@auth0/ai 5.1.0 → 5.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/authorizers/token-vault/TokenVaultAuthorizerBase.js +1 -1
- package/dist/cjs/authorizers/token-vault/TokenVaultAuthorizerBase.js.map +1 -1
- package/dist/esm/authorizers/token-vault/TokenVaultAuthorizerBase.js +1 -1
- package/dist/esm/authorizers/token-vault/TokenVaultAuthorizerBase.js.map +1 -1
- package/package.json +1 -1
|
@@ -89,7 +89,7 @@ class TokenVaultAuthorizerBase {
|
|
|
89
89
|
throw new interrupts_1.TokenVaultInterrupt(`Authorization required to access the Token Vault: ${this.params.connection}. Authorized scopes: ${currentScopes.join(", ")}. Missing scopes: ${missingScopes.join(", ")}`, {
|
|
90
90
|
connection,
|
|
91
91
|
scopes,
|
|
92
|
-
requiredScopes: [...currentScopes, ...
|
|
92
|
+
requiredScopes: [...currentScopes, ...missingScopes],
|
|
93
93
|
authorizationParams,
|
|
94
94
|
});
|
|
95
95
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TokenVaultAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/token-vault/TokenVaultAuthorizerBase.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAC5B,8DAAqC;AAErC,mDAI2B;AAC3B,iDAI0B;AAC1B,iDAAoD;AACpD,yCAAwC;AACxC,qCAAiD;AACjD,wCAA0D;AAC1D,oCAAgE;AAChE,2DAA2E;AAC3E,6EAGsC;AAEtC;;GAEG;AAEH,MAAa,wBAAwB;IAQnC,YACE,KAAiC,EACjC,MAAmD;QAEnD,IAAI,CAAC,KAAK,GAAG,yBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,iBAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,CAAC;QACnE,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC;QACjE,MAAM,mBAAmB,GAAG,OAAO,MAAM,CAAC,gBAAgB,KAAK,WAAW,CAAC;QAE3E,IAAI,CAAC,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QAED,yGAAyG;QACzG,IACE,cAAc;YACd,mBAAmB;YACnB,MAAM,CAAC,gBAAgB,KAAK,gDAAmB,CAAC,yBAAyB,EACzE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,EAAE;gBACxB,OAAO;gBACP,cAAc;gBACd,aAAa;gBACb,WAAW;aACZ,CAAC;SACH,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,qBAAU,EAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC;QAE1D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,gCAAmB,CAC3B,qDAAqD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAC7E;gBACE,UAAU;gBACV,MAAM;gBACN,cAAc,EAAE,MAAM;gBACtB,mBAAmB;aACpB,CACF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC;aAC9C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,gCAAmB,CAC3B,qDAAqD,IAAI,CAAC,MAAM,CAAC,UAAU,wBAAwB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1K;gBACE,UAAU;gBACV,MAAM;gBACN,cAAc,EAAE,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC;gBAC7C,mBAAmB;aACpB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,0EAA0E;QAC1E,IAAI,YAAgC,CAAC;QACrC,IAAI,gBAAwB,CAAC;QAE7B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;YAC1D,gBAAgB,GAAG,gDAAgD,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACzD,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,6BAA6B,CACtD,GAAG,WAAW,CACf,CAAW,CAAC;YACb,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACvD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvC,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,oFAAoF;YACpF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,UAAU;YACzC,CAAC,CAAC,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gBAAgB;YACpC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,iGAAiG;QACjG,IACE,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU;YAC9C,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;gBAC7C,IAAI,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,gDAAmB,CAAC,yBAAyB,CAAC,EAClD,CAAC;YACD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,wFAAwF;YACxF,aAAa,GAAG,CAAC,MAAM,IAAA,6BAAgB,EACrC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAkB,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,IAAA,uCAAyB,EAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAG,WAA4B;QAE/B,OAAO,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAClC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;aACrD,CAAC;YAEF,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;YAED,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,IAAA,uBAAa,EACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,4BAAe,EAAE,CAAC;wBACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,gCAAmB,CAAC,GAAG,CAAC,OAAO,EAAE;4BACrD,UAAU,EAAE,UAAU,CAAC,UAAU;4BACjC,MAAM,EAAE,UAAU,CAAC,MAAM;4BACzB,cAAc,EAAE,UAAU,CAAC,MAAM;4BACjC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;yBACpD,CAAC,CAAC;wBACH,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,2BAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF;AA9RD,4DA8RC","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n TokenResponse,\n TokenSet,\n tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n Auth0Interrupt,\n TokenVaultError,\n TokenVaultInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport {\n SUBJECT_TOKEN_TYPES,\n TokenVaultAuthorizerParams,\n} from \"./TokenVaultAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Token Vault.