@vendure/mcp-plugin 3.8.0-minor-bootstrap.0

package/lib/oauth/oauth.service.js

@@ -0,0 +1,650 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOauthService = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@vendure/core");
+const typeorm_1 = require("typeorm");
+const constants_1 = require("../constants");
+const mcp_authorization_code_entity_1 = require("../entities/mcp-authorization-code.entity");
+const mcp_authorization_request_entity_1 = require("../entities/mcp-authorization-request.entity");
+const mcp_oauth_client_entity_1 = require("../entities/mcp-oauth-client.entity");
+const mcp_oauth_grant_entity_1 = require("../entities/mcp-oauth-grant.entity");
+const get_language_code_1 = require("../get-language-code");
+const cimd_client_resolver_service_1 = require("./cimd/cimd-client-resolver.service");
+const cimd_url_1 = require("./cimd/cimd-url");
+const grant_session_service_1 = require("./grant-session.service");
+const oauth_error_1 = require("./oauth-error");
+const oauth_metadata_service_1 = require("./oauth-metadata.service");
+const oauth_utils_1 = require("./oauth-utils");
+const token_hash_1 = require("./token-hash");
+/** Each MCP grant is backed by its own Vendure session, kept isolated so the underlying session token is never exposed to a client. */
+let McpOauthService = class McpOauthService {
+    constructor(connection, requestContextService, sessionService, channelService, userService, options, cimdClientResolver, grantSessions, oauthMetadata) {
+        this.connection = connection;
+        this.requestContextService = requestContextService;
+        this.sessionService = sessionService;
+        this.channelService = channelService;
+        this.userService = userService;
+        this.options = options;
+        this.cimdClientResolver = cimdClientResolver;
+        this.grantSessions = grantSessions;
+        this.oauthMetadata = oauthMetadata;
+    }
+    async registerClient(input) {
+        var _a, _b, _c;
+        this.resolvedOauth(); // Refuses before any write when OAuth is not configured.
+        if (!input.client_name) {
+            throw new oauth_error_1.McpOauthError('invalid_client_metadata', 'client_name is required');
+        }
+        if (input.client_name.length > constants_1.MAX_CLIENT_METADATA_FIELD_LENGTH) {
+            throw new oauth_error_1.McpOauthError('invalid_client_metadata', `client_name must be at most ${constants_1.MAX_CLIENT_METADATA_FIELD_LENGTH} characters`);
+        }
+        if (!input.redirect_uris || input.redirect_uris.length === 0) {
+            throw new oauth_error_1.McpOauthError('invalid_redirect_uri', 'redirect_uris is required');
+        }
+        for (const redirectUri of input.redirect_uris) {
+            (0, oauth_utils_1.assertSafeRedirectUri)(redirectUri);
+        }
+        if (input.token_endpoint_auth_method && input.token_endpoint_auth_method !== 'none') {
+            throw new oauth_error_1.McpOauthError('invalid_client_metadata', 'token_endpoint_auth_method must be "none" — this server does not support client authentication');
+        }
+        if ((_a = input.grant_types) === null || _a === void 0 ? void 0 : _a.some(grantType => !constants_1.SUPPORTED_OAUTH_GRANT_TYPES.includes(grantType))) {
+            throw new oauth_error_1.McpOauthError('invalid_client_metadata', 'grant_types may only contain "authorization_code" and "refresh_token" — the only grants this server supports');
+        }
+        const ctx = await this.createAdminCtx();
+        const client = await this.connection.getRepository(ctx, mcp_oauth_client_entity_1.McpOauthClient).save(new mcp_oauth_client_entity_1.McpOauthClient({
+            clientId: (0, oauth_utils_1.randomToken)(),
+            clientName: input.client_name,
+            clientUri: (0, oauth_utils_1.httpsUrlOrNull)(input.client_uri),
+            logoUri: (0, oauth_utils_1.httpsUrlOrNull)(input.logo_uri),
+            redirectUris: input.redirect_uris,
+            grantTypes: (_b = input.grant_types) !== null && _b !== void 0 ? _b : [...constants_1.SUPPORTED_OAUTH_GRANT_TYPES],
+            tokenEndpointAuthMethod: (_c = input.token_endpoint_auth_method) !== null && _c !== void 0 ? _c : 'none',
+            cimdDocumentExpiresAt: null,
+            lastUsedAt: null,
+        }));
+        return Object.assign(Object.assign(Object.assign({ client_id: client.clientId, client_name: client.clientName }, (client.clientUri ? { client_uri: client.clientUri } : {})), (client.logoUri ? { logo_uri: client.logoUri } : {})), { redirect_uris: client.redirectUris, grant_types: client.grantTypes, token_endpoint_auth_method: client.tokenEndpointAuthMethod });
+    }
+    async createAuthorizationRedirect(input) {
+        var _a;
+        const oauth = this.resolvedOauth();
+        if (!input.client_id || !input.redirect_uri) {
+            throw new common_1.BadRequestException('client_id and redirect_uri are required');
+        }
+        const ctx = await this.createAdminCtx();
+        const client = await this.findClient(ctx, input.client_id);
+        if (!(0, oauth_utils_1.isRegisteredRedirectUri)(client.redirectUris, input.redirect_uri)) {
+            throw new common_1.BadRequestException('redirect_uri is not registered for client');
+        }
+        // Errors from here on are reported by redirecting to redirect_uri, since an HTTP error
+        // response would only reach the browser, not the client waiting on the redirect.
