@auth0/ai 3.4.1 → 3.5.0

package/dist/cjs/authorizers/federated-connections/FederatedConnectionAuthorizerBase.js

@@ -14,6 +14,7 @@ const util_1 = require("../../util");
 const context_1 = require("../context");
 const types_1 = require("../types");
 const asyncLocalStorage_1 = require("./asyncLocalStorage");
+const FederatedConnectionAuthorizerParams_1 = require("./FederatedConnectionAuthorizerParams");
 /**
  * Requests authorization to a third party service via Federated Connection.
  */
@@ -29,19 +30,34 @@ class FederatedConnectionAuthorizerBase {
             baseNamespace: [instanceID, "Credentials"],
             getTTL: (credentials) => credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,
         });
-        if (typeof params.refreshToken === "undefined" &&
-            typeof params.accessToken === "undefined") {
+        // Validate that exactly one token source is provided
+        const hasRefreshToken = typeof params.refreshToken !== "undefined";
+        const hasAccessToken = typeof params.accessToken !== "undefined";
+        const hasSubjectTokenType = typeof params.subjectTokenType !== "undefined";
+        if (!hasRefreshToken && !hasAccessToken) {
             throw new Error("Either refreshToken or accessToken must be provided to initialize the Authorizer.");
         }
-        if (typeof params.accessToken !== "undefined" &&
-            typeof params.refreshToken !== "undefined") {
+        if (hasRefreshToken && hasAccessToken) {
             throw new Error("Only one of refreshToken or accessToken can be provided to initialize the Authorizer.");
         }
+        // Validate resource server client credentials when using access tokens for token exchange w/ Token Vault
+        if (hasAccessToken &&
+            hasSubjectTokenType &&
+            params.subjectTokenType === FederatedConnectionAuthorizerParams_1.SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN) {
+            if (!this.auth0.clientId || !this.auth0.clientSecret) {
+                throw new Error("clientId and clientSecret must currently be provided when using accessToken for token exchange with Token Vault.");
+            }
+        }
     }
     getInstanceID() {
         const props = {
             auth0: this.auth0,
-            params: (0, util_1.omit)(this.params, ["store", "refreshToken", "accessToken"]),
+            params: (0, util_1.omit)(this.params, [
+                "store",
+                "refreshToken",
+                "accessToken",
+                "loginHint",
+            ]),
         };
         const sh = (0, stable_hash_1.default)(props);
         return crypto_1.default.createHash("MD5").update(sh).digest("hex");
@@ -74,16 +90,39 @@ class FederatedConnectionAuthorizerBase {
             throw new Error("The tool must be wrapped with the FederationConnectionAuthorizer.");
         }
         const { connection } = store;
-        const subjectToken = await this.getRefreshToken(...toolContext);
+        // Determine which token type to use and get the appropriate subject token
+        let subjectToken;
+        let subjectTokenType;
+        if (typeof this.params.refreshToken === "function") {
+            subjectToken = await this.getRefreshToken(...toolContext);
+            subjectTokenType = "urn:ietf:params:oauth:token-type:refresh_token";
+        }
+        else if (typeof this.params.accessToken === "function") {
+            subjectToken = (await this.getAccessTokenWithToolContext(...toolContext));
+            subjectTokenType = "urn:ietf:params:oauth:token-type:access_token";
+        }
+        else if (typeof this.params.accessToken === "string") {
+            subjectToken = this.params.accessToken;
+            subjectTokenType = "urn:ietf:params:oauth:token-type:access_token";
+        }
+        else {
+            // This should never happen due to constructor validation, but TypeScript needs this
+            throw new Error("Either refreshToken or accessToken must be configured");
+        }
         if (!subjectToken) {
             return;
         }
+        // Get optional login hint if provided
+        const loginHint = typeof this.params.loginHint === "function"
+            ? await (0, parameters_1.resolveParameter)(this.params.loginHint, toolContext)
+            : undefined;
         const exchangeParams = {
             grant_type: "urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",
             client_id: this.auth0.clientId,
             client_secret: this.auth0.clientSecret,
-            subject_token_type: "urn:ietf:params:oauth:token-type:refresh_token",
+            subject_token_type: subjectTokenType,
             subject_token: subjectToken,
+            login_hint: loginHint,
             connection: connection,
             requested_token_type: "http://auth0.com/oauth/token-type/federated-connection-access-token",
         };
@@ -101,11 +140,16 @@ class FederatedConnectionAuthorizerBase {
     }
     async getAccessToken(...toolContext) {
         let tokenResponse;
-        if (typeof this.params.refreshToken === "function") {
+        // Use token exchange for both refresh tokens and access tokens when subjectTokenType is provided
+        if (typeof this.params.refreshToken === "function" ||
+            (typeof this.params.accessToken !== "undefined" &&
+                this.params.subjectTokenType ===
+                    FederatedConnectionAuthorizerParams_1.SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN)) {
             tokenResponse = await this.getAccessTokenImpl(...toolContext);
         }
         else {
-            tokenResponse = await (0, parameters_1.resolveParameter)(this.params.accessToken, toolContext);
+            // fallback to existing behavior, where third party accessToken can be provided directly
+            tokenResponse = (await (0, parameters_1.resolveParameter)(this.params.accessToken, toolContext));
         }
         this.validateToken(tokenResponse);
         return (0, credentials_1.tokenSetFromTokenResponse)(tokenResponse);
@@ -113,6 +157,9 @@ class FederatedConnectionAuthorizerBase {
     async getRefreshToken(...toolContext) {
         return await (0, parameters_1.resolveParameter)(this.params.refreshToken, toolContext);
     }
+    async getAccessTokenWithToolContext(...toolContext) {
+        return await (0, parameters_1.resolveParameter)(this.params.accessToken, toolContext);
+    }
     /**
      *
      * Wraps the execute method of an AI tool to handle Federated Connections authorization.

package/dist/cjs/authorizers/federated-connections/FederatedConnectionAuthorizerBase.js.map