\n */\n\nexport class TokenVaultAuthorizerBase<ToolExecuteArgs extends any[]> {\n private readonly auth0: Auth0ClientParams;\n private readonly params: RequireFields<\n TokenVaultAuthorizerParams<ToolExecuteArgs>,\n \"credentialsContext\"\n >;\n private readonly credentialsStore: SubStore<TokenSet>;\n\n constructor(\n auth0: Partial<Auth0ClientParams>,\n params: TokenVaultAuthorizerParams<ToolExecuteArgs>,\n ) {\n this.auth0 = Auth0ClientSchema.parse(auth0);\n this.params = {\n credentialsContext: \"thread\",\n ...params,\n };\n\n const instanceID = this.getInstanceID();\n\n this.credentialsStore = new SubStore<TokenSet>(params.store, {\n baseNamespace: [instanceID, \"Credentials\"],\n getTTL: (credentials) =>\n credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n });\n\n // Validate that exactly one token source is provided\n const hasRefreshToken = typeof params.refreshToken !== \"undefined\";\n const hasAccessToken = typeof params.accessToken !== \"undefined\";\n const hasSubjectTokenType = typeof params.subjectTokenType !== \"undefined\";\n\n if (!hasRefreshToken && !hasAccessToken) {\n throw new Error(\n \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\",\n );\n }\n\n if (hasRefreshToken && hasAccessToken) {\n throw new Error(\n \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\",\n );\n }\n\n // Validate resource server client credentials when using access tokens for token exchange w/ Token Vault\n if (\n hasAccessToken &&\n hasSubjectTokenType &&\n params.subjectTokenType === SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN\n ) {\n if (!this.auth0.clientId || !this.auth0.clientSecret) {\n throw new Error(\n \"clientId and clientSecret must currently be provided when using accessToken for token exchange with Token Vault.\",\n );\n }\n }\n }\n\n private getInstanceID(): string {\n const props = {\n auth0: this.auth0,\n params: omit(this.params, [\n \"store\",\n \"refreshToken\",\n \"accessToken\",\n \"loginHint\",\n ]),\n };\n const sh = stableHash(props);\n return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n }\n\n protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n throw err;\n }\n\n protected validateToken(tokenResponse?: TokenResponse) {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\n \"The tool must be wrapped with the FederationConnectionAuthorizer.\",\n );\n }\n\n const { scopes, connection, authorizationParams } = store;\n\n if (!tokenResponse) {\n throw new TokenVaultInterrupt(\n `Authorization required to access the Token Vault: ${this.params.connection}`,\n {\n connection,\n scopes,\n requiredScopes: scopes,\n authorizationParams,\n },\n );\n }\n\n const currentScopes = (tokenResponse.scope ?? \"\")\n .replace(/,/g, \" \")\n .split(\" \");\n const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n store.currentScopes = currentScopes;\n\n if (missingScopes.length > 0) {\n throw new TokenVaultInterrupt(\n `Authorization required to access the Token Vault: ${this.params.connection}. Authorized scopes: ${currentScopes.join(\", \")}. Missing scopes: ${missingScopes.join(\", \")}`,\n {\n connection,\n scopes,\n requiredScopes: [...currentScopes, ...scopes],\n authorizationParams,\n },\n );\n }\n }\n\n private async getAccessTokenImpl(\n ...toolContext: ToolExecuteArgs\n ): Promise<TokenResponse | undefined> {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\n \"The tool must be wrapped with the FederationConnectionAuthorizer.\",\n );\n }\n\n const { connection } = store;\n\n // Determine which token type to use and get the appropriate subject token\n let subjectToken: string | undefined;\n let subjectTokenType: string;\n\n if (typeof this.params.refreshToken === \"function\") {\n subjectToken = await this.getRefreshToken(...toolContext);\n subjectTokenType = \"urn:ietf:params:oauth:token-type:refresh_token\";\n } else if (typeof this.params.accessToken === \"function\") {\n subjectToken = (await this.getAccessTokenWithToolContext(\n ...toolContext,\n )) as string;\n subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n } else if (typeof this.params.accessToken === \"string\") {\n subjectToken = this.params.accessToken;\n subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n } else {\n // This should never happen due to constructor validation, but TypeScript needs this\n throw new Error(\"Either refreshToken or accessToken must be configured\");\n }\n\n if (!subjectToken) {\n return;\n }\n\n // Get optional login hint if provided\n const loginHint =\n typeof this.params.loginHint === \"function\"\n ? await resolveParameter(this.params.loginHint, toolContext)\n : undefined;\n\n const exchangeParams = {\n grant_type:\n \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n client_id: this.auth0.clientId,\n client_secret: this.auth0.clientSecret,\n subject_token_type: subjectTokenType,\n subject_token: subjectToken,\n login_hint: loginHint,\n connection: connection,\n requested_token_type:\n \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n };\n\n const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(exchangeParams),\n });\n\n if (!res.ok) {\n //TODO: handle all type of response errors.