-auth.service.d.ts

@@ -0,0 +1,31 @@
+import { RefreshTokenEntity } from './entities/refresh-token.entity';
+import { Repository } from 'typeorm';
+import { IdentityProviderService } from '../identity-provider/identity-provider.service';
+import { JwksService } from '../auth/crypto/jwks.service';
+import { ActorEntity } from 'src/identity-provider/actor.entity';
+import { User } from 'src/identity-provider/user.entity';
+import { ActorService } from 'src/identity-provider/actor.service';
+export declare class WebAuthService {
+    private readonly identityProviderService;
+    private readonly actorService;
+    private readonly jwksService;
+    private readonly refreshTokenRepository;
+    private logger;
+    constructor(identityProviderService: IdentityProviderService, actorService: ActorService, jwksService: JwksService, refreshTokenRepository: Repository<RefreshTokenEntity>);
+    login(email: string, password: string): Promise<{
+        accessToken: string;
+        refreshToken: string;
+        expiresInSeconds: number;
+        actor: ActorEntity;
+        user: User;
+    }>;
+    private generateWebAccessToken;
+    private generateAndStoreRefreshToken;
+    refreshWebToken(refreshToken: string): Promise<{
+        accessToken: string;
+        refreshToken: string;
+        expiresIn: number;
+        user: User;
+        actor: ActorEntity;
+    }>;
+}

