@auth0/ai 1.0.0 → 1.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/dist/cjs/authorizers/ciba/CIBAAuthorizerBase.js +4 -6
  2. package/dist/cjs/authorizers/ciba/CIBAAuthorizerBase.js.map +1 -1
  3. package/dist/cjs/authorizers/ciba/CIBAAuthorizerParams.js.map +1 -1
  4. package/dist/esm/authorizers/ciba/CIBAAuthorizerBase.js +4 -6
  5. package/dist/esm/authorizers/ciba/CIBAAuthorizerBase.js.map +1 -1
  6. package/dist/esm/authorizers/ciba/CIBAAuthorizerParams.d.ts +2 -0
  7. package/dist/esm/authorizers/ciba/CIBAAuthorizerParams.js.map +1 -1
  8. package/package.json +2 -2
package/dist/cjs/authorizers/ciba/CIBAAuthorizerBase.js CHANGED
@@ -28,17 +28,15 @@ class CIBAAuthorizerBase {
28
28
  });
29
29
  }
30
30
  async start(toolContext) {
31
- var _a;
31
+ var _a, _b, _c;
32
32
  const requestedAt = Date.now() / 1000;
33
33
  const authorizeParams = {
34
34
  scope: ensureOpenIdScope(this.params.scopes).join(" "),
35
- binding_message: "",
36
- userId: "",
37
35
  audience: this.params.audience || "",
38
- request_expiry: (_a = this.params.requestExpiry) === null || _a === void 0 ? void 0 : _a.toString(),
36
+ request_expiry: ((_a = this.params.requestExpiry) !== null && _a !== void 0 ? _a : 300).toString(),
37
+ binding_message: (_b = (await (0, parameters_1.resolveParameter)(this.params.bindingMessage, toolContext))) !== null && _b !== void 0 ? _b : "",
38
+ userId: (_c = (await (0, parameters_1.resolveParameter)(this.params.userID, toolContext))) !== null && _c !== void 0 ? _c : "",
39
39
  };
40
- authorizeParams.binding_message = await (0, parameters_1.resolveParameter)(this.params.bindingMessage, toolContext);
41
- authorizeParams.userId = await (0, parameters_1.resolveParameter)(this.params.userID, toolContext);
42
40
  try {
43
41
  const response = await this.auth0.backchannel.authorize(authorizeParams);
44
42
  return {
package/dist/cjs/authorizers/ciba/CIBAAuthorizerBase.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"CIBAAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerBase.ts"],"names":[],"mappings":";;;AAAA,iCAA6C;AAI7C,iDAO0B;AAC1B,iDAAoD;AACpD,2DAA2E;AAI3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpE,CAAC;AACD;;;GAGG;AACH,MAAa,kBAAkB;IAG7B,YACE,KAAuB,EACN,MAA6C;QAA7C,WAAM,GAAN,MAAM,CAAuC;QAE9D,IAAI,CAAC,KAAK,GAAG,IAAI,4BAAoB,CAAC;YACpC,MAAM,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,YAAa;YAClD,QAAQ,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,KAAI,OAAO,CAAC,GAAG,CAAC,eAAgB;YACzD,YAAY,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,YAAY,KAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACpE,yBAAyB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,yBAAyB;YAC3D,yBAAyB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,yBAAyB;YAC3D,iBAAiB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,iBAAiB;YAC3C,cAAc,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,cAAc;YACrC,OAAO,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,WAA4B;;QAE5B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACtC,MAAM,eAAe,GAAG;YACtB,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,eAAe,EAAE,EAAE;YACnB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;YACpC,cAAc,EAAE,MAAA,IAAI,CAAC,MAAM,CAAC,aAAa,0CAAE,QAAQ,EAAE;SACtD,CAAC;QAEF,eAAe,CAAC,eAAe,GAAG,MAAM,IAAA,6BAAgB,EACtD,IAAI,CAAC,MAAM,CAAC,cAAc,EAC1B,WAAW,CACZ,CAAC;QAEF,eAAe,CAAC,MAAM,GAAG,MAAM,IAAA,6BAAgB,EAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,WAAW,CACZ,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,WAAW;gBACxB,WAAW,EAAE,WAAW;gBACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACnC,MAAM,IAAI,sDAAyC,CACjD,GAAG,CAAC,iBAAiB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,WAAqC;QAErC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC;YAEnE,IAAI,cAAc,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,iDAAoC,CAC5C,wCAAwC,EACxC,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,EAAE;aAC5B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG;gBAClB,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;oBACrC,KAAK,EAAE,QAAQ,CAAC,YAAY;iBAC7B;gBACD,YAAY,EAAE,QAAQ,CAAC,aAAa;oBAClC,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;wBACrC,KAAK,EAAE,QAAQ,CAAC,aAAa;qBAC9B;oBACH,CAAC,CAAC,SAAS;gBACb,OAAO,EAAE,QAAQ,CAAC,QAAQ;oBACxB,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;wBACrC,KAAK,EAAE,QAAQ,CAAC,QAAQ;qBACzB;oBACH,CAAC,CAAC,SAAS;aACd,CAAC;YAEF,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACxC,MAAM,IAAI,0CAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,0CAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,kCAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,sDAAyC,CACjD,CAAC,CAAC,iBAAiB,CACpB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,kCAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAES,KAAK,CAAC,cAAc,CAAC,WAAqC;QAClE,OAAO,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,WAAqC;QAErC,IAAI,WAAW,GAA4B,SAAS,CAAC;QAErD,GAAG,CAAC;YACF,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,0CAA6B;oBAC5C,GAAG,YAAY,0CAA6B,EAC5C,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,CAAC,WAAW,EAAE;QAEvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,iBAAiB;QACzB,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IACE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB;YACnC,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,EAClD,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAC3C,SAAS,EACT,GAAI,KAAK,CAAC,IAAwB,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA6C,EAC7C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,IAAI,WAAiD,CAAC;YACtD,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAA2B;gBACzC,IAAI;gBACJ,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;aAC7B,CAAC;YAEF,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,WAAoC,CAAC;gBAEzC,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW;oBACzD,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,CAAC;gBAErD,IAAI,CAAC;oBACH,IAAI,aAAa,EAAE,CAAC;wBAClB,WAAW,GAAG,MAAM,IAAA,6BAAgB,EAClC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EACpC,IAAI,CACL,CAAC;wBACF,IAAI,CAAC,WAAW,EAAE,CAAC;4BACjB,iBAAiB;4BACjB,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BACrC,MAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAC1C,WAAW,EACX,GAAG,IAAI,CACR,CAAC;wBACJ,CAAC;wBACD,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;oBACvD,CAAC;yBAAM,CAAC;wBACN,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrC,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,eAAe,GACnB,GAAG,YAAY,0CAA6B;wBAC5C,GAAG,YAAY,0CAA6B,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BACrD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAY,EAAE,GAAG,IAAI,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;gBACrC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAES,6BAA6B,CACrC,GAAkE;QAElE,MAAM,GAAG,CAAC;IACZ,CAAC;CACF;AA3PD,gDA2PC","sourcesContent":["import { AuthenticationClient } from \"auth0\";\n\nimport { AuthorizerParams } from \"../\";\nimport { Credentials } from \"../../credentials\";\nimport {\n AccessDeniedInterrupt,\n AuthorizationPendingInterrupt,\n AuthorizationPollingInterrupt,\n AuthorizationRequestExpiredInterrupt,\n InvalidGrantInterrupt,\n UserDoesNotHavePushNotificationsInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\nimport { CIBAAuthorizerParams } from \"./CIBAAuthorizerParams\";\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\nfunction ensureOpenIdScope(scopes: string[]): string[] {\n return scopes.includes(\"openid\") ? scopes : [\"openid\", ...scopes];\n}\n/**\n * Requests authorization by prompting the user via an out-of-band channel from\n * the backend.