@agentic-qe/v3 3.0.0-alpha.10

package/dist/mcp/security/index.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Agentic QE v3 - MCP Security Module
+ * Security features for MCP tools per ADR-012
+ *
+ * Components:
+ * - JSON Schema Validator: Validate all MCP tool inputs
+ * - Rate Limiter: Token bucket algorithm (100 req/s, 200 burst)
+ * - OAuth 2.1 Provider: OAuth 2.1 + PKCE for enterprise authentication
+ * - Sampling Server: Server-initiated LLM for AI-driven decisions
+ * - CVE Prevention: Path traversal, ReDoS, timing-safe comparison
+ */
+export { SchemaValidator, createSchemaValidator, createStrictSchemaValidator, getSchemaValidator, CommonSchemas, } from './schema-validator';
+export type { JSONSchema, JSONSchemaType, JSONSchemaFormat, ValidationError, ValidationResult, FormatValidator, SchemaValidatorConfig, } from './schema-validator';
+export { RateLimiter, SlidingWindowRateLimiter, createRateLimiter, createStrictRateLimiter, createSlidingWindowLimiter, getRateLimiter, resetDefaultRateLimiter, } from './rate-limiter';
+export type { RateLimiterConfig, TokenBucket, RateLimitResult, RateLimitHeaders, RateLimiterStats, EndpointRateLimit, } from './rate-limiter';
+export { OAuth21Provider, createOAuth21Provider, getOAuth21Provider, } from './oauth21-provider';
+export type { OAuth21GrantType, TokenType, PKCEMethod, OAuth21Client, AuthorizationRequest, AuthorizationCode, TokenRequest, TokenResponse, TokenData, TokenIntrospection, OAuthError, OAuthErrorCode, OAuth21ProviderConfig, } from './oauth21-provider';
+export { SamplingServer, createSamplingServer, getSamplingServer, QEDecisionPrompts, } from './sampling-server';
+export type { SamplingRequest, SamplingMessage, SamplingContent, SamplingResponse, TokenUsage, SamplingHandler, SamplingServerConfig, SamplingServerStats, } from './sampling-server';
+export { validatePath, normalizePath, joinPaths, getExtension, isRegexSafe, escapeRegex, createSafeRegex, timingSafeCompare, timingSafeHashCompare, generateSecureToken, secureHash, sanitizeInput, escapeHtml, stripHtmlTags, validateCommand, escapeShellArg, CVEPrevention, } from './cve-prevention';
+export type { PathValidationResult, PathValidationOptions, RegexSafetyResult, CommandValidationResult, SanitizationOptions, } from './cve-prevention';
+import { type JSONSchema } from './schema-validator';
+import { type RateLimiterConfig } from './rate-limiter';
+import { type OAuth21ProviderConfig } from './oauth21-provider';
+/**
+ * Security middleware configuration
+ */
+export interface SecurityMiddlewareConfig {
+    enableSchemaValidation?: boolean;
+    enableRateLimiting?: boolean;
+    enableOAuth?: boolean;
+    enableCVEPrevention?: boolean;
+    rateLimiter?: Partial<RateLimiterConfig>;
+    oauth?: Partial<OAuth21ProviderConfig>;
+}
+/**
+ * Security context for tool invocation
+ */
+export interface SecurityContext {
+    clientId?: string;
+    userId?: string;
+    scopes?: string[];
+    token?: string;
+    endpoint?: string;
+    ip?: string;
+}
+/**
+ * Security middleware result
+ */
+export interface SecurityCheckResult {
+    allowed: boolean;
+    errors: string[];
+    warnings: string[];
+    context?: SecurityContext;
+}
+/**
+ * Create security middleware for MCP tools
+ */
+export declare function createSecurityMiddleware(config?: SecurityMiddlewareConfig): {
+    /**
+     * Validate tool input against schema
+     */
+    validateInput<T>(input: unknown, schema: JSONSchema): {
+        valid: true;
+        data: T;
+    } | {
+        valid: false;
+        errors: string[];
+    };
+    /**
+     * Check rate limit
+     */
+    checkRateLimit(clientId?: string, endpoint?: string): import("./rate-limiter").RateLimitResult | {
+        allowed: boolean;
+        remaining: number;
+        headers: any;
+    };
+    /**
+     * Validate OAuth token
+     */
+    validateToken(token: string): {
+        valid: true;
+        data: import("./oauth21-provider").TokenData;
+    } | {
+        valid: false;
+        error: string;
+    } | {
+        valid: boolean;
+        data: null;
+    };
+    /**
+     * Validate file path for security
+     */
