@vendure/mcp-plugin 3.8.0-minor-bootstrap.0

package/lib/oauth/oauth-metadata.service.js

@@ -0,0 +1,107 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOauthMetadataService = void 0;
+const server_1 = require("@modelcontextprotocol/server");
+const common_1 = require("@nestjs/common");
+const constants_1 = require("../constants");
+const endpoint_paths_1 = require("../shared/endpoint-paths");
+const oauth_error_1 = require("./oauth-error");
+const oauth_utils_1 = require("./oauth-utils");
+/** Builds the RFC 8414 and RFC 9728 OAuth discovery documents this server publishes. */
+let McpOauthMetadataService = class McpOauthMetadataService {
+    constructor(options) {
+        this.options = options;
+    }
+    metadata() {
+        const issuer = this.issuerOrigin();
+        return {
+            issuer,
+            authorization_endpoint: `${issuer}/${endpoint_paths_1.OAUTH_ENDPOINT_PATHS.authorize}`,
+            token_endpoint: `${issuer}/${endpoint_paths_1.OAUTH_ENDPOINT_PATHS.token}`,
+            registration_endpoint: `${issuer}/${endpoint_paths_1.OAUTH_ENDPOINT_PATHS.register}`,
+            revocation_endpoint: `${issuer}/${endpoint_paths_1.OAUTH_ENDPOINT_PATHS.revoke}`,
+            response_types_supported: ['code'],
+            grant_types_supported: constants_1.SUPPORTED_OAUTH_GRANT_TYPES,
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: ['none'],
+            // CIMD (draft-ietf-oauth-client-id-metadata-document §6): clients check this
+            // flag before sending a URL client_id, so it must be present because we support it.
+            client_id_metadata_document_supported: true,
+        };
+    }
+    protectedResourceMetadata(toolsetParam) {
+        if (toolsetParam !== 'shop' && toolsetParam !== 'admin') {
+            throw new common_1.NotFoundException();
+        }
+        if (!this.availableToolsets().includes(toolsetParam)) {
+            throw new common_1.NotFoundException();
+        }
+        const issuer = this.issuerOrigin();
+        return {
+            resource: this.resourceForToolset(toolsetParam),
+            authorization_servers: [issuer],
+            bearer_methods_supported: ['header'],
+            resource_name: `Vendure ${toolsetParam} MCP`,
+        };
+    }
+    protectedResourceMetadataUrl(toolset) {
+        return (0, server_1.getOAuthProtectedResourceMetadataUrl)(new URL(this.resourceForToolset(toolset)));
+    }
+    resolveResource(resource) {
+        if (!resource) {
+            throw new oauth_error_1.McpOauthError('invalid_target', 'resource is required');
+        }
+        let url;
+        try {
+            url = new URL(resource);
+        }
+        catch (_a) {
+            throw new oauth_error_1.McpOauthError('invalid_target', 'Unsupported OAuth resource');
+        }
+        if (url.search || url.hash) {
+            throw new oauth_error_1.McpOauthError('invalid_target', 'OAuth resource must not include query parameters or fragments');
+        }
+        const wanted = comparableResource(url);
+        for (const toolset of this.availableToolsets()) {
+            const candidate = this.resourceForToolset(toolset);
+            if (comparableResource(new URL(candidate)) === wanted) {
+                return { resource: candidate, toolset };
+            }
+        }
+        throw new oauth_error_1.McpOauthError('invalid_target', 'Unsupported OAuth resource');
+    }
+    /** Shop is not a valid toolset when shop access is switched off. */
+    availableToolsets() {
+        return this.options.shopAccess === 'disabled' ? ['admin'] : ['shop', 'admin'];
+    }
+    issuerOrigin() {
+        return (0, oauth_utils_1.resolvedOauthOptions)(this.options).issuer.replace(/\/$/, '');
+    }
+    resourceForToolset(toolset) {
+        return `${this.issuerOrigin()}/mcp/${toolset}`;
+    }
+};
+exports.McpOauthMetadataService = McpOauthMetadataService;
+exports.McpOauthMetadataService = McpOauthMetadataService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.MCP_PLUGIN_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], McpOauthMetadataService);
+/** Origin plus path with a trailing slash removed, so two spellings of one resource compare equal. */
+function comparableResource(url) {
+    const path = url.pathname.length > 1 ? url.pathname.replace(/\/$/, '') : url.pathname;
+    return `${url.origin}${path}`;
+}
+//# sourceMappingURL=oauth-metadata.service.js.map