\n */\nexport class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {\n auth0: AuthenticationClient;\n\n constructor(\n auth0: AuthorizerParams,\n private readonly params: CIBAAuthorizerParams<ToolExecuteArgs>\n ) {\n this.auth0 = new AuthenticationClient({\n domain: auth0?.domain || process.env.AUTH0_DOMAIN!,\n clientId: auth0?.clientId || process.env.AUTH0_CLIENT_ID!,\n clientSecret: auth0?.clientSecret || process.env.AUTH0_CLIENT_SECRET,\n clientAssertionSigningAlg: auth0?.clientAssertionSigningAlg,\n clientAssertionSigningKey: auth0?.clientAssertionSigningKey,\n idTokenSigningAlg: auth0?.idTokenSigningAlg,\n clockTolerance: auth0?.clockTolerance,\n useMTLS: auth0?.useMTLS,\n });\n }\n\n private async start(\n toolContext: ToolExecuteArgs\n ): Promise<CIBAAuthorizationRequest> {\n const requestedAt = Date.now() / 1000;\n const authorizeParams = {\n scope: ensureOpenIdScope(this.params.scopes).join(\" \"),\n binding_message: \"\",\n userId: \"\",\n audience: this.params.audience || \"\",\n request_expiry: this.params.requestExpiry?.toString(),\n };\n\n authorizeParams.binding_message = await resolveParameter(\n this.params.bindingMessage,\n toolContext\n );\n\n authorizeParams.userId = await resolveParameter(\n this.params.userID,\n toolContext\n );\n\n try {\n const response = await this.auth0.backchannel.authorize(authorizeParams);\n\n return {\n id: response.auth_req_id,\n requestedAt: requestedAt,\n expiresIn: response.expires_in,\n interval: response.interval,\n };\n } catch (err: any) {\n if (err.error == \"invalid_request\") {\n throw new UserDoesNotHavePushNotificationsInterrupt(\n err.error_description\n );\n }\n throw err;\n }\n }\n\n private async getCredentialsInternal(\n authRequest: CIBAAuthorizationRequest\n ): Promise<Credentials | undefined> {\n try {\n const elapsedSeconds = Date.now() / 1000 - authRequest.requestedAt;\n\n if (elapsedSeconds >= authRequest.expiresIn) {\n throw new AuthorizationRequestExpiredInterrupt(\n \"The authorization request has expired.\",\n authRequest\n );\n }\n\n const response = await this.auth0.backchannel.backchannelGrant({\n auth_req_id: authRequest.id,\n });\n\n const credentials = {\n accessToken: {\n type: response.token_type || \"bearer\",\n value: response.access_token,\n },\n refreshToken: response.refresh_token\n ? {\n type: response.token_type || \"bearer\",\n value: response.refresh_token,\n }\n : undefined,\n idToken: response.id_token\n ? {\n type: response.token_type || \"bearer\",\n value: response.id_token,\n }\n : undefined,\n };\n\n return credentials;\n } catch (e: any) {\n if (e.error === \"authorization_pending\") {\n throw new AuthorizationPendingInterrupt(\n e.error_description,\n authRequest\n );\n }\n\n if (e.error === \"slow_down\") {\n throw new AuthorizationPollingInterrupt(\n e.error_description,\n authRequest\n );\n }\n\n if (e.error == \"invalid_grant\") {\n throw new InvalidGrantInterrupt(e.error_description, authRequest);\n }\n\n if (e.error == \"invalid_request\") {\n throw new UserDoesNotHavePushNotificationsInterrupt(\n e.error_description\n );\n }\n\n if (e.error == \"access_denied\") {\n throw new AccessDeniedInterrupt(e.error_description, authRequest);\n }\n\n throw e;\n }\n }\n\n protected async getCredentials(authRequest: CIBAAuthorizationRequest) {\n return this.getCredentialsInternal(authRequest);\n }\n\n protected async getCredentialsPolling(\n authRequest: CIBAAuthorizationRequest\n ): Promise<Credentials | undefined> {\n let credentials: Credentials | undefined = undefined;\n\n do {\n try {\n credentials = await this.getCredentialsInternal(authRequest);\n } catch (err) {\n if (\n err instanceof AuthorizationPendingInterrupt ||\n err instanceof AuthorizationPollingInterrupt\n ) {\n await sleep(err.request.interval * 1000);\n } else {\n throw err;\n }\n }\n } while (!credentials);\n\n return credentials;\n }\n\n protected deleteAuthRequest() {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\"This method should be called from within a tool.\");\n }\n if (\n !this.params.onAuthorizationRequest ||\n this.params.onAuthorizationRequest === \"interrupt\"\n ) {\n return this.params.storeAuthorizationResponse(\n undefined,\n ...(store.args as ToolExecuteArgs)\n );\n }\n }\n\n /**\n *\n * Wraps the execute method of a AI tool to handle CIBA authorization.\n *\n * @param getContext - A function that returns the context of the tool execution.\n * @param execute - The tool execute method.\n * @returns The wrapped execute method.\n */\n protect(\n getContext: (...args: ToolExecuteArgs) => any,\n execute: (...args: ToolExecuteArgs) => any\n ): (...args: ToolExecuteArgs) => any {\n return async (...args: ToolExecuteArgs) => {\n let authRequest: CIBAAuthorizationRequest | undefined;\n if (asyncLocalStorage.getStore()) {\n throw new Error(\n \"Cannot nest tool calls that require CIBA authorization.\"\n );\n }\n\n const storeValue: AsyncStorageValue<any> = {\n args,\n context: getContext(...args),\n };\n\n return asyncLocalStorage.run(storeValue, async () => {\n let credentials: Credentials | undefined;\n\n const interruptMode =\n typeof this.params.onAuthorizationRequest === \"undefined\" ||\n this.params.onAuthorizationRequest === \"interrupt\";\n\n try {\n if (interruptMode) {\n authRequest = await resolveParameter(\n this.params.getAuthorizationResponse,\n args\n );\n if (!authRequest) {\n //Initial request\n authRequest = await this.start(args);\n await this.params.storeAuthorizationResponse(\n authRequest,\n ...args\n );\n }\n credentials = await this.getCredentials(authRequest);\n } else {\n authRequest = await this.start(args);\n credentials = await this.getCredentialsPolling(authRequest);\n }\n } catch (err) {\n const shouldInterrupt =\n err instanceof AuthorizationPendingInterrupt ||\n err instanceof AuthorizationPollingInterrupt;\n if (shouldInterrupt) {\n return this.handleAuthorizationInterrupts(err);\n } else {\n await this.deleteAuthRequest();\n if (typeof this.params.onUnauthorized === \"function\") {\n return this.params.onUnauthorized(err as Error, ...args);\n } else {\n return err;\n }\n }\n }\n await this.deleteAuthRequest();\n storeValue.credentials = credentials;\n return execute(...args);\n });\n };\n }\n\n protected handleAuthorizationInterrupts(\n err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt\n ) {\n throw err;\n }\n}\n"]}
1
+ {"version":3,"file":"CIBAAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerBase.ts"],"names":[],"mappings":";;;AAAA,iCAA6C;AAI7C,iDAO0B;AAC1B,iDAAoD;AACpD,2DAA2E;AAI3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpE,CAAC;AACD;;;GAGG;AACH,MAAa,kBAAkB;IAG7B,YACE,KAAuB,EACN,MAA6C;QAA7C,WAAM,GAAN,MAAM,CAAuC;QAE9D,IAAI,CAAC,KAAK,GAAG,IAAI,4BAAoB,CAAC;YACpC,MAAM,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,YAAa;YAClD,QAAQ,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,KAAI,OAAO,CAAC,GAAG,CAAC,eAAgB;YACzD,YAAY,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,YAAY,KAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACpE,yBAAyB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,yBAAyB;YAC3D,yBAAyB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,yBAAyB;YAC3D,iBAAiB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,iBAAiB;YAC3C,cAAc,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,cAAc;YACrC,OAAO,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,WAA4B;;QAE5B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACtC,MAAM,eAAe,GAAG;YACtB,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;YACpC,cAAc,EAAE,CAAC,MAAA,IAAI,CAAC,MAAM,CAAC,aAAa,mCAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;YAC7D,eAAe,EACb,MAAA,CAAC,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;YACzE,MAAM,EAAE,MAAA,CAAC,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;SACxE,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,WAAW;gBACxB,WAAW,EAAE,WAAW;gBACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACnC,MAAM,IAAI,sDAAyC,CACjD,GAAG,CAAC,iBAAiB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,WAAqC;QAErC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC;YAEnE,IAAI,cAAc,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,iDAAoC,CAC5C,wCAAwC,EACxC,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,EAAE;aAC5B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG;gBAClB,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;oBACrC,KAAK,EAAE,QAAQ,CAAC,YAAY;iBAC7B;gBACD,YAAY,EAAE,QAAQ,CAAC,aAAa;oBAClC,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;wBACrC,KAAK