+    validateFilePath(path: string, basePath?: string): import("./cve-prevention").PathValidationResult;
+    /**
+     * Sanitize user input
+     */
+    sanitize(input: string): string;
+    /**
+     * Validate command for execution
+     */
+    validateShellCommand(command: string, allowedCommands?: string[]): import("./cve-prevention").CommandValidationResult;
+    /**
+     * Run all security checks
+     */
+    runSecurityChecks(context: SecurityContext, input?: unknown, schema?: JSONSchema): Promise<SecurityCheckResult>;
+    /**
+     * Dispose all security resources
+     */
+    dispose(): void;
+};
+/**
+ * Get the default security middleware
+ */
+export declare function getSecurityMiddleware(): ReturnType<typeof createSecurityMiddleware>;
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,kBAAkB,EAClB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,cAAc,EACd,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAEL,YAAY,EACZ,aAAa,EACb,SAAS,EACT,YAAY,EAGZ,WAAW,EACX,WAAW,EACX,eAAe,EAGf,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,UAAU,EAGV,aAAa,EACb,UAAU,EACV,aAAa,EAGb,eAAe,EACf,cAAc,EAGd,aAAa,GACd,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAyB,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGvF;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzC,KAAK,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,GAAE,wBAA6B;IAe1E;;OAEG;kBACW,CAAC,SAAS,OAAO,UAAU,UAAU,GAAG;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAgBnH;;OAEG;8BACuB,MAAM,aAAa,MAAM;;;iBAEa,GAAG;;IAMnE;;OAEG;yBACkB,MAAM;;;;;;;;;;IAQ3B;;OAEG;2BACoB,MAAM,aAAa,MAAM;IAQhD;;OAEG;oBACa,MAAM;IAQtB;;OAEG;kCAC2B,MAAM,oBAAoB,MAAM,EAAE;IAQhE;;OAEG;+BAEQ,eAAe,UAChB,OAAO,WACN,UAAU,GAClB,OAAO,CAAC,mBAAmB,CAAC;IAsC/B;;OAEG;;EAUN;AAOD;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAKnF"}

package/dist/mcp/security/index.js

@@ -0,0 +1,184 @@
+/**
+ * Agentic QE v3 - MCP Security Module
+ * Security features for MCP tools per ADR-012
+ *
+ * Components:
+ * - JSON Schema Validator: Validate all MCP tool inputs
+ * - Rate Limiter: Token bucket algorithm (100 req/s, 200 burst)
+ * - OAuth 2.1 Provider: OAuth 2.1 + PKCE for enterprise authentication
+ * - Sampling Server: Server-initiated LLM for AI-driven decisions
+ * - CVE Prevention: Path traversal, ReDoS, timing-safe comparison
+ */
+// ============================================================================
+// Schema Validator
+// ============================================================================
+export { SchemaValidator, createSchemaValidator, createStrictSchemaValidator, getSchemaValidator, CommonSchemas, } from './schema-validator';
+// ============================================================================
+// Rate Limiter
+// ============================================================================
+export { RateLimiter, SlidingWindowRateLimiter, createRateLimiter, createStrictRateLimiter, createSlidingWindowLimiter, getRateLimiter, resetDefaultRateLimiter, } from './rate-limiter';
+// ============================================================================
+// OAuth 2.1 Provider
+// ============================================================================
+export { OAuth21Provider, createOAuth21Provider, getOAuth21Provider, } from './oauth21-provider';
+// ============================================================================
+// Sampling Server
+// ============================================================================
+export { SamplingServer, createSamplingServer, getSamplingServer, QEDecisionPrompts, } from './sampling-server';
+// ============================================================================
+// CVE Prevention
+// ============================================================================
+export { 
+// Path traversal protection
+validatePath, normalizePath, joinPaths, getExtension, 
+// ReDoS prevention
+isRegexSafe, escapeRegex, createSafeRegex, 
+// Timing-safe comparison
+timingSafeCompare, timingSafeHashCompare, generateSecureToken, secureHash, 
+// Input sanitization
+sanitizeInput, escapeHtml, stripHtmlTags, 
+// Command injection prevention
+validateCommand, escapeShellArg, 
+// Utilities object