@@ -1 +1 @@
-{"version":3,"file":"FederatedConnectionAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerBase.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAC5B,8DAAqC;AAErC,mDAI2B;AAC3B,iDAI0B;AAC1B,iDAAoD;AACpD,yCAAwC;AACxC,qCAAiD;AACjD,wCAA0D;AAC1D,oCAAgE;AAChE,2DAA2E;AAG3E;;GAEG;AAEH,MAAa,iCAAiC;IAQ5C,YACE,KAAiC,EACjC,MAA4D;QAE5D,IAAI,CAAC,KAAK,GAAG,yBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,iBAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,IACE,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW;YAC1C,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW;YACzC,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;SACpE,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,qBAAU,EAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,yCAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EACtF,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC;aAC9C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,yCAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACnI,UAAU,EACV,MAAM,EACN,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;QAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gDAAgD;YACpE,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,IAAA,6BAAgB,EACpC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,IAAA,uCAAyB,EAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC;YAEF,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,IAAA,uBAAa,EACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,qCAAwB,EAAE,CAAC;wBAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,yCAA4B,CAChD,GAAG,CAAC,OAAO,EACX,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,2BAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF;AAhOD,8EAgOC","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n  TokenResponse,\n  TokenSet,\n  tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n  Auth0Interrupt,\n  FederatedConnectionError,\n  FederatedConnectionInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Federated Connection.\n */\n\nexport class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: Auth0ClientParams;\n  private readonly params: RequireFields<\n    FederatedConnectionAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n  private readonly credentialsStore: SubStore<TokenSet>;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: FederatedConnectionAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = Auth0ClientSchema.parse(auth0);\n    this.params = {\n      credentialsContext: \"thread\",\n      ...params,\n    };\n\n    const instanceID = this.getInstanceID();\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      baseNamespace: [instanceID, \"Credentials\"],\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n\n    if (\n      typeof params.refreshToken === \"undefined\" &&\n      typeof params.accessToken === \"undefined\"\n    ) {\n      throw new Error(\n        \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\"\n      );\n    }\n\n    if (\n      typeof params.accessToken !== \"undefined\" &&\n      typeof params.refreshToken !== \"undefined\"\n    ) {\n      throw new Error(\n        \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\"\n      );\n    }\n  }\n\n  private getInstanceID(): string {\n    const props = {\n      auth0: this.auth0,\n      params: omit(this.params, [\"store\", \"refreshToken\", \"accessToken\"]),\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n    throw err;\n  }\n\n  protected validateToken(tokenResponse?: TokenResponse) {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { scopes, connection } = store;\n\n    if (!tokenResponse) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}`,\n        connection,\n        scopes,\n        scopes\n      );\n    }\n\n    const currentScopes = (tokenResponse.scope ?? \"\")\n      .replace(/,/g, \" \")\n      .split(\" \");\n    const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n    store.currentScopes = currentScopes;\n\n    if (missingScopes.length > 0) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(\", \")}`,\n        connection,\n        scopes,\n        [...currentScopes, ...scopes]\n      );\n    }\n  }\n\n  private async getAccessTokenImpl(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { connection } = store;\n\n    const subjectToken = await this.getRefreshToken(...toolContext);\n\n    if (!subjectToken) {\n      return;\n    }\n\n    const exchangeParams = {\n      grant_type:\n        \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n      client_id: this.auth0.clientId,\n      client_secret: this.auth0.clientSecret,\n      subject_token_type: \"urn:ietf:params:oauth:token-type:refresh_token\",\n      subject_token: subjectToken,\n      connection: connection,\n      requested_token_type:\n        \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n    };\n\n    const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(exchangeParams),\n    });\n\n    if (!res.ok) {\n      //TODO: handle all type of response errors.\n      return;\n    }\n\n    const tokenResponse: TokenResponse = await res.json();\n    return tokenResponse;\n  }\n\n  protected async getAccessToken(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenSet> {\n    let tokenResponse: TokenResponse | undefined;\n    if (typeof this.params.refreshToken === \"function\") {\n      tokenResponse = await this.getAccessTokenImpl(...toolContext);\n    } else {\n      tokenResponse = await resolveParameter(\n        this.params.accessToken!,\n        toolContext\n      );\n    }\n    this.validateToken(tokenResponse);\n    return tokenSetFromTokenResponse(tokenResponse!);\n  }\n\n  protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n    return await resolveParameter(this.params.refreshToken, toolContext);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle Federated Connections authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const context = getContext(...args);\n      const asyncStore: AsyncStorageValue = {\n        context: context,\n        scopes: this.params.scopes,\n        connection: this.params.connection,\n      };\n\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require federated connection authorization.\"\n        );\n      }\n\n      return asyncLocalStorage.run(asyncStore, async () => {\n        const credentialsNS = nsFromContext(\n          this.params.credentialsContext,\n          context\n        );\n        try {\n          let credentials: TokenSet = await this.credentialsStore.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            credentials = await this.getAccessToken(...args);\n            await this.credentialsStore.put(\n              credentialsNS,\n              \"credential\",\n              credentials\n            );\n          }\n          asyncStore.credentials = credentials;\n          return await execute(...args);\n        } catch (err) {\n          if (err instanceof FederatedConnectionError) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            const interrupt = new FederatedConnectionInterrupt(\n              err.message,\n              asyncStore.connection,\n              asyncStore.scopes,\n              asyncStore.scopes\n            );\n            return this.handleAuthorizationInterrupts(interrupt);\n          }\n          if (err instanceof Auth0Interrupt) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            return this.handleAuthorizationInterrupts(err);\n          }\n          throw err;\n        }\n      });\n    };\n  }\n}\n"]}
+{"version":3,"file":"FederatedConnectionAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerBase.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAC5B,8DAAqC;AAErC,mDAI2B;AAC3B,iDAI0B;AAC1B,iDAAoD;AACpD,yCAAwC;AACxC,qCAAiD;AACjD,wCAA0D;AAC1D,oCAAgE;AAChE,2DAA2E;AAC3E,+FAG+C;AAE/C;;GAEG;AAEH,MAAa,iCAAiC;IAQ5C,YACE,KAAiC,EACjC,MAA4D;QAE5D,IAAI,CAAC,KAAK,GAAG,yBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,iBAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,CAAC;QACnE,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC;QACjE,MAAM,mBAAmB,GAAG,OAAO,MAAM,CAAC,gBAAgB,KAAK,WAAW,CAAC;QAE3E,IAAI,CAAC,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QAED,yGAAyG;QACzG,IACE,cAAc;YACd,mBAAmB;YACnB,MAAM,CAAC,gBAAgB,KAAK,yDAAmB,CAAC,yBAAyB,EACzE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,EAAE;gBACxB,OAAO;gBACP,cAAc;gBACd,aAAa;gBACb,WAAW;aACZ,CAAC;SACH,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,qBAAU,EAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,yCAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EACtF,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC;aAC9C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,yCAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACnI,UAAU,EACV,MAAM,EACN,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,0EAA0E;QAC1E,IAAI,YAAgC,CAAC;QACrC,IAAI,gBAAwB,CAAC;QAE7B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;YAC1D,gBAAgB,GAAG,gDAAgD,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACzD,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,6BAA6B,CACtD,GAAG,WAAW,CACf,CAAW,CAAC;YACb,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACvD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvC,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,oFAAoF;YACpF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,UAAU;YACzC,CAAC,CAAC,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gBAAgB;YACpC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,iGAAiG;QACjG,IACE,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU;YAC9C,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;gBAC7C,IAAI,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,yDAAmB,CAAC,yBAAyB,CAAC,EAClD,CAAC;YACD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,wFAAwF;YACxF,aAAa,GAAG,CAAC,MAAM,IAAA,6BAAgB,EACrC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAkB,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,IAAA,uCAAyB,EAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAG,WAA4B;QAE/B,OAAO,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC;YAEF,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,IAAA,uBAAa,EACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,qCAAwB,EAAE,CAAC;wBAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,yCAA4B,CAChD,GAAG,CAAC,OAAO,EACX,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,2BAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF;AAvRD,8EAuRC","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n  TokenResponse,\n  TokenSet,\n  tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n  Auth0Interrupt,\n  FederatedConnectionError,\n  FederatedConnectionInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport {\n  FederatedConnectionAuthorizerParams,\n  SUBJECT_TOKEN_TYPES,\n} from \"./FederatedConnectionAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Federated Connection.\n */\n\nexport class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: Auth0ClientParams;\n  private readonly params: RequireFields<\n    FederatedConnectionAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n  private readonly credentialsStore: SubStore<TokenSet>;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: FederatedConnectionAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = Auth0ClientSchema.parse(auth0);\n    this.params = {\n      credentialsContext: \"thread\",\n      ...params,\n    };\n\n    const instanceID = this.getInstanceID();\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      baseNamespace: [instanceID, \"Credentials\"],\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n\n    // Validate that exactly one token source is provided\n    const hasRefreshToken = typeof params.refreshToken !== \"undefined\";\n    const hasAccessToken = typeof params.accessToken !== \"undefined\";\n    const hasSubjectTokenType = typeof params.subjectTokenType !== \"undefined\";\n\n    if (!hasRefreshToken && !hasAccessToken) {\n      throw new Error(\n        \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\"\n      );\n    }\n\n    if (hasRefreshToken && hasAccessToken) {\n      throw new Error(\n        \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\"\n      );\n    }\n\n    // Validate resource server client credentials when using access tokens for token exchange w/ Token Vault\n    if (\n      hasAccessToken &&\n      hasSubjectTokenType &&\n      params.subjectTokenType === SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN\n    ) {\n      if (!this.auth0.clientId || !this.auth0.clientSecret) {\n        throw new Error(\n          \"clientId and clientSecret must currently be provided when using accessToken for token exchange with Token Vault.\"\n        );\n      }\n    }\n  }\n\n  private getInstanceID(): string {\n    const props = {\n      auth0: this.auth0,\n      params: omit(this.params, [\n        \"store\",\n        \"refreshToken\",\n        \"accessToken\",\n        \"loginHint\",\n      ]),\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n    throw err;\n  }\n\n  protected validateToken(tokenResponse?: TokenResponse) {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { scopes, connection } = store;\n\n    if (!tokenResponse) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}`,\n        connection,\n        scopes,\n        scopes\n      );\n    }\n\n    const currentScopes = (tokenResponse.scope ?? \"\")\n      .replace(/,/g, \" \")\n      .split(\" \");\n    const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n    store.currentScopes = currentScopes;\n\n    if (missingScopes.length > 0) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(\", \")}`,\n        connection,\n        scopes,\n        [...currentScopes, ...scopes]\n      );\n    }\n  }\n\n  private async getAccessTokenImpl(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { connection } = store;\n\n    // Determine which token type to use and get the appropriate subject token\n    let subjectToken: string | undefined;\n    let subjectTokenType: string;\n\n    if (typeof this.params.refreshToken === \"function\") {\n      subjectToken = await this.getRefreshToken(...toolContext);\n      subjectTokenType = \"urn:ietf:params:oauth:token-type:refresh_token\";\n    } else if (typeof this.params.accessToken === \"function\") {\n      subjectToken = (await this.getAccessTokenWithToolContext(\n        ...toolContext\n      )) as string;\n      subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n    } else if (typeof this.params.accessToken === \"string\") {\n      subjectToken = this.params.accessToken;\n      subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n    } else {\n      // This should never happen due to constructor validation, but TypeScript needs this\n      throw new Error(\"Either refreshToken or accessToken must be configured\");\n    }\n\n    if (!subjectToken) {\n      return;\n    }\n\n    // Get optional login hint if provided\n    const loginHint =\n      typeof this.params.loginHint === \"function\"\n        ? await resolveParameter(this.params.loginHint, toolContext)\n        : undefined;\n\n    const exchangeParams = {\n      grant_type:\n        \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n      client_id: this.auth0.clientId,\n      client_secret: this.auth0.clientSecret,\n      subject_token_type: subjectTokenType,\n      subject_token: subjectToken,\n      login_hint: loginHint,\n      connection: connection,\n      requested_token_type:\n        \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n    };\n\n    const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(exchangeParams),\n    });\n\n    if (!res.ok) {\n      //TODO: handle all type of response errors.\n      return;\n    }\n\n    const tokenResponse: TokenResponse = await res.json();\n    return tokenResponse;\n  }\n\n  protected async getAccessToken(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenSet> {\n    let tokenResponse: TokenResponse | undefined;\n    // Use token exchange for both refresh tokens and access tokens when subjectTokenType is provided\n    if (\n      typeof this.params.refreshToken === \"function\" ||\n      (typeof this.params.accessToken !== \"undefined\" &&\n        this.params.subjectTokenType ===\n          SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN)\n    ) {\n      tokenResponse = await this.getAccessTokenImpl(...toolContext);\n    } else {\n      // fallback to existing behavior, where third party accessToken can be provided directly\n      tokenResponse = (await resolveParameter(\n        this.params.accessToken!,\n        toolContext\n      )) as TokenResponse;\n    }\n    this.validateToken(tokenResponse);\n    return tokenSetFromTokenResponse(tokenResponse!);\n  }\n\n  protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n    return await resolveParameter(this.params.refreshToken, toolContext);\n  }\n\n  protected async getAccessTokenWithToolContext(\n    ...toolContext: ToolExecuteArgs\n  ) {\n    return await resolveParameter(this.params.accessToken, toolContext);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle Federated Connections authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const context = getContext(...args);\n      const asyncStore: AsyncStorageValue = {\n        context: context,\n        scopes: this.params.scopes,\n        connection: this.params.connection,\n      };\n\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require federated connection authorization.\"\n        );\n      }\n\n      return asyncLocalStorage.run(asyncStore, async () => {\n        const credentialsNS = nsFromContext(\n          this.params.credentialsContext,\n          context\n        );\n        try {\n          let credentials: TokenSet = await this.credentialsStore.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            credentials = await this.getAccessToken(...args);\n            await this.credentialsStore.put(\n              credentialsNS,\n              \"credential\",\n              credentials\n            );\n          }\n          asyncStore.credentials = credentials;\n          return await execute(...args);\n        } catch (err) {\n          if (err instanceof FederatedConnectionError) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            const interrupt = new FederatedConnectionInterrupt(\n              err.message,\n              asyncStore.connection,\n              asyncStore.scopes,\n              asyncStore.scopes\n            );\n            return this.handleAuthorizationInterrupts(interrupt);\n          }\n          if (err instanceof Auth0Interrupt) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            return this.handleAuthorizationInterrupts(err);\n          }\n          throw err;\n        }\n      });\n    };\n  }\n}\n"]}