\n return;\n }\n\n const tokenResponse: TokenResponse = await res.json();\n return tokenResponse;\n }\n\n protected async getAccessToken(\n ...toolContext: ToolExecuteArgs\n ): Promise<TokenSet> {\n let tokenResponse: TokenResponse | undefined;\n // Use token exchange for both refresh tokens and access tokens when subjectTokenType is provided\n if (\n typeof this.params.refreshToken === \"function\" ||\n (typeof this.params.accessToken !== \"undefined\" &&\n this.params.subjectTokenType ===\n SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN)\n ) {\n tokenResponse = await this.getAccessTokenImpl(...toolContext);\n } else {\n // fallback to existing behavior, where third party accessToken can be provided directly\n tokenResponse = (await resolveParameter(\n this.params.accessToken!,\n toolContext,\n )) as TokenResponse;\n }\n this.validateToken(tokenResponse);\n return tokenSetFromTokenResponse(tokenResponse!);\n }\n\n protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n return await resolveParameter(this.params.refreshToken, toolContext);\n }\n\n protected async getAccessTokenWithToolContext(\n ...toolContext: ToolExecuteArgs\n ) {\n return await resolveParameter(this.params.accessToken, toolContext);\n }\n\n /**\n *\n * Wraps the execute method of an AI tool to handle Token Vaults authorization.\n *\n * @param getContext - A function that returns the context of the tool execution.\n * @param execute - The tool execute method.\n * @returns The wrapped execute method.\n */\n protect(\n getContext: ContextGetter<ToolExecuteArgs>,\n execute: (...args: ToolExecuteArgs) => any,\n ): (...args: ToolExecuteArgs) => any {\n return async (...args: ToolExecuteArgs) => {\n const context = getContext(...args);\n const asyncStore: AsyncStorageValue = {\n context: context,\n scopes: this.params.scopes,\n connection: this.params.connection,\n authorizationParams: this.params.authorizationParams,\n };\n\n if (asyncLocalStorage.getStore()) {\n throw new Error(\n \"Cannot nest tool calls that require Token Vault authorization.\",\n );\n }\n\n return asyncLocalStorage.run(asyncStore, async () => {\n const credentialsNS = nsFromContext(\n this.params.credentialsContext,\n context,\n );\n try {\n let credentials: TokenSet = await this.credentialsStore.get(\n credentialsNS,\n \"credential\",\n );\n if (!credentials) {\n credentials = await this.getAccessToken(...args);\n await this.credentialsStore.put(\n credentialsNS,\n \"credential\",\n credentials,\n );\n }\n asyncStore.credentials = credentials;\n return await execute(...args);\n } catch (err) {\n if (err instanceof TokenVaultError) {\n this.credentialsStore.delete(credentialsNS, \"credential\");\n const interrupt = new TokenVaultInterrupt(err.message, {\n connection: asyncStore.connection,\n scopes: asyncStore.scopes,\n requiredScopes: asyncStore.scopes,\n authorizationParams: asyncStore.authorizationParams,\n });\n return this.handleAuthorizationInterrupts(interrupt);\n }\n if (err instanceof Auth0Interrupt) {\n this.credentialsStore.delete(credentialsNS, \"credential\");\n return this.handleAuthorizationInterrupts(err);\n }\n throw err;\n }\n });\n };\n }\n}\n"]}
|
|
1
|
+
{"version":3,"file":"TokenVaultAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/token-vault/TokenVaultAuthorizerBase.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAC5B,8DAAqC;AAErC,mDAI2B;AAC3B,iDAI0B;AAC1B,iDAAoD;AACpD,yCAAwC;AACxC,qCAAiD;AACjD,wCAA0D;AAC1D,oCAAgE;AAChE,2DAA2E;AAC3E,6EAGsC;AAEtC;;GAEG;AAEH,MAAa,wBAAwB;IAQnC,YACE,KAAiC,EACjC,MAAmD;QAEnD,IAAI,CAAC,KAAK,GAAG,yBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,iBAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,CAAC;QACnE,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC;QACjE,MAAM,mBAAmB,GAAG,OAAO,MAAM,CAAC,gBAAgB,KAAK,WAAW,CAAC;QAE3E,IAAI,CAAC,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QAED,yGAAyG;QACzG,IACE,cAAc;YACd,mBAAmB;YACnB,MAAM,CAAC,gBAAgB,KAAK,gDAAmB,CAAC,yBAAyB,EACzE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,EAAE;gBACxB,OAAO;gBACP,cAAc;gBACd,aAAa;gBACb,WAAW;aACZ,CAAC;SACH,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,qBAAU,EAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC;QAE1D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,gCAAmB,CAC3B,qDAAqD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAC7E;gBACE,UAAU;gBACV,MAAM;gBACN,cAAc,EAAE,MAAM;gBACtB,mBAAmB;aACpB,CACF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC;aAC9C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,gCAAmB,CAC3B,qDAAqD,IAAI,CAAC,MAAM,CAAC,UAAU,wBAAwB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1K;gBACE,UAAU;gBACV,MAAM;gBACN,cAAc,EAAE,CAAC,GAAG,aAAa,EAAE,GAAG,aAAa,CAAC;gBACpD,mBAAmB;aACpB