+CVEPrevention, } from './cve-prevention';
+// ============================================================================
+// Security Middleware Factory
+// ============================================================================
+import { createSchemaValidator } from './schema-validator';
+import { createRateLimiter } from './rate-limiter';
+import { createOAuth21Provider } from './oauth21-provider';
+import { validatePath, sanitizeInput, validateCommand } from './cve-prevention';
+/**
+ * Create security middleware for MCP tools
+ */
+export function createSecurityMiddleware(config = {}) {
+    const { enableSchemaValidation = true, enableRateLimiting = true, enableOAuth = false, enableCVEPrevention = true, rateLimiter: rateLimiterConfig, oauth: oauthConfig, } = config;
+    const schemaValidator = enableSchemaValidation ? createSchemaValidator() : null;
+    const rateLimiter = enableRateLimiting ? createRateLimiter(rateLimiterConfig) : null;
+    const oauthProvider = enableOAuth ? createOAuth21Provider(oauthConfig) : null;
+    return {
+        /**
+         * Validate tool input against schema
+         */
+        validateInput(input, schema) {
+            if (!schemaValidator) {
+                return { valid: true, data: input };
+            }
+            const result = schemaValidator.validate(input, schema);
+            if (result.valid) {
+                return { valid: true, data: input };
+            }
+            return {
+                valid: false,
+                errors: result.errors.map(e => `${e.path}: ${e.message}`),
+            };
+        },
+        /**
+         * Check rate limit
+         */
+        checkRateLimit(clientId, endpoint) {
+            if (!rateLimiter) {
+                return { allowed: true, remaining: Infinity, headers: {} };
+            }
+            return rateLimiter.check(clientId, endpoint);
+        },
+        /**
+         * Validate OAuth token
+         */
+        validateToken(token) {
+            if (!oauthProvider) {
+                return { valid: true, data: null };
+            }
+            return oauthProvider.validateAccessToken(token);
+        },
+        /**
+         * Validate file path for security
+         */
+        validateFilePath(path, basePath) {
+            if (!enableCVEPrevention) {
+                return { valid: true, normalizedPath: path, riskLevel: 'none' };
+            }
+            return validatePath(path, { basePath });
+        },
+        /**
+         * Sanitize user input
+         */
+        sanitize(input) {
+            if (!enableCVEPrevention) {
+                return input;
+            }
+            return sanitizeInput(input);
+        },
+        /**
+         * Validate command for execution
+         */
+        validateShellCommand(command, allowedCommands) {
+            if (!enableCVEPrevention) {
+                return { valid: true, sanitizedCommand: command, blockedPatterns: [] };
+            }
+            return validateCommand(command, allowedCommands);
+        },
+        /**
+         * Run all security checks
+         */
+        async runSecurityChecks(context, input, schema) {
+            const errors = [];
+            const warnings = [];
+            // Rate limit check
+            if (rateLimiter) {
+                const rateResult = rateLimiter.check(context.clientId, context.endpoint);
+                if (!rateResult.allowed) {
+                    errors.push(`Rate limit exceeded. Retry after ${rateResult.retryAfter}ms`);
+                }
+            }
+            // OAuth check
+            if (oauthProvider && context.token) {
+                const tokenResult = oauthProvider.validateAccessToken(context.token);
+                if (!tokenResult.valid) {
+                    errors.push(`Invalid token: ${tokenResult.error}`);
+                }
+            }
+            else if (oauthProvider && !context.token) {
+                warnings.push('No authentication token provided');
+            }
+            // Schema validation
+            if (schemaValidator && input && schema) {
+                const validationResult = schemaValidator.validate(input, schema);