package/dist/cjs/authorizers/federated-connections/FederatedConnectionAuthorizerParams.js

@@ -1,3 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUBJECT_TOKEN_TYPES = void 0;
+var SUBJECT_TOKEN_TYPES;
+(function (SUBJECT_TOKEN_TYPES) {
+    /**
+     * Indicates that the token is an OAuth 2.0 refresh token issued by the given authorization server.
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.4 RFC 8693 Section 3-3.4}
+     */
+    SUBJECT_TOKEN_TYPES["SUBJECT_TYPE_REFRESH_TOKEN"] = "urn:ietf:params:oauth:token-type:refresh_token";
+    /**
+     * Indicates that the token is an OAuth 2.0 access token issued by the given authorization server.
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.2 RFC 8693 Section 3-3.2}
+     */
+    SUBJECT_TOKEN_TYPES["SUBJECT_TYPE_ACCESS_TOKEN"] = "urn:ietf:params:oauth:token-type:access_token";
+})(SUBJECT_TOKEN_TYPES || (exports.SUBJECT_TOKEN_TYPES = SUBJECT_TOKEN_TYPES = {}));
 //# sourceMappingURL=FederatedConnectionAuthorizerParams.js.map

package/dist/cjs/authorizers/federated-connections/FederatedConnectionAuthorizerParams.js.map