package/dist/authorization-server/web-auth.service.js

@@ -0,0 +1,164 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var WebAuthService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebAuthService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const jose_1 = require("jose");
+const refresh_token_entity_1 = require("./entities/refresh-token.entity");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const identity_provider_service_1 = require("../identity-provider/identity-provider.service");
+const env_config_1 = require("../config/env.config");
+const jwks_service_1 = require("../auth/crypto/jwks.service");
+const user_scopes_1 = require("../auth/core/scopes/user.scopes");
+const actor_service_1 = require("../identity-provider/actor.service");
+const all_web_scopes_1 = require("../auth/core/scopes/all-web.scopes");
+const mcp_registry_scopes_1 = require("../mcp-registry/mcp-registry.scopes");
+let WebAuthService = WebAuthService_1 = class WebAuthService {
+    identityProviderService;
+    actorService;
+    jwksService;
+    refreshTokenRepository;
+    logger = new common_1.Logger(WebAuthService_1.name);
+    constructor(identityProviderService, actorService, jwksService, refreshTokenRepository) {
+        this.identityProviderService = identityProviderService;
+        this.actorService = actorService;
+        this.jwksService = jwksService;
+        this.refreshTokenRepository = refreshTokenRepository;
+    }
+    async login(email, password) {
+        this.logger.debug(`Login attempt for email: ${email}`);
+        const { user, actor } = await this.identityProviderService.validateUser(email, password);
+        const config = (0, env_config_1.getConfig)();
+        const durationMinutes = config.webAccessTokenDurationMinutes;
+        const accessToken = await this.generateWebAccessToken(durationMinutes, actor, user);
+        const refreshToken = await this.generateAndStoreRefreshToken(user.id);
+        this.logger.log(`User logged in successfully: ${email}`);
+        return {
+            user,
+            actor,
+            accessToken,
+            refreshToken,
+            expiresInSeconds: durationMinutes * 60,
+        };
+    }
+    async generateWebAccessToken(durationMinutes, actor, user) {
+        const signingKey = await this.jwksService.getActiveSigningKey();
+        const privateKey = await (0, jose_1.importPKCS8)(signingKey.privateKeyPem, signingKey.algorithm);
+        const now = Math.floor(Date.now() / 1000);
+        const config = (0, env_config_1.getConfig)();
+        console.log("USER ROLE");
+        console.log(user.role);
+        const scopes = [
+            ...all_web_scopes_1.ALL_WEB_SCOPES,
+            ...mcp_registry_scopes_1.ALL_MCP_REGISTRY_SCOPES,
+            user.role === 'admin' ? user_scopes_1.UserScopes.ADMIN : user_scopes_1.UserScopes.STANDARD,
+        ];
+        const payload = {
+            iss: config.issuerUrl,
+            sub: actor.id,
+            actor_id: actor.id,
+            actor_slug: actor.slug,
+            actor_type: actor.type,
+            displayName: actor.displayName,
+            email: user.email,
+            scope: scopes.map((s) => s.id),
+            aud: 'ai-backend',
+            client_id: 'web-app',
+            resource: `${config.issuerUrl}`,
+            version: '0.0.0',
+            iat: now,
+            exp: now + durationMinutes * 60,
+            jti: (0, crypto_1.randomBytes)(16).toString('hex'),
+        };
+        const jwt = await new jose_1.SignJWT(payload)
+            .setProtectedHeader({
+            alg: signingKey.algorithm,
+            kid: signingKey.kid,
+            typ: 'JWT',
+        })
+            .sign(privateKey);
+        return jwt;
+    }
+    async generateAndStoreRefreshToken(userId) {
+        const token = (0, crypto_1.randomBytes)(32).toString('base64url');
+        const tokenHash = (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+        const config = (0, env_config_1.getConfig)();
+        const expiresAt = new Date();
+        expiresAt.setDate(expiresAt.getDate() + config.webRefreshTokenDurationDays);
+        const refreshToken = this.refreshTokenRepository.create({
+            userId,
+            tokenHash,
+            expiresAt,
+            revokedAt: null,
+        });
+        await this.refreshTokenRepository.save(refreshToken);
+        return token;
+    }
+    async refreshWebToken(refreshToken) {
+        this.logger.debug('Refresh token request');
+        const tokenHash = (0, crypto_1.createHash)('sha256').update(refreshToken).digest('hex');
+        const storedToken = await this.refreshTokenRepository.findOne({
+            where: { tokenHash },
+            relations: ['user', 'user.actor'],
+        });
+        if (!storedToken) {
+            this.logger.warn('Refresh token not found');
+            throw new common_1.UnauthorizedException('Invalid refresh token');
+        }
+        if (storedToken.revokedAt) {
+            this.logger.warn('Refresh token has been revoked');
+            throw new common_1.UnauthorizedException('Refresh token revoked');
+        }
+        if (new Date() > storedToken.expiresAt) {
+            this.logger.warn('Refresh token expired');
+            throw new common_1.UnauthorizedException('Refresh token expired');
+        }
+        storedToken.revokedAt = new Date();
+        await this.refreshTokenRepository.save(storedToken);
+        const user = storedToken.user;
+        if (!user) {
+            this.logger.error('User not found for refresh token. This should not happen');
+            throw new common_1.InternalServerErrorException('Failed to retrieve user');
+        }
+        const actor = storedToken.user.actor;
+        if (!actor) {
+            this.logger.error('Actor not found for refresh token. This should not happen');
+            throw new common_1.InternalServerErrorException('Failed to retrieve actor');
+        }
+        const refreshConfig = (0, env_config_1.getConfig)();
+        const newAccessToken = await this.generateWebAccessToken(refreshConfig.webAccessTokenDurationMinutes, actor, user);
+        const newRefreshToken = await this.generateAndStoreRefreshToken(user.id);
+        this.logger.log(`Refresh token exchanged successfully for user: ${user.email}`);
+        return {
+            accessToken: newAccessToken,
+            refreshToken: newRefreshToken,
+            expiresIn: refreshConfig.webAccessTokenDurationMinutes * 60,
+            actor,
+            user,
+        };
+    }
+};
+exports.WebAuthService = WebAuthService;
+exports.WebAuthService = WebAuthService = WebAuthService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(3, (0, typeorm_1.InjectRepository)(refresh_token_entity_1.RefreshTokenEntity)),
+    __metadata("design:paramtypes", [identity_provider_service_1.IdentityProviderService,
+        actor_service_1.ActorService,
+        jwks_service_1.JwksService,
+        typeorm_2.Repository])
+], WebAuthService);
+//# sourceMappingURL=web-auth.service.js.map

