@vendure/mcp-plugin 3.8.0-minor-bootstrap.0

package/lib/oauth/oauth.controller.js

@@ -0,0 +1,132 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOauthController = void 0;
+const common_1 = require("@nestjs/common");
+const zod_1 = require("zod");
+const mcp_oauth_rate_limit_guard_1 = require("../rate-limit/mcp-oauth-rate-limit.guard");
+const endpoint_paths_1 = require("../shared/endpoint-paths");
+const oauth_error_1 = require("./oauth-error");
+const oauth_metadata_service_1 = require("./oauth-metadata.service");
+const oauth_types_1 = require("./oauth-types");
+const oauth_service_1 = require("./oauth.service");
+let McpOauthController = class McpOauthController {
+    constructor(oauthService, oauthMetadata) {
+        this.oauthService = oauthService;
+        this.oauthMetadata = oauthMetadata;
+    }
+    metadata() {
+        return this.oauthMetadata.metadata();
+    }
+    protectedResourceMetadata(toolsetParam) {
+        return this.oauthMetadata.protectedResourceMetadata(toolsetParam);
+    }
+    // Every route below either carries or accepts a credential, so none of them may be cached
+    // (RFC 6749 section 5.1). The two metadata documents above are public and stay cacheable.
+    register(body) {
+        const input = (0, oauth_error_1.parseOAuthInput)(oauth_types_1.registerClientInputSchema, body, 'invalid_client_metadata');
+        return this.oauthService.registerClient(input);
+    }
+    async authorize(query, res) {
+        const input = (0, oauth_error_1.parseOAuthInput)(oauth_types_1.authorizeInputSchema, query, 'invalid_request');
+        const redirectUrl = await this.oauthService.createAuthorizationRedirect(input);
+        res.redirect(redirectUrl);
+    }
+    authorizationRequest(requestToken) {
+        const token = (0, oauth_error_1.parseOAuthInput)(zod_1.z.string().optional(), requestToken, 'invalid_request');
+        return this.oauthService.getAuthorizationRequestInfo(token);
+    }
+    // RFC 6749 §5.1 requires the token endpoint to respond with 200; override the NestJS
+    // @Post default of 201.
+    token(body) {
+        const input = (0, oauth_error_1.parseOAuthInput)(oauth_types_1.tokenInputSchema, body, 'invalid_request');
+        return this.oauthService.exchangeToken(input);
+    }
+    revoke(body) {
+        // RFC 7009 §2.2 leaves revocation no way to report a bad token, so a token that is not
+        // a string is treated as no token at all and the route still answers 200.
+        const token = body === null || body === void 0 ? void 0 : body.token;
+        return this.oauthService.revoke(typeof token === 'string' ? token : undefined);
+    }
+};
+exports.McpOauthController = McpOauthController;
+__decorate([
+    (0, common_1.Get)('.well-known/oauth-authorization-server'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], McpOauthController.prototype, "metadata", null);
+__decorate([
+    (0, common_1.Get)('.well-known/oauth-protected-resource/mcp/:toolset'),
+    __param(0, (0, common_1.Param)('toolset')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", void 0)
+], McpOauthController.prototype, "protectedResourceMetadata", null);
+__decorate([
+    (0, common_1.Post)(endpoint_paths_1.OAUTH_ENDPOINT_PATHS.register),
+    (0, common_1.Header)('Cache-Control', 'no-store'),
+    (0, common_1.Header)('Pragma', 'no-cache'),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], McpOauthController.prototype, "register", null);
+__decorate([
+    (0, common_1.Get)(endpoint_paths_1.OAUTH_ENDPOINT_PATHS.authorize),
+    (0, common_1.Header)('Cache-Control', 'no-store'),
+    (0, common_1.Header)('Pragma', 'no-cache'),
+    __param(0, (0, common_1.Query)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], McpOauthController.prototype, "authorize", null);
+__decorate([
+    (0, common_1.Get)(endpoint_paths_1.OAUTH_ENDPOINT_PATHS.authorizationRequest),
+    (0, common_1.Header)('Cache-Control', 'no-store'),
+    (0, common_1.Header)('Pragma', 'no-cache'),
+    __param(0, (0, common_1.Query)('request_token')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], McpOauthController.prototype, "authorizationRequest", null);
+__decorate([
+    (0, common_1.Post)(endpoint_paths_1.OAUTH_ENDPOINT_PATHS.token),
+    (0, common_1.HttpCode)(200),
+    (0, common_1.Header)('Cache-Control', 'no-store'),
+    (0, common_1.Header)('Pragma', 'no-cache'),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], McpOauthController.prototype, "token", null);
+__decorate([
+    (0, common_1.Post)(endpoint_paths_1.OAUTH_ENDPOINT_PATHS.revoke),
+    (0, common_1.HttpCode)(200),
+    (0, common_1.Header)('Cache-Control', 'no-store'),
+    (0, common_1.Header)('Pragma', 'no-cache'),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], McpOauthController.prototype, "revoke", null);
+exports.McpOauthController = McpOauthController = __decorate([
+    (0, common_1.UseGuards)(mcp_oauth_rate_limit_guard_1.McpOauthRateLimitGuard),
+    (0, common_1.UseFilters)(new mcp_oauth_rate_limit_guard_1.McpOauthRateLimitExceptionFilter(), new oauth_error_1.McpOauthExceptionFilter()),
+    (0, common_1.Controller)(),
+    __metadata("design:paramtypes", [oauth_service_1.McpOauthService,
+        oauth_metadata_service_1.McpOauthMetadataService])
+], McpOauthController);
+//# sourceMappingURL=oauth.controller.js.map