@@ -1 +1 @@
-{"version":3,"file":"FederatedConnectionAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { TokenResponse } from \"../../credentials\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { Store } from \"../../stores\";\nimport { AuthContext } from \"../context\";\n\nexport type FederatedConnectionAuthorizerParams<ToolExecuteArgs extends any[]> =\n  {\n    /**\n     * The Auth0 refresh token to exchange for an Federated Connection access token.\n     */\n    refreshToken?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;\n\n    /**\n     * The Federated connection access token if available in the tool context.\n     */\n    accessToken?: AuthorizerToolParameter<\n      ToolExecuteArgs,\n      TokenResponse | undefined\n    >;\n\n    /**\n     * The scopes required in the access token of the federated connection provider.\n     */\n    scopes: string[];\n\n    /**\n     * The connection name of the federated connection provider.\n     */\n    connection: string;\n\n    /**\n     * AuthContext defines the scope of credential sharing:\n     * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n     * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n     * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n     * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n     *\n     * @default \"thread\"\n     */\n    credentialsContext?: AuthContext;\n\n    /**\n     * An store used to store the authorization credentials according\n     * to the `credentialsContext` scope.\n     */\n    store: Store;\n  };\n"]}
+{"version":3,"file":"FederatedConnectionAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerParams.ts"],"names":[],"mappings":";;;AAKA,IAAY,mBAcX;AAdD,WAAY,mBAAmB;IAC7B;;;;OAIG;IACH,oGAA6E,CAAA;IAE7E;;;;OAIG;IACH,kGAA2E,CAAA;AAC7E,CAAC,EAdW,mBAAmB,mCAAnB,mBAAmB,QAc9B","sourcesContent":["import { TokenResponse } from \"../../credentials\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { Store } from \"../../stores\";\nimport { AuthContext } from \"../context\";\n\nexport enum SUBJECT_TOKEN_TYPES {\n  /**\n   * Indicates that the token is an OAuth 2.0 refresh token issued by the given authorization server.\n   *\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.4 RFC 8693 Section 3-3.4}\n   */\n  SUBJECT_TYPE_REFRESH_TOKEN = \"urn:ietf:params:oauth:token-type:refresh_token\",\n\n  /**\n   * Indicates that the token is an OAuth 2.0 access token issued by the given authorization server.\n   *\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.2 RFC 8693 Section 3-3.2}\n   */\n  SUBJECT_TYPE_ACCESS_TOKEN = \"urn:ietf:params:oauth:token-type:access_token\",\n}\n\nexport type FederatedConnectionAuthorizerParams<ToolExecuteArgs extends any[]> =\n  {\n    /**\n     * The Auth0 refresh token to exchange for an Federated Connection access token.\n     */\n    refreshToken?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;\n\n    /**\n     * The Federated connection access token if available in the tool context.\n     * This can also be provided as a string exchange when exchanging an access token for a Federated Connection access token.\n     */\n    accessToken?:\n      | AuthorizerToolParameter<\n          ToolExecuteArgs,\n          TokenResponse | string | undefined\n        >\n      | string\n      | undefined;\n\n    /**\n     * This is used to specify the type of token being requested from Auth0 during the OAuth 2.0 token exchange request.\n     */\n    subjectTokenType?: SUBJECT_TOKEN_TYPES | undefined;\n\n    /**\n     * Optional login hint to provide when exchanging an access or refresh token for a Federated Connection access token.\n     */\n    loginHint?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;\n\n    /**\n     * The scopes required in the access token of the federated connection provider.\n     */\n    scopes: string[];\n\n    /**\n     * The connection name of the federated connection provider.\n     */\n    connection: string;\n\n    /**\n     * AuthContext defines the scope of credential sharing:\n     * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n     * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n     * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n     * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n     *\n     * @default \"thread\"\n     */\n    credentialsContext?: AuthContext;\n\n    /**\n     * An store used to store the authorization credentials according\n     * to the `credentialsContext` scope.\n     */\n    store: Store;\n  };\n"]}

package/dist/cjs/authorizers/federated-connections/index.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FederatedConnectionAuthorizerBase = exports.getAccessTokenForConnection = exports.getCredentialsForConnection = exports.asyncLocalStorage = void 0;
+exports.SUBJECT_TOKEN_TYPES = exports.FederatedConnectionAuthorizerBase = exports.getAccessTokenForConnection = exports.getCredentialsForConnection = exports.asyncLocalStorage = void 0;
 var asyncLocalStorage_1 = require("./asyncLocalStorage");
 Object.defineProperty(exports, "asyncLocalStorage", { enumerable: true, get: function () { return asyncLocalStorage_1.asyncLocalStorage; } });
 Object.defineProperty(exports, "getCredentialsForConnection", { enumerable: true, get: function () { return asyncLocalStorage_1.getCredentialsForConnection; } });
 Object.defineProperty(exports, "getAccessTokenForConnection", { enumerable: true, get: function () { return asyncLocalStorage_1.getAccessTokenForConnection; } });
 var FederatedConnectionAuthorizerBase_1 = require("./FederatedConnectionAuthorizerBase");
 Object.defineProperty(exports, "FederatedConnectionAuthorizerBase", { enumerable: true, get: function () { return FederatedConnectionAuthorizerBase_1.FederatedConnectionAuthorizerBase; } });
+var FederatedConnectionAuthorizerParams_1 = require("./FederatedConnectionAuthorizerParams");
+Object.defineProperty(exports, "SUBJECT_TOKEN_TYPES", { enumerable: true, get: function () { return FederatedConnectionAuthorizerParams_1.SUBJECT_TOKEN_TYPES; } });
 //# sourceMappingURL=index.js.map

package/dist/cjs/authorizers/federated-connections/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/index.ts"],"names":[],"mappings":";;;AAEA,yDAI6B;AAH3B,sHAAA,iBAAiB,OAAA;AACjB,gIAAA,2BAA2B,OAAA;AAC3B,gIAAA,2BAA2B,OAAA;AAG7B,yFAAwF;AAA/E,sJAAA,iCAAiC,OAAA","sourcesContent":["export type { AsyncStorageValue } from \"./asyncLocalStorage\";\n\nexport {\n  asyncLocalStorage,\n  getCredentialsForConnection,\n  getAccessTokenForConnection,\n} from \"./asyncLocalStorage\";\n\nexport { FederatedConnectionAuthorizerBase } from \"./FederatedConnectionAuthorizerBase\";\n\nexport type { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/index.ts"],"names":[],"mappings":";;;AAEA,yDAI6B;AAH3B,sHAAA,iBAAiB,OAAA;AACjB,gIAAA,2BAA2B,OAAA;AAC3B,gIAAA,2BAA2B,OAAA;AAG7B,yFAAwF;AAA/E,sJAAA,iCAAiC,OAAA;AAI1C,6FAA4E;AAAnE,0IAAA,mBAAmB,OAAA","sourcesContent":["export type { AsyncStorageValue } from \"./asyncLocalStorage\";\n\nexport {\n  asyncLocalStorage,\n  getCredentialsForConnection,\n  getAccessTokenForConnection,\n} from \"./asyncLocalStorage\";\n\nexport { FederatedConnectionAuthorizerBase } from \"./FederatedConnectionAuthorizerBase\";\n\nexport type { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n\nexport { SUBJECT_TOKEN_TYPES } from \"./FederatedConnectionAuthorizerParams\";\n"]}

package/dist/cjs/index.js

@@ -14,7 +14,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUBJECT_TOKEN_TYPES = void 0;
 __exportStar(require("./errors"), exports);
+var federated_connections_1 = require("./authorizers/federated-connections");
+Object.defineProperty(exports, "SUBJECT_TOKEN_TYPES", { enumerable: true, get: function () { return federated_connections_1.SUBJECT_TOKEN_TYPES; } });
 __exportStar(require("./authorizers/fga/fga-filter"), exports);
 __exportStar(require("./authorizers/fga/fga-client"), exports);
 __exportStar(require("./parameters"), exports);

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAEA,2CAAyB;AACzB,+DAA6C;AAC7C,+DAA6C;AAC7C,+CAA6B","sourcesContent":["export type { AuthParams, Auth0ClientParams } from \"./authorizers/types\";\nexport type * from \"./credentials\";\nexport * from \"./errors\";\nexport * from \"./authorizers/fga/fga-filter\";\nexport * from \"./authorizers/fga/fga-client\";\nexport * from \"./parameters\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAEA,2CAAyB;AACzB,6EAA0E;AAAjE,4HAAA,mBAAmB,OAAA;AAC5B,+DAA6C;AAC7C,+DAA6C;AAC7C,+CAA6B","sourcesContent":["export type { AuthParams, Auth0ClientParams } from \"./authorizers/types\";\nexport type * from \"./credentials\";\nexport * from \"./errors\";\nexport { SUBJECT_TOKEN_TYPES } from \"./authorizers/federated-connections\";\nexport * from \"./authorizers/fga/fga-filter\";\nexport * from \"./authorizers/fga/fga-client\";\nexport * from \"./parameters\";\n"]}

package/dist/esm/authorizers/federated-connections/FederatedConnectionAuthorizerBase.d.ts