,EAAE,QAAQ,CAAC,aAAa;qBAC9B;oBACH,CAAC,CAAC,SAAS;gBACb,OAAO,EAAE,QAAQ,CAAC,QAAQ;oBACxB,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;wBACrC,KAAK,EAAE,QAAQ,CAAC,QAAQ;qBACzB;oBACH,CAAC,CAAC,SAAS;aACd,CAAC;YAEF,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACxC,MAAM,IAAI,0CAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,0CAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,kCAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,sDAAyC,CACjD,CAAC,CAAC,iBAAiB,CACpB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,kCAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAES,KAAK,CAAC,cAAc,CAAC,WAAqC;QAClE,OAAO,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,WAAqC;QAErC,IAAI,WAAW,GAA4B,SAAS,CAAC;QAErD,GAAG,CAAC;YACF,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,0CAA6B;oBAC5C,GAAG,YAAY,0CAA6B,EAC5C,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,CAAC,WAAW,EAAE;QAEvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,iBAAiB;QACzB,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IACE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB;YACnC,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,EAClD,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAC3C,SAAS,EACT,GAAI,KAAK,CAAC,IAAwB,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA6C,EAC7C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,IAAI,WAAiD,CAAC;YACtD,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAA2B;gBACzC,IAAI;gBACJ,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;aAC7B,CAAC;YAEF,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,WAAoC,CAAC;gBAEzC,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW;oBACzD,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,CAAC;gBAErD,IAAI,CAAC;oBACH,IAAI,aAAa,EAAE,CAAC;wBAClB,WAAW,GAAG,MAAM,IAAA,6BAAgB,EAClC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EACpC,IAAI,CACL,CAAC;wBACF,IAAI,CAAC,WAAW,EAAE,CAAC;4BACjB,iBAAiB;4BACjB,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BACrC,MAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAC1C,WAAW,EACX,GAAG,IAAI,CACR,CAAC;wBACJ,CAAC;wBACD,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;oBACvD,CAAC;yBAAM,CAAC;wBACN,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrC,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,eAAe,GACnB,GAAG,YAAY,0CAA6B;wBAC5C,GAAG,YAAY,0CAA6B,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BACrD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAY,EAAE,GAAG,IAAI,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;gBACrC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAES,6BAA6B,CACrC,GAAkE;QAElE,MAAM,GAAG,CAAC;IACZ,CAAC;CACF;AAlPD,gDAkPC","sourcesContent":["import { AuthenticationClient } from \"auth0\";\n\nimport { AuthorizerParams } from \"../\";\nimport { Credentials } from \"../../credentials\";\nimport {\n AccessDeniedInterrupt,\n AuthorizationPendingInterrupt,\n AuthorizationPollingInterrupt,\n AuthorizationRequestExpiredInterrupt,\n InvalidGrantInterrupt,\n UserDoesNotHavePushNotificationsInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\nimport { CIBAAuthorizerParams } from \"./CIBAAuthorizerParams\";\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\nfunction ensureOpenIdScope(scopes: string[]): string[] {\n return scopes.includes(\"openid\") ? scopes : [\"openid\", ...scopes];\n}\n/**\n * Requests authorization by prompting the user via an out-of-band channel from\n * the backend.\n */\nexport class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {\n auth0: AuthenticationClient;\n\n constructor(\n auth0: AuthorizerParams,\n private readonly params: CIBAAuthorizerParams<ToolExecuteArgs>\n ) {\n this.auth0 = new AuthenticationClient({\n domain: auth0?.domain || process.env.AUTH0_DOMAIN!,\n clientId: auth0?.clientId || process.env.AUTH0_CLIENT_ID!,\n clientSecret: auth0?.clientSecret || process.env.AUTH0_CLIENT_SECRET,\n clientAssertionSigningAlg: auth0?.clientAssertionSigningAlg,\n clientAssertionSigningKey: auth0?.clientAssertionSigningKey,\n idTokenSigningAlg: auth0?.idTokenSigningAlg,\n clockTolerance: auth0?.clockTolerance,\n useMTLS: auth0?.useMTLS,\n });\n }\n\n private async start(\n toolContext: ToolExecuteArgs\n ): Promise<CIBAAuthorizationRequest> {\n const requestedAt = Date.now() / 1000;\n const authorizeParams = {\n scope: ensureOpenIdScope(this.params.scopes).join(\" \"),\n audience: this.params.audience || \"\",\n request_expiry: (this.params.requestExpiry ?? 300).toString(),\n binding_message:\n (await resolveParameter(this.params.bindingMessage, toolContext)) ?? \"\",\n userId: (await resolveParameter(this.params.userID, toolContext)) ?? \"\",\n };\n\n try {\n const response = await this.auth0.backchannel.authorize(authorizeParams);\n\n return {\n id: response.auth_req_id,\n requestedAt: requestedAt,\n expiresIn: response.expires_in,\n interval: response.interval,\n };\n } catch (err: any) {\n if (err.error == \"invalid_request\") {\n throw new UserDoesNotHavePushNotificationsInterrupt(\n err.error_description\n );\n }\n throw err;\n }\n }\n\n private async getCredentialsInternal(\n authRequest: CIBAAuthorizationRequest\n ): Promise<Credentials | undefined> {\n try {\n const elapsedSeconds = Date.now() / 1000 - authRequest.requestedAt;\n\n if (elapsedSeconds >= authRequest.expiresIn) {\n throw new AuthorizationRequestExpiredInterrupt(\n \"The authorization request has expired.\",\n authRequest\n );\n }\n\n const response = await this.auth0.backchannel.backchannelGrant({\n auth_req_id: authRequest.id,\n });\n\n const credentials = {\n accessToken: {\n type: response.token_type || \"bearer\",\n value: response.access_token,\n },\n refreshToken: response.refresh_token\n ? {\n type: response.token_type || \"bearer\",\n value: response.refresh_token,\n }\n : undefined,\n idToken: response.id_token\n ? {\n type: response.token_type || \"bearer\",\n value: response.id_token,\n }\n : undefined,\n };\n\n return credentials;\n } catch (e: any) {\n if (e.error === \"authorization_pending\") {\n throw new AuthorizationPendingInterrupt(\n e.error_description,\n authRequest\n );\n }\n\n if (e.error === \"slow_down\") {\n throw new AuthorizationPollingInterrupt(\n e.error_description,\n authRequest\n );\n }\n\n if (e.error == \"invalid_grant\") {\n throw new InvalidGrantInterrupt(e.error_description, authRequest);\n }\n\n if (e.error == \"invalid_request\") {\n throw new UserDoesNotHavePushNotificationsInterrupt(\n e.error_description\n );\n }\n\n if (e.error == \"access_denied\") {\n throw new AccessDeniedInterrupt(e.error_description, authRequest);\n }\n\n throw e;\n }\n }\n\n protected async getCredentials(authRequest: CIBAAuthorizationRequest) {\n return this.getCredentialsInternal(authRequest);\n }\n\n protected async getCredentialsPolling(\n authRequest: CIBAAuthorizationRequest\n ): Promise<Credentials | undefined> {\n let credentials: Credentials | undefined = undefined;\n\n do {\n try {\n credentials = await this.getCredentialsInternal(authRequest);\n } catch (err) {\n if (\n err instanceof AuthorizationPendingInterrupt ||\n err instanceof AuthorizationPollingInterrupt\n ) {\n await sleep(err.request.interval * 1000);\n } else {\n throw err;\n }\n }\n } while (!credentials);\n\n return credentials;\n }\n\n protected deleteAuthRequest() {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\"This method should be called from within a tool.\");\n }\n if (\n !this.params.onAuthorizationRequest ||\n this.params.onAuthorizationRequest === \"interrupt\"\n ) {\n return this.params.storeAuthorizationResponse(\n undefined,\n ...(store.args as ToolExecuteArgs)\n );\n }\n }\n\n /**\n *\n * Wraps the execute method of a AI tool to handle CIBA authorization.\n *\n * @param getContext - A function that returns the context of the tool execution.\n * @param execute - The tool execute method.\n * @returns The wrapped execute method.