+        const redirectUri = input.redirect_uri;
+        const redirectError = (error, error_description) => (0, oauth_utils_1.appendOAuthParams)(redirectUri, {
+            error,
+            error_description,
+            state: input.state,
+        });
+        if (input.response_type !== 'code') {
+            return redirectError('unsupported_response_type', 'Only response_type=code is supported');
+        }
+        if (!input.code_challenge) {
+            return redirectError('invalid_request', 'code_challenge is required');
+        }
+        if (input.code_challenge_method !== 'S256') {
+            return redirectError('invalid_request', 'Only PKCE S256 is supported');
+        }
+        let resource;
+        let toolset;
+        try {
+            ({ resource, toolset } = this.oauthMetadata.resolveResource(input.resource));
+        }
+        catch (e) {
+            if (e instanceof oauth_error_1.McpOauthError) {
+                return redirectError(e.code, e.message);
+            }
+            throw e;
+        }
+        if (input.state && input.state.length > constants_1.MAX_OAUTH_STATE_LENGTH) {
+            return redirectError('invalid_request', `state must not exceed ${constants_1.MAX_OAUTH_STATE_LENGTH} characters`);
+        }
+        // RFC 7636 §4.2: a code_challenge is 43-128 characters.
+        if (input.code_challenge.length < 43 || input.code_challenge.length > 128) {
+            return redirectError('invalid_request', 'code_challenge must be between 43 and 128 characters (RFC 7636)');
+        }
+        let consentUrl;
+        if (toolset === 'admin') {
+            consentUrl = new URL(oauth.adminConsentPath, oauth.issuer);
+        }
+        else {
+            const storefrontConsentUrl = oauth.storefrontConsentUrl;
+            if (!storefrontConsentUrl) {
+                core_1.Logger.error('A customer authorization request was refused because oauth.storefrontConsentUrl is not set. ' +
+                    'Set it to your storefront consent page URL. Staff-only deployments do not need it.', constants_1.loggerCtx);
+                return redirectError('server_error', 'This store is not configured to authorize customer access.');
+            }
+            consentUrl = new URL(storefrontConsentUrl);
+        }
+        const requestTokenPlaintext = (0, oauth_utils_1.randomToken)();
+        await this.connection.getRepository(ctx, mcp_authorization_request_entity_1.McpAuthorizationRequest).save(new mcp_authorization_request_entity_1.McpAuthorizationRequest({
+            requestToken: this.hashLookup(requestTokenPlaintext),
+            oauthClient: client,
+            oauthClientId: client.id,
+            redirectUri,
+            state: (_a = input.state) !== null && _a !== void 0 ? _a : null,
+            codeChallenge: input.code_challenge,
+            toolset,
+            resource,
+            expiresAt: (0, oauth_utils_1.addSeconds)(new Date(), oauth.authorizationRequestTtlSeconds),
+        }));
+        consentUrl.searchParams.set('request_token', requestTokenPlaintext);
+        return consentUrl.toString();
+    }
+    async getAuthorizationRequestInfo(requestToken) {
+        if (!requestToken) {
+            throw new common_1.BadRequestException('request_token is required');
+        }
+        const ctx = await this.createAdminCtx();
+        const request = await this.findActiveAuthorizationRequest(requestToken, ctx);
+        const client = request.oauthClient;
+        return Object.assign(Object.assign(Object.assign({ client_id: client.clientId, 
+            // A URL client_id is one this server fetched a metadata document from; anything else
+            // is a token it issued at registration.