@@ -17,6 +17,7 @@ export declare class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends a
     private getAccessTokenImpl;
     protected getAccessToken(...toolContext: ToolExecuteArgs): Promise<TokenSet>;
     protected getRefreshToken(...toolContext: ToolExecuteArgs): Promise<string | undefined>;
+    protected getAccessTokenWithToolContext(...toolContext: ToolExecuteArgs): Promise<string | TokenResponse | undefined>;
     /**
      *
      * Wraps the execute method of an AI tool to handle Federated Connections authorization.

package/dist/esm/authorizers/federated-connections/FederatedConnectionAuthorizerBase.js

@@ -8,6 +8,7 @@ import { omit } from "../../util";
 import { nsFromContext } from "../context";
 import { Auth0ClientSchema } from "../types";
 import { asyncLocalStorage } from "./asyncLocalStorage";
+import { SUBJECT_TOKEN_TYPES, } from "./FederatedConnectionAuthorizerParams";
 /**
  * Requests authorization to a third party service via Federated Connection.
  */
@@ -23,19 +24,34 @@ export class FederatedConnectionAuthorizerBase {
             baseNamespace: [instanceID, "Credentials"],
             getTTL: (credentials) => credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,
         });
-        if (typeof params.refreshToken === "undefined" &&
-            typeof params.accessToken === "undefined") {
+        // Validate that exactly one token source is provided
+        const hasRefreshToken = typeof params.refreshToken !== "undefined";
+        const hasAccessToken = typeof params.accessToken !== "undefined";
+        const hasSubjectTokenType = typeof params.subjectTokenType !== "undefined";
+        if (!hasRefreshToken && !hasAccessToken) {
             throw new Error("Either refreshToken or accessToken must be provided to initialize the Authorizer.");
         }
-        if (typeof params.accessToken !== "undefined" &&
-            typeof params.refreshToken !== "undefined") {
+        if (hasRefreshToken && hasAccessToken) {
             throw new Error("Only one of refreshToken or accessToken can be provided to initialize the Authorizer.");
         }
+        // Validate resource server client credentials when using access tokens for token exchange w/ Token Vault
+        if (hasAccessToken &&
+            hasSubjectTokenType &&
+            params.subjectTokenType === SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN) {
+            if (!this.auth0.clientId || !this.auth0.clientSecret) {
+                throw new Error("clientId and clientSecret must currently be provided when using accessToken for token exchange with Token Vault.");
+            }
+        }
     }
     getInstanceID() {
         const props = {
             auth0: this.auth0,
-            params: omit(this.params, ["store", "refreshToken", "accessToken"]),
+            params: omit(this.params, [
+                "store",
+                "refreshToken",
+                "accessToken",
+                "loginHint",
+            ]),
         };
         const sh = stableHash(props);
         return crypto.createHash("MD5").update(sh).digest("hex");
@@ -68,16 +84,39 @@ export class FederatedConnectionAuthorizerBase {
             throw new Error("The tool must be wrapped with the FederationConnectionAuthorizer.");
         }
         const { connection } = store;
-        const subjectToken = await this.getRefreshToken(...toolContext);
+        // Determine which token type to use and get the appropriate subject token
+        let subjectToken;
+        let subjectTokenType;
+        if (typeof this.params.refreshToken === "function") {
+            subjectToken = await this.getRefreshToken(...toolContext);
+            subjectTokenType = "urn:ietf:params:oauth:token-type:refresh_token";
+        }
+        else if (typeof this.params.accessToken === "function") {
+            subjectToken = (await this.getAccessTokenWithToolContext(...toolContext));
+            subjectTokenType = "urn:ietf:params:oauth:token-type:access_token";
+        }
+        else if (typeof this.params.accessToken === "string") {
+            subjectToken = this.params.accessToken;
+            subjectTokenType = "urn:ietf:params:oauth:token-type:access_token";
+        }
+        else {
+            // This should never happen due to constructor validation, but TypeScript needs this
+            throw new Error("Either refreshToken or accessToken must be configured");
+        }
         if (!subjectToken) {
             return;
         }
+        // Get optional login hint if provided
+        const loginHint = typeof this.params.loginHint === "function"
+            ? await resolveParameter(this.params.loginHint, toolContext)
+            : undefined;
         const exchangeParams = {
             grant_type: "urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",
             client_id: this.auth0.clientId,
             client_secret: this.auth0.clientSecret,
-            subject_token_type: "urn:ietf:params:oauth:token-type:refresh_token",
+            subject_token_type: subjectTokenType,
             subject_token: subjectToken,
+            login_hint: loginHint,
             connection: connection,
             requested_token_type: "http://auth0.com/oauth/token-type/federated-connection-access-token",
         };
@@ -95,11 +134,16 @@ export class FederatedConnectionAuthorizerBase {
     }
     async getAccessToken(...toolContext) {
         let tokenResponse;
-        if (typeof this.params.refreshToken === "function") {
+        // Use token exchange for both refresh tokens and access tokens when subjectTokenType is provided
+        if (typeof this.params.refreshToken === "function" ||
+            (typeof this.params.accessToken !== "undefined" &&
+                this.params.subjectTokenType ===
+                    SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN)) {
             tokenResponse = await this.getAccessTokenImpl(...toolContext);
         }
         else {
-            tokenResponse = await resolveParameter(this.params.accessToken, toolContext);
+            // fallback to existing behavior, where third party accessToken can be provided directly
+            tokenResponse = (await resolveParameter(this.params.accessToken, toolContext));
         }
         this.validateToken(tokenResponse);
         return tokenSetFromTokenResponse(tokenResponse);
@@ -107,6 +151,9 @@ export class FederatedConnectionAuthorizerBase {
     async getRefreshToken(...toolContext) {
         return await resolveParameter(this.params.refreshToken, toolContext);
     }
+    async getAccessTokenWithToolContext(...toolContext) {
+        return await resolveParameter(this.params.accessToken, toolContext);
+    }
     /**
      *
      * Wraps the execute method of an AI tool to handle Federated Connections authorization.

package/dist/esm/authorizers/federated-connections/FederatedConnectionAuthorizerBase.js.map