package/lib/oauth/oauth-metadata.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-metadata.service.js","sourceRoot":"","sources":["../../src/oauth/oauth-metadata.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,yDAAoF;AACpF,2CAAuE;AAGvE,4CAA+E;AAE/E,6DAAgE;AAEhE,+CAA8C;AAC9C,+CAAqD;AAErD,wFAAwF;AAEjF,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAChC,YAAyD,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;IAAG,CAAC;IAE9F,QAAQ;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO;YACH,MAAM;YACN,sBAAsB,EAAE,GAAG,MAAM,IAAI,qCAAoB,CAAC,SAAS,EAAE;YACrE,cAAc,EAAE,GAAG,MAAM,IAAI,qCAAoB,CAAC,KAAK,EAAE;YACzD,qBAAqB,EAAE,GAAG,MAAM,IAAI,qCAAoB,CAAC,QAAQ,EAAE;YACnE,mBAAmB,EAAE,GAAG,MAAM,IAAI,qCAAoB,CAAC,MAAM,EAAE;YAC/D,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,uCAA2B;YAClD,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;YAC/C,6EAA6E;YAC7E,oFAAoF;YACpF,qCAAqC,EAAE,IAAI;SAC9C,CAAC;IACN,CAAC;IAED,yBAAyB,CAAC,YAAoB;QAC1C,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;YACtD,MAAM,IAAI,0BAAiB,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,0BAAiB,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO;YACH,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC;YAC/C,qBAAqB,EAAE,CAAC,MAAM,CAAC;YAC/B,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,aAAa,EAAE,WAAW,YAAY,MAAM;SAC/C,CAAC;IACN,CAAC;IAED,4BAA4B,CAAC,OAAmB;QAC5C,OAAO,IAAA,6CAAoC,EAAC,IAAI,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,eAAe,CAAC,QAAiB;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,2BAAa,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACD,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAAC,WAAM,CAAC;YACL,MAAM,IAAI,2BAAa,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,2BAAa,CACnB,gBAAgB,EAChB,+DAA+D,CAClE,CAAC;QACN,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACvC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACpD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;YAC5C,CAAC;QACL,CAAC;QACD,MAAM,IAAI,2BAAa,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;IAC5E,CAAC;IAED,oEAAoE;IAC5D,iBAAiB;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IAEO,YAAY;QAChB,OAAO,IAAA,kCAAoB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,kBAAkB,CAAC,OAAmB;QAClC,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,OAAO,EAAE,CAAC;IACnD,CAAC;CACJ,CAAA;AA/EY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAEI,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;;GAD9B,uBAAuB,CA+EnC;AAED,sGAAsG;AACtG,SAAS,kBAAkB,CAAC,GAAQ;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtF,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;AAClC,CAAC"}

package/lib/oauth/oauth-retention.service.d.ts

@@ -0,0 +1,23 @@
+import { ConfigService, RequestContext, TransactionalConnection } from '@vendure/core';
+import { ResolvedMcpPluginOptions } from '../internal-types';
+export interface McpOauthRetentionResult {
+    deletedSessions: number;
+    deletedRequests: number;
+    deletedCodes: number;
+    deletedGrants: number;
+    deletedClients: number;
+}
+export declare class McpOauthRetentionService {
+    private readonly connection;
+    private readonly configService;
+    private readonly options;
+    constructor(connection: TransactionalConnection, configService: ConfigService, options: ResolvedMcpPluginOptions);
+    deleteExpiredOauthRecords(ctx: RequestContext): Promise<McpOauthRetentionResult>;
+    /** Prevents expired or revoked grants from leaving a live GraphQL session behind. */
+    private deleteSessionsOfDeadGrants;
+    /** Only ever catches abandoned flows, since a used request or code is deleted immediately when it's consumed. */
+    private deleteExpiredShortLivedRecords;
+    /** Kept longer than other OAuth records for audit value; the default retention matches the tool-call log window so a retained log can still resolve its grant. */
+    private deleteDeadGrants;
+    private deleteUnusedClients;
+}