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,0EAA0E;QAC1E,IAAI,YAAgC,CAAC;QACrC,IAAI,gBAAwB,CAAC;QAE7B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;YAC1D,gBAAgB,GAAG,gDAAgD,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACzD,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,6BAA6B,CACtD,GAAG,WAAW,CACf,CAAW,CAAC;YACb,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACvD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvC,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,oFAAoF;YACpF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,UAAU;YACzC,CAAC,CAAC,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gBAAgB;YACpC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,iGAAiG;QACjG,IACE,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU;YAC9C,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;gBAC7C,IAAI,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,gDAAmB,CAAC,yBAAyB,CAAC,EAClD,CAAC;YACD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,wFAAwF;YACxF,aAAa,GAAG,CAAC,MAAM,IAAA,6BAAgB,EACrC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAkB,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,IAAA,uCAAyB,EAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAG,WAA4B;QAE/B,OAAO,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAClC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;aACrD,CAAC;YAEF,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;YAED,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,IAAA,uBAAa,EACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,4BAAe,EAAE,CAAC;wBACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,gCAAmB,CAAC,GAAG,CAAC,OAAO,EAAE;4BACrD,UAAU,EAAE,UAAU,CAAC,UAAU;4BACjC,MAAM,EAAE,UAAU,CAAC,MAAM;4BACzB,cAAc,EAAE,UAAU,CAAC,MAAM;4BACjC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;yBACpD,CAAC,CAAC;wBACH,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,2BAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF;AA9RD,4DA8RC","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n TokenResponse,\n TokenSet,\n tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n Auth0Interrupt,\n TokenVaultError,\n TokenVaultInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport {\n SUBJECT_TOKEN_TYPES,\n TokenVaultAuthorizerParams,\n} from \"./TokenVaultAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Token Vault.\n */\n\nexport class TokenVaultAuthorizerBase<ToolExecuteArgs extends any[]> {\n private readonly auth0: Auth0ClientParams;\n private readonly params: RequireFields<\n TokenVaultAuthorizerParams<ToolExecuteArgs>,\n \"credentialsContext\"\n >;\n private readonly credentialsStore: SubStore<TokenSet>;\n\n constructor(\n auth0: Partial<Auth0ClientParams>,\n params: TokenVaultAuthorizerParams<ToolExecuteArgs>,\n ) {\n this.auth0 = Auth0ClientSchema.parse(auth0);\n this.params = {\n credentialsContext: \"thread\",\n ...params,\n };\n\n const instanceID = this.getInstanceID();\n\n this.credentialsStore = new SubStore<TokenSet>(params.store, {\n baseNamespace: [instanceID, \"Credentials\"],\n getTTL: (credentials) =>\n credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n });\n\n // Validate that exactly one token source is provided\n const hasRefreshToken = typeof params.refreshToken !== \"undefined\";\n const hasAccessToken = typeof params.accessToken !== \"undefined\";\n const hasSubjectTokenType = typeof params.subjectTokenType !== \"undefined\";\n\n if (!hasRefreshToken && !hasAccessToken) {\n throw new Error(\n \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\",\n );\n }\n\n if (hasRefreshToken && hasAccessToken) {\n throw new Error(\n \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\",\n );\n }\n\n // Validate resource server client credentials when using access tokens for token exchange w/ Token Vault\n if (\n hasAccessToken &&\n hasSubjectTokenType &&\n params.subjectTokenType === SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN\n ) {\n if (!this.auth0.clientId || !this.auth0.clientSecret) {\n throw new Error(\n \"clientId and clientSecret must currently be provided when using accessToken for token exchange with Token Vault.\",\n );\n }\n }\n }\n\n private getInstanceID(): string {\n const props = {\n auth0: this.auth0,\n params: omit(this.params, [\n \"store\",\n \"refreshToken\",\n \"accessToken\",\n \"loginHint\",\n ]),\n };\n const sh = stableHash(props);\n return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n }\n\n protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n throw err;\n }\n\n protected validateToken(tokenResponse?: TokenResponse) {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\n \"The tool must be wrapped with the FederationConnectionAuthorizer.