package/dist/authorization-server/web-auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-auth.service.js","sourceRoot":"","sources":["../../src/authorization-server/web-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,mCAAiD;AACjD,+BAA4C;AAC5C,0EAAqE;AACrE,6CAAmD;AACnD,qCAAqC;AACrC,8FAAyF;AACzF,qDAAiD;AACjD,8DAA0D;AAG1D,iEAA8D;AAG9D,sEAAmE;AACnE,uEAAqE;AACrE,6EAA+E;AAGxE,IAAM,cAAc,sBAApB,MAAM,cAAc;IAIN;IACA;IACA;IAEA;IAPX,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAEjD,YACmB,uBAAgD,EAChD,YAA0B,EAC1B,WAAwB,EAExB,sBAAsD;QAJtD,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAa;QAExB,2BAAsB,GAAtB,sBAAsB,CAAgC;IACtE,CAAC;IAMJ,KAAK,CAAC,KAAK,CACT,KAAa,EACb,QAAgB;QAQhB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QAGvD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,CACrE,KAAK,EACL,QAAQ,CACT,CAAC;QAGF,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,eAAe,GAAG,MAAM,CAAC,6BAA6B,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACnD,eAAe,EACf,KAAK,EACL,IAAI,CACL,CAAC;QAGF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEtE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QAEzD,OAAO;YACL,IAAI;YACJ,KAAK;YACL,WAAW;YACX,YAAY;YACZ,gBAAgB,EAAE,eAAe,GAAG,EAAE;SACvC,CAAC;IACJ,CAAC;IAKO,KAAK,CAAC,sBAAsB,CAClC,eAAuB,EACvB,KAAkB,EAClB,IAAU;QAGV,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;QAGhE,MAAM,UAAU,GAAG,MAAM,IAAA,kBAAW,EAClC,UAAU,CAAC,aAAa,EACxB,UAAU,CAAC,SAAS,CACrB,CAAC;QAGF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAG3B,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtB,MAAM,MAAM,GAAY;YACtB,GAAG,+BAAc;YACjB,GAAG,6CAAuB;YAC1B,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAU,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAU,CAAC,QAAQ;SAC/D,CAAC;QAEF,MAAM,OAAO,GAAsB;YACjC,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,GAAG,EAAE,KAAK,CAAC,EAAE;YACb,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,UAAU,EAAE,KAAK,CAAC,IAAI;YACtB,UAAU,EAAE,KAAK,CAAC,IAAI;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,GAAG,EAAE,YAAY;YACjB,SAAS,EAAE,SAAS;YAEpB,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE;YAC/B,OAAO,EAAE,OAAO;YAChB,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,eAAe,GAAG,EAAE;YAC/B,GAAG,EAAE,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;SACrC,CAAC;QAGF,MAAM,GAAG,GAAG,MAAM,IAAI,cAAO,CAAC,OAAc,CAAC;aAC1C,kBAAkB,CAAC;YAClB,GAAG,EAAE,UAAU,CAAC,SAAS;YACzB,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,EAAE,KAAK;SACX,CAAC;aACD,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpB,OAAO,GAAG,CAAC;IACb,CAAC;IAMO,KAAK,CAAC,4BAA4B,CAAC,MAAc;QAEvD,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAGpD,MAAM,SAAS,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAGnE,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAG5E,MAAM,YAAY,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACtD,MAAM;YACN,SAAS;YACT,SAAS;YACT,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAGrD,OAAO,KAAK,CAAC;IACf,CAAC;IAMD,KAAK,CAAC,eAAe,CAAC,YAAoB;QAOxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAG3C,MAAM,SAAS,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAI1E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAC5D,KAAK,EAAE,EAAE,SAAS,EAAE;YACpB,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAC5C,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAGD,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YACnD,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAGD,IAAI,IAAI,IAAI,EAAE,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC1C,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAGD,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAGpD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0DAA0D,CAC3D,CAAC;YAEF,MAAM,IAAI,qCAA4B,CAAC,yBAAyB,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2DAA2D,CAC5D,CAAC;YAEF,MAAM,IAAI,qCAA4B,CAAC,0BAA0B,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,aAAa,GAAG,IAAA,sBAAS,GAAE,CAAC;QAClC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACtD,aAAa,CAAC,6BAA6B,EAC3C,KAAK,EACL,IAAI,CACL,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEzE,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,kDAAkD,IAAI,CAAC,KAAK,EAAE,CAC/D,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,cAAc;YAC3B,YAAY,EAAE,eAAe;YAC7B,SAAS,EAAE,aAAa,CAAC,6BAA6B,GAAG,EAAE;YAC3D,KAAK;YACL,IAAI;SACL,CAAC;IACJ,CAAC;CACF,CAAA;AArOY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAQR,WAAA,IAAA,0BAAgB,EAAC,yCAAkB,CAAC,CAAA;qCAHK,mDAAuB;QAClC,4BAAY;QACb,0BAAW;QAEA,oBAAU;GAR1C,cAAc,CAqO1B"}

package/dist/common/utils/color-palette.util.d.ts

@@ -0,0 +1 @@
+export declare function getRandomTagColor(): string;