package/lib/oauth/oauth-retention.service.js

@@ -0,0 +1,103 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOauthRetentionService = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@vendure/core");
+const constants_1 = require("../constants");
+const delete_in_batches_1 = require("../delete-in-batches");
+const mcp_authorization_code_entity_1 = require("../entities/mcp-authorization-code.entity");
+const mcp_authorization_request_entity_1 = require("../entities/mcp-authorization-request.entity");
+const mcp_oauth_client_entity_1 = require("../entities/mcp-oauth-client.entity");
+const mcp_oauth_grant_entity_1 = require("../entities/mcp-oauth-grant.entity");
+const oauth_utils_1 = require("./oauth-utils");
+let McpOauthRetentionService = class McpOauthRetentionService {
+    constructor(connection, configService, options) {
+        this.connection = connection;
+        this.configService = configService;
+        this.options = options;
+    }
+    async deleteExpiredOauthRecords(ctx) {
+        const deletedSessions = await this.deleteSessionsOfDeadGrants(ctx);
+        const deletedRequests = await this.deleteExpiredShortLivedRecords(ctx, mcp_authorization_request_entity_1.McpAuthorizationRequest);
+        const deletedCodes = await this.deleteExpiredShortLivedRecords(ctx, mcp_authorization_code_entity_1.McpAuthorizationCode);
+        const deletedGrants = await this.deleteDeadGrants(ctx);
+        const deletedClients = await this.deleteUnusedClients(ctx);
+        return { deletedSessions, deletedRequests, deletedCodes, deletedGrants, deletedClients };
+    }
+    /** Prevents expired or revoked grants from leaving a live GraphQL session behind. */
+    deleteSessionsOfDeadGrants(ctx) {
+        return (0, delete_in_batches_1.deleteInBatches)(this.connection, ctx, core_1.Session, () => this.connection
+            .getRepository(ctx, mcp_oauth_grant_entity_1.McpOauthGrant)
+            .createQueryBuilder('grant')
+            .select('session.id', 'id')
+            .addSelect('session.token', 'token')
+            .innerJoin(core_1.Session, 'session', 'session.id = grant.vendureSessionId')
+            .where('grant.expiresAt <= :now', { now: new Date() })
+            .orWhere('grant.revokedAt IS NOT NULL')
+            .limit(constants_1.RETENTION_DELETE_BATCH_SIZE)
+            .getRawMany(), async (sessions) => {
+            for (const session of sessions) {
+                await (0, oauth_utils_1.deleteCachedVendureSession)(this.configService, session.token);
+            }
+        });
+    }
+    /** Only ever catches abandoned flows, since a used request or code is deleted immediately when it's consumed. */
+    deleteExpiredShortLivedRecords(ctx, entity) {
+        return (0, delete_in_batches_1.deleteInBatches)(this.connection, ctx, entity, () => this.connection
+            .getRepository(ctx, entity)
+            .createQueryBuilder('record')
+            .select('record.id', 'id')
+            .where('record.expiresAt <= :now', { now: new Date() })
+            .limit(constants_1.RETENTION_DELETE_BATCH_SIZE)
+            .getRawMany());
+    }
+    /** Kept longer than other OAuth records for audit value; the default retention matches the tool-call log window so a retained log can still resolve its grant. */
+    deleteDeadGrants(ctx) {
+        const oauth = this.options.oauth;
+        if (!oauth || oauth.grantRetentionDays === 0) {
+            return Promise.resolve(0);
+        }
+        const cutoff = new Date(Date.now() - oauth.grantRetentionDays * constants_1.MS_PER_DAY);
+        return (0, delete_in_batches_1.deleteInBatches)(this.connection, ctx, mcp_oauth_grant_entity_1.McpOauthGrant, () => this.connection
+            .getRepository(ctx, mcp_oauth_grant_entity_1.McpOauthGrant)
+            .createQueryBuilder('grant')
+            .select('grant.id', 'id')
+            .where('grant.expiresAt < :cutoff', { cutoff })
+            .orWhere('grant.revokedAt < :cutoff', { cutoff })
+            .limit(constants_1.RETENTION_DELETE_BATCH_SIZE)
+            .getRawMany());
+    }
+    deleteUnusedClients(ctx) {
+        const cutoff = new Date(Date.now() - constants_1.MCP_UNUSED_OAUTH_CLIENT_RETENTION_MS);
+        return (0, delete_in_batches_1.deleteInBatches)(this.connection, ctx, mcp_oauth_client_entity_1.McpOauthClient, () => this.connection
+            .getRepository(ctx, mcp_oauth_client_entity_1.McpOauthClient)
+            .createQueryBuilder('client')
+            .select('client.id', 'id')
+            .leftJoin(mcp_oauth_grant_entity_1.McpOauthGrant, 'grant', 'grant.oauthClientId = client.id')
+            .where('client.lastUsedAt IS NULL')
+            .andWhere('client.createdAt < :cutoff', { cutoff })
+            .andWhere('grant.id IS NULL')
+            .limit(constants_1.RETENTION_DELETE_BATCH_SIZE)
+            .getRawMany());
+    }
+};
+exports.McpOauthRetentionService = McpOauthRetentionService;
+exports.McpOauthRetentionService = McpOauthRetentionService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(constants_1.MCP_PLUGIN_OPTIONS)),
+    __metadata("design:paramtypes", [core_1.TransactionalConnection,
+        core_1.ConfigService, Object])
+], McpOauthRetentionService);
+//# sourceMappingURL=oauth-retention.service.js.map

