@vendure/mcp-plugin 3.8.0-minor-bootstrap.0

package/lib/oauth/cimd/cimd-fetch.js

@@ -0,0 +1,192 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAllowedCimdAddress = isAllowedCimdAddress;
+exports.fetchCimdDocument = fetchCimdDocument;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@vendure/core");
+const dns = __importStar(require("node:dns"));
+const http = __importStar(require("node:http"));
+const https = __importStar(require("node:https"));
+const node_net_1 = require("node:net");
+const constants_1 = require("../../constants");
+// Blocks every IANA-reserved, non-public address range so a client_id URL can't be used
+// to probe this server's own network.
+// https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+// https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
+const blockedRanges = new node_net_1.BlockList();
+blockedRanges.addSubnet('0.0.0.0', 8, 'ipv4');
+blockedRanges.addSubnet('10.0.0.0', 8, 'ipv4');
+blockedRanges.addSubnet('100.64.0.0', 10, 'ipv4');
+blockedRanges.addSubnet('127.0.0.0', 8, 'ipv4');
+blockedRanges.addSubnet('169.254.0.0', 16, 'ipv4');
+blockedRanges.addSubnet('172.16.0.0', 12, 'ipv4');
+blockedRanges.addSubnet('192.0.0.0', 24, 'ipv4');
+blockedRanges.addSubnet('192.0.2.0', 24, 'ipv4');
+blockedRanges.addSubnet('192.88.99.0', 24, 'ipv4');
+blockedRanges.addSubnet('192.168.0.0', 16, 'ipv4');
+blockedRanges.addSubnet('198.18.0.0', 15, 'ipv4');
+blockedRanges.addSubnet('198.51.100.0', 24, 'ipv4');
+blockedRanges.addSubnet('203.0.113.0', 24, 'ipv4');
+blockedRanges.addSubnet('224.0.0.0', 4, 'ipv4');
+blockedRanges.addSubnet('240.0.0.0', 4, 'ipv4');
+blockedRanges.addSubnet('::', 128, 'ipv6');
+blockedRanges.addSubnet('::1', 128, 'ipv6');
+blockedRanges.addSubnet('64:ff9b::', 96, 'ipv6');
+blockedRanges.addSubnet('64:ff9b:1::', 48, 'ipv6');
+blockedRanges.addSubnet('100::', 64, 'ipv6');
+blockedRanges.addSubnet('100:0:0:1::', 64, 'ipv6');
+blockedRanges.addSubnet('2001::', 23, 'ipv6');
+blockedRanges.addSubnet('2001:db8::', 32, 'ipv6');
+blockedRanges.addSubnet('2002::', 16, 'ipv6');
+blockedRanges.addSubnet('3fff::', 20, 'ipv6');
+blockedRanges.addSubnet('5f00::', 16, 'ipv6');
+blockedRanges.addSubnet('fc00::', 7, 'ipv6');
+blockedRanges.addSubnet('fe80::', 10, 'ipv6');
+blockedRanges.addSubnet('ff00::', 8, 'ipv6');
+const loopbackRanges = new node_net_1.BlockList();
+loopbackRanges.addSubnet('127.0.0.0', 8, 'ipv4');
+loopbackRanges.addAddress('::1', 'ipv6');
+/** True when a resolved address may be dialed. Loopback is only allowed in development. */
+function isAllowedCimdAddress(address, family, allowLoopback) {
+    const familyName = family === 6 ? 'ipv6' : 'ipv4';
+    try {
+        if (allowLoopback && loopbackRanges.check(address, familyName)) {
+            return true;
+        }
+        return !blockedRanges.check(address, familyName);
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** Checks every address a hostname resolves to, since a hostname could mix a public and a private record to slip past a single check. */
+function createGuardedLookup(allowLoopback, baseLookup) {
+    const guarded = (hostname, optionsOrCallback, maybeCallback) => {
+        const callerOptions = typeof optionsOrCallback === 'function' ? {} : (optionsOrCallback !== null && optionsOrCallback !== void 0 ? optionsOrCallback : {});
+        const callback = typeof optionsOrCallback === 'function' ? optionsOrCallback : maybeCallback;
+        baseLookup(hostname, { all: true, verbatim: true }, (error, addresses) => {
+            if (error) {
+                return callback(error);
+            }
+            const allAllowed = addresses.length > 0 &&
+                addresses.every(entry => isAllowedCimdAddress(entry.address, entry.family, allowLoopback));
+            if (!allAllowed) {
+                return callback(new Error('client_id host does not resolve to a public address'));
+            }