@@ -1 +1 @@
-{"version":3,"file":"FederatedConnectionAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,OAAO,EAGL,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,IAAI,EAAiB,MAAM,YAAY,CAAC;AACjD,OAAO,EAAiB,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAqB,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAG3E;;GAEG;AAEH,MAAM,OAAO,iCAAiC;IAQ5C,YACE,KAAiC,EACjC,MAA4D;QAE5D,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,QAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,IACE,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW;YAC1C,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW;YACzC,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;SACpE,CAAC;QACF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,4BAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EACtF,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC;aAC9C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACnI,UAAU,EACV,MAAM,EACN,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;QAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gDAAgD;YACpE,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,gBAAgB,CACpC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,yBAAyB,CAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC;YAEF,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,aAAa,CACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;wBAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,4BAA4B,CAChD,GAAG,CAAC,OAAO,EACX,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n  TokenResponse,\n  TokenSet,\n  tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n  Auth0Interrupt,\n  FederatedConnectionError,\n  FederatedConnectionInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Federated Connection.\n */\n\nexport class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: Auth0ClientParams;\n  private readonly params: RequireFields<\n    FederatedConnectionAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n  private readonly credentialsStore: SubStore<TokenSet>;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: FederatedConnectionAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = Auth0ClientSchema.parse(auth0);\n    this.params = {\n      credentialsContext: \"thread\",\n      ...params,\n    };\n\n    const instanceID = this.getInstanceID();\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      baseNamespace: [instanceID, \"Credentials\"],\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n\n    if (\n      typeof params.refreshToken === \"undefined\" &&\n      typeof params.accessToken === \"undefined\"\n    ) {\n      throw new Error(\n        \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\"\n      );\n    }\n\n    if (\n      typeof params.accessToken !== \"undefined\" &&\n      typeof params.refreshToken !== \"undefined\"\n    ) {\n      throw new Error(\n        \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\"\n      );\n    }\n  }\n\n  private getInstanceID(): string {\n    const props = {\n      auth0: this.auth0,\n      params: omit(this.params, [\"store\", \"refreshToken\", \"accessToken\"]),\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n    throw err;\n  }\n\n  protected validateToken(tokenResponse?: TokenResponse) {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { scopes, connection } = store;\n\n    if (!tokenResponse) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}`,\n        connection,\n        scopes,\n        scopes\n      );\n    }\n\n    const currentScopes = (tokenResponse.scope ?? \"\")\n      .replace(/,/g, \" \")\n      .split(\" \");\n    const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n    store.currentScopes = currentScopes;\n\n    if (missingScopes.length > 0) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(\", \")}`,\n        connection,\n        scopes,\n        [...currentScopes, ...scopes]\n      );\n    }\n  }\n\n  private async getAccessTokenImpl(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { connection } = store;\n\n    const subjectToken = await this.getRefreshToken(...toolContext);\n\n    if (!subjectToken) {\n      return;\n    }\n\n    const exchangeParams = {\n      grant_type:\n        \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n      client_id: this.auth0.clientId,\n      client_secret: this.auth0.clientSecret,\n      subject_token_type: \"urn:ietf:params:oauth:token-type:refresh_token\",\n      subject_token: subjectToken,\n      connection: connection,\n      requested_token_type:\n        \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n    };\n\n    const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(exchangeParams),\n    });\n\n    if (!res.ok) {\n      //TODO: handle all type of response errors.\n      return;\n    }\n\n    const tokenResponse: TokenResponse = await res.json();\n    return tokenResponse;\n  }\n\n  protected async getAccessToken(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenSet> {\n    let tokenResponse: TokenResponse | undefined;\n    if (typeof this.params.refreshToken === \"function\") {\n      tokenResponse = await this.getAccessTokenImpl(...toolContext);\n    } else {\n      tokenResponse = await resolveParameter(\n        this.params.accessToken!,\n        toolContext\n      );\n    }\n    this.validateToken(tokenResponse);\n    return tokenSetFromTokenResponse(tokenResponse!);\n  }\n\n  protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n    return await resolveParameter(this.params.refreshToken, toolContext);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle Federated Connections authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const context = getContext(...args);\n      const asyncStore: AsyncStorageValue = {\n        context: context,\n        scopes: this.params.scopes,\n        connection: this.params.connection,\n      };\n\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require federated connection authorization.\"\n        );\n      }\n\n      return asyncLocalStorage.run(asyncStore, async () => {\n        const credentialsNS = nsFromContext(\n          this.params.credentialsContext,\n          context\n        );\n        try {\n          let credentials: TokenSet = await this.credentialsStore.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            credentials = await this.getAccessToken(...args);\n            await this.credentialsStore.put(\n              credentialsNS,\n              \"credential\",\n              credentials\n            );\n          }\n          asyncStore.credentials = credentials;\n          return await execute(...args);\n        } catch (err) {\n          if (err instanceof FederatedConnectionError) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            const interrupt = new FederatedConnectionInterrupt(\n              err.message,\n              asyncStore.connection,\n              asyncStore.scopes,\n              asyncStore.scopes\n            );\n            return this.handleAuthorizationInterrupts(interrupt);\n          }\n          if (err instanceof Auth0Interrupt) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            return this.handleAuthorizationInterrupts(err);\n          }\n          throw err;\n        }\n      });\n    };\n  }\n}\n"]}
+{"version":3,"file":"FederatedConnectionAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,OAAO,EAGL,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,IAAI,EAAiB,MAAM,YAAY,CAAC;AACjD,OAAO,EAAiB,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAqB,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAEL,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAE/C;;GAEG;AAEH,MAAM,OAAO,iCAAiC;IAQ5C,YACE,KAAiC,EACjC,MAA4D;QAE5D,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,QAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,CAAC;QACnE,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC;QACjE,MAAM,mBAAmB,GAAG,OAAO,MAAM,CAAC,gBAAgB,KAAK,WAAW,CAAC;QAE3E,IAAI,CAAC,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QAED,yGAAyG;QACzG,IACE,cAAc;YACd,mBAAmB;YACnB,MAAM,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,yBAAyB,EACzE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACxB,OAAO;gBACP,cAAc;gBACd,aAAa;gBACb,WAAW;aACZ,CAAC;SACH,CAAC;QACF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,4BAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EACtF,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC;aAC9C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACnI,UAAU,EACV,MAAM,EACN,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,0EAA0E;QAC1E,IAAI,YAAgC,CAAC;QACrC,IAAI,gBAAwB,CAAC;QAE7B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;YAC1D,gBAAgB,GAAG,gDAAgD,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACzD,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,6BAA6B,CACtD,GAAG,WAAW,CACf,CAAW,CAAC;YACb,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACvD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvC,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,oFAAoF;YACpF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,UAAU;YACzC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gBAAgB;YACpC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,iGAAiG;QACjG,IACE,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU;YAC9C,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;gBAC7C,IAAI,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,mBAAmB,CAAC,yBAAyB,CAAC,EAClD,CAAC;YACD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,wFAAwF;YACxF,aAAa,GAAG,CAAC,MAAM,gBAAgB,CACrC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAkB,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,yBAAyB,CAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAG,WAA4B;QAE/B,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC;YAEF,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,aAAa,CACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;wBAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,4BAA4B,CAChD,GAAG,CAAC,OAAO,EACX,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n  TokenResponse,\n  TokenSet,\n  tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n  Auth0Interrupt,\n  FederatedConnectionError,\n  FederatedConnectionInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport {\n  FederatedConnectionAuthorizerParams,\n  SUBJECT_TOKEN_TYPES,\n} from \"./FederatedConnectionAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Federated Connection.\n */\n\nexport class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: Auth0ClientParams;\n  private readonly params: RequireFields<\n    FederatedConnectionAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n  private readonly credentialsStore: SubStore<TokenSet>;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: FederatedConnectionAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = Auth0ClientSchema.parse(auth0);\n    this.params = {\n      credentialsContext: \"thread\",\n      ...params,\n    };\n\n    const instanceID = this.getInstanceID();\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      baseNamespace: [instanceID, \"Credentials\"],\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n\n    // Validate that exactly one token source is provided\n    const hasRefreshToken = typeof params.refreshToken !== \"undefined\";\n    const hasAccessToken = typeof params.accessToken !== \"undefined\";\n    const hasSubjectTokenType = typeof params.subjectTokenType !== \"undefined\";\n\n    if (!hasRefreshToken && !hasAccessToken) {\n      throw new Error(\n        \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\"\n      );\n    }\n\n    if (hasRefreshToken && hasAccessToken) {\n      throw new Error(\n        \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\"\n      );\n    }\n\n    // Validate resource server client credentials when using access tokens for token exchange w/ Token Vault\n    if (\n      hasAccessToken &&\n      hasSubjectTokenType &&\n      params.subjectTokenType === SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN\n    ) {\n      if (!this.auth0.clientId || !this.auth0.clientSecret) {\n        throw new Error(\n          \"clientId and clientSecret must currently be provided when using accessToken for token exchange with Token Vault.\"\n        );\n      }\n    }\n  }\n\n  private getInstanceID(): string {\n    const props = {\n      auth0: this.auth0,\n      params: omit(this.params, [\n        \"store\",\n        \"refreshToken\",\n        \"accessToken\",\n        \"loginHint\",\n      ]),\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n    throw err;\n  }\n\n  protected validateToken(tokenResponse?: TokenResponse) {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { scopes, connection } = store;\n\n    if (!tokenResponse) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}`,\n        connection,\n        scopes,\n        scopes\n      );\n    }\n\n    const currentScopes = (tokenResponse.scope ?? \"\")\n      .replace(/,/g, \" \")\n      .split(\" \");\n    const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n    store.currentScopes = currentScopes;\n\n    if (missingScopes.length > 0) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(\", \")}`,\n        connection,\n        scopes,\n        [...currentScopes, ...scopes]\n      );\n    }\n  }\n\n  private async getAccessTokenImpl(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { connection } = store;\n\n    // Determine which token type to use and get the appropriate subject token\n    let subjectToken: string | undefined;\n    let subjectTokenType: string;\n\n    if (typeof this.params.refreshToken === \"function\") {\n      subjectToken = await this.getRefreshToken(...toolContext);\n      subjectTokenType = \"urn:ietf:params:oauth:token-type:refresh_token\";\n    } else if (typeof this.params.accessToken === \"function\") {\n      subjectToken = (await this.getAccessTokenWithToolContext(\n        ...toolContext\n      )) as string;\n      subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n    } else if (typeof this.params.accessToken === \"string\") {\n      subjectToken = this.params.accessToken;\n      subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n    } else {\n      // This should never happen due to constructor validation, but TypeScript needs this\n      throw new Error(\"Either refreshToken or accessToken must be configured\");\n    }\n\n    if (!subjectToken) {\n      return;\n    }\n\n    // Get optional login hint if provided\n    const loginHint =\n      typeof this.params.loginHint === \"function\"\n        ? await resolveParameter(this.params.loginHint, toolContext)\n        : undefined;\n\n    const exchangeParams = {\n      grant_type:\n        \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n      client_id: this.auth0.clientId,\n      client_secret: this.auth0.clientSecret,\n      subject_token_type: subjectTokenType,\n      subject_token: subjectToken,\n      login_hint: loginHint,\n      connection: connection,\n      requested_token_type:\n        \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n    };\n\n    const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(exchangeParams),\n    });\n\n    if (!res.ok) {\n      //TODO: handle all type of response errors.\n      return;\n    }\n\n    const tokenResponse: TokenResponse = await res.json();\n    return tokenResponse;\n  }\n\n  protected async getAccessToken(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenSet> {\n    let tokenResponse: TokenResponse | undefined;\n    // Use token exchange for both refresh tokens and access tokens when subjectTokenType is provided\n    if (\n      typeof this.params.refreshToken === \"function\" ||\n      (typeof this.params.accessToken !== \"undefined\" &&\n        this.params.subjectTokenType ===\n          SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN)\n    ) {\n      tokenResponse = await this.getAccessTokenImpl(...toolContext);\n    } else {\n      // fallback to existing behavior, where third party accessToken can be provided directly\n      tokenResponse = (await resolveParameter(\n        this.params.accessToken!,\n        toolContext\n      )) as TokenResponse;\n    }\n    this.validateToken(tokenResponse);\n    return tokenSetFromTokenResponse(tokenResponse!);\n  }\n\n  protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n    return await resolveParameter(this.params.refreshToken, toolContext);\n  }\n\n  protected async getAccessTokenWithToolContext(\n    ...toolContext: ToolExecuteArgs\n  ) {\n    return await resolveParameter(this.params.accessToken, toolContext);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle Federated Connections authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const context = getContext(...args);\n      const asyncStore: AsyncStorageValue = {\n        context: context,\n        scopes: this.params.scopes,\n        connection: this.params.connection,\n      };\n\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require federated connection authorization.\"\n        );\n      }\n\n      return asyncLocalStorage.run(asyncStore, async () => {\n        const credentialsNS = nsFromContext(\n          this.params.credentialsContext,\n          context\n        );\n        try {\n          let credentials: TokenSet = await this.credentialsStore.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            credentials = await this.getAccessToken(...args);\n            await this.credentialsStore.put(\n              credentialsNS,\n              \"credential\",\n              credentials\n            );\n          }\n          asyncStore.credentials = credentials;\n          return await execute(...args);\n        } catch (err) {\n          if (err instanceof FederatedConnectionError) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            const interrupt = new FederatedConnectionInterrupt(\n              err.message,\n              asyncStore.connection,\n              asyncStore.scopes,\n              asyncStore.scopes\n            );\n            return this.handleAuthorizationInterrupts(interrupt);\n          }\n          if (err instanceof Auth0Interrupt) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            return this.handleAuthorizationInterrupts(err);\n          }\n          throw err;\n        }\n      });\n    };\n  }\n}\n"]}