package/lib/oauth/oauth-retention.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-retention.service.js","sourceRoot":"","sources":["../../src/oauth/oauth-retention.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,wCAAoG;AAGpG,4CAKsB;AACtB,4DAAuD;AACvD,6FAAiF;AACjF,mGAAuF;AACvF,iFAAqE;AACrE,+EAAmE;AAGnE,+CAA2D;AAWpD,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACjC,YACqB,UAAmC,EACnC,aAA4B,EACA,OAAiC;QAF7D,eAAU,GAAV,UAAU,CAAyB;QACnC,kBAAa,GAAb,aAAa,CAAe;QACA,YAAO,GAAP,OAAO,CAA0B;IAC/E,CAAC;IAEJ,KAAK,CAAC,yBAAyB,CAAC,GAAmB;QAC/C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,GAAG,EAAE,0DAAuB,CAAC,CAAC;QAChG,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,GAAG,EAAE,oDAAoB,CAAC,CAAC;QAC1F,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC3D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;IAC7F,CAAC;IAED,qFAAqF;IAC7E,0BAA0B,CAAC,GAAmB;QAClD,OAAO,IAAA,mCAAe,EAClB,IAAI,CAAC,UAAU,EACf,GAAG,EACH,cAAO,EACP,GAAG,EAAE,CACD,IAAI,CAAC,UAAU;aACV,aAAa,CAAC,GAAG,EAAE,sCAAa,CAAC;aACjC,kBAAkB,CAAC,OAAO,CAAC;aAC3B,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC;aAC1B,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC;aACnC,SAAS,CAAC,cAAO,EAAE,SAAS,EAAE,qCAAqC,CAAC;aACpE,KAAK,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACrD,OAAO,CAAC,6BAA6B,CAAC;aACtC,KAAK,CAAC,uCAA2B,CAAC;aAClC,UAAU,EAA6B,EAChD,KAAK,EAAC,QAAQ,EAAC,EAAE;YACb,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAA,wCAA0B,EAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxE,CAAC;QACL,CAAC,CACJ,CAAC;IACN,CAAC;IAED,iHAAiH;IACzG,8BAA8B,CAClC,GAAmB,EACnB,MAAqB;QAErB,OAAO,IAAA,mCAAe,EAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CACtD,IAAI,CAAC,UAAU;aACV,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC;aAC1B,kBAAkB,CAAC,QAAQ,CAAC;aAC5B,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC;aACzB,KAAK,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACtD,KAAK,CAAC,uCAA2B,CAAC;aAClC,UAAU,EAAc,CAChC,CAAC;IACN,CAAC;IAED,kKAAkK;IAC1J,gBAAgB,CAAC,GAAmB;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,kBAAkB,GAAG,sBAAU,CAAC,CAAC;QAC5E,OAAO,IAAA,mCAAe,EAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,sCAAa,EAAE,GAAG,EAAE,CAC7D,IAAI,CAAC,UAAU;aACV,aAAa,CAAC,GAAG,EAAE,sCAAa,CAAC;aACjC,kBAAkB,CAAC,OAAO,CAAC;aAC3B,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC;aACxB,KAAK,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC;aAC9C,OAAO,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC;aAChD,KAAK,CAAC,uCAA2B,CAAC;aAClC,UAAU,EAAc,CAChC,CAAC;IACN,CAAC;IAEO,mBAAmB,CAAC,GAAmB;QAC3C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gDAAoC,CAAC,CAAC;QAC3E,OAAO,IAAA,mCAAe,EAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,wCAAc,EAAE,GAAG,EAAE,CAC9D,IAAI,CAAC,UAAU;aACV,aAAa,CAAC,GAAG,EAAE,wCAAc,CAAC;aAClC,kBAAkB,CAAC,QAAQ,CAAC;aAC5B,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC;aACzB,QAAQ,CAAC,sCAAa,EAAE,OAAO,EAAE,iCAAiC,CAAC;aACnE,KAAK,CAAC,2BAA2B,CAAC;aAClC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,CAAC;aAClD,QAAQ,CAAC,kBAAkB,CAAC;aAC5B,KAAK,CAAC,uCAA2B,CAAC;aAClC,UAAU,EAAc,CAChC,CAAC;IACN,CAAC;CACJ,CAAA;AA3FY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAKJ,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;qCAFE,8BAAuB;QACpB,oBAAa;GAHxC,wBAAwB,CA2FpC"}