+            // The socket may ask for one address or (with `all`, e.g. for happy-eyeballs
+            // connection racing) the whole list — answer in the shape it asked for.
+            if (callerOptions.all) {
+                return callback(null, addresses);
+            }
+            callback(null, addresses[0].address, addresses[0].family);
+        });
+    };
+    return guarded;
+}
+const jsonContentType = /^application\/(?:[^;+\s]+\+)?json\s*(?:;.*)?$/i;
+/** Caps outbound fetches process-wide so many concurrent client_id URLs can't fan this server out into a flood of connections. */
+let activeFetchCount = 0;
+async function fetchCimdDocument(url, options) {
+    if (activeFetchCount >= constants_1.MAX_CONCURRENT_CIMD_FETCHES) {
+        throw new common_1.BadRequestException('client_id metadata document could not be fetched');
+    }
+    activeFetchCount++;
+    try {
+        return await runFetch(url, options);
+    }
+    finally {
+        activeFetchCount--;
+    }
+}
+function runFetch(url, options) {
+    const transport = url.protocol === 'https:' ? https : http;
+    const deadline = AbortSignal.timeout(options.timeoutMs);
+    const timedOut = () => new common_1.BadRequestException('client_id metadata document request timed out');
+    return new Promise((resolve, reject) => {
+        var _a;
+        const fail = (error) => {
+            request.destroy();
+            reject(error);
+        };
+        const request = transport.request(url, {
+            method: 'GET',
+            headers: { accept: 'application/json' },
+            lookup: createGuardedLookup(options.allowLoopback, (_a = options.lookup) !== null && _a !== void 0 ? _a : dns.lookup),
+            // Disables connection reuse: a pooled socket would skip the lookup above, which is
+            // where the address check happens.
+            agent: false,
+            signal: deadline,
+        }, response => {
+            var _a;
+            if (response.statusCode !== 200) {
+                return fail(new common_1.BadRequestException(`client_id metadata document request failed with HTTP ${String(response.statusCode)}`));
+            }
+            const contentType = String((_a = response.headers['content-type']) !== null && _a !== void 0 ? _a : '');
+            if (!jsonContentType.test(contentType)) {
+                return fail(new common_1.BadRequestException('client_id metadata document must be JSON'));
+            }
+            const chunks = [];
+            let received = 0;
+            response.on('data', (chunk) => {
+                received += chunk.length;
+                if (received > options.maxBytes) {
+                    return fail(new common_1.BadRequestException('client_id metadata document is too large'));
+                }
+                chunks.push(chunk);
+            });
+            response.on('end', () => {
+                resolve(Buffer.concat(chunks).toString('utf8'));
+            });
+            // The deadline destroys the request mid-body, which surfaces here rather than on
+            // the request itself, so it has to be reported as the timeout it is.
+            response.on('error', () => fail(deadline.aborted
+                ? timedOut()
+                : new common_1.BadRequestException('client_id metadata document could not be read')));
+        });
+        request.on('error', error => {
+            if (error instanceof common_1.BadRequestException) {
+                return fail(error);
+            }
+            if (deadline.aborted) {
+                return fail(timedOut());
+            }
+            core_1.Logger.warn(`Failed to fetch the client_id metadata document at ${url.hostname}: ${error.message}`, constants_1.loggerCtx);
+            fail(new common_1.BadRequestException('client_id metadata document could not be fetched'));
+        });
+        request.end();
+    });
+}
+//# sourceMappingURL=cimd-fetch.js.map