\n */\n protect(\n getContext: (...args: ToolExecuteArgs) => any,\n execute: (...args: ToolExecuteArgs) => any\n ): (...args: ToolExecuteArgs) => any {\n return async (...args: ToolExecuteArgs) => {\n let authRequest: CIBAAuthorizationRequest | undefined;\n if (asyncLocalStorage.getStore()) {\n throw new Error(\n \"Cannot nest tool calls that require CIBA authorization.\"\n );\n }\n\n const storeValue: AsyncStorageValue<any> = {\n args,\n context: getContext(...args),\n };\n\n return asyncLocalStorage.run(storeValue, async () => {\n let credentials: Credentials | undefined;\n\n const interruptMode =\n typeof this.params.onAuthorizationRequest === \"undefined\" ||\n this.params.onAuthorizationRequest === \"interrupt\";\n\n try {\n if (interruptMode) {\n authRequest = await resolveParameter(\n this.params.getAuthorizationResponse,\n args\n );\n if (!authRequest) {\n //Initial request\n authRequest = await this.start(args);\n await this.params.storeAuthorizationResponse(\n authRequest,\n ...args\n );\n }\n credentials = await this.getCredentials(authRequest);\n } else {\n authRequest = await this.start(args);\n credentials = await this.getCredentialsPolling(authRequest);\n }\n } catch (err) {\n const shouldInterrupt =\n err instanceof AuthorizationPendingInterrupt ||\n err instanceof AuthorizationPollingInterrupt;\n if (shouldInterrupt) {\n return this.handleAuthorizationInterrupts(err);\n } else {\n await this.deleteAuthRequest();\n if (typeof this.params.onUnauthorized === \"function\") {\n return this.params.onUnauthorized(err as Error, ...args);\n } else {\n return err;\n }\n }\n }\n await this.deleteAuthRequest();\n storeValue.credentials = credentials;\n return execute(...args);\n });\n };\n }\n\n protected handleAuthorizationInterrupts(\n err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt\n ) {\n throw err;\n }\n}\n"]}
package/dist/cjs/authorizers/ciba/CIBAAuthorizerParams.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"CIBAAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { CIBAInterrupt } from \"../../interrupts\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\n\nexport type OnAuthorizationRequest = \"block\" | \"interrupt\";\n\nexport type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {\n /**\n * The user ID to request authorization for.\n */\n userID: AuthorizerToolParameter<ToolExecuteArgs>;\n\n /**\n * The binding message to send to the user.\n */\n bindingMessage: AuthorizerToolParameter<ToolExecuteArgs>;\n\n /**\n * The scope to request authorization for.\n */\n scopes: string[];\n\n /**\n * The audience to request authorization for.\n */\n audience?: string;\n\n /**\n * The time in seconds for the authorization request to expire.\n */\n requestExpiry?: number;\n\n /**\n * The behavior when the authorization request is made.\n *\n * - `block`: The tool execution is blocked until the user completes the authorization.\n * - `interrupt`: The tool execution is interrupted until the user completes the authorization.\n *\n * Defaults to `interrupt`.\n * Note: The block mode is only useful for development purposes and should not be used in production.\n */\n onAuthorizationRequest?: OnAuthorizationRequest;\n\n /**\n *\n * Optional callback to generate a tool result when the invocation is not authorized.\n *\n * By default it will return the instance of the Error.\n *\n * @param args - The tool execution arguments.\n * @returns The response to return when the invocation is not authorized.\n */\n onUnauthorized?: (\n err: Error | CIBAInterrupt,\n ...args: ToolExecuteArgs\n ) => any;\n} & (\n | {\n onAuthorizationRequest: \"block\";\n }\n | {\n onAuthorizationRequest?: \"interrupt\";\n\n /**\n * Retrieves the authorization response data.\n * @param args - The tool execution arguments.\n * @returns The authorization response data.\n * @remarks The data should be stored in a way that it can be retrieved later by the `storeAuthorizationResponse` parameter.\n */\n getAuthorizationResponse: AuthorizerToolParameter<\n ToolExecuteArgs,\n CIBAAuthorizationRequest | undefined\n >;\n\n /**\n * Stores the authorization response data.\n * @param request - The authorization response data.\n * @param args - The tool execution arguments.\n * @returns A promise that resolves when the data is stored.\n * @remarks The data should be stored in a way that it can be retrieved later by the `getAuthorizationResponse` parameter.\n **/\n storeAuthorizationResponse: (\n request: CIBAAuthorizationRequest | undefined,\n ...args: ToolExecuteArgs\n ) => Promise<void>;\n }\n);\n"]}
1
+ {"version":3,"file":"CIBAAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { CIBAInterrupt } from \"../../interrupts\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\n\nexport type OnAuthorizationRequest = \"block\" | \"interrupt\";\n\nexport type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {\n /**\n * The user ID to request authorization for.\n */\n userID: AuthorizerToolParameter<ToolExecuteArgs>;\n\n /**\n * The binding message to send to the user.\n */\n bindingMessage: AuthorizerToolParameter<ToolExecuteArgs>;\n\n /**\n * The scope to request authorization for.\n */\n scopes: string[];\n\n /**\n * The audience to request authorization for.\n */\n audience?: string;\n\n /**\n * The time in seconds for the authorization request to expire.\n *\n * Defaults to 5m.\n */\n requestExpiry?: number;\n\n /**\n * The behavior when the authorization request is made.\n *\n * - `block`: The tool execution is blocked until the user completes the authorization.\n * - `interrupt`: The tool execution is interrupted until the user completes the authorization.\n *\n * Defaults to `interrupt`.\n * Note: The block mode is only useful for development purposes and should not be used in production.\n */\n onAuthorizationRequest?: OnAuthorizationRequest;\n\n /**\n *\n * Optional callback to generate a tool result when the invocation is not authorized.\n *\n * By default it will return the instance of the Error.\n *\n * @param args - The tool execution arguments.\n * @returns The response to return when the invocation is not authorized.\n */\n onUnauthorized?: (\n err: Error | CIBAInterrupt,\n ...args: ToolExecuteArgs\n ) => any;\n} & (\n | {\n onAuthorizationRequest: \"block\";\n }\n | {\n onAuthorizationRequest?: \"interrupt\";\n\n /**\n * Retrieves the authorization response data.\n * @param args - The tool execution arguments.\n * @returns The authorization response data.\n * @remarks The data should be stored in a way that it can be retrieved later by the `storeAuthorizationResponse` parameter.\n */\n getAuthorizationResponse: AuthorizerToolParameter<\n ToolExecuteArgs,\n CIBAAuthorizationRequest | undefined\n >;\n\n /**\n * Stores the authorization response data.\n * @param request - The authorization response data.\n * @param args - The tool execution arguments.\n * @returns A promise that resolves when the data is stored.\n * @remarks The data should be stored in a way that it can be retrieved later by the `getAuthorizationResponse` parameter.\n **/\n storeAuthorizationResponse: (\n request: CIBAAuthorizationRequest | undefined,\n ...args: ToolExecuteArgs\n ) => Promise<void>;\n }\n);\n"]}
package/dist/esm/authorizers/ciba/CIBAAuthorizerBase.js CHANGED
@@ -25,17 +25,15 @@ export class CIBAAuthorizerBase {
25
25
  });
26
26
  }
27
27
  async start(toolContext) {
28
- var _a;
28
+ var _a, _b, _c;
29
29
  const requestedAt = Date.now() / 1000;
30
30
  const authorizeParams = {
31
31
  scope: ensureOpenIdScope(this.params.scopes).join(" "),
32
- binding_message: "",
33
- userId: "",
34
32
  audience: this.params.audience || "",
35
- request_expiry: (_a = this.params.requestExpiry) === null || _a === void 0 ? void 0 : _a.toString(),
33
+ request_expiry: ((_a = this.params.requestExpiry) !== null && _a !== void 0 ? _a : 300).toString(),
34
+ binding_message: (_b = (await resolveParameter(this.params.bindingMessage, toolContext))) !== null && _b !== void 0 ? _b : "",
35
+ userId: (_c = (await resolveParameter(this.params.userID, toolContext))) !== null && _c !== void 0 ? _c : "",
36
36
  };
37
- authorizeParams.binding_message = await resolveParameter(this.params.bindingMessage, toolContext);
38