+            client_id_source: (0, cimd_url_1.isUrlClientId)(client.clientId) ? 'cimd' : 'dcr', client_name: client.clientName }, (client.clientUri ? { client_uri: client.clientUri } : {})), (client.logoUri ? { logo_uri: client.logoUri } : {})), { redirect_uri: request.redirectUri, resource: request.resource, toolset: request.toolset });
+    }
+    async approveAdminRequest(ctx, requestToken, approved) {
+        var _a, _b;
+        if (!ctx.activeUserId || !((_a = ctx.session) === null || _a === void 0 ? void 0 : _a.token)) {
+            throw new common_1.UnauthorizedException('Admin consent requires an authenticated administrator session');
+        }
+        if (!ctx.userHasPermissions([constants_1.mcpServerPermission.Update])) {
+            throw new common_1.ForbiddenException('Admin consent requires an administrator with the UpdateMcpServer permission');
+        }
+        this.assertConsentRequestOrigin(ctx);
+        if (!approved) {
+            return this.denyAuthorizationRequest(requestToken, 'admin');
+        }
+        return this.approveAuthorizationRequest(requestToken, 'admin', {
+            actorId: ctx.activeUserId,
+            actorType: 'admin',
+            channelId: (_b = ctx.channelId) !== null && _b !== void 0 ? _b : null,
+        });
+    }
+    /** Called from the Shop API, so `ctx` already identifies the customer and channel. */
+    async approveCustomerRequest(ctx, requestToken, approved) {
+        var _a;
+        if (!approved) {
+            return this.denyAuthorizationRequest(requestToken, 'shop');
+        }
+        if (!ctx.activeUserId) {
+            throw new common_1.UnauthorizedException('Approving requires a signed-in customer');
+        }
+        this.assertStorefrontConsentOrigin(ctx);
+        await this.assertNotAnAdministrator(ctx);
+        return this.approveAuthorizationRequest(requestToken, 'shop', {
+            actorId: ctx.activeUserId,
+            actorType: 'customer',
+            channelId: (_a = ctx.channelId) !== null && _a !== void 0 ? _a : null,
+        });
+    }
+    async assertNotAnAdministrator(ctx) {
+        const administrator = await this.connection
+            .getRepository(ctx, core_1.Administrator)
+            .findOne({ where: { user: { id: ctx.activeUserId } }, relations: ['user'] });
+        if (administrator) {
+            throw new common_1.ForbiddenException('Customer consent cannot be given by an administrator');
+        }
+    }
+    async exchangeToken(input) {
+        if (input.grant_type === 'authorization_code') {
+            return this.exchangeAuthorizationCode(input);
+        }
+        if (input.grant_type === 'refresh_token') {
+            return this.exchangeRefreshToken(input);
+        }
+        throw new oauth_error_1.McpOauthError('unsupported_grant_type', 'Unsupported grant_type');
+    }
+    async revoke(token) {
+        if (!token) {
+            return {};
+        }
+        const ctx = await this.createAdminCtx();
+        const hash = this.hashLookup(token);
+        // Revoking either token in the pair kills the whole grant (RFC 7009), and the previous
+        // refresh token counts too, since a client that lost its rotation response may still hold it.