+                if (!validationResult.valid) {
+                    errors.push(...validationResult.errors.map(e => `${e.path}: ${e.message}`));
+                }
+            }
+            return {
+                allowed: errors.length === 0,
+                errors,
+                warnings,
+                context,
+            };
+        },
+        /**
+         * Dispose all security resources
+         */
+        dispose() {
+            if (rateLimiter) {
+                rateLimiter.dispose();
+            }
+            if (oauthProvider) {
+                oauthProvider.dispose();
+            }
+        },
+    };
+}
+/**
+ * Default security middleware instance
+ */
+let defaultMiddleware = null;
+/**
+ * Get the default security middleware
+ */
+export function getSecurityMiddleware() {
+    if (!defaultMiddleware) {
+        defaultMiddleware = createSecurityMiddleware();
+    }
+    return defaultMiddleware;
+}
+//# sourceMappingURL=index.js.map

package/dist/mcp/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,kBAAkB,EAClB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAY5B,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,cAAc,EACd,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAWxB,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAkB5B,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAa3B,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,OAAO;AACL,4BAA4B;AAC5B,YAAY,EACZ,aAAa,EACb,SAAS,EACT,YAAY;AAEZ,mBAAmB;AACnB,WAAW,EACX,WAAW,EACX,eAAe;AAEf,yBAAyB;AACzB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,UAAU;AAEV,qBAAqB;AACrB,aAAa,EACb,UAAU,EACV,aAAa;AAEb,+BAA+B;AAC/B,eAAe,EACf,cAAc;AAEd,mBAAmB;AACnB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAU1B,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E,OAAO,EAAE,qBAAqB,EAAmB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAA0B,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAA8B,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAoChF;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAmC,EAAE;IAC5E,MAAM,EACJ,sBAAsB,GAAG,IAAI,EAC7B,kBAAkB,GAAG,IAAI,EACzB,WAAW,GAAG,KAAK,EACnB,mBAAmB,GAAG,IAAI,EAC1B,WAAW,EAAE,iBAAiB,EAC9B,KAAK,EAAE,WAAW,GACnB,GAAG,MAAM,CAAC;IAEX,MAAM,eAAe,GAAG,sBAAsB,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,WAAW,GAAG,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9E,OAAO;QACL;;WAEG;QACH,aAAa,CAAI,KAAc,EAAE,MAAkB;YACjD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAU,EAAE,CAAC;YAC3C,CAAC;YAED,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAU,EAAE,CAAC;YAC3C,CAAC;YAED,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC1D,CAAC;QACJ,CAAC;QAED;;WAEG;QACH,cAAc,CAAC,QAAiB,EAAE,QAAiB;YACjD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAS,EAAE,CAAC;YACpE,CAAC;YAED,OAAO,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAED;;WAEG;QACH,aAAa,CAAC,KAAa;YACzB,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;YAED,OAAO,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAED;;WAEG;QACH,gBAAgB,CAAC,IAAY,EAAE,QAAiB;YAC9C,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,MAAe,EAAE,CAAC;YAC3E,CAAC;YAED,OAAO,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED;;WAEG;QACH,QAAQ,CAAC,KAAa;YACpB,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED;;WAEG;QACH,oBAAoB,CAAC,OAAe,EAAE,eAA0B;YAC9D,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;YACzE,CAAC;YAED,OAAO,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACnD,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,iBAAiB,CACrB,OAAwB,EACxB,KAAe,EACf,MAAmB;YAEnB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;YAE9B,mBAAmB;YACnB,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACzE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC,oCAAoC,UAAU,CAAC,UAAU,IAAI,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YAED,cAAc;YACd,IAAI,aAAa,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAG,aAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACrE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;oBACvB,MAAM,CAAC,IAAI,CAAC,kBAAkB,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;iBAAM,IAAI,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACpD,CAAC;YAED,oBAAoB;YACpB,IAAI,eAAe,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;gBACvC,MAAM,gBAAgB,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACjE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;gBAC5B,MAAM;gBACN,QAAQ;gBACR,OAAO;aACR,CAAC;QACJ,CAAC;QAED;;WAEG;QACH,OAAO;YACL,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBAClB,aAAa,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,IAAI,iBAAiB,GAAuD,IAAI,CAAC;AAEjF;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,iBAAiB,GAAG,wBAAwB,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC"}