- authorizeParams.userId = await resolveParameter(this.params.userID, toolContext);
39
37
  try {
40
38
  const response = await this.auth0.backchannel.authorize(authorizeParams);
41
39
  return {
package/dist/esm/authorizers/ciba/CIBAAuthorizerBase.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"CIBAAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAI7C,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,6BAA6B,EAC7B,oCAAoC,EACpC,qBAAqB,EACrB,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAI3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpE,CAAC;AACD;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAG7B,YACE,KAAuB,EACN,MAA6C;QAA7C,WAAM,GAAN,MAAM,CAAuC;QAE9D,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC;YACpC,MAAM,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,YAAa;YAClD,QAAQ,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,KAAI,OAAO,CAAC,GAAG,CAAC,eAAgB;YACzD,YAAY,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,YAAY,KAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACpE,yBAAyB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,yBAAyB;YAC3D,yBAAyB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,yBAAyB;YAC3D,iBAAiB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,iBAAiB;YAC3C,cAAc,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,cAAc;YACrC,OAAO,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,WAA4B;;QAE5B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACtC,MAAM,eAAe,GAAG;YACtB,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,eAAe,EAAE,EAAE;YACnB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;YACpC,cAAc,EAAE,MAAA,IAAI,CAAC,MAAM,CAAC,aAAa,0CAAE,QAAQ,EAAE;SACtD,CAAC;QAEF,eAAe,CAAC,eAAe,GAAG,MAAM,gBAAgB,CACtD,IAAI,CAAC,MAAM,CAAC,cAAc,EAC1B,WAAW,CACZ,CAAC;QAEF,eAAe,CAAC,MAAM,GAAG,MAAM,gBAAgB,CAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,WAAW,CACZ,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,WAAW;gBACxB,WAAW,EAAE,WAAW;gBACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACnC,MAAM,IAAI,yCAAyC,CACjD,GAAG,CAAC,iBAAiB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,WAAqC;QAErC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC;YAEnE,IAAI,cAAc,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,oCAAoC,CAC5C,wCAAwC,EACxC,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,EAAE;aAC5B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG;gBAClB,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;oBACrC,KAAK,EAAE,QAAQ,CAAC,YAAY;iBAC7B;gBACD,YAAY,EAAE,QAAQ,CAAC,aAAa;oBAClC,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;wBACrC,KAAK,EAAE,QAAQ,CAAC,aAAa;qBAC9B;oBACH,CAAC,CAAC,SAAS;gBACb,OAAO,EAAE,QAAQ,CAAC,QAAQ;oBACxB,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;wBACrC,KAAK,EAAE,QAAQ,CAAC,QAAQ;qBACzB;oBACH,CAAC,CAAC,SAAS;aACd,CAAC;YAEF,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACxC,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,yCAAyC,CACjD,CAAC,CAAC,iBAAiB,CACpB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAES,KAAK,CAAC,cAAc,CAAC,WAAqC;QAClE,OAAO,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,WAAqC;QAErC,IAAI,WAAW,GAA4B,SAAS,CAAC;QAErD,GAAG,CAAC;YACF,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,6BAA6B;oBAC5C,GAAG,YAAY,6BAA6B,EAC5C,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,CAAC,WAAW,EAAE;QAEvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,iBAAiB;QACzB,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IACE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB;YACnC,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,EAClD,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAC3C,SAAS,EACT,GAAI,KAAK,CAAC,IAAwB,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA6C,EAC7C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,IAAI,WAAiD,CAAC;YACtD,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAA2B;gBACzC,IAAI;gBACJ,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;aAC7B,CAAC;YAEF,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,WAAoC,CAAC;gBAEzC,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW;oBACzD,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,CAAC;gBAErD,IAAI,CAAC;oBACH,IAAI,aAAa,EAAE,CAAC;wBAClB,WAAW,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EACpC,IAAI,CACL,CAAC;wBACF,IAAI,CAAC,WAAW,EAAE,CAAC;4BACjB,iBAAiB;4BACjB,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BACrC,MAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAC1C,WAAW,EACX,GAAG,IAAI,CACR,CAAC;wBACJ,CAAC;wBACD,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;oBACvD,CAAC;yBAAM,CAAC;wBACN,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrC,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,eAAe,GACnB,GAAG,YAAY,6BAA6B;wBAC5C,GAAG,YAAY,6BAA6B,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BACrD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAY,EAAE,GAAG,IAAI,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;gBACrC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAES,6BAA6B,CACrC,GAAkE;QAElE,MAAM,GAAG,CAAC;IACZ,CAAC;CACF","sourcesContent":["import { AuthenticationClient } from \"auth0\";\n\nimport { AuthorizerParams } from \"../\";\nimport { Credentials } from \"../../credentials\";\nimport {\n AccessDeniedInterrupt,\n AuthorizationPendingInterrupt,\n AuthorizationPollingInterrupt,\n AuthorizationRequestExpiredInterrupt,\n InvalidGrantInterrupt,\n UserDoesNotHavePushNotificationsInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\nimport { CIBAAuthorizerParams } from \"./CIBAAuthorizerParams\";\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\nfunction ensureOpenIdScope(scopes: string[]): string[] {\n return scopes.includes(\"openid\") ? scopes : [\"openid\", ...scopes];\n}\n/**\n * Requests authorization by prompting the user via an out-of-band channel from\n * the backend.\n */\nexport class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {\n auth0: AuthenticationClient;\n\n constructor(\n auth0: AuthorizerParams,\n private readonly params: CIBAAuthorizerParams<ToolExecuteArgs>\n ) {\n this.auth0 = new AuthenticationClient({\n domain: auth0?.domain || process.env.AUTH0_DOMAIN!,\n clientId: auth0?.clientId || process.env.AUTH0_CLIENT_ID!,\n clientSecret: auth0?.clientSecret || process.env.AUTH0_CLIENT_SECRET,\n clientAssertionSigningAlg: auth0?.clientAssertionSigningAlg,\n clientAssertionSigningKey: auth0?.clientAssertionSigningKey,\n idTokenSigningAlg: auth0?.idTokenSigningAlg,\n clockTolerance: auth0?.clockTolerance,\n useMTLS: auth0?.useMTLS,\n });\n }\n\n private async start(\n toolContext: ToolExecuteArgs\n ): Promise<CIBAAuthorizationRequest> {\n const requestedAt = Date.now() / 1000;\n const authorizeParams = {\n scope: ensureOpenIdScope(this.params.scopes).join(\" \"),\n binding_message: \"\",\n userId: \"\",\n audience: this.params.audience || \"\",\n request_expiry: this.params.requestExpiry?.toString(),\n };\n\n authorizeParams.binding_message = await resolveParameter(\n this.params.bindingMessage,\n toolContext\n );\n\n authorizeParams.userId = await resolveParameter(\n this.params.userID,\n toolContext\n );\n\n try {\n const response = await this.auth0.backchannel.authorize(authorizeParams);\n\n return {\n id: response.auth_req_id,\n requestedAt: requestedAt,\n expiresIn: response.expires_in,\n interval: response.interval,\n };\n } catch (err: any) {\n if (err.error == \"invalid_request\") {\n throw new UserDoesNotHavePushNotificationsInterrupt(\n err.error_description\n );\n }\n throw err;\n }\n }\n\n private async getCredentialsInternal(\n authRequest: CIBAAuthorizationRequest\n ): Promise<Credentials | undefined> {\n try {\n const elapsedSeconds = Date.now() / 1000 - authRequest.requestedAt;\n\n if (elapsedSeconds >= authRequest.expiresIn) {\n throw new AuthorizationRequestExpiredInterrupt(\n \"The authorization request has expired.