\",\n );\n }\n\n const { scopes, connection, authorizationParams } = store;\n\n if (!tokenResponse) {\n throw new TokenVaultInterrupt(\n `Authorization required to access the Token Vault: ${this.params.connection}`,\n {\n connection,\n scopes,\n requiredScopes: scopes,\n authorizationParams,\n },\n );\n }\n\n const currentScopes = (tokenResponse.scope ?? \"\")\n .replace(/,/g, \" \")\n .split(\" \");\n const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n store.currentScopes = currentScopes;\n\n if (missingScopes.length > 0) {\n throw new TokenVaultInterrupt(\n `Authorization required to access the Token Vault: ${this.params.connection}. Authorized scopes: ${currentScopes.join(\", \")}. Missing scopes: ${missingScopes.join(\", \")}`,\n {\n connection,\n scopes,\n requiredScopes: [...currentScopes, ...missingScopes],\n authorizationParams,\n },\n );\n }\n }\n\n private async getAccessTokenImpl(\n ...toolContext: ToolExecuteArgs\n ): Promise<TokenResponse | undefined> {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\n \"The tool must be wrapped with the FederationConnectionAuthorizer.\",\n );\n }\n\n const { connection } = store;\n\n // Determine which token type to use and get the appropriate subject token\n let subjectToken: string | undefined;\n let subjectTokenType: string;\n\n if (typeof this.params.refreshToken === \"function\") {\n subjectToken = await this.getRefreshToken(...toolContext);\n subjectTokenType = \"urn:ietf:params:oauth:token-type:refresh_token\";\n } else if (typeof this.params.accessToken === \"function\") {\n subjectToken = (await this.getAccessTokenWithToolContext(\n ...toolContext,\n )) as string;\n subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n } else if (typeof this.params.accessToken === \"string\") {\n subjectToken = this.params.accessToken;\n subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n } else {\n // This should never happen due to constructor validation, but TypeScript needs this\n throw new Error(\"Either refreshToken or accessToken must be configured\");\n }\n\n if (!subjectToken) {\n return;\n }\n\n // Get optional login hint if provided\n const loginHint =\n typeof this.params.loginHint === \"function\"\n ? await resolveParameter(this.params.loginHint, toolContext)\n : undefined;\n\n const exchangeParams = {\n grant_type:\n \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n client_id: this.auth0.clientId,\n client_secret: this.auth0.clientSecret,\n subject_token_type: subjectTokenType,\n subject_token: subjectToken,\n login_hint: loginHint,\n connection: connection,\n requested_token_type:\n \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n };\n\n const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(exchangeParams),\n });\n\n if (!res.ok) {\n //TODO: handle all type of response errors.\n return;\n }\n\n const tokenResponse: TokenResponse = await res.json();\n return tokenResponse;\n }\n\n protected async getAccessToken(\n ...toolContext: ToolExecuteArgs\n ): Promise<TokenSet> {\n let tokenResponse: TokenResponse | undefined;\n // Use token exchange for both refresh tokens and access tokens when subjectTokenType is provided\n if (\n typeof this.params.refreshToken === \"function\" ||\n (typeof this.params.accessToken !== \"undefined\" &&\n this.params.subjectTokenType ===\n SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN)\n ) {\n tokenResponse = await this.getAccessTokenImpl(...toolContext);\n } else {\n // fallback to existing behavior, where third party accessToken can be provided directly\n tokenResponse = (await resolveParameter(\n this.params.accessToken!,\n toolContext,\n )) as TokenResponse;\n }\n this.validateToken(tokenResponse);\n return tokenSetFromTokenResponse(tokenResponse!);\n }\n\n protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n return await resolveParameter(this.params.refreshToken, toolContext);\n }\n\n protected async getAccessTokenWithToolContext(\n ...toolContext: ToolExecuteArgs\n ) {\n return await resolveParameter(this.params.accessToken, toolContext);\n }\n\n /**\n *\n * Wraps the execute method of an AI tool to handle Token Vaults authorization.\n *\n * @param getContext - A function that returns the context of the tool execution.\n * @param execute - The tool execute method.\n * @returns The wrapped execute method.\n */\n protect(\n getContext: ContextGetter<ToolExecuteArgs>,\n execute: (...args: ToolExecuteArgs) => any,\n ): (...args: ToolExecuteArgs) => any {\n return async (...args: ToolExecuteArgs) => {\n const context = getContext(...args);\n const asyncStore: AsyncStorageValue = {\n context: context,\n scopes: this.params.scopes,\n connection: this.params.connection,\n authorizationParams: this.params.authorizationParams,\n };\n\n if (asyncLocalStorage.getStore()) {\n throw new Error(\n \"Cannot nest tool calls that require Token Vault authorization.