package/lib/oauth/cimd/cimd-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-fetch.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-fetch.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA,oDAUC;AAiCD,8CAUC;AAnHD,2CAAqD;AACrD,wCAAuC;AACvC,8CAAgC;AAChC,gDAAkC;AAClC,kDAAoC;AACpC,uCAAqC;AAErC,+CAAyE;AAezE,wFAAwF;AACxF,sCAAsC;AACtC,+FAA+F;AAC/F,+FAA+F;AAC/F,MAAM,aAAa,GAAG,IAAI,oBAAS,EAAE,CAAC;AACtC,aAAa,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAC9C,aAAa,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/C,aAAa,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAClD,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAChD,aAAa,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACnD,aAAa,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAClD,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACjD,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACjD,aAAa,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACnD,aAAa,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACnD,aAAa,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAClD,aAAa,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACpD,aAAa,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACnD,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAChD,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAChD,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AAC3C,aAAa,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AAC5C,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACjD,aAAa,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACnD,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC7C,aAAa,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACnD,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9C,aAAa,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAClD,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9C,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9C,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9C,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAC7C,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9C,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAE7C,MAAM,cAAc,GAAG,IAAI,oBAAS,EAAE,CAAC;AACvC,cAAc,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AACjD,cAAc,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAEzC,2FAA2F;AAC3F,SAAgB,oBAAoB,CAAC,OAAe,EAAE,MAAc,EAAE,aAAsB;IACxF,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,CAAC;QACD,IAAI,aAAa,IAAI,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,yIAAyI;AACzI,SAAS,mBAAmB,CAAC,aAAsB,EAAE,UAA6B;IAC9E,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,iBAAsB,EAAE,aAAmB,EAAE,EAAE;QAC9E,MAAM,aAAa,GAAG,OAAO,iBAAiB,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,aAAjB,iBAAiB,cAAjB,iBAAiB,GAAI,EAAE,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,OAAO,iBAAiB,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7F,UAAU,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;YACrE,IAAI,KAAK,EAAE,CAAC;gBACR,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM,UAAU,GACZ,SAAS,CAAC,MAAM,GAAG,CAAC;gBACpB,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;YAC/F,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;YACtF,CAAC;YACD,6EAA6E;YAC7E,wEAAwE;YACxE,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC;gBACpB,OAAO,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACrC,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IACF,OAAO,OAA4B,CAAC;AACxC,CAAC;AAED,MAAM,eAAe,GAAG,gDAAgD,CAAC;AAEzE,kIAAkI;AAClI,IAAI,gBAAgB,GAAG,CAAC,CAAC;AAElB,KAAK,UAAU,iBAAiB,CAAC,GAAQ,EAAE,OAAyB;IACvE,IAAI,gBAAgB,IAAI,uCAA2B,EAAE,CAAC;QAClD,MAAM,IAAI,4BAAmB,CAAC,kDAAkD,CAAC,CAAC;IACtF,CAAC;IACD,gBAAgB,EAAE,CAAC;IACnB,IAAI,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;YAAS,CAAC;QACP,gBAAgB,EAAE,CAAC;IACvB,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,GAAQ,EAAE,OAAyB;IACjD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,4BAAmB,CAAC,+CAA+C,CAAC,CAAC;IAChG,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;QAC3C,MAAM,IAAI,GAAG,CAAC,KAAY,EAAE,EAAE;YAC1B,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAC7B,GAAG,EACH;YACI,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAA,OAAO,CAAC,MAAM,mCAAI,GAAG,CAAC,MAAM,CAAC;YAChF,mFAAmF;YACnF,mCAAmC;YACnC,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,QAAQ;SACnB,EACD,QAAQ,CAAC,EAAE;;YACP,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC9B,OAAO,IAAI,CACP,IAAI,4BAAmB,CACnB,wDAAwD,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CACxF,CACJ,CAAC;YACN,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAA,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,mCAAI,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAClC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;gBACzB,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAC,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC,CAAC;gBACrF,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACpB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;YACH,iFAAiF;YACjF,qEAAqE;YACrE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CACtB,IAAI,CACA,QAAQ,CAAC,OAAO;gBACZ,CAAC,CAAC,QAAQ,EAAE;gBACZ,CAAC,CAAC,IAAI,4BAAmB,CAAC,+CAA+C,CAAC,CACjF,CACJ,CAAC;QACN,CAAC,CACJ,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;YACxB,IAAI,KAAK,YAAY,4BAAmB,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5B,CAAC;YACD,aAAM,CAAC,IAAI,CACP,sDAAsD,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,EACtF,qBAAS,CACZ,CAAC;YACF,IAAI,CAAC,IAAI,4BAAmB,CAAC,kDAAkD,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/lib/oauth/cimd/cimd-url.d.ts