package/lib/oauth/oauth-types.d.ts

@@ -0,0 +1,61 @@
+import { McpToolset } from '@vendure/mcp-sdk';
+import { z } from 'zod';
+export declare const registerClientInputSchema: z.ZodObject<{
+    client_name: z.ZodOptional<z.ZodString>;
+    client_uri: z.ZodOptional<z.ZodString>;
+    logo_uri: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type RegisterClientInput = z.infer<typeof registerClientInputSchema>;
+export declare const authorizeInputSchema: z.ZodObject<{
+    response_type: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    redirect_uri: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    code_challenge: z.ZodOptional<z.ZodString>;
+    code_challenge_method: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuthorizeInput = z.infer<typeof authorizeInputSchema>;
+export declare const tokenInputSchema: z.ZodObject<{
+    grant_type: z.ZodOptional<z.ZodString>;
+    code: z.ZodOptional<z.ZodString>;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    redirect_uri: z.ZodOptional<z.ZodString>;
+    code_verifier: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TokenInput = z.infer<typeof tokenInputSchema>;
+export interface AuthorizationRequestInfo {
+    client_id: string;
+    /**
+     * How the client's identity was established: 'cimd' when the client_id is a URL whose
+     * metadata document was fetched and validated (its hostname is verifiable), 'dcr' for
+     * Dynamic Client Registration (all fields self-asserted).
+     */
+    client_id_source: 'cimd' | 'dcr';
+    client_name: string;
+    client_uri?: string;
+    logo_uri?: string;
+    redirect_uri: string;
+    resource: string;
+    toolset: McpToolset;
+}
+export interface RegisteredClientResponse {
+    client_id: string;
+    client_name: string;
+    client_uri?: string;
+    logo_uri?: string;
+    redirect_uris: string[];
+    grant_types: string[];
+    token_endpoint_auth_method: string;
+}
+export interface OAuthTokenResponse {
+    access_token: string;
+    refresh_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+}