\",\n );\n }\n\n return asyncLocalStorage.run(asyncStore, async () => {\n const credentialsNS = nsFromContext(\n this.params.credentialsContext,\n context,\n );\n try {\n let credentials: TokenSet = await this.credentialsStore.get(\n credentialsNS,\n \"credential\",\n );\n if (!credentials) {\n credentials = await this.getAccessToken(...args);\n await this.credentialsStore.put(\n credentialsNS,\n \"credential\",\n credentials,\n );\n }\n asyncStore.credentials = credentials;\n return await execute(...args);\n } catch (err) {\n if (err instanceof TokenVaultError) {\n this.credentialsStore.delete(credentialsNS, \"credential\");\n const interrupt = new TokenVaultInterrupt(err.message, {\n connection: asyncStore.connection,\n scopes: asyncStore.scopes,\n requiredScopes: asyncStore.scopes,\n authorizationParams: asyncStore.authorizationParams,\n });\n return this.handleAuthorizationInterrupts(interrupt);\n }\n if (err instanceof Auth0Interrupt) {\n this.credentialsStore.delete(credentialsNS, \"credential\");\n return this.handleAuthorizationInterrupts(err);\n }\n throw err;\n }\n });\n };\n }\n}\n"]}
|
|
@@ -83,7 +83,7 @@ export class TokenVaultAuthorizerBase {
|
|
|
83
83
|
throw new TokenVaultInterrupt(`Authorization required to access the Token Vault: ${this.params.connection}. Authorized scopes: ${currentScopes.join(", ")}. Missing scopes: ${missingScopes.join(", ")}`, {
|
|
84
84
|
connection,
|
|
85
85
|
scopes,
|
|
86
|
-
requiredScopes: [...currentScopes, ...
|
|
86
|
+
requiredScopes: [...currentScopes, ...missingScopes],
|
|
87
87
|
authorizationParams,
|
|
88
88
|
});
|
|
89
89
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TokenVaultAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/token-vault/TokenVaultAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,OAAO,EAGL,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,eAAe,EACf,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,IAAI,EAAiB,MAAM,YAAY,CAAC;AACjD,OAAO,EAAiB,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAqB,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC;;GAEG;AAEH,MAAM,OAAO,wBAAwB;IAQnC,YACE,KAAiC,EACjC,MAAmD;QAEnD,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,QAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,CAAC;QACnE,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC;QACjE,MAAM,mBAAmB,GAAG,OAAO,MAAM,CAAC,gBAAgB,KAAK,WAAW,CAAC;QAE3E,IAAI,CAAC,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QAED,yGAAyG;QACzG,IACE,cAAc;YACd,mBAAmB;YACnB,MAAM,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,yBAAyB,EACzE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACxB,OAAO;gBACP,cAAc;gBACd,aAAa;gBACb,WAAW;aACZ,CAAC;SACH,CAAC;QACF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC;QAE1D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAC3B,qDAAqD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAC7E;gBACE,UAAU;gBACV,MAAM;gBACN,cAAc,EAAE,MAAM;gBACtB,mBAAmB;aACpB,CACF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC;aAC9C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,mBAAmB,CAC3B,qDAAqD,IAAI,CAAC,MAAM,CAAC,UAAU,wBAAwB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1K;gBACE,UAAU;gBACV,MAAM;gBACN,cAAc,EAAE,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC;gBAC7C,mBAAmB;aACpB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,0EAA0E;QAC1E,IAAI,YAAgC,CAAC;QACrC,IAAI,gBAAwB,CAAC;QAE7B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;YAC1D,gBAAgB,GAAG,gDAAgD,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACzD,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,6BAA6B,CACtD,GAAG,WAAW,CACf,CAAW,CAAC;YACb,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACvD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvC,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,oFAAoF;YACpF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,UAAU;YACzC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gBAAgB;YACpC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,iGAAiG;QACjG,IACE,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU;YAC9C,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;gBAC7C,IAAI,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,mBAAmB,CAAC,yBAAyB,CAAC,EAClD,CAAC;YACD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,wFAAwF;YACxF,aAAa,GAAG,CAAC,MAAM,gBAAgB,CACrC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAkB,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,yBAAyB,CAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAG,WAA4B;QAE/B,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAClC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;aACrD,CAAC;YAEF,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;YAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,aAAa,CACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;wBACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE;4BACrD,UAAU,EAAE,UAAU,CAAC,UAAU;4BACjC,MAAM,EAAE,UAAU,CAAC,MAAM;4BACzB,cAAc,EAAE,UAAU,CAAC,MAAM;4BACjC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;yBACpD,CAAC,CAAC;wBACH,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n TokenResponse,\n TokenSet,\n tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n Auth0Interrupt,\n TokenVaultError,\n TokenVaultInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport {\n SUBJECT_TOKEN_TYPES,\n TokenVaultAuthorizerParams,\n} from \"./TokenVaultAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Token Vault.