@@ -0,0 +1,5 @@
+export declare function isUrlClientId(clientId: string): boolean;
+export interface CimdClientIdUrlOptions {
+    allowLoopback: boolean;
+}
+export declare function validateCimdClientIdUrl(clientId: string, options: CimdClientIdUrlOptions): URL;

package/lib/oauth/cimd/cimd-url.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isUrlClientId = isUrlClientId;
+exports.validateCimdClientIdUrl = validateCimdClientIdUrl;
+const common_1 = require("@nestjs/common");
+const node_net_1 = require("node:net");
+const constants_1 = require("../../constants");
+const loopback_1 = require("../../shared/loopback");
+// Client ID Metadata Documents (CIMD, draft-ietf-oauth-client-id-metadata-document-02):
+// a client_id that is an HTTPS URL pointing at a JSON document describing the client,
+// instead of an id created by registration. This module owns the URL-shape rules (§3).
+function isUrlClientId(clientId) {
+    // URL scheme is case-insensitive; normalization is handled by validation layer.
+    const scheme = clientId.slice(0, 8).toLowerCase();
+    return scheme.startsWith('https://') || scheme.startsWith('http://');
+}
+function validateCimdClientIdUrl(clientId, options) {
+    assertWithinLengthLimit(clientId);
+    const url = parseClientIdUrl(clientId);
+    const loopback = (0, loopback_1.isLoopbackHostname)(url.hostname);
+    assertSchemeAllowed(url, loopback, options);
+    assertNoUserinfo(url);
+    assertNoFragment(url);
+    assertNoQueryString(url, clientId);
+    assertHasPath(url);
+    assertNoDotSegments(clientId);
+    assertHostnameIsNotIpAddress(url, loopback, options);
+    assertCanonicalForm(url, clientId);
+    return url;
+}
+function assertWithinLengthLimit(clientId) {
+    if (clientId.length > constants_1.CIMD_MAX_CLIENT_ID_LENGTH) {
+        throw new common_1.BadRequestException(`client_id URL must be at most ${constants_1.CIMD_MAX_CLIENT_ID_LENGTH} characters`);
+    }
+}
+function parseClientIdUrl(clientId) {
+    try {
+        return new URL(clientId);
+    }
+    catch (_a) {
+        throw new common_1.BadRequestException('client_id is not a valid URL');
+    }
+}
+function assertSchemeAllowed(url, loopback, options) {
+    const httpLoopbackAllowed = options.allowLoopback && url.protocol === 'http:' && loopback;
+    if (url.protocol !== 'https:' && !httpLoopbackAllowed) {
+        throw new common_1.BadRequestException('client_id URL must use https');
+    }
+    if (loopback && !options.allowLoopback) {
+        throw new common_1.BadRequestException('client_id URL must not point at a loopback address');
+    }
+}
+function assertNoUserinfo(url) {
+    if (url.username || url.password) {
+        throw new common_1.BadRequestException('client_id URL must not contain userinfo');
+    }
+}
+function assertNoFragment(url) {
+    if (url.hash) {
+        throw new common_1.BadRequestException('client_id URL must not contain a fragment');
+    }
+}
+function assertNoQueryString(url, clientId) {
+    if (url.search || clientId.includes('?')) {
+        throw new common_1.BadRequestException('client_id URL must not contain a query string');
+    }
+}
+function assertHasPath(url) {
+    if (url.pathname === '/') {
+        throw new common_1.BadRequestException('client_id URL must include a path, for example /oauth-client-metadata.json');
+    }
+}
+/** The URL parser resolves "." and ".." segments silently, so check the raw string instead. */
+function assertNoDotSegments(clientId) {
+    for (const segment of clientId.split('/')) {
+        const normalized = segment.toLowerCase().replace(/%2e/g, '.');
+        if (normalized === '.' || normalized === '..') {
+            throw new common_1.BadRequestException('client_id URL must not contain dot path segments');
+        }
+    }
+}
+function assertHostnameIsNotIpAddress(url, loopback, options) {
+    const bareHost = url.hostname.replace(/^\[|\]$/g, '');
+    if ((0, node_net_1.isIP)(bareHost) !== 0 && !(options.allowLoopback && loopback)) {
+        throw new common_1.BadRequestException('client_id URL must use a hostname, not an IP address');
+    }
+}
+/** Catches parser rewrites the other checks can't see, such as resolving "." and ".." segments. */
+function assertCanonicalForm(url, clientId) {
+    if (url.href !== clientId) {
+        throw new common_1.BadRequestException(`client_id URL must be given in canonical form (${url.href}), not "${clientId}"`);
+    }
+}
+//# sourceMappingURL=cimd-url.js.map

package/lib/oauth/cimd/cimd-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-url.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-url.ts"],"names":[],"mappings":";;AAUA,sCAIC;AAOD,0DAaC;AAlCD,2CAAqD;AACrD,uCAAgC;AAEhC,+CAA4D;AAC5D,oDAA2D;AAE3D,wFAAwF;AACxF,sFAAsF;AACtF,uFAAuF;AAEvF,SAAgB,aAAa,CAAC,QAAgB;IAC1C,gFAAgF;IAChF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AACzE,CAAC;AAOD,SAAgB,uBAAuB,CAAC,QAAgB,EAAE,OAA+B;IACrF,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAA,6BAAkB,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnC,aAAa,CAAC,GAAG,CAAC,CAAC;IACnB,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9B,4BAA4B,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC7C,IAAI,QAAQ,CAAC,MAAM,GAAG,qCAAyB,EAAE,CAAC;QAC9C,MAAM,IAAI,4BAAmB,CACzB,iCAAiC,qCAAyB,aAAa,CAC1E,CAAC;IACN,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACtC,IAAI,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,WAAM,CAAC;QACL,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAQ,EAAE,QAAiB,EAAE,OAA+B;IACrF,MAAM,mBAAmB,GAAG,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC;IAC1F,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACpD,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,IAAI,4BAAmB,CAAC,oDAAoD,CAAC,CAAC;IACxF,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAQ;IAC9B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,4BAAmB,CAAC,yCAAyC,CAAC,CAAC;IAC7E,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAQ;IAC9B,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,4BAAmB,CAAC,2CAA2C,CAAC,CAAC;IAC/E,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAQ,EAAE,QAAgB;IACnD,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,4BAAmB,CAAC,+CAA+C,CAAC,CAAC;IACnF,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,GAAQ;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,4BAAmB,CACzB,4EAA4E,CAC/E,CAAC;IACN,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,SAAS,mBAAmB,CAAC,QAAgB;IACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,IAAI,4BAAmB,CAAC,kDAAkD,CAAC,CAAC;QACtF,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAQ,EAAE,QAAiB,EAAE,OAA+B;IAC9F,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,IAAA,eAAI,EAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,4BAAmB,CAAC,sDAAsD,CAAC,CAAC;IAC1F,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,SAAS,mBAAmB,CAAC,GAAQ,EAAE,QAAgB;IACnD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,4BAAmB,CACzB,kDAAkD,GAAG,CAAC,IAAI,WAAW,QAAQ,GAAG,CACnF,CAAC;IACN,CAAC;AACL,CAAC"}