package/lib/oauth/oauth-types.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokenInputSchema = exports.authorizeInputSchema = exports.registerClientInputSchema = void 0;
+const zod_1 = require("zod");
+// Field names are snake_case to match the OAuth 2.1 wire contract.
+exports.registerClientInputSchema = zod_1.z.object({
+    client_name: zod_1.z.string().optional(),
+    client_uri: zod_1.z.string().optional(),
+    logo_uri: zod_1.z.string().optional(),
+    redirect_uris: zod_1.z.array(zod_1.z.string()).optional(),
+    grant_types: zod_1.z.array(zod_1.z.string()).optional(),
+    token_endpoint_auth_method: zod_1.z.string().optional(),
+});
+exports.authorizeInputSchema = zod_1.z.object({
+    response_type: zod_1.z.string().optional(),
+    client_id: zod_1.z.string().optional(),
+    redirect_uri: zod_1.z.string().optional(),
+    state: zod_1.z.string().optional(),
+    code_challenge: zod_1.z.string().optional(),
+    code_challenge_method: zod_1.z.string().optional(),
+    resource: zod_1.z.string().optional(),
+});
+exports.tokenInputSchema = zod_1.z.object({
+    grant_type: zod_1.z.string().optional(),
+    code: zod_1.z.string().optional(),
+    refresh_token: zod_1.z.string().optional(),
+    client_id: zod_1.z.string().optional(),
+    redirect_uri: zod_1.z.string().optional(),
+    code_verifier: zod_1.z.string().optional(),
+    resource: zod_1.z.string().optional(),
+});
+//# sourceMappingURL=oauth-types.js.map

package/lib/oauth/oauth-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-types.js","sourceRoot":"","sources":["../../src/oauth/oauth-types.ts"],"names":[],"mappings":";;;AACA,6BAAwB;AAExB,mEAAmE;AACtD,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,0BAA0B,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGU,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC"}

package/lib/oauth/oauth-utils.d.ts

@@ -0,0 +1,20 @@
+import { ConfigService } from '@vendure/core';
+import { McpOauthOptionsWithDefaults, ResolvedMcpPluginOptions } from '../internal-types';
+export declare function randomToken(): string;
+export declare function addSeconds(date: Date, seconds: number): Date;
+export declare function verifyPkceChallenge(verifier: string, challenge: string): boolean;
+export declare function appendOAuthParams(redirectUri: string, params: Record<string, string | undefined>): string;
+export declare function assertSafeRedirectUri(redirectUri: string): void;
+export declare function httpsUrlOrNull(value: unknown): string | null;
+export declare function deleteCachedVendureSession(configService: ConfigService, token: string | undefined): Promise<void>;
+/** The OAuth options with defaults applied and the issuer known. */
+export type McpOauthOptionsWithIssuer = McpOauthOptionsWithDefaults & {
+    issuer: string;
+};
+/**
+ * Returns the resolved OAuth options, throwing if OAuth was not configured
+ * (i.e. no `oauth.tokenSecret` was supplied to the plugin).
+ */
+export declare function resolvedOauthOptions(options: ResolvedMcpPluginOptions): McpOauthOptionsWithIssuer;
+/** RFC 8252 section 7.3: a loopback redirect URI matches whatever port the app picked at runtime. */
+export declare function isRegisteredRedirectUri(registeredUris: readonly string[], redirectUri: string): boolean;