\n */\n\nexport class TokenVaultAuthorizerBase<ToolExecuteArgs extends any[]> {\n private readonly auth0: Auth0ClientParams;\n private readonly params: RequireFields<\n TokenVaultAuthorizerParams<ToolExecuteArgs>,\n \"credentialsContext\"\n >;\n private readonly credentialsStore: SubStore<TokenSet>;\n\n constructor(\n auth0: Partial<Auth0ClientParams>,\n params: TokenVaultAuthorizerParams<ToolExecuteArgs>,\n ) {\n this.auth0 = Auth0ClientSchema.parse(auth0);\n this.params = {\n credentialsContext: \"thread\",\n ...params,\n };\n\n const instanceID = this.getInstanceID();\n\n this.credentialsStore = new SubStore<TokenSet>(params.store, {\n baseNamespace: [instanceID, \"Credentials\"],\n getTTL: (credentials) =>\n credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n });\n\n // Validate that exactly one token source is provided\n const hasRefreshToken = typeof params.refreshToken !== \"undefined\";\n const hasAccessToken = typeof params.accessToken !== \"undefined\";\n const hasSubjectTokenType = typeof params.subjectTokenType !== \"undefined\";\n\n if (!hasRefreshToken && !hasAccessToken) {\n throw new Error(\n \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\",\n );\n }\n\n if (hasRefreshToken && hasAccessToken) {\n throw new Error(\n \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\",\n );\n }\n\n // Validate resource server client credentials when using access tokens for token exchange w/ Token Vault\n if (\n hasAccessToken &&\n hasSubjectTokenType &&\n params.subjectTokenType === SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN\n ) {\n if (!this.auth0.clientId || !this.auth0.clientSecret) {\n throw new Error(\n \"clientId and clientSecret must currently be provided when using accessToken for token exchange with Token Vault.\",\n );\n }\n }\n }\n\n private getInstanceID(): string {\n const props = {\n auth0: this.auth0,\n params: omit(this.params, [\n \"store\",\n \"refreshToken\",\n \"accessToken\",\n \"loginHint\",\n ]),\n };\n const sh = stableHash(props);\n return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n }\n\n protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n throw err;\n }\n\n protected validateToken(tokenResponse?: TokenResponse) {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\n \"The tool must be wrapped with the FederationConnectionAuthorizer.\",\n );\n }\n\n const { scopes, connection, authorizationParams } = store;\n\n if (!tokenResponse) {\n throw new TokenVaultInterrupt(\n `Authorization required to access the Token Vault: ${this.params.connection}`,\n {\n connection,\n scopes,\n requiredScopes: scopes,\n authorizationParams,\n },\n );\n }\n\n const currentScopes = (tokenResponse.scope ?? \"\")\n .replace(/,/g, \" \")\n .split(\" \");\n const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n store.currentScopes = currentScopes;\n\n if (missingScopes.length > 0) {\n throw new TokenVaultInterrupt(\n `Authorization required to access the Token Vault: ${this.params.connection}. Authorized scopes: ${currentScopes.join(\", \")}. Missing scopes: ${missingScopes.join(\", \")}`,\n {\n connection,\n scopes,\n requiredScopes: [...currentScopes, ...scopes],\n authorizationParams,\n },\n );\n }\n }\n\n private async getAccessTokenImpl(\n ...toolContext: ToolExecuteArgs\n ): Promise<TokenResponse | undefined> {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\n \"The tool must be wrapped with the FederationConnectionAuthorizer.\",\n );\n }\n\n const { connection } = store;\n\n // Determine which token type to use and get the appropriate subject token\n let subjectToken: string | undefined;\n let subjectTokenType: string;\n\n if (typeof this.params.refreshToken === \"function\") {\n subjectToken = await this.getRefreshToken(...toolContext);\n subjectTokenType = \"urn:ietf:params:oauth:token-type:refresh_token\";\n } else if (typeof this.params.accessToken === \"function\") {\n subjectToken = (await this.getAccessTokenWithToolContext(\n ...toolContext,\n )) as string;\n subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n } else if (typeof this.params.accessToken === \"string\") {\n subjectToken = this.params.accessToken;\n subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n } else {\n // This should never happen due to constructor validation, but TypeScript needs this\n throw new Error(\"Either refreshToken or accessToken must be configured\");\n }\n\n if (!subjectToken) {\n return;\n }\n\n // Get optional login hint if provided\n const loginHint =\n typeof this.params.loginHint === \"function\"\n ? await resolveParameter(this.params.loginHint, toolContext)\n : undefined;\n\n const exchangeParams = {\n grant_type:\n \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n client_id: this.auth0.clientId,\n client_secret: this.auth0.clientSecret,\n subject_token_type: subjectTokenType,\n subject_token: subjectToken,\n login_hint: loginHint,\n connection: connection,\n requested_token_type:\n \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n };\n\n const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(exchangeParams),\n });\n\n if (!res.ok) {\n //TODO: handle all type of response errors.