mcp

listify-api/src/auth/auth.service.ts

@@ -8,13 +8,7 @@ import {
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { JwtService } from '@nestjs/jwt';
 import { InjectRepository } from '@nestjs/typeorm';
-import {
-  createHash,
-  randomBytes,
-  randomUUID,
-  scryptSync,
-  timingSafeEqual,
-} from 'crypto';
+import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from 'crypto';
 import { Like, Repository } from 'typeorm';
 import { AuditLogService } from '../audit/audit-log.service';
 import { LoginDto } from './dto/login.dto';
@@ -25,8 +19,6 @@ import {
   AuthTokenResponse,
   AuthTokens,
   JwtTokenPayload,
-  McpApiKeyResponse,
-  McpApiKeyStatus,
   PublicUser,
   PublicUserSearchResult,
 } from './auth.types';
@@ -38,7 +30,6 @@ import { UserEntity } from './user.entity';
 export class AuthService {
   private readonly accessTokenExpiresIn = '7d';
   private readonly refreshTokenExpiresIn = '30d';
-  private readonly mcpApiKeyPrefix = 'lfy_mcp_';
   private readonly accessTokenSecret =
     process.env.JWT_ACCESS_SECRET ?? 'dev-access-secret';
   private readonly refreshTokenSecret =
@@ -281,35 +272,6 @@ export class AuthService {
     }
   }
 
-  async verifyMcpCredential(token: string): Promise<JwtTokenPayload> {
-    if (token.startsWith(this.mcpApiKeyPrefix)) {
-      return this.verifyMcpApiKey(token);
-    }
-
-    return this.verifyAccessToken(token);
-  }
-
-  async verifyMcpApiKey(apiKey: string): Promise<JwtTokenPayload> {
-    const apiKeyHash = this.hashApiKey(apiKey);
-    const user = await this.usersRepository.findOne({
-      where: { mcpApiKeyHash: apiKeyHash },
-    });
-
-    if (
-      !user ||
-      !user.verified ||
-      !this.apiKeyHashMatches(apiKey, apiKeyHash)
-    ) {
-      throw new UnauthorizedException('MCP API key is invalid.');
-    }
-
-    return {
-      sub: user.id,
-      email: user.email,
-      type: 'mcp_api_key',
-    };
-  }
-
   async getUserDisplayName(userId: string): Promise<string> {
     const user = await this.usersRepository.findOne({
       where: { id: userId },
@@ -334,57 +296,6 @@ export class AuthService {
     return this.toPublicUser(user);
   }
 
-  async getMcpApiKeyStatus(userId: string): Promise<McpApiKeyStatus> {
-    const user = await this.requireUser(userId);
-
-    return this.toMcpApiKeyStatus(user);
-  }
-
-  async createMcpApiKey(userId: string): Promise<McpApiKeyResponse> {
-    const user = await this.requireUser(userId);
-    const hadExistingKey = Boolean(user.mcpApiKeyHash);
-    const apiKey = `${this.mcpApiKeyPrefix}${randomBytes(32).toString('base64url')}`;
-    const createdAt = new Date();
-
-    user.mcpApiKeyHash = this.hashApiKey(apiKey);
-    user.mcpApiKeyCreatedAt = createdAt;
-
-    const savedUser = await this.usersRepository.save(user);
-
-    await this.auditLogService?.record({
-      actorUserId: savedUser.id,
-      actorEmail: savedUser.email,
-      action: 'user.mcp_api_key_created',
-      entityType: 'user',
-      entityId: savedUser.id,
-      metadata: { rotated: hadExistingKey },
-    });
-
-    return {
-      apiKey,
-      ...this.toMcpApiKeyStatus(savedUser),
-    };
-  }
-
-  async revokeMcpApiKey(userId: string): Promise<McpApiKeyStatus> {
-    const user = await this.requireUser(userId);
-
-    user.mcpApiKeyHash = null;
-    user.mcpApiKeyCreatedAt = null;
-
-    const savedUser = await this.usersRepository.save(user);
-
-    await this.auditLogService?.record({
-      actorUserId: savedUser.id,
-      actorEmail: savedUser.email,
-      action: 'user.mcp_api_key_revoked',
-      entityType: 'user',
-      entityId: savedUser.id,
-    });
-
-    return this.toMcpApiKeyStatus(savedUser);
-  }
-
   async searchUsers(
     actorUserId: string,
     query?: string,
@@ -448,18 +359,6 @@ export class AuthService {
     return this.toPublicUser(savedUser);
   }
 
-  private async requireUser(userId: string): Promise<UserEntity> {
-    const user = await this.usersRepository.findOne({
-      where: { id: userId },
-    });
-
-    if (!user) {
-      throw new UnauthorizedException('Authenticated user is required.');
-    }
-
-    return user;
-  }
-
   private normalizeEmail(email?: string): string {
     const normalizedEmail = email?.trim().toLowerCase();
 
@@ -580,20 +479,6 @@ export class AuthService {
     return this.passwordMatches(token, tokenHash);
   }
 
-  private hashApiKey(apiKey: string): string {
-    return createHash('sha256').update(apiKey).digest('hex');
-  }
-
-  private apiKeyHashMatches(apiKey: string, apiKeyHash: string): boolean {
-    const expectedHashBuffer = Buffer.from(apiKeyHash, 'hex');
-    const attemptedHashBuffer = Buffer.from(this.hashApiKey(apiKey), 'hex');
-
-    return (
-      expectedHashBuffer.length === attemptedHashBuffer.length &&
-      timingSafeEqual(expectedHashBuffer, attemptedHashBuffer)
-    );
-  }
-
   private createToken(): string {
     return randomBytes(32).toString('hex');
   }
@@ -612,10 +497,4 @@ export class AuthService {
       onboardingCompleted: user.onboardingCompleted === true,
     };
   }
-
-  private toMcpApiKeyStatus(user: UserEntity): McpApiKeyStatus {
-    return user.mcpApiKeyHash && user.mcpApiKeyCreatedAt
-      ? { createdAt: user.mcpApiKeyCreatedAt.toISOString() }
-      : {};
-  }
 }