+        const grant = await this.connection.getRepository(ctx, mcp_oauth_grant_entity_1.McpOauthGrant).findOne({
+            where: [
+                { accessTokenHash: hash },
+                { refreshTokenHash: hash },
+                { previousRefreshTokenHash: hash },
+            ],
+        });
+        if (grant) {
+            await this.grantSessions.revokeGrant(ctx, grant);
+        }
+        return {};
+    }
+    async revokeGrantById(ctx, grantId) {
+        const grant = await this.connection
+            .getRepository(ctx, mcp_oauth_grant_entity_1.McpOauthGrant)
+            .findOne({ where: { id: grantId } });
+        if (!grant) {
+            return false;
+        }
+        if (ctx.channelId != null &&
+            grant.channelId != null &&
+            !(0, core_1.idsAreEqual)(grant.channelId, ctx.channelId)) {
+            return false;
+        }
+        await this.grantSessions.revokeGrant(ctx, grant);
+        return true;
+    }
+    /** No channel filter: consent belongs to the person, not the storefront it was given on, so a customer sees every grant regardless of channel. */
+    async listCustomerGrants(ctx) {
+        if (!ctx.activeUserId) {
+            throw new common_1.UnauthorizedException('Listing MCP client grants requires a signed-in customer');
+        }
+        return this.connection.getRepository(ctx, mcp_oauth_grant_entity_1.McpOauthGrant).find({
+            where: {
+                actorId: ctx.activeUserId,
+                actorType: 'customer',
+                revokedAt: (0, typeorm_1.IsNull)(),
+                expiresAt: (0, typeorm_1.MoreThan)(new Date()),
+            },
+            relations: ['oauthClient'],
+            order: { lastActivityAt: 'DESC' },
+        });
+    }
+    /** Uses the same error for an unknown grant and one owned by someone else, so a caller can't tell the two apart. */
+    async revokeCustomerGrant(ctx, grantId) {
+        if (!ctx.activeUserId) {
+            throw new common_1.UnauthorizedException('Revoking an MCP client grant requires a signed-in customer');
+        }
+        const grant = await this.connection
+            .getRepository(ctx, mcp_oauth_grant_entity_1.McpOauthGrant)
+            .findOne({ where: { id: grantId } });
+        if ((grant === null || grant === void 0 ? void 0 : grant.actorType) !== 'customer' || !(0, core_1.idsAreEqual)(grant.actorId, ctx.activeUserId)) {
+            throw new core_1.EntityNotFoundError('McpOauthGrant', grantId);
+        }
+        await this.grantSessions.revokeGrant(ctx, grant);
+        return true;
+    }
+    async authenticateBearerToken(token, apiType, req) {
+        const adminCtx = await this.createAdminCtx();
+        const resolved = this.usableGrant(await this.findGrantAndSessionToken(adminCtx, token), apiType);
+        const { grant } = resolved;
+        let vendureSession = resolved.sessionToken
+            ? await this.sessionService.getSessionFromToken(resolved.sessionToken)
+            : undefined;
+        if (!vendureSession) {
+            const user = await this.userService.getUserById(adminCtx, grant.actorId);
+            if (!user || user.deletedAt) {
+                await this.grantSessions.revokeGrant(adminCtx, grant);
+                throw new common_1.UnauthorizedException('Vendure user no longer exists');
+            }
+            vendureSession = await this.grantSessions.recreateGrantSession(adminCtx, grant, user);
+        }
+        const channel = grant.channelId
+            ? await this.channelService.findOne(adminCtx, grant.channelId)
+            : await this.channelService.getDefaultChannel(adminCtx);
+        if (!channel) {
+            await this.grantSessions.revokeGrant(adminCtx, grant);
+            throw new common_1.UnauthorizedException('Channel no longer exists');
+        }
+        const ctx = new core_1.RequestContext({
+            apiType,
+            channel,
+            languageCode: (0, get_language_code_1.getLanguageCodeFromQuery)(req),
+            session: vendureSession,
+            isAuthorized: true,
+            authorizedAsOwnerOnly: false,
+            req,
+            translationFn: req === null || req === void 0 ? void 0 : req.t,
+        });
+        this.touchGrantActivity(adminCtx, grant);
+        return { ctx, grant };
+    }
+    usableGrant(resolved, apiType) {
+        if (!resolved) {
+            throw new common_1.UnauthorizedException('Invalid or expired access token');
+        }
+        const { grant } = resolved;
+        if (grant.revokedAt) {
+            throw new common_1.UnauthorizedException('Access token revoked');
+        }
+        if (grant.accessTokenExpiresAt <= new Date()) {
+            throw new oauth_error_1.McpAccessTokenExpiredError();
+        }
