Add a TikTok Shop Seller connector with its own shop authorization - #1523

Summary

Adds a TikTok Shop Seller catalog connector, as proposed in #1522. TikTok Shop does not use standard OAuth 2. The seller authorizes through a service_id link, TikTok redirects to the one Redirect URL set on the app, and the code is exchanged with a GET that carries the app key and secret. Calls send the token in an x-tts-access-token header and sign the path, the sorted query and the body with the app secret. Shop calls also need a shop_cipher. So this PR adds a token provider like the Shopee one (#1147) and an adapter that uses the existing query-signing options.

Cloud and self-hosted: both work the same way. The connector uses the seller's own TikTok Shop app (App key, App secret, Service ID), whose Redirect URL is <SERVER_URL>/api/tiktok-shop/callback, on Cloud https://cloud.anythingmcp.com/api/tiktok-shop/callback. TikTok only lets sellers with an assigned account manager register as seller developers, and the instructions say so. A public AnythingMCP app for Cloud is not part of this PR; the provider does not preclude it.

Changes

• TikTokShopTokenService (opt-in through authType: HMAC + authConfig.tokenProvider: "tiktok-shop"):
  • code exchange and refresh on auth.tiktok-shops.com; expiry is read from the Unix timestamps TikTok returns;
  • renewal starts within a day of expiry (tokens last 7 days), one renewal per connector, in process and under a Postgres advisory lock;
  • a refused refresh token, or an authorization period that has ended, marks the connector needs_reauth and sends one owner email;
  • the shop cipher is read from Get Authorized Shops. When several shops are authorized, the optional TIKTOK_SHOP_SHOP_ID (id, code or name) picks one, else the first is used.
• RestEngine:
  • sends the token header and the signed shop_cipher credential parameter, except on /authorization/, /seller/ and upload paths;
  • renews once and re-signs after 105002 or an invalid-token 36009004;
  • new opt-in signature.excludeMultipartBody signs multipart uploads without their body, as TikTok does. Existing HMAC adapters are unchanged; the Shopee pin spec now lists tiktok-shop among the query-signed adapters.
• /api/tiktok-shop/connectors/:id/authorize, /callback and /complete, on the same encrypted single-use attempt store. The user who started the flow is checked before it is consumed. US shops (TIKTOK_SHOP_MARKET=US) go to services.us.tiktokshop.com.
• Setup status needs_authorization, import probe skipped until authorized, egress hint for TikTok's IP allow-list error (36009033).
• Dashboard: Authorize card on the connector page, completion page and setup page routing; en/de/it strings.
• Adapter intl/tiktok-shop.json, 35 tools: authorized shops, orders (search, detail, price detail), products (search, detail, inventory), categories, attributes, rules, brands, warehouses, delivery options and carriers, packages, handover slots, shipping documents (label and packing slip), tracking, returns, cancellations, statements, order settlements, and an image upload from a link.
  • Installed switched off: ship package, mark package shipped, update tracking, create, full edit and partial edit of a product, stock update, price update, activate and deactivate.
  • errorWhen maps TikTok's code to 401, 403, 429 and 400.
• Logo, catalog regeneration, quoted counts (695), docs/tool-definition.md (the TikTok template, excludeMultipartBody, and a section on the two shop token providers).

Paths, versions and fields follow TikTok's API reference (Partner Center docs, API Reference pages). Each tool uses the version the current reference documents: for example Get Order Detail 202507, Search Products 202502, Edit and Partial Edit Product 202509, Search Returns and Cancellations 202602, Mark Package As Shipped 202610. Public SDKs and MCP servers were used only to cross-check paths; no code or text was copied.

Type

• Bug fix
• New feature
• Documentation
• Refactoring
• Performance improvement
• Other (describe below)

Testing

• Added/updated unit tests
• Tested manually (describe steps below)
• No tests needed (explain why)

New specs:

• tiktok-shop-token.service.spec.ts (18 tests): signature vectors, link building, classifiers, exchange, refresh, refusal, rate limit, expired authorization, lazy shop cipher, burst renewal.
• rest.engine.tiktok-shop.spec.ts (6 tests): signatures through the real engine against vectors computed independently with Python hmac; multipart upload; error in a 200 answer; renewal and retry.
• tiktok-shop-auth.controller.spec.ts (7 tests).
• intl/tiktok-shop.live.spec.ts (48 static tests: every tool's method, path, query, body and signature; the live block is gated by RUN_TIKTOK_SHOP_LIVE=1).

Not tested live: no Partner Center app or development shop was available. The live block is not run.

Commands and results:

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• All existing tests pass (npm test): one DB-backed baseline failure, see above
• This PR has a descriptive title

Related Issues

Closes #1522

Not verified against TikTok directly:

• The error codes TikTok returns when it refuses a refresh token. Any non-zero code is treated as a refusal except rate limits, internal errors, timeouts and app key or secret errors.
• Whether the 202610 Mark Package As Shipped schema (order_line_list + shipping_info_list) is live in every market.
• The Partner Center scope names quoted in the instructions.