package/dist/mcp/security/oauth21-provider.d.ts

@@ -0,0 +1,229 @@
+/**
+ * Agentic QE v3 - MCP Security: OAuth 2.1 Provider
+ * OAuth 2.1 + PKCE implementation for enterprise authentication (ADR-012)
+ *
+ * Features:
+ * - OAuth 2.1 compliant (requires PKCE for all clients)
+ * - Authorization Code Flow with PKCE
+ * - Token management with refresh tokens
+ * - Scope-based authorization
+ * - Token introspection and revocation
+ */
+/**
+ * OAuth 2.1 Grant Types (subset of OAuth 2.0)
+ */
+export type OAuth21GrantType = 'authorization_code' | 'refresh_token' | 'client_credentials';
+/**
+ * Token types
+ */
+export type TokenType = 'access_token' | 'refresh_token';
+/**
+ * PKCE code challenge method
+ */
+export type PKCEMethod = 'S256' | 'plain';
+/**
+ * OAuth client configuration
+ */
+export interface OAuth21Client {
+    clientId: string;
+    clientSecret?: string;
+    redirectUris: string[];
+    allowedScopes: string[];
+    allowedGrantTypes: OAuth21GrantType[];
+    confidential: boolean;
+    requirePKCE: boolean;
+    accessTokenTTL: number;
+    refreshTokenTTL: number;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Authorization request parameters
+ */
+export interface AuthorizationRequest {
+    clientId: string;
+    redirectUri: string;
+    responseType: 'code';
+    scope: string;
+    state: string;
+    codeChallenge: string;
+    codeChallengeMethod: PKCEMethod;
+    nonce?: string;
+}
+/**
+ * Authorization code stored data
+ */
+export interface AuthorizationCode {
+    code: string;
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    userId: string;
+    codeChallenge: string;
+    codeChallengeMethod: PKCEMethod;
+    expiresAt: number;
+    nonce?: string;
+}
+/**
+ * Token request parameters
+ */
+export interface TokenRequest {
+    grantType: OAuth21GrantType;
+    clientId: string;
+    clientSecret?: string;
+    code?: string;
+    redirectUri?: string;
+    codeVerifier?: string;
+    refreshToken?: string;
+    scope?: string;
+}
+/**
+ * Token response
+ */
+export interface TokenResponse {
+    accessToken: string;
+    tokenType: 'Bearer';
+    expiresIn: number;
+    refreshToken?: string;
+    scope: string;
+}
+/**
+ * Token data stored
+ */
+export interface TokenData {
+    token: string;
+    tokenHash: string;
+    type: TokenType;
+    clientId: string;
+    userId?: string;
+    scope: string;
+    expiresAt: number;
+    issuedAt: number;
+    refreshTokenHash?: string;
+}
+/**
+ * Token introspection response
+ */
+export interface TokenIntrospection {
+    active: boolean;
+    scope?: string;
+    clientId?: string;
+    username?: string;
+    tokenType?: string;
+    exp?: number;
+    iat?: number;
+    sub?: string;
+}
+/**
+ * OAuth error response
+ */
+export interface OAuthError {
+    error: OAuthErrorCode;
+    errorDescription?: string;
+    errorUri?: string;
+}
+/**
+ * OAuth error codes
+ */
+export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope' | 'server_error' | 'access_denied';
+/**
+ * Provider configuration
+ */
+export interface OAuth21ProviderConfig {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    introspectionEndpoint?: string;
+    revocationEndpoint?: string;
+    defaultAccessTokenTTL: number;
+    defaultRefreshTokenTTL: number;
+    requirePKCE: boolean;
+    allowedScopes: string[];
+}
+/**
+ * OAuth 2.1 Provider with PKCE support
+ */
+export declare class OAuth21Provider {
+    private readonly config;
+    private readonly clients;
+    private readonly authorizationCodes;
+    private readonly tokens;
+    private readonly revokedTokens;