package/lib/oauth/grant-session.service.d.ts

@@ -0,0 +1,19 @@
+import { AuthenticatedSession, CachedSession, ConfigService, RequestContext, SessionService, TransactionalConnection, User } from '@vendure/core';
+import { McpOauthGrant } from '../entities/mcp-oauth-grant.entity';
+/** Keeps each MCP grant's Vendure session in sync with the grant, safely even when requests race. */
+export declare class McpGrantSessionService {
+    private readonly connection;
+    private readonly sessionService;
+    private readonly configService;
+    constructor(connection: TransactionalConnection, sessionService: SessionService, configService: ConfigService);
+    /** Safe to call on an already-revoked grant, so callers don't need to check `revokedAt` first. */
+    revokeGrant(ctx: RequestContext, grant: McpOauthGrant): Promise<void>;
+    /** Runs as one transaction so a lapsed session is never replaced twice or left orphaned when requests race. */
+    recreateGrantSession(ctx: RequestContext, grant: McpOauthGrant, user: User): Promise<CachedSession>;
+    /** Falls back to the session another request just created, for when two requests try to replace the same lapsed session at once. */
+    private loadSessionOfReplacedGrant;
+    /** No token is supplied, so the session's identifier can't be derived from the OAuth tokens that reach it. */
+    createVendureSession(ctx: RequestContext, user: User): Promise<AuthenticatedSession>;
+    /** Returns the deleted session's token too, since a cached session keeps serving until its entry ages out even after the row is gone. */
+    private deleteVendureSessionRow;
+}