package/lib/oauth/oauth-utils.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.randomToken = randomToken;
+exports.addSeconds = addSeconds;
+exports.verifyPkceChallenge = verifyPkceChallenge;
+exports.appendOAuthParams = appendOAuthParams;
+exports.assertSafeRedirectUri = assertSafeRedirectUri;
+exports.httpsUrlOrNull = httpsUrlOrNull;
+exports.deleteCachedVendureSession = deleteCachedVendureSession;
+exports.resolvedOauthOptions = resolvedOauthOptions;
+exports.isRegisteredRedirectUri = isRegisteredRedirectUri;
+const core_1 = require("@vendure/core");
+const node_crypto_1 = require("node:crypto");
+const constants_1 = require("../constants");
+const loopback_1 = require("../shared/loopback");
+const oauth_error_1 = require("./oauth-error");
+function randomToken() {
+    return (0, node_crypto_1.randomBytes)(32).toString('base64url');
+}
+function addSeconds(date, seconds) {
+    return new Date(date.getTime() + seconds * 1000);
+}
+function verifyPkceChallenge(verifier, challenge) {
+    const digest = (0, node_crypto_1.createHash)('sha256').update(verifier).digest('base64url');
+    return digest === challenge;
+}
+function appendOAuthParams(redirectUri, params) {
+    const url = new URL(redirectUri);
+    for (const [key, value] of Object.entries(params)) {
+        if (value != null) {
+            url.searchParams.set(key, value);
+        }
+    }
+    return url.toString();
+}
+// Blocks schemes a browser could execute or that reach the local filesystem. Anything else
+// non-http(s) is assumed to be a native app's own scheme (RFC 8252), which the OS hands to
+// the installed app instead.
+const FORBIDDEN_REDIRECT_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:', 'file:', 'blob:', 'about:']);
+function assertSafeRedirectUri(redirectUri) {
+    let url;
+    try {
+        url = new URL(redirectUri);
+    }
+    catch (_a) {
+        throw new oauth_error_1.McpOauthError('invalid_redirect_uri', 'redirect_uri must be an absolute URL');
+    }
+    if (url.protocol === 'http:' && !(0, loopback_1.isLoopbackHostname)(url.hostname)) {
+        throw new oauth_error_1.McpOauthError('invalid_redirect_uri', 'redirect_uri may only use HTTP on localhost');
+    }
+    if (FORBIDDEN_REDIRECT_SCHEMES.has(url.protocol.toLowerCase())) {
+        throw new oauth_error_1.McpOauthError('invalid_redirect_uri', `redirect_uri must not use the ${url.protocol} scheme`);
+    }
+    if (redirectUri.length > constants_1.MAX_CLIENT_METADATA_FIELD_LENGTH) {
+        throw new oauth_error_1.McpOauthError('invalid_redirect_uri', `redirect_uri must be at most ${constants_1.MAX_CLIENT_METADATA_FIELD_LENGTH} characters`);
+    }
+}
+function httpsUrlOrNull(value) {
+    if (typeof value !== 'string' || value.length > constants_1.MAX_CLIENT_METADATA_FIELD_LENGTH) {
+        return null;
+    }
+    try {
+        return new URL(value).protocol === 'https:' ? value : null;
+    }
+    catch (_a) {
+        return null;
+    }
+}
+async function deleteCachedVendureSession(configService, token) {
+    if (!token)
+        return;
+    try {
+        await configService.authOptions.sessionCacheStrategy.delete(token);
+    }
+    catch (error) {
+        core_1.Logger.error('Failed to evict a deleted MCP session from the session cache', constants_1.loggerCtx, error instanceof Error ? error.stack : undefined);
+    }
+}
+/**
+ * Returns the resolved OAuth options, throwing if OAuth was not configured
+ * (i.e. no `oauth.tokenSecret` was supplied to the plugin).
+ */
+function resolvedOauthOptions(options) {
+    var _a;
+    if (!((_a = options.oauth) === null || _a === void 0 ? void 0 : _a.tokenSecret)) {
+        throw new oauth_error_1.McpOauthError('server_error', 'MCP OAuth is not configured (oauth.tokenSecret is required)');
+    }
+    // The plugin's configuration hook sets oauth.issuer at boot when the user left it out, so by
+    // the time any request arrives it is always a string.
+    return options.oauth;
+}
+/** RFC 8252 section 7.3: a loopback redirect URI matches whatever port the app picked at runtime. */
+function isRegisteredRedirectUri(registeredUris, redirectUri) {
+    let requested;
+    try {
+        requested = withoutLoopbackPort(redirectUri);
+    }
+    catch (_a) {
+        return false;
+    }
+    // Registered URIs passed assertSafeRedirectUri, so they parse.
+    return registeredUris.some(registered => withoutLoopbackPort(registered) === requested);
+}
+function withoutLoopbackPort(uri) {
+    const url = new URL(uri);
+    if (url.protocol === 'http:' && (0, loopback_1.isLoopbackHostname)(url.hostname)) {
+        url.port = '';
+    }
+    return url.href;
+}
+//# sourceMappingURL=oauth-utils.js.map