package/dist/common/utils/color-palette.util.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRandomTagColor = getRandomTagColor;
+const TAG_COLOR_PALETTE = [
+    '#FF6B6B',
+    '#4ECDC4',
+    '#45B7D1',
+    '#FFA07A',
+    '#98D8C8',
+    '#F7DC6F',
+    '#BB8FCE',
+    '#85C1E2',
+    '#F8B739',
+    '#52B788',
+    '#E76F51',
+    '#8E7CC3',
+    '#FF9FF3',
+    '#54A0FF',
+    '#48DBFB',
+    '#1DD1A1',
+    '#FFA502',
+    '#FF6348',
+    '#5F27CD',
+    '#00D2D3',
+];
+function getRandomTagColor() {
+    const randomIndex = Math.floor(Math.random() * TAG_COLOR_PALETTE.length);
+    return TAG_COLOR_PALETTE[randomIndex];
+}
+//# sourceMappingURL=color-palette.util.js.map

package/dist/common/utils/color-palette.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"color-palette.util.js","sourceRoot":"","sources":["../../../src/common/utils/color-palette.util.ts"],"names":[],"mappings":";;AA8BA,8CAGC;AA7BD,MAAM,iBAAiB,GAAG;IACxB,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;CACV,CAAC;AAKF,SAAgB,iBAAiB;IAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC"}

package/dist/config/env.config.d.ts

@@ -0,0 +1,23 @@
+export type NodeEnv = 'development' | 'production';
+export interface AppConfig {
+    port: number;
+    nodeEnv: NodeEnv;
+    issuerUrl: string;
+    callbackUrl: string;
+    databasePath: string;
+    adkUrl: string;
+    ollamaUrl: string;
+    clientSecretLength: number;
+    jwksKeySigningTtlHours: number;
+    jwksKeyVerifyingTtlHours: number;
+    mcpAccessTokenDurationSeconds: number;
+    mcpRefreshTokenDurationDays: number;
+    webAccessTokenDurationMinutes: number;
+    webRefreshTokenDurationDays: number;
+    mcpClientPruneRetentionHours: number;
+    vitePort: string;
+}
+export declare function loadConfig(): AppConfig;
+export declare function getConfig(): AppConfig;
+export declare function isDevelopment(): boolean;
+export declare function isProduction(): boolean;

package/dist/config/env.config.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadConfig = loadConfig;
+exports.getConfig = getConfig;
+exports.isDevelopment = isDevelopment;
+exports.isProduction = isProduction;
+const common_1 = require("@nestjs/common");
+const logger = new common_1.Logger('EnvConfig');
+function loadConfig() {
+    const config = {
+        port: parseInt(process.env.BACKEND_PORT || '3000', 10),
+        nodeEnv: getEnv(),
+        issuerUrl: getIssuerUrl(),
+        callbackUrl: getCallbackUrl(),
+        databasePath: process.env.DATABASE_PATH || 'data/database.sqlite',
+        adkUrl: getADKUrl(),
+        ollamaUrl: getOllamaUrl(),
+        clientSecretLength: parseInt(process.env.CLIENT_SECRET_LENGTH || '32', 10),
+        jwksKeySigningTtlHours: parseInt(process.env.JWKS_KEY_SIGNING_TTL_HOURS || '72', 10),
+        jwksKeyVerifyingTtlHours: parseInt(process.env.JWKS_KEY_VERIFYING_TTL_HOURS || '1440', 10),
+        mcpAccessTokenDurationSeconds: parseInt(process.env.MCP_ACCESS_TOKEN_DURATION_SECONDS || '600', 10),
+        mcpRefreshTokenDurationDays: parseInt(process.env.MCP_REFRESH_TOKEN_DURATION_DAYS || '7', 10),
+        webAccessTokenDurationMinutes: parseInt(process.env.WEB_ACCESS_TOKEN_DURATION_MINUTES || '60', 10),
+        webRefreshTokenDurationDays: parseInt(process.env.WEB_REFRESH_TOKEN_DURATION_DAYS || '1', 10),
+        mcpClientPruneRetentionHours: parseFloat(process.env.MCP_CLIENT_PRUNE_RETENTION_HOURS || '0.75'),
+        vitePort: process.env.VITE_PORT || '1000',
+    };
+    logger.log('Configuration loaded:');
+    logger.log(`  - Port: ${config.port}`);
+    logger.log(`  - Node Environment: ${config.nodeEnv}`);
+    logger.log(`  - Issuer URL: ${config.issuerUrl}`);
+    logger.log(`  - Callback URL: ${config.callbackUrl}`);
+    logger.log(`  - Database Path: ${config.databasePath}`);
+    logger.log(`  - ADK URL: ${config.adkUrl}`);
+    logger.log(`  - Ollama URL: ${config.ollamaUrl}`);
+    logger.log(`  - MCP Client Prune Retention Hours: ${config.mcpClientPruneRetentionHours}`);
+    return config;
+}
+function getEnv() {
+    const env = process.env.NODE_ENV;
+    if (env === 'production' || env === 'development') {
+        return env;
+    }
+    return 'development';
+}
+function getIssuerUrl() {
+    const issuerUrl = process.env.ISSUER_URL;
+    if (issuerUrl) {
+        return issuerUrl;
+    }
+    if (getEnv() === 'production') {
+        logger.error('ISSUER_URL is not set in production environment');
+        throw new Error('ISSUER_URL must be set in production');
+    }
+    logger.warn('Using default ISSUER_URL for development');
+    return 'http://localhost:1000';
+}
+function getCallbackUrl() {
+    const issuerUrl = getIssuerUrl();
+    return `${issuerUrl}/api/v1/auth/callback`;
+}
+function getADKUrl() {
+    const adkUrl = process.env.ADK_URL;
+    if (adkUrl) {
+        return adkUrl;
+    }
+    if (getEnv() === 'production') {
+        logger.error('ADK_URL is not set in production environment');
+        throw new Error('ADK_URL must be set in production');
+    }
+    logger.warn('Using default ADK_URL for development');
+    return 'http://localhost:8000';
+}
+function getOllamaUrl() {
+    const ollamaUrl = process.env.OLLAMA_URL;
+    if (ollamaUrl) {
+        return ollamaUrl;
+    }
+    if (getEnv() === 'production') {
+        logger.error('OLLAMA_URL is not set in production environment');
+        throw new Error('OLLAMA_URL must be set in production');
+    }
+    logger.warn('Using default OLLAMA_URL for development');
+    return 'http://localhost:11434';
+}
+let configInstance = null;
+function getConfig() {
+    if (!configInstance) {
+        configInstance = loadConfig();
+    }
+    return configInstance;
+}
+function isDevelopment() {
+    return getConfig().nodeEnv !== 'production';
+}
+function isProduction() {
+    return getConfig().nodeEnv === 'production';
+}
+//# sourceMappingURL=env.config.js.map