package/lib/oauth/grant-session.service.js

@@ -0,0 +1,141 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpGrantSessionService = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@vendure/core");
+const mcp_oauth_grant_entity_1 = require("../entities/mcp-oauth-grant.entity");
+const oauth_utils_1 = require("./oauth-utils");
+/**
+ * Name recorded against the dedicated Vendure session created for an MCP grant.
+ */
+const MCP_SESSION_STRATEGY = 'mcp-dedicated-session';
+/** Used only to roll back the transaction below when another request already replaced or revoked the grant; never thrown outside this file. */
+class GrantSessionAlreadyReplaced extends Error {
+}
+/** Keeps each MCP grant's Vendure session in sync with the grant, safely even when requests race. */
+let McpGrantSessionService = class McpGrantSessionService {
+    constructor(connection, sessionService, configService) {
+        this.connection = connection;
+        this.sessionService = sessionService;
+        this.configService = configService;
+    }
+    /** Safe to call on an already-revoked grant, so callers don't need to check `revokedAt` first. */
+    async revokeGrant(ctx, grant) {
+        const sessionToken = await this.connection.withTransaction(ctx, async (txCtx) => {
+            // Only one of two simultaneous revokes should win, since the loser could otherwise
+            // delete a session row the winner already replaced.
+            const claim = await this.connection
+                .getRepository(txCtx, mcp_oauth_grant_entity_1.McpOauthGrant)
+                .createQueryBuilder()
+                .update(mcp_oauth_grant_entity_1.McpOauthGrant)
+                .set({ revokedAt: new Date() })
+                .where('id = :id', { id: grant.id })
+                .andWhere('revokedAt IS NULL')
+                .execute();
+            if (!claim.affected) {
+                return undefined;
+            }
+            return this.deleteVendureSessionRow(txCtx, grant.vendureSessionId);
+        });
+        await (0, oauth_utils_1.deleteCachedVendureSession)(this.configService, sessionToken);
+    }
+    /** Runs as one transaction so a lapsed session is never replaced twice or left orphaned when requests race. */
+    async recreateGrantSession(ctx, grant, user) {
+        const staleSessionId = grant.vendureSessionId;
+        let staleSessionToken;
+        let createdSessionToken;
+        try {
+            await this.connection.withTransaction(ctx, async (txCtx) => {
+                // The lapsed session row may still be in the table, because Vendure clears
+                // expired sessions with a background job rather than on read.
+                staleSessionToken = await this.deleteVendureSessionRow(txCtx, staleSessionId);
+                const created = await this.createVendureSession(txCtx, user);
+                createdSessionToken = created.token;
+                const claim = await this.connection
+                    .getRepository(txCtx, mcp_oauth_grant_entity_1.McpOauthGrant)
+                    .createQueryBuilder()
+                    .update(mcp_oauth_grant_entity_1.McpOauthGrant)
+                    .set({ vendureSessionId: created.id })
+                    .where('id = :id', { id: grant.id })
+                    .andWhere('vendureSessionId = :staleSessionId', { staleSessionId })
+                    .andWhere('revokedAt IS NULL')
+                    .execute();
+                if (!claim.affected) {
+                    throw new GrantSessionAlreadyReplaced();
+                }
+            });
+        }
+        catch (e) {
+            if (!(e instanceof GrantSessionAlreadyReplaced)) {
+                throw e;
+            }
+            // The session row we created was rolled back with the rest of the transaction, but
+            // Core had already written it to the session cache, so that entry has to go by hand.
+            await (0, oauth_utils_1.deleteCachedVendureSession)(this.configService, createdSessionToken);
+            return this.loadSessionOfReplacedGrant(ctx, grant);
+        }
+        // Deleting the stale row is only half the job: a cached session is served without
+        // touching the database until its entry ages out.
+        await (0, oauth_utils_1.deleteCachedVendureSession)(this.configService, staleSessionToken);
+        const session = createdSessionToken
+            ? await this.sessionService.getSessionFromToken(createdSessionToken)
+            : undefined;
+        if (!session) {
+            throw new common_1.UnauthorizedException('Failed to establish Vendure session');
+        }
+        grant.vendureSessionId = session.id;
+        return session;
+    }
+    /** Falls back to the session another request just created, for when two requests try to replace the same lapsed session at once. */
+    async loadSessionOfReplacedGrant(ctx, grant) {
+        const current = await this.connection
+            .getRepository(ctx, mcp_oauth_grant_entity_1.McpOauthGrant)
+            .findOne({ where: { id: grant.id } });
+        if (!current || current.revokedAt) {
+            throw new common_1.UnauthorizedException('Invalid or expired access token');
+        }
+        const sessionRow = await this.connection
+            .getRepository(ctx, core_1.Session)
+            .findOne({ where: { id: current.vendureSessionId } });
+        const session = sessionRow
+            ? await this.sessionService.getSessionFromToken(sessionRow.token)
+            : undefined;
+        if (!session) {
+            throw new common_1.UnauthorizedException('Failed to establish Vendure session');
+        }
+        grant.vendureSessionId = current.vendureSessionId;
+        return session;
+    }
+    /** No token is supplied, so the session's identifier can't be derived from the OAuth tokens that reach it. */
+    createVendureSession(ctx, user) {
+        return this.sessionService.createNewAuthenticatedSession(ctx, user, MCP_SESSION_STRATEGY);
+    }
+    /** Returns the deleted session's token too, since a cached session keeps serving until its entry ages out even after the row is gone. */
+    async deleteVendureSessionRow(ctx, sessionId) {
+        const session = await this.connection
+            .getRepository(ctx, core_1.Session)
+            .findOne({ where: { id: sessionId } });
+        if (!session) {
+            return;
+        }
+        await this.connection.getRepository(ctx, core_1.Session).remove(session);
+        return session.token;
+    }
+};
+exports.McpGrantSessionService = McpGrantSessionService;
+exports.McpGrantSessionService = McpGrantSessionService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.TransactionalConnection,
+        core_1.SessionService,
+        core_1.ConfigService])
+], McpGrantSessionService);
+//# sourceMappingURL=grant-session.service.js.map