package/dist/esm/authorizers/federated-connections/FederatedConnectionAuthorizerParams.d.ts

@@ -2,6 +2,20 @@ import { TokenResponse } from "../../credentials";
 import { AuthorizerToolParameter } from "../../parameters";
 import { Store } from "../../stores";
 import { AuthContext } from "../context";
+export declare enum SUBJECT_TOKEN_TYPES {
+    /**
+     * Indicates that the token is an OAuth 2.0 refresh token issued by the given authorization server.
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.4 RFC 8693 Section 3-3.4}
+     */
+    SUBJECT_TYPE_REFRESH_TOKEN = "urn:ietf:params:oauth:token-type:refresh_token",
+    /**
+     * Indicates that the token is an OAuth 2.0 access token issued by the given authorization server.
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.2 RFC 8693 Section 3-3.2}
+     */
+    SUBJECT_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token"
+}
 export type FederatedConnectionAuthorizerParams<ToolExecuteArgs extends any[]> = {
     /**
      * The Auth0 refresh token to exchange for an Federated Connection access token.
@@ -9,8 +23,17 @@ export type FederatedConnectionAuthorizerParams<ToolExecuteArgs extends any[]> =
     refreshToken?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;
     /**
      * The Federated connection access token if available in the tool context.
+     * This can also be provided as a string exchange when exchanging an access token for a Federated Connection access token.
+     */
+    accessToken?: AuthorizerToolParameter<ToolExecuteArgs, TokenResponse | string | undefined> | string | undefined;
+    /**
+     * This is used to specify the type of token being requested from Auth0 during the OAuth 2.0 token exchange request.
+     */
+    subjectTokenType?: SUBJECT_TOKEN_TYPES | undefined;
+    /**
+     * Optional login hint to provide when exchanging an access or refresh token for a Federated Connection access token.
      */
-    accessToken?: AuthorizerToolParameter<ToolExecuteArgs, TokenResponse | undefined>;
+    loginHint?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;
     /**
      * The scopes required in the access token of the federated connection provider.
      */

package/dist/esm/authorizers/federated-connections/FederatedConnectionAuthorizerParams.js

@@ -1,2 +1,16 @@
-export {};
+export var SUBJECT_TOKEN_TYPES;
+(function (SUBJECT_TOKEN_TYPES) {
+    /**
+     * Indicates that the token is an OAuth 2.0 refresh token issued by the given authorization server.
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.4 RFC 8693 Section 3-3.4}
+     */
+    SUBJECT_TOKEN_TYPES["SUBJECT_TYPE_REFRESH_TOKEN"] = "urn:ietf:params:oauth:token-type:refresh_token";
+    /**
+     * Indicates that the token is an OAuth 2.0 access token issued by the given authorization server.
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.2 RFC 8693 Section 3-3.2}
+     */
+    SUBJECT_TOKEN_TYPES["SUBJECT_TYPE_ACCESS_TOKEN"] = "urn:ietf:params:oauth:token-type:access_token";
+})(SUBJECT_TOKEN_TYPES || (SUBJECT_TOKEN_TYPES = {}));
 //# sourceMappingURL=FederatedConnectionAuthorizerParams.js.map

package/dist/esm/authorizers/federated-connections/FederatedConnectionAuthorizerParams.js.map