\",\n authRequest\n );\n }\n\n const response = await this.auth0.backchannel.backchannelGrant({\n auth_req_id: authRequest.id,\n });\n\n const credentials = {\n accessToken: {\n type: response.token_type || \"bearer\",\n value: response.access_token,\n },\n refreshToken: response.refresh_token\n ? {\n type: response.token_type || \"bearer\",\n value: response.refresh_token,\n }\n : undefined,\n idToken: response.id_token\n ? {\n type: response.token_type || \"bearer\",\n value: response.id_token,\n }\n : undefined,\n };\n\n return credentials;\n } catch (e: any) {\n if (e.error === \"authorization_pending\") {\n throw new AuthorizationPendingInterrupt(\n e.error_description,\n authRequest\n );\n }\n\n if (e.error === \"slow_down\") {\n throw new AuthorizationPollingInterrupt(\n e.error_description,\n authRequest\n );\n }\n\n if (e.error == \"invalid_grant\") {\n throw new InvalidGrantInterrupt(e.error_description, authRequest);\n }\n\n if (e.error == \"invalid_request\") {\n throw new UserDoesNotHavePushNotificationsInterrupt(\n e.error_description\n );\n }\n\n if (e.error == \"access_denied\") {\n throw new AccessDeniedInterrupt(e.error_description, authRequest);\n }\n\n throw e;\n }\n }\n\n protected async getCredentials(authRequest: CIBAAuthorizationRequest) {\n return this.getCredentialsInternal(authRequest);\n }\n\n protected async getCredentialsPolling(\n authRequest: CIBAAuthorizationRequest\n ): Promise<Credentials | undefined> {\n let credentials: Credentials | undefined = undefined;\n\n do {\n try {\n credentials = await this.getCredentialsInternal(authRequest);\n } catch (err) {\n if (\n err instanceof AuthorizationPendingInterrupt ||\n err instanceof AuthorizationPollingInterrupt\n ) {\n await sleep(err.request.interval * 1000);\n } else {\n throw err;\n }\n }\n } while (!credentials);\n\n return credentials;\n }\n\n protected deleteAuthRequest() {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\"This method should be called from within a tool.\");\n }\n if (\n !this.params.onAuthorizationRequest ||\n this.params.onAuthorizationRequest === \"interrupt\"\n ) {\n return this.params.storeAuthorizationResponse(\n undefined,\n ...(store.args as ToolExecuteArgs)\n );\n }\n }\n\n /**\n *\n * Wraps the execute method of a AI tool to handle CIBA authorization.\n *\n * @param getContext - A function that returns the context of the tool execution.\n * @param execute - The tool execute method.\n * @returns The wrapped execute method.\n */\n protect(\n getContext: (...args: ToolExecuteArgs) => any,\n execute: (...args: ToolExecuteArgs) => any\n ): (...args: ToolExecuteArgs) => any {\n return async (...args: ToolExecuteArgs) => {\n let authRequest: CIBAAuthorizationRequest | undefined;\n if (asyncLocalStorage.getStore()) {\n throw new Error(\n \"Cannot nest tool calls that require CIBA authorization.\"\n );\n }\n\n const storeValue: AsyncStorageValue<any> = {\n args,\n context: getContext(...args),\n };\n\n return asyncLocalStorage.run(storeValue, async () => {\n let credentials: Credentials | undefined;\n\n const interruptMode =\n typeof this.params.onAuthorizationRequest === \"undefined\" ||\n this.params.onAuthorizationRequest === \"interrupt\";\n\n try {\n if (interruptMode) {\n authRequest = await resolveParameter(\n this.params.getAuthorizationResponse,\n args\n );\n if (!authRequest) {\n //Initial request\n authRequest = await this.start(args);\n await this.params.storeAuthorizationResponse(\n authRequest,\n ...args\n );\n }\n credentials = await this.getCredentials(authRequest);\n } else {\n authRequest = await this.start(args);\n credentials = await this.getCredentialsPolling(authRequest);\n }\n } catch (err) {\n const shouldInterrupt =\n err instanceof AuthorizationPendingInterrupt ||\n err instanceof AuthorizationPollingInterrupt;\n if (shouldInterrupt) {\n return this.handleAuthorizationInterrupts(err);\n } else {\n await this.deleteAuthRequest();\n if (typeof this.params.onUnauthorized === \"function\") {\n return this.params.onUnauthorized(err as Error, ...args);\n } else {\n return err;\n }\n }\n }\n await this.deleteAuthRequest();\n storeValue.credentials = credentials;\n return execute(...args);\n });\n };\n }\n\n protected handleAuthorizationInterrupts(\n err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt\n ) {\n throw err;\n }\n}\n"]}
1
+ {"version":3,"file":"CIBAAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAI7C,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,6BAA6B,EAC7B,oCAAoC,EACpC,qBAAqB,EACrB,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAI3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpE,CAAC;AACD;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAG7B,YACE,KAAuB,EACN,MAA6C;QAA7C,WAAM,GAAN,MAAM,CAAuC;QAE9D,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC;YACpC,MAAM,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,YAAa;YAClD,QAAQ,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,KAAI,OAAO,CAAC,GAAG,CAAC,eAAgB;YACzD,YAAY,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,YAAY,KAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACpE,yBAAyB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,yBAAyB;YAC3D,yBAAyB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,yBAAyB;YAC3D,iBAAiB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,iBAAiB;YAC3C,cAAc,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,cAAc;YACrC,OAAO,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,WAA4B;;QAE5B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACtC,MAAM,eAAe,GAAG;YACtB,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;YACpC,cAAc,EAAE,CAAC,MAAA,IAAI,CAAC,MAAM,CAAC,aAAa,mCAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;YAC7D,eAAe,EACb,MAAA,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;YACzE,MAAM,EAAE,MAAA,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;SACxE,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,WAAW;gBACxB,WAAW,EAAE,WAAW;gBACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACnC,MAAM,IAAI,yCAAyC,CACjD,GAAG,CAAC,iBAAiB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,WAAqC;QAErC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC;YAEnE,IAAI,cAAc,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,oCAAoC,CAC5C,wCAAwC,EACxC,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,EAAE;aAC5B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG;gBAClB,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;oBACrC,KAAK,EAAE,QAAQ,CAAC,YAAY;iBAC7B;gBACD,YAAY,EAAE,QAAQ,CAAC,aAAa;oBAClC,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;wBACrC,KAAK,EAAE,QAAQ,CAAC,aAAa;qBAC9B;oBACH,CAAC,CAAC,SAAS;gBACb,OAAO,EAAE,QAAQ,CAAC,QAAQ;oBACxB,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;wBACrC,KAAK,EAAE,QAAQ,CAAC,QAAQ;qBACzB;oBACH,CAAC,CAAC,SAAS;aACd,CAAC;YAEF,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACxC,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,yCAAyC,CACjD,CAAC,CAAC,iBAAiB,CACpB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAES,KAAK,CAAC,cAAc,CAAC,WAAqC;QAClE,OAAO,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,WAAqC;QAErC,IAAI,WAAW,GAA4B,SAAS,CAAC;QAErD,GAAG,CAAC;YACF,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,6BAA6B;oBAC5C,GAAG,YAAY,6BAA6B,EAC5C,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,CAAC,WAAW,EAAE;QAEvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,iBAAiB;QACzB,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IACE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB;YACnC,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,EAClD,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAC3C,SAAS,EACT,GAAI,KAAK,CAAC,IAAwB,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA6C,EAC7C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,IAAI,WAAiD,CAAC;YACtD,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAA2B;gBACzC,IAAI;gBACJ,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;aAC7B,CAAC;YAEF,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,WAAoC,CAAC;gBAEzC,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW;oBACzD,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,CAAC;gBAErD,IAAI,CAAC;oBACH,IAAI,aAAa,EAAE,CAAC;wBAClB,WAAW,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EACpC,IAAI,CACL,CAAC;wBACF,IAAI,CAAC,WAAW,EAAE,CAAC;4BACjB,iBAAiB;4BACjB,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BACrC,MAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAC1C,WAAW,EACX,GAAG,IAAI,CACR,CAAC;wBACJ,CAAC;wBACD,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;oBACvD,CAAC;yBAAM,CAAC;wBACN,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrC,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,eAAe,GACnB,GAAG,YAAY,6BAA6B;wBAC5C,GAAG,YAAY,6BAA6B,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BACrD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAY,EAAE,GAAG,IAAI,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;gBACrC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAES,6BAA6B,CACrC,GAAkE;QAElE,MAAM,GAAG,CAAC;IACZ,CAAC;CACF","sourcesContent":["import { AuthenticationClient } from \"auth0\";\n\nimport { AuthorizerParams } from \"../\";\nimport { Credentials } from \"../../credentials\";\nimport {\n AccessDeniedInterrupt,\n AuthorizationPendingInterrupt,\n AuthorizationPollingInterrupt,\n AuthorizationRequestExpiredInterrupt,\n InvalidGrantInterrupt,\n UserDoesNotHavePushNotificationsInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\nimport { CIBAAuthorizerParams } from \"./CIBAAuthorizerParams\";\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\nfunction ensureOpenIdScope(scopes: string[]): string[] {\n return scopes.includes(\"openid\") ? scopes : [\"openid\", ...scopes];\n}\n/**\n * Requests authorization by prompting the user via an out-of-band channel from\n * the backend.\n */\nexport class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {\n auth0: AuthenticationClient;\n\n constructor(\n auth0: AuthorizerParams,\n private readonly params: CIBAAuthorizerParams<ToolExecuteArgs>\n ) {\n this.auth0 = new AuthenticationClient({\n domain: auth0?.domain || process.env.AUTH0_DOMAIN!,\n clientId: auth0?.clientId || process.env.AUTH0_CLIENT_ID!,\n clientSecret: auth0?.clientSecret || process.env.AUTH0_CLIENT_SECRET,\n clientAssertionSigningAlg: auth0?.clientAssertionSigningAlg,\n clientAssertionSigningKey: auth0?.clientAssertionSigningKey,\n idTokenSigningAlg: auth0?.idTokenSigningAlg,\n clockTolerance: auth0?.clockTolerance,\n useMTLS: auth0?.useMTLS,\n });\n }\n\n private async start(\n toolContext: ToolExecuteArgs\n ): Promise<CIBAAuthorizationRequest> {\n const requestedAt = Date.now() / 1000;\n const authorizeParams = {\n scope: ensureOpenIdScope(this.params.scopes).join(\" \"),\n audience: this.params.audience || \"\",\n request_expiry: (this.params.requestExpiry ?? 300).toString(),\n binding_message:\n (await resolveParameter(this.params.bindingMessage, toolContext)) ?? \"\",\n userId: (await resolveParameter(this.params.userID, toolContext)) ?? \"\",\n };\n\n try {\n const response = await this.auth0.backchannel.authorize(authorizeParams);\n\n return {\n id: response.auth_req_id,\n requestedAt: requestedAt,\n expiresIn: response.expires_in,\n interval: response.interval,\n };\n } catch (err: any) {\n if (err.error == \"invalid_request\") {\n throw new UserDoesNotHavePushNotificationsInterrupt(\n err.error_description\n );\n }\n throw err;\n }\n }\n\n private async getCredentialsInternal(\n authRequest: CIBAAuthorizationRequest\n ): Promise<Credentials | undefined> {\n try {\n const elapsedSeconds = Date.now() / 1000 - authRequest.requestedAt;\n\n if (elapsedSeconds >= authRequest.expiresIn) {\n throw new AuthorizationRequestExpiredInterrupt(\n \"The authorization request has expired.\",\n authRequest\n );\n }\n\n const response = await this.auth0.backchannel.backchannelGrant({\n auth_req_id: authRequest.id,\n });\n\n const credentials = {\n accessToken: {\n type: response.token_type || \"bearer\",\n value: response.access_token,\n },\n refreshToken: response.refresh_token\n ? {\n type: response.token_type || \"bearer\",\n value: response.refresh_token,\n }\n : undefined,\n idToken: response.id_token\n ? {\n type: response.token_type || \"bearer\",\n value: response.id_token,\n }\n : undefined,\n };\n\n return credentials;\n } catch (e: any) {\n if (e.error === \"authorization_pending\") {\n throw new AuthorizationPendingInterrupt(\n e.error_description,\n authRequest\n );\n }\n\n if (e.error === \"slow_down\") {\n throw new AuthorizationPollingInterrupt(\n e.error_description,\n authRequest\n );\n }\n\n if (e.error == \"invalid_grant\") {\n throw new InvalidGrantInterrupt(e.error_description, authRequest);\n }\n\n if (e.error == \"invalid_request\") {\n throw new UserDoesNotHavePushNotificationsInterrupt(\n e.error_description\n );\n }\n\n if (e.error == \"access_denied\") {\n throw new AccessDeniedInterrupt(e.error_description, authRequest);\n }\n\n throw e;\n }\n }\n\n protected async getCredentials(authRequest: CIBAAuthorizationRequest) {\n return this.getCredentialsInternal(authRequest);\n }\n\n protected async getCredentialsPolling(\n authRequest: CIBAAuthorizationRequest\n ): Promise<Credentials | undefined> {\n let credentials: Credentials | undefined = undefined;\n\n do {\n try {\n credentials = await this.getCredentialsInternal(authRequest);\n } catch (err) {\n if (\n err instanceof AuthorizationPendingInterrupt ||\n err instanceof AuthorizationPollingInterrupt\n ) {\n await sleep(err.request.interval * 1000);\n } else {\n throw err;\n }\n }\n } while (!credentials);\n\n return credentials;\n }\n\n protected deleteAuthRequest() {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\"This method should be called from within a tool.\");\n }\n if (\n !this.params.onAuthorizationRequest ||\n this.params.onAuthorizationRequest === \"interrupt\"\n ) {\n return this.params.storeAuthorizationResponse(\n undefined,\n ...(store.args as ToolExecuteArgs)\n );\n }\n }\n\n /**\n *\n * Wraps the execute method of a AI tool to handle CIBA authorization.\n *\n * @param getContext - A function that returns the context of the tool execution.\n * @param execute - The tool execute method.\n * @returns The wrapped execute method.\n */\n protect(\n getContext: (...args: ToolExecuteArgs) => any,\n execute: (...args: ToolExecuteArgs) => any\n ): (...args: ToolExecuteArgs) => any {\n return async (...args: ToolExecuteArgs) => {\n let authRequest: CIBAAuthorizationRequest | undefined;\n if (asyncLocalStorage.getStore()) {\n throw new Error(\n \"Cannot nest tool calls that require CIBA authorization.\"\n );\n }\n\n const storeValue: AsyncStorageValue<any> = {\n args,\n context: getContext(...args),\n };\n\n return asyncLocalStorage.run(storeValue, async () => {\n let credentials: Credentials | undefined;\n\n const interruptMode =\n typeof this.params.onAuthorizationRequest === \"undefined\" ||\n this.params.onAuthorizationRequest === \"interrupt\";\n\n try {\n if (interruptMode) {\n authRequest = await resolveParameter(\n this.params.getAuthorizationResponse,\n args\n );\n if (!authRequest) {\n //Initial request\n authRequest = await this.start(args);\n await this.params.storeAuthorizationResponse(\n authRequest,\n ...args\n );\n }\n credentials = await this.getCredentials(authRequest);\n } else {\n authRequest = await this.start(args);\n credentials = await this.getCredentialsPolling(authRequest);\n }\n } catch (err) {\n const shouldInterrupt =\n err instanceof AuthorizationPendingInterrupt ||\n err instanceof AuthorizationPollingInterrupt;\n if (shouldInterrupt) {\n return this.handleAuthorizationInterrupts(err);\n } else {\n await this.deleteAuthRequest();\n if (typeof this.params.onUnauthorized === \"function\") {\n return this.params.onUnauthorized(err as Error, ...args);\n } else {\n return err;\n }\n }\n }\n await this.deleteAuthRequest();\n storeValue.credentials = credentials;\n return execute(...args);\n });\n };\n }\n\n protected handleAuthorizationInterrupts(\n err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt\n ) {\n throw err;\n }\n}\n"]}
package/dist/esm/authorizers/ciba/CIBAAuthorizerParams.d.ts CHANGED
@@ -21,6 +21,8 @@ export type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {
21
21
  audience?: string;
22
22
  /**
23
23
  * The time in seconds for the authorization request to expire.