package/lib/oauth/grant-session.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-session.service.js","sourceRoot":"","sources":["../../src/oauth/grant-session.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,wCAUuB;AAEvB,+EAAmE;AAEnE,+CAA2D;AAE3D;;GAEG;AACH,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAErD,+IAA+I;AAC/I,MAAM,2BAA4B,SAAQ,KAAK;CAAG;AAElD,qGAAqG;AAE9F,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAC/B,YACqB,UAAmC,EACnC,cAA8B,EAC9B,aAA4B;QAF5B,eAAU,GAAV,UAAU,CAAyB;QACnC,mBAAc,GAAd,cAAc,CAAgB;QAC9B,kBAAa,GAAb,aAAa,CAAe;IAC9C,CAAC;IAEJ,kGAAkG;IAClG,KAAK,CAAC,WAAW,CAAC,GAAmB,EAAE,KAAoB;QACvD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1E,mFAAmF;YACnF,oDAAoD;YACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU;iBAC9B,aAAa,CAAC,KAAK,EAAE,sCAAa,CAAC;iBACnC,kBAAkB,EAAE;iBACpB,MAAM,CAAC,sCAAa,CAAC;iBACrB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAC9B,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;iBACnC,QAAQ,CAAC,mBAAmB,CAAC;iBAC7B,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,MAAM,IAAA,wCAA0B,EAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACvE,CAAC;IAED,+GAA+G;IAC/G,KAAK,CAAC,oBAAoB,CACtB,GAAmB,EACnB,KAAoB,EACpB,IAAU;QAEV,MAAM,cAAc,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC9C,IAAI,iBAAqC,CAAC;QAC1C,IAAI,mBAAuC,CAAC;QAC5C,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;gBACrD,2EAA2E;gBAC3E,8DAA8D;gBAC9D,iBAAiB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;gBAC9E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC7D,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC;gBACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU;qBAC9B,aAAa,CAAC,KAAK,EAAE,sCAAa,CAAC;qBACnC,kBAAkB,EAAE;qBACpB,MAAM,CAAC,sCAAa,CAAC;qBACrB,GAAG,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;qBACrC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;qBACnC,QAAQ,CAAC,oCAAoC,EAAE,EAAE,cAAc,EAAE,CAAC;qBAClE,QAAQ,CAAC,mBAAmB,CAAC;qBAC7B,OAAO,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAClB,MAAM,IAAI,2BAA2B,EAAE,CAAC;gBAC5C,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,IAAI,CAAC,CAAC,CAAC,YAAY,2BAA2B,CAAC,EAAE,CAAC;gBAC9C,MAAM,CAAC,CAAC;YACZ,CAAC;YACD,mFAAmF;YACnF,qFAAqF;YACrF,MAAM,IAAA,wCAA0B,EAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QAED,kFAAkF;QAClF,kDAAkD;QAClD,MAAM,IAAA,wCAA0B,EAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,mBAAmB;YAC/B,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;YACpE,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,qCAAqC,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,gBAAgB,GAAG,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,oIAAoI;IAC5H,KAAK,CAAC,0BAA0B,CACpC,GAAmB,EACnB,KAAoB;QAEpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU;aAChC,aAAa,CAAC,GAAG,EAAE,sCAAa,CAAC;aACjC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU;aACnC,aAAa,CAAC,GAAG,EAAE,cAAO,CAAC;aAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,UAAU;YACtB,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC;YACjE,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,qCAAqC,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAClD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,8GAA8G;IAC9G,oBAAoB,CAAC,GAAmB,EAAE,IAAU;QAChD,OAAO,IAAI,CAAC,cAAc,CAAC,6BAA6B,CAAC,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC9F,CAAC;IAED,yIAAyI;IACjI,KAAK,CAAC,uBAAuB,CAAC,GAAmB,EAAE,SAAa;QACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU;aAChC,aAAa,CAAC,GAAG,EAAE,cAAO,CAAC;aAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO;QACX,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,cAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC,KAAK,CAAC;IACzB,CAAC;CACJ,CAAA;AAxHY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;qCAGwB,8BAAuB;QACnB,qBAAc;QACf,oBAAa;GAJxC,sBAAsB,CAwHlC"}

package/lib/oauth/oauth-error.d.ts

@@ -0,0 +1,18 @@
+import { ArgumentsHost, BadRequestException, ExceptionFilter, UnauthorizedException } from '@nestjs/common';
+import type { ZodType } from 'zod';
+/** Follows the OAuth spec's error codes, minus `invalid_client` since clients here are never authenticated. */
+export type McpOauthErrorCode = 'invalid_request' | 'invalid_grant' | 'unsupported_grant_type' | 'invalid_target' | 'invalid_client_metadata' | 'invalid_redirect_uri' | 'server_error';
+export declare class McpOauthError extends BadRequestException {
+    readonly code: McpOauthErrorCode;
+    constructor(code: McpOauthErrorCode, description: string);
+}
+/** Kept apart from other 401s so the transport can treat it as a routine token refresh rather than a failed authentication attempt. */
+export declare class McpAccessTokenExpiredError extends UnauthorizedException {
+    constructor();
+}
+/** Converts a schema failure into an OAuth-compliant 400, so bad client input never reaches the service as a 500. */
+export declare function parseOAuthInput<T>(schema: ZodType<T>, value: unknown, code: McpOauthErrorCode): T;
+/** Ensures every 400 from the OAuth endpoints comes back in the OAuth error shape, so clients only ever parse one format. */
+export declare class McpOauthExceptionFilter implements ExceptionFilter {
+    catch(exception: BadRequestException, host: ArgumentsHost): void;
+}