@@ -1 +1 @@
-{"version":3,"file":"FederatedConnectionAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { TokenResponse } from \"../../credentials\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { Store } from \"../../stores\";\nimport { AuthContext } from \"../context\";\n\nexport type FederatedConnectionAuthorizerParams<ToolExecuteArgs extends any[]> =\n  {\n    /**\n     * The Auth0 refresh token to exchange for an Federated Connection access token.\n     */\n    refreshToken?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;\n\n    /**\n     * The Federated connection access token if available in the tool context.\n     */\n    accessToken?: AuthorizerToolParameter<\n      ToolExecuteArgs,\n      TokenResponse | undefined\n    >;\n\n    /**\n     * The scopes required in the access token of the federated connection provider.\n     */\n    scopes: string[];\n\n    /**\n     * The connection name of the federated connection provider.\n     */\n    connection: string;\n\n    /**\n     * AuthContext defines the scope of credential sharing:\n     * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n     * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n     * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n     * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n     *\n     * @default \"thread\"\n     */\n    credentialsContext?: AuthContext;\n\n    /**\n     * An store used to store the authorization credentials according\n     * to the `credentialsContext` scope.\n     */\n    store: Store;\n  };\n"]}
+{"version":3,"file":"FederatedConnectionAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerParams.ts"],"names":[],"mappings":"AAKA,MAAM,CAAN,IAAY,mBAcX;AAdD,WAAY,mBAAmB;IAC7B;;;;OAIG;IACH,oGAA6E,CAAA;IAE7E;;;;OAIG;IACH,kGAA2E,CAAA;AAC7E,CAAC,EAdW,mBAAmB,KAAnB,mBAAmB,QAc9B","sourcesContent":["import { TokenResponse } from \"../../credentials\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { Store } from \"../../stores\";\nimport { AuthContext } from \"../context\";\n\nexport enum SUBJECT_TOKEN_TYPES {\n  /**\n   * Indicates that the token is an OAuth 2.0 refresh token issued by the given authorization server.\n   *\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.4 RFC 8693 Section 3-3.4}\n   */\n  SUBJECT_TYPE_REFRESH_TOKEN = \"urn:ietf:params:oauth:token-type:refresh_token\",\n\n  /**\n   * Indicates that the token is an OAuth 2.0 access token issued by the given authorization server.\n   *\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.2 RFC 8693 Section 3-3.2}\n   */\n  SUBJECT_TYPE_ACCESS_TOKEN = \"urn:ietf:params:oauth:token-type:access_token\",\n}\n\nexport type FederatedConnectionAuthorizerParams<ToolExecuteArgs extends any[]> =\n  {\n    /**\n     * The Auth0 refresh token to exchange for an Federated Connection access token.\n     */\n    refreshToken?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;\n\n    /**\n     * The Federated connection access token if available in the tool context.\n     * This can also be provided as a string exchange when exchanging an access token for a Federated Connection access token.\n     */\n    accessToken?:\n      | AuthorizerToolParameter<\n          ToolExecuteArgs,\n          TokenResponse | string | undefined\n        >\n      | string\n      | undefined;\n\n    /**\n     * This is used to specify the type of token being requested from Auth0 during the OAuth 2.0 token exchange request.\n     */\n    subjectTokenType?: SUBJECT_TOKEN_TYPES | undefined;\n\n    /**\n     * Optional login hint to provide when exchanging an access or refresh token for a Federated Connection access token.\n     */\n    loginHint?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;\n\n    /**\n     * The scopes required in the access token of the federated connection provider.\n     */\n    scopes: string[];\n\n    /**\n     * The connection name of the federated connection provider.\n     */\n    connection: string;\n\n    /**\n     * AuthContext defines the scope of credential sharing:\n     * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n     * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n     * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n     * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n     *\n     * @default \"thread\"\n     */\n    credentialsContext?: AuthContext;\n\n    /**\n     * An store used to store the authorization credentials according\n     * to the `credentialsContext` scope.\n     */\n    store: Store;\n  };\n"]}

package/dist/esm/authorizers/federated-connections/index.d.ts

@@ -2,4 +2,5 @@ export type { AsyncStorageValue } from "./asyncLocalStorage";
 export { asyncLocalStorage, getCredentialsForConnection, getAccessTokenForConnection, } from "./asyncLocalStorage";
 export { FederatedConnectionAuthorizerBase } from "./FederatedConnectionAuthorizerBase";
 export type { FederatedConnectionAuthorizerParams } from "./FederatedConnectionAuthorizerParams";
+export { SUBJECT_TOKEN_TYPES } from "./FederatedConnectionAuthorizerParams";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/authorizers/federated-connections/index.js

@@ -1,3 +1,4 @@
 export { asyncLocalStorage, getCredentialsForConnection, getAccessTokenForConnection, } from "./asyncLocalStorage";
 export { FederatedConnectionAuthorizerBase } from "./FederatedConnectionAuthorizerBase";
+export { SUBJECT_TOKEN_TYPES } from "./FederatedConnectionAuthorizerParams";
 //# sourceMappingURL=index.js.map

package/dist/esm/authorizers/federated-connections/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC","sourcesContent":["export type { AsyncStorageValue } from \"./asyncLocalStorage\";\n\nexport {\n  asyncLocalStorage,\n  getCredentialsForConnection,\n  getAccessTokenForConnection,\n} from \"./asyncLocalStorage\";\n\nexport { FederatedConnectionAuthorizerBase } from \"./FederatedConnectionAuthorizerBase\";\n\nexport type { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAIxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC","sourcesContent":["export type { AsyncStorageValue } from \"./asyncLocalStorage\";\n\nexport {\n  asyncLocalStorage,\n  getCredentialsForConnection,\n  getAccessTokenForConnection,\n} from \"./asyncLocalStorage\";\n\nexport { FederatedConnectionAuthorizerBase } from \"./FederatedConnectionAuthorizerBase\";\n\nexport type { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n\nexport { SUBJECT_TOKEN_TYPES } from \"./FederatedConnectionAuthorizerParams\";\n"]}

package/dist/esm/index.d.ts

@@ -1,6 +1,7 @@
 export type { AuthParams, Auth0ClientParams } from "./authorizers/types";
 export type * from "./credentials";
 export * from "./errors";
+export { SUBJECT_TOKEN_TYPES } from "./authorizers/federated-connections";
 export * from "./authorizers/fga/fga-filter";
 export * from "./authorizers/fga/fga-client";
 export * from "./parameters";

package/dist/esm/index.js

@@ -1,4 +1,5 @@
 export * from "./errors";
+export { SUBJECT_TOKEN_TYPES } from "./authorizers/federated-connections";
 export * from "./authorizers/fga/fga-filter";
 export * from "./authorizers/fga/fga-client";
 export * from "./parameters";

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,UAAU,CAAC;AACzB,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,cAAc,CAAC","sourcesContent":["export type { AuthParams, Auth0ClientParams } from \"./authorizers/types\";\nexport type * from \"./credentials\";\nexport * from \"./errors\";\nexport * from \"./authorizers/fga/fga-filter\";\nexport * from \"./authorizers/fga/fga-client\";\nexport * from \"./parameters\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,UAAU,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,cAAc,CAAC","sourcesContent":["export type { AuthParams, Auth0ClientParams } from \"./authorizers/types\";\nexport type * from \"./credentials\";\nexport * from \"./errors\";\nexport { SUBJECT_TOKEN_TYPES } from \"./authorizers/federated-connections\";\nexport * from \"./authorizers/fga/fga-filter\";\nexport * from \"./authorizers/fga/fga-client\";\nexport * from \"./parameters\";\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth0/ai",
-  "version": "3.4.1",
+  "version": "3.5.0",
   "description": "Auth0AI SDK for JavaScript",
   "types": "dist/esm/index.d.ts",
   "main": "dist/cjs/index.js",