package/lib/oauth/oauth-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-utils.js","sourceRoot":"","sources":["../../src/oauth/oauth-utils.ts"],"names":[],"mappings":";;AASA,kCAEC;AAED,gCAEC;AAED,kDAGC;AAED,8CAQC;AAOD,sDAsBC;AAED,wCASC;AAED,gEAeC;AASD,oDAUC;AAGD,0DASC;AAtHD,wCAAsD;AACtD,6CAAsD;AAEtD,4CAA2E;AAE3E,iDAAwD;AAExD,+CAA8C;AAE9C,SAAgB,WAAW;IACvB,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,SAAgB,UAAU,CAAC,IAAU,EAAE,OAAe;IAClD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAgB,mBAAmB,CAAC,QAAgB,EAAE,SAAiB;IACnE,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzE,OAAO,MAAM,KAAK,SAAS,CAAC;AAChC,CAAC;AAED,SAAgB,iBAAiB,CAAC,WAAmB,EAAE,MAA0C;IAC7F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAChB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC;AAED,2FAA2F;AAC3F,2FAA2F;AAC3F,6BAA6B;AAC7B,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE9G,SAAgB,qBAAqB,CAAC,WAAmB;IACrD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAAC,WAAM,CAAC;QACL,MAAM,IAAI,2BAAa,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAA,6BAAkB,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,2BAAa,CAAC,sBAAsB,EAAE,6CAA6C,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,2BAAa,CACnB,sBAAsB,EACtB,iCAAiC,GAAG,CAAC,QAAQ,SAAS,CACzD,CAAC;IACN,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,4CAAgC,EAAE,CAAC;QACxD,MAAM,IAAI,2BAAa,CACnB,sBAAsB,EACtB,gCAAgC,4CAAgC,aAAa,CAChF,CAAC;IACN,CAAC;AACL,CAAC;AAED,SAAgB,cAAc,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,4CAAgC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAC5C,aAA4B,EAC5B,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,IAAI,CAAC;QACD,MAAM,aAAa,CAAC,WAAW,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,aAAM,CAAC,KAAK,CACR,8DAA8D,EAC9D,qBAAS,EACT,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC;IACN,CAAC;AACL,CAAC;AAKD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAiC;;IAClE,IAAI,CAAC,CAAA,MAAA,OAAO,CAAC,KAAK,0CAAE,WAAW,CAAA,EAAE,CAAC;QAC9B,MAAM,IAAI,2BAAa,CACnB,cAAc,EACd,6DAA6D,CAChE,CAAC;IACN,CAAC;IACD,6FAA6F;IAC7F,sDAAsD;IACtD,OAAO,OAAO,CAAC,KAAkC,CAAC;AACtD,CAAC;AAED,qGAAqG;AACrG,SAAgB,uBAAuB,CAAC,cAAiC,EAAE,WAAmB;IAC1F,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACD,SAAS,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,+DAA+D;IAC/D,OAAO,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAA,6BAAkB,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AACpB,CAAC"}

package/lib/oauth/oauth.controller.d.ts

@@ -0,0 +1,31 @@
+import type { Response } from 'express';
+import { McpOauthMetadataService } from './oauth-metadata.service';
+import { McpOauthService } from './oauth.service';
+export declare class McpOauthController {
+    private readonly oauthService;
+    private readonly oauthMetadata;
+    constructor(oauthService: McpOauthService, oauthMetadata: McpOauthMetadataService);
+    metadata(): {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        registration_endpoint: string;
+        revocation_endpoint: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        token_endpoint_auth_methods_supported: string[];
+        client_id_metadata_document_supported: boolean;
+    };
+    protectedResourceMetadata(toolsetParam: string): {
+        resource: string;
+        authorization_servers: string[];
+        bearer_methods_supported: string[];
+        resource_name: string;
+    };
+    register(body: unknown): Promise<import("./oauth-types").RegisteredClientResponse>;
+    authorize(query: unknown, res: Response): Promise<void>;
+    authorizationRequest(requestToken: unknown): Promise<import("./oauth-types").AuthorizationRequestInfo>;
+    token(body: unknown): Promise<import("./oauth-types").OAuthTokenResponse>;
+    revoke(body: unknown): Promise<Record<string, never>>;
+}