package/lib/oauth/oauth-error.js

@@ -0,0 +1,60 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOauthExceptionFilter = exports.McpAccessTokenExpiredError = exports.McpOauthError = void 0;
+exports.parseOAuthInput = parseOAuthInput;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@vendure/core");
+const constants_1 = require("../constants");
+class McpOauthError extends common_1.BadRequestException {
+    constructor(code, description) {
+        super({ error: code, error_description: description });
+        this.code = code;
+        this.message = description;
+    }
+}
+exports.McpOauthError = McpOauthError;
+/** Kept apart from other 401s so the transport can treat it as a routine token refresh rather than a failed authentication attempt. */
+class McpAccessTokenExpiredError extends common_1.UnauthorizedException {
+    constructor() {
+        super('Access token expired');
+    }
+}
+exports.McpAccessTokenExpiredError = McpAccessTokenExpiredError;
+/** Converts a schema failure into an OAuth-compliant 400, so bad client input never reaches the service as a 500. */
+function parseOAuthInput(schema, value, code) {
+    const result = schema.safeParse(value);
+    if (result.success) {
+        return result.data;
+    }
+    const issue = result.error.issues[0];
+    const fieldPath = issue.path.join('.');
+    throw new McpOauthError(code, fieldPath ? `${fieldPath}: ${issue.message}` : issue.message);
+}
+/** Ensures every 400 from the OAuth endpoints comes back in the OAuth error shape, so clients only ever parse one format. */
+let McpOauthExceptionFilter = class McpOauthExceptionFilter {
+    catch(exception, host) {
+        const res = host.switchToHttp().getResponse();
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('Pragma', 'no-cache');
+        let body;
+        if (exception instanceof McpOauthError) {
+            body = exception.getResponse();
+        }
+        else {
+            core_1.Logger.warn(`OAuth request rejected: ${exception.message}`, constants_1.loggerCtx);
+            body = { error: 'invalid_request', error_description: exception.message };
+        }
+        res.status(exception.getStatus()).json(body);
+    }
+};
+exports.McpOauthExceptionFilter = McpOauthExceptionFilter;
+exports.McpOauthExceptionFilter = McpOauthExceptionFilter = __decorate([
+    (0, common_1.Catch)(common_1.BadRequestException)
+], McpOauthExceptionFilter);
+//# sourceMappingURL=oauth-error.js.map

package/lib/oauth/oauth-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-error.js","sourceRoot":"","sources":["../../src/oauth/oauth-error.ts"],"names":[],"mappings":";;;;;;;;;AAyCA,0CAQC;AAjDD,2CAMwB;AACxB,wCAAuC;AAIvC,4CAAyC;AAYzC,MAAa,aAAc,SAAQ,4BAAmB;IAGlD,YAAY,IAAuB,EAAE,WAAmB;QACpD,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;IAC/B,CAAC;CACJ;AARD,sCAQC;AAED,uIAAuI;AACvI,MAAa,0BAA2B,SAAQ,8BAAqB;IACjE;QACI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClC,CAAC;CACJ;AAJD,gEAIC;AAED,qHAAqH;AACrH,SAAgB,eAAe,CAAI,MAAkB,EAAE,KAAc,EAAE,IAAuB;IAC1F,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAChG,CAAC;AAED,6HAA6H;AAEtH,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAChC,KAAK,CAAC,SAA8B,EAAE,IAAmB;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpC,IAAI,IAAa,CAAC;QAClB,IAAI,SAAS,YAAY,aAAa,EAAE,CAAC;YACrC,IAAI,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACnC,CAAC;aAAM,CAAC;YACJ,aAAM,CAAC,IAAI,CAAC,2BAA2B,SAAS,CAAC,OAAO,EAAE,EAAE,qBAAS,CAAC,CAAC;YACvE,IAAI,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;CACJ,CAAA;AAdY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,cAAK,EAAC,4BAAmB,CAAC;GACd,uBAAuB,CAcnC"}

package/lib/oauth/oauth-metadata.service.d.ts

@@ -0,0 +1,34 @@
+import { McpToolset } from '@vendure/mcp-sdk';
+import { ResolvedMcpPluginOptions } from '../internal-types';
+/** Builds the RFC 8414 and RFC 9728 OAuth discovery documents this server publishes. */
+export declare class McpOauthMetadataService {
+    private readonly options;
+    constructor(options: ResolvedMcpPluginOptions);
+    metadata(): {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        registration_endpoint: string;
+        revocation_endpoint: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        token_endpoint_auth_methods_supported: string[];
+        client_id_metadata_document_supported: boolean;
+    };
+    protectedResourceMetadata(toolsetParam: string): {
+        resource: string;
+        authorization_servers: string[];
+        bearer_methods_supported: string[];
+        resource_name: string;
+    };
+    protectedResourceMetadataUrl(toolset: McpToolset): string;
+    resolveResource(resource?: string): {
+        resource: string;
+        toolset: McpToolset;
+    };
+    /** Shop is not a valid toolset when shop access is switched off. */
+    private availableToolsets;
+    private issuerOrigin;
+    resourceForToolset(toolset: McpToolset): string;
+}