package/dist/config/env.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.config.js","sourceRoot":"","sources":["../../src/config/env.config.ts"],"names":[],"mappings":";;AAsDA,gCAqEC;AAmED,8BAKC;AAKD,sCAEC;AAED,oCAEC;AAtMD,2CAAwC;AAExC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,WAAW,CAAC,CAAC;AA4CvC,SAAgB,UAAU;IACxB,MAAM,MAAM,GAAc;QAExB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,EAAE,EAAE,CAAC;QACtD,OAAO,EAAE,MAAM,EAAE;QAGjB,SAAS,EAAE,YAAY,EAAE;QACzB,WAAW,EAAE,cAAc,EAAE;QAG7B,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,sBAAsB;QAGjE,MAAM,EAAE,SAAS,EAAE;QACnB,SAAS,EAAE,YAAY,EAAE;QAGzB,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1E,sBAAsB,EAAE,QAAQ,CAC9B,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,IAAI,EAC9C,EAAE,CACH;QACD,wBAAwB,EAAE,QAAQ,CAChC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,MAAM,EAClD,EAAE,CACH;QAID,6BAA6B,EAAE,QAAQ,CACrC,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,KAAK,EACtD,EAAE,CACH;QAED,2BAA2B,EAAE,QAAQ,CACnC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,GAAG,EAClD,EAAE,CACH;QAED,6BAA6B,EAAE,QAAQ,CACrC,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,IAAI,EACrD,EAAE,CACH;QAED,2BAA2B,EAAE,QAAQ,CACnC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,GAAG,EAClD,EAAE,CACH;QAGD,4BAA4B,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,MAAM,CAAC;QAGhG,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;KAC1C,CAAC;IAGF,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,yCAAyC,MAAM,CAAC,4BAA4B,EAAE,CAAC,CAAC;IAE3F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM;IACb,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjC,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACzC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,EAAE,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACxD,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,OAAO,GAAG,SAAS,uBAAuB,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,EAAE,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACrD,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACzC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,EAAE,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACxD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAMD,IAAI,cAAc,GAAqB,IAAI,CAAC;AAM5C,SAAgB,SAAS;IACvB,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,UAAU,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAKD,SAAgB,aAAa;IAC3B,OAAO,SAAS,EAAE,CAAC,OAAO,KAAK,YAAY,CAAC;AAC9C,CAAC;AAED,SAAgB,YAAY;IAC1B,OAAO,SAAS,EAAE,CAAC,OAAO,KAAK,YAAY,CAAC;AAC9C,CAAC"}