24
+ *
25
+ * Defaults to 5m.
24
26
  */
25
27
  requestExpiry?: number;
26
28
  /**
package/dist/esm/authorizers/ciba/CIBAAuthorizerParams.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"CIBAAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { CIBAInterrupt } from \"../../interrupts\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\n\nexport type OnAuthorizationRequest = \"block\" | \"interrupt\";\n\nexport type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {\n /**\n * The user ID to request authorization for.\n */\n userID: AuthorizerToolParameter<ToolExecuteArgs>;\n\n /**\n * The binding message to send to the user.\n */\n bindingMessage: AuthorizerToolParameter<ToolExecuteArgs>;\n\n /**\n * The scope to request authorization for.\n */\n scopes: string[];\n\n /**\n * The audience to request authorization for.\n */\n audience?: string;\n\n /**\n * The time in seconds for the authorization request to expire.\n */\n requestExpiry?: number;\n\n /**\n * The behavior when the authorization request is made.\n *\n * - `block`: The tool execution is blocked until the user completes the authorization.\n * - `interrupt`: The tool execution is interrupted until the user completes the authorization.\n *\n * Defaults to `interrupt`.\n * Note: The block mode is only useful for development purposes and should not be used in production.\n */\n onAuthorizationRequest?: OnAuthorizationRequest;\n\n /**\n *\n * Optional callback to generate a tool result when the invocation is not authorized.\n *\n * By default it will return the instance of the Error.\n *\n * @param args - The tool execution arguments.\n * @returns The response to return when the invocation is not authorized.\n */\n onUnauthorized?: (\n err: Error | CIBAInterrupt,\n ...args: ToolExecuteArgs\n ) => any;\n} & (\n | {\n onAuthorizationRequest: \"block\";\n }\n | {\n onAuthorizationRequest?: \"interrupt\";\n\n /**\n * Retrieves the authorization response data.\n * @param args - The tool execution arguments.\n * @returns The authorization response data.\n * @remarks The data should be stored in a way that it can be retrieved later by the `storeAuthorizationResponse` parameter.\n */\n getAuthorizationResponse: AuthorizerToolParameter<\n ToolExecuteArgs,\n CIBAAuthorizationRequest | undefined\n >;\n\n /**\n * Stores the authorization response data.\n * @param request - The authorization response data.\n * @param args - The tool execution arguments.\n * @returns A promise that resolves when the data is stored.\n * @remarks The data should be stored in a way that it can be retrieved later by the `getAuthorizationResponse` parameter.\n **/\n storeAuthorizationResponse: (\n request: CIBAAuthorizationRequest | undefined,\n ...args: ToolExecuteArgs\n ) => Promise<void>;\n }\n);\n"]}
1
+ {"version":3,"file":"CIBAAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { CIBAInterrupt } from \"../../interrupts\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\n\nexport type OnAuthorizationRequest = \"block\" | \"interrupt\";\n\nexport type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {\n /**\n * The user ID to request authorization for.\n */\n userID: AuthorizerToolParameter<ToolExecuteArgs>;\n\n /**\n * The binding message to send to the user.\n */\n bindingMessage: AuthorizerToolParameter<ToolExecuteArgs>;\n\n /**\n * The scope to request authorization for.\n */\n scopes: string[];\n\n /**\n * The audience to request authorization for.\n */\n audience?: string;\n\n /**\n * The time in seconds for the authorization request to expire.\n *\n * Defaults to 5m.\n */\n requestExpiry?: number;\n\n /**\n * The behavior when the authorization request is made.\n *\n * - `block`: The tool execution is blocked until the user completes the authorization.\n * - `interrupt`: The tool execution is interrupted until the user completes the authorization.\n *\n * Defaults to `interrupt`.\n * Note: The block mode is only useful for development purposes and should not be used in production.\n */\n onAuthorizationRequest?: OnAuthorizationRequest;\n\n /**\n *\n * Optional callback to generate a tool result when the invocation is not authorized.\n *\n * By default it will return the instance of the Error.\n *\n * @param args - The tool execution arguments.\n * @returns The response to return when the invocation is not authorized.\n */\n onUnauthorized?: (\n err: Error | CIBAInterrupt,\n ...args: ToolExecuteArgs\n ) => any;\n} & (\n | {\n onAuthorizationRequest: \"block\";\n }\n | {\n onAuthorizationRequest?: \"interrupt\";\n\n /**\n * Retrieves the authorization response data.\n * @param args - The tool execution arguments.\n * @returns The authorization response data.\n * @remarks The data should be stored in a way that it can be retrieved later by the `storeAuthorizationResponse` parameter.\n */\n getAuthorizationResponse: AuthorizerToolParameter<\n ToolExecuteArgs,\n CIBAAuthorizationRequest | undefined\n >;\n\n /**\n * Stores the authorization response data.\n * @param request - The authorization response data.\n * @param args - The tool execution arguments.\n * @returns A promise that resolves when the data is stored.\n * @remarks The data should be stored in a way that it can be retrieved later by the `getAuthorizationResponse` parameter.\n **/\n storeAuthorizationResponse: (\n request: CIBAAuthorizationRequest | undefined,\n ...args: ToolExecuteArgs\n ) => Promise<void>;\n }\n);\n"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@auth0/ai",
3
- "version": "1.0.0",
3
+ "version": "1.0.1",
4
4
  "description": "Auth0AI SDK for JavaScript",
5
5
  "types": "dist/esm/index.d.ts",
6
6
  "main": "dist/cjs/index.js",
@@ -60,7 +60,7 @@
60
60
  "typedoc": "^0.27.6",
61
61
  "typescript": "^5.7.3",
62
62
  "typescript-eslint": "^8.20.0",
63
- "vitest": "^3.0.8"
63
+ "vitest": "^3.0.9"
64
64
  },
65
65
  "dependencies": {
66
66
  "@openfga/sdk": "^0.8.0",