+    private cleanupTimer;
+    constructor(config: OAuth21ProviderConfig);
+    /**
+     * Register a new client
+     */
+    registerClient(client: OAuth21Client): void;
+    /**
+     * Get client by ID
+     */
+    getClient(clientId: string): OAuth21Client | undefined;
+    /**
+     * Remove a client
+     */
+    removeClient(clientId: string): boolean;
+    /**
+     * Validate authorization request and create authorization code
+     */
+    authorize(request: AuthorizationRequest, userId: string): {
+        code: string;
+        state: string;
+    };
+    /**
+     * Exchange authorization code or refresh token for tokens
+     */
+    token(request: TokenRequest): TokenResponse;
+    private handleAuthorizationCodeGrant;
+    private handleRefreshTokenGrant;
+    private handleClientCredentialsGrant;
+    /**
+     * Introspect a token
+     */
+    introspect(token: string): TokenIntrospection;
+    /**
+     * Validate an access token
+     */
+    validateAccessToken(token: string): {
+        valid: true;
+        data: TokenData;
+    } | {
+        valid: false;
+        error: string;
+    };
+    /**
+     * Revoke a token
+     */
+    revoke(token: string, tokenType?: TokenType): boolean;
+    /**
+     * Revoke all tokens for a user
+     */
+    revokeAllUserTokens(userId: string): number;
+    /**
+     * Generate a PKCE code verifier
+     */
+    generateCodeVerifier(): string;
+    /**
+     * Generate a PKCE code challenge from verifier
+     */
+    generateCodeChallenge(verifier: string, method?: PKCEMethod): string;
+    private computeCodeChallenge;
+    /**
+     * Dispose the provider
+     */
+    dispose(): void;
+    private generateTokens;
+    private generateToken;
+    private hashToken;
+    private timingSafeCompare;
+    private createError;
+    private startCleanup;
+}
+/**
+ * Create a new OAuth 2.1 provider
+ */
+export declare function createOAuth21Provider(config?: Partial<OAuth21ProviderConfig>): OAuth21Provider;
+/**
+ * Get the default OAuth 2.1 provider instance
+ */
+export declare function getOAuth21Provider(): OAuth21Provider;
+//# sourceMappingURL=oauth21-provider.d.ts.map

package/dist/mcp/security/oauth21-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth21-provider.d.ts","sourceRoot":"","sources":["../../../src/mcp/security/oauth21-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAC;AAEzB;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,eAAe,CAAC;AAEzD;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1C;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACtC,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,UAAU,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,UAAU,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,QAAQ,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,cAAc,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,GACf,cAAc,GACd,eAAe,CAAC;AAEpB;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAMD;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiC;IACpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAc;IAC5C,OAAO,CAAC,YAAY,CAA+C;gBAEvD,MAAM,EAAE,qBAAqB;IAezC;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAa3C;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAItD;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAgBvC;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAgEzF;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa;IAa3C,OAAO,CAAC,4BAA4B;IAgEpC,OAAO,CAAC,uBAAuB;IA+D/B,OAAO,CAAC,4BAA4B;IA+DpC;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB;IA6B7C;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAuBtG;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO;IA4BrD;;OAEG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAgB3C;;OAEG;IACH,oBAAoB,IAAI,MAAM;IAK9B;;OAEG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAE,UAAmB,GAAG,MAAM;IAI5E,OAAO,CAAC,oBAAoB;IAkB5B;;OAEG;IACH,OAAO,IAAI,IAAI;IAcf,OAAO,CAAC,cAAc;IA+CtB,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,YAAY;CAwBrB;AAMD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,GAAE,OAAO,CAAC,qBAAqB,CAAM,GAAG,eAAe,CAoBlG;AAQD;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,CAKpD"}