+        if ((apiType === 'admin' && grant.actorType !== 'admin') ||
+            (apiType === 'shop' && grant.actorType !== 'customer')) {
+            throw new common_1.UnauthorizedException('Access token does not allow this MCP endpoint');
+        }
+        if (grant.resource !== this.oauthMetadata.resourceForToolset(apiType)) {
+            throw new common_1.UnauthorizedException('Access token was not issued for this MCP resource');
+        }
+        if (grant.expiresAt <= new Date()) {
+            throw new common_1.UnauthorizedException('MCP grant is expired');
+        }
+        return resolved;
+    }
+    /** Runs in the background so the request doesn't wait on it; mirrors how core updates `ApiKey.lastUsedAt`. */
+    touchGrantActivity(ctx, grant) {
+        const staleBefore = new Date(Date.now() - constants_1.MCP_GRANT_ACTIVITY_UPDATE_INTERVAL_MS);
+        if (!grant.lastActivityAt || grant.lastActivityAt < staleBefore) {
+            this.connection
+                .getRepository(ctx, mcp_oauth_grant_entity_1.McpOauthGrant)
+                .update({ id: grant.id }, { lastActivityAt: new Date() })
+                .catch(err => core_1.Logger.error(`Failed to update lastActivityAt for MCP grant ${String(grant.id)}`, constants_1.loggerCtx, err === null || err === void 0 ? void 0 : err.stack));
+        }
+    }
+    /** Raw-selects the session token via LEFT JOIN rather than a relation, so a missing session doesn't hide an otherwise-live grant. */
+    async findGrantAndSessionToken(ctx, accessToken) {
+        var _a, _b;
+        const result = await this.connection
+            .getRepository(ctx, mcp_oauth_grant_entity_1.McpOauthGrant)
+            .createQueryBuilder('grant')
+            .leftJoinAndSelect('grant.oauthClient', 'oauthClient')
+            .leftJoin(core_1.Session, 'vendureSession', 'vendureSession.id = grant.vendureSessionId')
+            .addSelect('vendureSession.token', 'vendureSessionToken')
+            .where('grant.accessTokenHash = :accessTokenHash', {
+            accessTokenHash: this.hashLookup(accessToken),
+        })
+            .getRawAndEntities();
+        const grant = result.entities[0];
+        return grant ? { grant, sessionToken: (_b = (_a = result.raw[0]) === null || _a === void 0 ? void 0 : _a.vendureSessionToken) !== null && _b !== void 0 ? _b : null } : undefined;
+    }
+    /** Checks the toolset matches, so a code requested for one API can't be used to spoof a token for the other. */
+    async consumeAuthorizationRequest(requestToken, expectedToolset, existingCtx) {
+        const ctx = existingCtx !== null && existingCtx !== void 0 ? existingCtx : (await this.createAdminCtx());
+        const request = await this.findActiveAuthorizationRequest(requestToken, ctx);
+        if (request.toolset !== expectedToolset) {
+            throw new common_1.BadRequestException('Authorization request invalid or expired');
+        }
+        const claim = await this.connection
+            .getRepository(ctx, mcp_authorization_request_entity_1.McpAuthorizationRequest)
+            .createQueryBuilder()
+            .delete()
+            .where('requestToken = :requestToken', { requestToken: this.hashLookup(requestToken) })
+            .execute();
+        if (!claim.affected) {
+            throw new common_1.BadRequestException('Authorization request invalid or expired');
+        }
+        return request;
+    }
+    async denyAuthorizationRequest(requestToken, expectedToolset) {
+        var _a;
+        const request = await this.consumeAuthorizationRequest(requestToken, expectedToolset);
+        return {
+            redirectUrl: (0, oauth_utils_1.appendOAuthParams)(request.redirectUri, {
+                error: 'access_denied',
+                state: (_a = request.state) !== null && _a !== void 0 ? _a : undefined,
+            }),
+        };
+    }
+    /** Runs both writes in one transaction so a failure midway can't leave the client with a broken redirect. */
+    async approveAuthorizationRequest(requestToken, expectedToolset, approver) {
+        var _a;
+        const ctx = await this.createAdminCtx();
+        const { actorId, actorType, channelId } = approver;
+        const codePlaintext = (0, oauth_utils_1.randomToken)();
+        const consented = await this.connection.withTransaction(ctx, async (txCtx) => {
+            const request = await this.consumeAuthorizationRequest(requestToken, expectedToolset, txCtx);
+            await this.connection.getRepository(txCtx, mcp_authorization_code_entity_1.McpAuthorizationCode).save(new mcp_authorization_code_entity_1.McpAuthorizationCode({
+                code: this.hashLookup(codePlaintext),
+                oauthClient: request.oauthClient,
+                oauthClientId: request.oauthClientId,