package/lib/oauth/oauth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.controller.js","sourceRoot":"","sources":["../../src/oauth/oauth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAYwB;AAExB,6BAAwB;AAExB,yFAGkD;AAClD,6DAAgE;AAEhE,+CAAyE;AACzE,qEAAmE;AACnE,+CAAkG;AAClG,mDAAkD;AAK3C,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC3B,YACqB,YAA6B,EAC7B,aAAsC;QADtC,iBAAY,GAAZ,YAAY,CAAiB;QAC7B,kBAAa,GAAb,aAAa,CAAyB;IACxD,CAAC;IAGJ,QAAQ;QACJ,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;IACzC,CAAC;IAGD,yBAAyB,CAAmB,YAAoB;QAC5D,OAAO,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACtE,CAAC;IAED,0FAA0F;IAC1F,0FAA0F;IAI1F,QAAQ,CAAS,IAAa;QAC1B,MAAM,KAAK,GAAG,IAAA,6BAAe,EAAC,uCAAyB,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAKK,AAAN,KAAK,CAAC,SAAS,CAAU,KAAc,EAAS,GAAa;QACzD,MAAM,KAAK,GAAG,IAAA,6BAAe,EAAC,kCAAoB,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC9E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;IAKD,oBAAoB,CAAyB,YAAqB;QAC9D,MAAM,KAAK,GAAG,IAAA,6BAAe,EAAC,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAED,qFAAqF;IACrF,wBAAwB;IAKxB,KAAK,CAAS,IAAa;QACvB,MAAM,KAAK,GAAG,IAAA,6BAAe,EAAC,8BAAgB,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAMD,MAAM,CAAS,IAAa;QACxB,uFAAuF;QACvF,0EAA0E;QAC1E,MAAM,KAAK,GAAI,IAA+C,aAA/C,IAAI,uBAAJ,IAAI,CAA6C,KAAK,CAAC;QACtE,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnF,CAAC;CACJ,CAAA;AAhEY,gDAAkB;AAO3B;IADC,IAAA,YAAG,EAAC,wCAAwC,CAAC;;;;kDAG7C;AAGD;IADC,IAAA,YAAG,EAAC,mDAAmD,CAAC;IAC9B,WAAA,IAAA,cAAK,EAAC,SAAS,CAAC,CAAA;;;;mEAE1C;AAOD;IAHC,IAAA,aAAI,EAAC,qCAAoB,CAAC,QAAQ,CAAC;IACnC,IAAA,eAAM,EAAC,eAAe,EAAE,UAAU,CAAC;IACnC,IAAA,eAAM,EAAC,QAAQ,EAAE,UAAU,CAAC;IACnB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;kDAGf;AAKK;IAHL,IAAA,YAAG,EAAC,qCAAoB,CAAC,SAAS,CAAC;IACnC,IAAA,eAAM,EAAC,eAAe,EAAE,UAAU,CAAC;IACnC,IAAA,eAAM,EAAC,QAAQ,EAAE,UAAU,CAAC;IACZ,WAAA,IAAA,cAAK,GAAE,CAAA;IAAkB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;mDAI9C;AAKD;IAHC,IAAA,YAAG,EAAC,qCAAoB,CAAC,oBAAoB,CAAC;IAC9C,IAAA,eAAM,EAAC,eAAe,EAAE,UAAU,CAAC;IACnC,IAAA,eAAM,EAAC,QAAQ,EAAE,UAAU,CAAC;IACP,WAAA,IAAA,cAAK,EAAC,eAAe,CAAC,CAAA;;;;8DAG3C;AAQD;IAJC,IAAA,aAAI,EAAC,qCAAoB,CAAC,KAAK,CAAC;IAChC,IAAA,iBAAQ,EAAC,GAAG,CAAC;IACb,IAAA,eAAM,EAAC,eAAe,EAAE,UAAU,CAAC;IACnC,IAAA,eAAM,EAAC,QAAQ,EAAE,UAAU,CAAC;IACtB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;+CAGZ;AAMD;IAJC,IAAA,aAAI,EAAC,qCAAoB,CAAC,MAAM,CAAC;IACjC,IAAA,iBAAQ,EAAC,GAAG,CAAC;IACb,IAAA,eAAM,EAAC,eAAe,EAAE,UAAU,CAAC;IACnC,IAAA,eAAM,EAAC,QAAQ,EAAE,UAAU,CAAC;IACrB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;gDAKb;6BA/DQ,kBAAkB;IAH9B,IAAA,kBAAS,EAAC,mDAAsB,CAAC;IACjC,IAAA,mBAAU,EAAC,IAAI,6DAAgC,EAAE,EAAE,IAAI,qCAAuB,EAAE,CAAC;IACjF,IAAA,mBAAU,GAAE;qCAG0B,+BAAe;QACd,gDAAuB;GAHlD,kBAAkB,CAgE9B"}