+                actorId,
+                actorType,
+                redirectUri: request.redirectUri,
+                resource: request.resource,
+                codeChallenge: request.codeChallenge,
+                channelId,
+                expiresAt: (0, oauth_utils_1.addSeconds)(new Date(), this.resolvedOauth().authorizationCodeTtlSeconds),
+            }));
+            return { redirectUri: request.redirectUri, state: request.state };
+        });
+        return {
+            redirectUrl: (0, oauth_utils_1.appendOAuthParams)(consented.redirectUri, {
+                code: codePlaintext,
+                state: (_a = consented.state) !== null && _a !== void 0 ? _a : undefined,
+            }),
+        };
+    }
+    async exchangeAuthorizationCode(input) {
+        if (!input.code ||
+            !input.client_id ||
+            !input.redirect_uri ||
+            !input.code_verifier ||
+            !input.resource) {
+            throw new oauth_error_1.McpOauthError('invalid_request', 'code, client_id, redirect_uri, code_verifier and resource are required');
+        }
+        const { resource } = this.oauthMetadata.resolveResource(input.resource);
+        const ctx = await this.createAdminCtx();
+        const codeRepo = this.connection.getRepository(ctx, mcp_authorization_code_entity_1.McpAuthorizationCode);
+        const codeHash = this.hashLookup(input.code);
+        const code = await codeRepo.findOne({
+            where: { code: codeHash },
+            relations: ['oauthClient'],
+        });
+        if (!code || code.expiresAt <= new Date()) {
+            throw new oauth_error_1.McpOauthError('invalid_grant', 'Authorization code invalid or expired');
+        }
+        if (code.oauthClient.clientId !== input.client_id || code.redirectUri !== input.redirect_uri) {
+            throw new oauth_error_1.McpOauthError('invalid_grant', 'Authorization code does not match client or redirect_uri');
+        }
+        if (code.resource !== resource) {
+            throw new oauth_error_1.McpOauthError('invalid_grant', 'Authorization code does not match token request resource');
+        }
+        if (!(0, oauth_utils_1.verifyPkceChallenge)(input.code_verifier, code.codeChallenge)) {
+            throw new oauth_error_1.McpOauthError('invalid_grant', 'Invalid PKCE verifier');
+        }
+        // One transaction: otherwise a failure between claiming the code and issuing tokens would
+        // burn the client's one exchange attempt and orphan the session just created.
+        return this.connection.withTransaction(ctx, async (txCtx) => {
+            const claim = await this.connection
+                .getRepository(txCtx, mcp_authorization_code_entity_1.McpAuthorizationCode)
+                .createQueryBuilder()
+                .delete()
+                .where('code = :code', { code: codeHash })
+                .execute();
+            if (!claim.affected) {
+                throw new oauth_error_1.McpOauthError('invalid_grant', 'Authorization code invalid or expired');
+            }
+            return this.issueTokenPair(txCtx, code.oauthClient, code.actorId, code.actorType, code.resource, code.channelId);
+        });
+    }
+    async exchangeRefreshToken(input) {
+        const oauth = this.resolvedOauth();
+        if (!input.refresh_token || !input.client_id) {
+            throw new oauth_error_1.McpOauthError('invalid_request', 'refresh_token and client_id are required');
+        }
+        const ctx = await this.createAdminCtx();
+        const grantRepo = this.connection.getRepository(ctx, mcp_oauth_grant_entity_1.McpOauthGrant);
+        const refreshTokenHash = this.hashLookup(input.refresh_token);
+        const grant = await grantRepo.findOne({
+            where: { refreshTokenHash },
+            relations: ['oauthClient'],
+        });
+        if (!grant) {
+            const reused = await grantRepo.findOne({
+                where: { previousRefreshTokenHash: refreshTokenHash },
+            });
+            if (reused) {
+                await this.grantSessions.revokeGrant(ctx, reused);
+            }
+            throw new oauth_error_1.McpOauthError('invalid_grant', 'Refresh token invalid or expired');
+        }
+        if (grant.revokedAt || grant.expiresAt <= new Date()) {
+            throw new oauth_error_1.McpOauthError('invalid_grant', 'Refresh token invalid or expired');
+        }
+        if (grant.oauthClient.clientId !== input.client_id) {
+            throw new oauth_error_1.McpOauthError('invalid_grant', 'Refresh token does not match client');
+        }
+        // RFC 8707 asks a client to name the resource on a refresh but does not require it, so a
+        // request that leaves it out is refreshing for the resource the grant already names.
+        if (input.resource) {
+            const { resource } = this.oauthMetadata.resolveResource(input.resource);
+            if (grant.resource !== resource) {
+                throw new oauth_error_1.McpOauthError('invalid_grant', 'Refresh token does not match token request resource');
+            }
+        }
+        const now = new Date();
+        const accessPlaintext = (0, oauth_utils_1.randomToken)();
+        const refreshPlaintext = (0, oauth_utils_1.randomToken)();
+        await this.connection.withTransaction(ctx, async (txCtx) => {
+            // If two requests race to rotate the same refresh token, only one UPDATE matches and
+            // the other is rejected; the old hash is kept so replaying it is recognized as reuse.
+            const claim = await this.connection
+                .getRepository(txCtx, mcp_oauth_grant_entity_1.McpOauthGrant)
+                .createQueryBuilder()
+                .update(mcp_oauth_grant_entity_1.McpOauthGrant)
+                .set({
+                accessTokenHash: this.hashLookup(accessPlaintext),
+                refreshTokenHash: this.hashLookup(refreshPlaintext),
+                previousRefreshTokenHash: refreshTokenHash,
+                accessTokenExpiresAt: (0, oauth_utils_1.addSeconds)(now, oauth.accessTokenTtlSeconds),
+                expiresAt: (0, oauth_utils_1.addSeconds)(now, oauth.refreshTokenTtlSeconds),
+                lastActivityAt: now,
+            })
+                .where('id = :id', { id: grant.id })
+                .andWhere('refreshTokenHash = :refreshTokenHash', { refreshTokenHash })
+                .andWhere('revokedAt IS NULL')
+                .execute();
+            if (!claim.affected) {
+                throw new oauth_error_1.McpOauthError('invalid_grant', 'Refresh token invalid or expired');
+            }
+            await this.connection
+                .getRepository(txCtx, mcp_oauth_client_entity_1.McpOauthClient)
+                .update({ id: grant.oauthClientId }, { lastUsedAt: now });
+        });
+        return this.tokenResponse(accessPlaintext, refreshPlaintext);
+    }
+    async issueTokenPair(ctx, client, actorId, actorType, resource, channelId) {
+        const oauth = this.resolvedOauth();
+        // Checked here too (not just on session re-creation) because `getUserById` returns
+        // soft-deleted users, and a code can outlive the account that approved it.
+        const user = await this.userService.getUserById(ctx, actorId);
+        if (!user || user.deletedAt) {
+            throw new oauth_error_1.McpOauthError('invalid_grant', 'Vendure user no longer exists');
+        }
+        const now = new Date();
+        const accessPlaintext = (0, oauth_utils_1.randomToken)();
+        const refreshPlaintext = (0, oauth_utils_1.randomToken)();
+        const createdSession = await this.grantSessions.createVendureSession(ctx, user);
+        await this.connection.getRepository(ctx, mcp_oauth_grant_entity_1.McpOauthGrant).save(new mcp_oauth_grant_entity_1.McpOauthGrant({
+            accessTokenHash: this.hashLookup(accessPlaintext),
+            refreshTokenHash: this.hashLookup(refreshPlaintext),
+            previousRefreshTokenHash: null,
+            oauthClient: client,
+            oauthClientId: client.id,
+            actorId,
+            actorType,
+            resource,
+            accessTokenExpiresAt: (0, oauth_utils_1.addSeconds)(now, oauth.accessTokenTtlSeconds),
+            expiresAt: (0, oauth_utils_1.addSeconds)(now, oauth.refreshTokenTtlSeconds),
+            revokedAt: null,
+            vendureSessionId: createdSession.id,
+            channelId,
+            lastActivityAt: now,
+        }));
+        await this.connection
+            .getRepository(ctx, mcp_oauth_client_entity_1.McpOauthClient)
+            .update({ id: client.id }, { lastUsedAt: now });
+        return this.tokenResponse(accessPlaintext, refreshPlaintext);
+    }
+    tokenResponse(accessPlaintext, refreshPlaintext) {
+        return {