package/lib/oauth/oauth.service.d.ts

@@ -0,0 +1,69 @@
+import { ChannelService, I18nRequest, ID, RequestContext, RequestContextService, SessionService, TransactionalConnection, UserService } from '@vendure/core';
+import { McpToolset } from '@vendure/mcp-sdk';
+import { McpOauthGrant } from '../entities/mcp-oauth-grant.entity';
+import { McpAuthenticatedContext, ResolvedMcpPluginOptions } from '../internal-types';
+import { McpCimdClientResolverService } from './cimd/cimd-client-resolver.service';
+import { McpGrantSessionService } from './grant-session.service';
+import { McpOauthMetadataService } from './oauth-metadata.service';
+import { AuthorizationRequestInfo, AuthorizeInput, OAuthTokenResponse, RegisterClientInput, RegisteredClientResponse, TokenInput } from './oauth-types';
+/** Each MCP grant is backed by its own Vendure session, kept isolated so the underlying session token is never exposed to a client. */
+export declare class McpOauthService {
+    private readonly connection;
+    private readonly requestContextService;
+    private readonly sessionService;
+    private readonly channelService;
+    private readonly userService;
+    private readonly options;
+    private readonly cimdClientResolver;
+    private readonly grantSessions;
+    private readonly oauthMetadata;
+    private cachedHashKey;
+    constructor(connection: TransactionalConnection, requestContextService: RequestContextService, sessionService: SessionService, channelService: ChannelService, userService: UserService, options: ResolvedMcpPluginOptions, cimdClientResolver: McpCimdClientResolverService, grantSessions: McpGrantSessionService, oauthMetadata: McpOauthMetadataService);
+    registerClient(input: RegisterClientInput): Promise<RegisteredClientResponse>;
+    createAuthorizationRedirect(input: AuthorizeInput): Promise<string>;
+    getAuthorizationRequestInfo(requestToken: string | undefined): Promise<AuthorizationRequestInfo>;
+    approveAdminRequest(ctx: RequestContext, requestToken: string, approved: boolean): Promise<{
+        redirectUrl: string;
+    }>;
+    /** Called from the Shop API, so `ctx` already identifies the customer and channel. */
+    approveCustomerRequest(ctx: RequestContext, requestToken: string, approved: boolean): Promise<{
+        redirectUrl: string;
+    }>;
+    private assertNotAnAdministrator;
+    exchangeToken(input: TokenInput): Promise<OAuthTokenResponse>;
+    revoke(token: string | undefined): Promise<Record<string, never>>;
+    revokeGrantById(ctx: RequestContext, grantId: ID): Promise<boolean>;
+    /** No channel filter: consent belongs to the person, not the storefront it was given on, so a customer sees every grant regardless of channel. */
+    listCustomerGrants(ctx: RequestContext): Promise<McpOauthGrant[]>;
+    /** Uses the same error for an unknown grant and one owned by someone else, so a caller can't tell the two apart. */
+    revokeCustomerGrant(ctx: RequestContext, grantId: ID): Promise<boolean>;
+    authenticateBearerToken(token: string, apiType: McpToolset, req?: I18nRequest): Promise<McpAuthenticatedContext>;
+    private usableGrant;
+    /** Runs in the background so the request doesn't wait on it; mirrors how core updates `ApiKey.lastUsedAt`. */
+    private touchGrantActivity;
+    /** Raw-selects the session token via LEFT JOIN rather than a relation, so a missing session doesn't hide an otherwise-live grant. */
+    private findGrantAndSessionToken;
+    /** Checks the toolset matches, so a code requested for one API can't be used to spoof a token for the other. */
+    private consumeAuthorizationRequest;
+    private denyAuthorizationRequest;
+    /** Runs both writes in one transaction so a failure midway can't leave the client with a broken redirect. */
+    private approveAuthorizationRequest;
+    private exchangeAuthorizationCode;
+    private exchangeRefreshToken;
+    private issueTokenPair;
+    private tokenResponse;
+    private findClient;
+    private findActiveAuthorizationRequest;
+    private createAdminCtx;
+    /** Expects the Vendure server's own origin, since Vendure serves the admin consent page itself. */
+    private assertConsentRequestOrigin;
+    /** Expects the merchant's storefront consent page origin; a server-rendered page with no `Origin` header is allowed through. */
+    private assertStorefrontConsentOrigin;
+    /** Blocks a cross-site request from riding a signed-in user's session, by requiring the `Origin` header to match when the browser sends one. */
+    private assertOriginMatches;
+    /** See {@link resolvedOauthOptions}. */
+    private resolvedOauth;
+    /** Derived once and cached, since re-deriving the key for every hash would be expensive. */
+    private getHashKey;
+    private hashLookup;
+}