+            access_token: accessPlaintext,
+            refresh_token: refreshPlaintext,
+            token_type: 'Bearer',
+            expires_in: this.resolvedOauth().accessTokenTtlSeconds,
+        };
+    }
+    async findClient(ctx, clientId) {
+        if ((0, cimd_url_1.isUrlClientId)(clientId)) {
+            return this.cimdClientResolver.resolveClient(ctx, clientId);
+        }
+        const client = await this.connection.getRepository(ctx, mcp_oauth_client_entity_1.McpOauthClient).findOne({
+            where: { clientId },
+        });
+        if (!client) {
+            throw new common_1.BadRequestException('Unknown OAuth client');
+        }
+        return client;
+    }
+    async findActiveAuthorizationRequest(requestToken, ctx) {
+        const request = await this.connection.getRepository(ctx, mcp_authorization_request_entity_1.McpAuthorizationRequest).findOne({
+            where: { requestToken: this.hashLookup(requestToken) },
+            relations: ['oauthClient'],
+        });
+        if (!request || request.expiresAt <= new Date()) {
+            throw new common_1.BadRequestException('Authorization request invalid or expired');
+        }
+        return request;
+    }
+    createAdminCtx() {
+        return this.requestContextService.create({ apiType: 'admin' });
+    }
+    /** Expects the Vendure server's own origin, since Vendure serves the admin consent page itself. */
+    assertConsentRequestOrigin(ctx) {
+        this.assertOriginMatches(ctx, new URL(this.resolvedOauth().issuer).origin, 'Admin consent must be submitted from the Vendure consent page');
+    }
+    /** Expects the merchant's storefront consent page origin; a server-rendered page with no `Origin` header is allowed through. */
+    assertStorefrontConsentOrigin(ctx) {
+        const consentUrl = this.resolvedOauth().storefrontConsentUrl;
+        if (!consentUrl) {
+            throw new common_1.ForbiddenException('Customer consent requires oauth.storefrontConsentUrl to be configured');
+        }
+        this.assertOriginMatches(ctx, new URL(consentUrl).origin, 'Customer consent must be submitted from your consent page');
+    }
+    /** Blocks a cross-site request from riding a signed-in user's session, by requiring the `Origin` header to match when the browser sends one. */
+    assertOriginMatches(ctx, expectedOrigin, message) {
+        var _a, _b;
+        const rawOrigin = (_b = (_a = ctx.req) === null || _a === void 0 ? void 0 : _a.headers) === null || _b === void 0 ? void 0 : _b.origin;
+        const originHeader = Array.isArray(rawOrigin) ? rawOrigin[0] : rawOrigin;
+        if (!originHeader) {
+            return;
+        }
+        if (originHeader !== expectedOrigin) {
+            throw new common_1.ForbiddenException(message);
+        }
+    }
+    /** See {@link resolvedOauthOptions}. */
+    resolvedOauth() {
+        return (0, oauth_utils_1.resolvedOauthOptions)(this.options);
+    }
+    /** Derived once and cached, since re-deriving the key for every hash would be expensive. */
+    getHashKey() {
+        if (!this.cachedHashKey) {
+            this.cachedHashKey = (0, token_hash_1.deriveHashKey)(this.resolvedOauth().tokenSecret);
+        }
+        return this.cachedHashKey;
+    }
+    hashLookup(value) {
+        return (0, token_hash_1.hashLookupToken)(value, this.getHashKey());
+    }
+};
+exports.McpOauthService = McpOauthService;
+exports.McpOauthService = McpOauthService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(5, (0, common_1.Inject)(constants_1.MCP_PLUGIN_OPTIONS)),
+    __metadata("design:paramtypes", [core_1.TransactionalConnection,
+        core_1.RequestContextService,
+        core_1.SessionService,
+        core_1.ChannelService,
+        core_1.UserService, Object, cimd_client_resolver_service_1.McpCimdClientResolverService,
+        grant_session_service_1.McpGrantSessionService,
+        oauth_metadata_service_1.McpOauthMetadataService])
+], McpOauthService);
+//# sourceMappingURL=oauth.service.js.map