\n return;\n }\n\n const tokenResponse: TokenResponse = await res.json();\n return tokenResponse;\n }\n\n protected async getAccessToken(\n ...toolContext: ToolExecuteArgs\n ): Promise<TokenSet> {\n let tokenResponse: TokenResponse | undefined;\n // Use token exchange for both refresh tokens and access tokens when subjectTokenType is provided\n if (\n typeof this.params.refreshToken === \"function\" ||\n (typeof this.params.accessToken !== \"undefined\" &&\n this.params.subjectTokenType ===\n SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN)\n ) {\n tokenResponse = await this.getAccessTokenImpl(...toolContext);\n } else {\n // fallback to existing behavior, where third party accessToken can be provided directly\n tokenResponse = (await resolveParameter(\n this.params.accessToken!,\n toolContext,\n )) as TokenResponse;\n }\n this.validateToken(tokenResponse);\n return tokenSetFromTokenResponse(tokenResponse!);\n }\n\n protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n return await resolveParameter(this.params.refreshToken, toolContext);\n }\n\n protected async getAccessTokenWithToolContext(\n ...toolContext: ToolExecuteArgs\n ) {\n return await resolveParameter(this.params.accessToken, toolContext);\n }\n\n /**\n *\n * Wraps the execute method of an AI tool to handle Token Vaults authorization.\n *\n * @param getContext - A function that returns the context of the tool execution.\n * @param execute - The tool execute method.\n * @returns The wrapped execute method.\n */\n protect(\n getContext: ContextGetter<ToolExecuteArgs>,\n execute: (...args: ToolExecuteArgs) => any,\n ): (...args: ToolExecuteArgs) => any {\n return async (...args: ToolExecuteArgs) => {\n const context = getContext(...args);\n const asyncStore: AsyncStorageValue = {\n context: context,\n scopes: this.params.scopes,\n connection: this.params.connection,\n authorizationParams: this.params.authorizationParams,\n };\n\n if (asyncLocalStorage.getStore()) {\n throw new Error(\n \"Cannot nest tool calls that require Token Vault authorization.\",\n );\n }\n\n return asyncLocalStorage.run(asyncStore, async () => {\n const credentialsNS = nsFromContext(\n this.params.credentialsContext,\n context,\n );\n try {\n let credentials: TokenSet = await this.credentialsStore.get(\n credentialsNS,\n \"credential\",\n );\n if (!credentials) {\n credentials = await this.getAccessToken(...args);\n await this.credentialsStore.put(\n credentialsNS,\n \"credential\",\n credentials,\n );\n }\n asyncStore.credentials = credentials;\n return await execute(...args);\n } catch (err) {\n if (err instanceof TokenVaultError) {\n this.credentialsStore.delete(credentialsNS, \"credential\");\n const interrupt = new TokenVaultInterrupt(err.message, {\n connection: asyncStore.connection,\n scopes: asyncStore.scopes,\n requiredScopes: asyncStore.scopes,\n authorizationParams: asyncStore.authorizationParams,\n });\n return this.handleAuthorizationInterrupts(interrupt);\n }\n if (err instanceof Auth0Interrupt) {\n this.credentialsStore.delete(credentialsNS, \"credential\");\n return this.handleAuthorizationInterrupts(err);\n }\n throw err;\n }\n });\n };\n }\n}\n"]}
|
|
1
|
+
{"version":3,"file":"TokenVaultAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/token-vault/TokenVaultAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,OAAO,EAGL,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,eAAe,EACf,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,IAAI,EAAiB,MAAM,YAAY,CAAC;AACjD,OAAO,EAAiB,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAqB,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC;;GAEG;AAEH,MAAM,OAAO,wBAAwB;IAQnC,YACE,KAAiC,EACjC,MAAmD;QAEnD,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,QAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,CAAC;QACnE,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC;QACjE,MAAM,mBAAmB,GAAG,OAAO,MAAM,CAAC,gBAAgB,KAAK,WAAW,CAAC;QAE3E,IAAI,CAAC,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QAED,yGAAyG;QACzG,IACE,cAAc;YACd,mBAAmB;YACnB,MAAM,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,yBAAyB,EACzE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACxB,OAAO;gBACP,cAAc;gBACd,aAAa;gBACb,WAAW;aACZ,CAAC;SACH,CAAC;QACF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC;QAE1D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAC3B,qDAAqD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAC7E;gBACE,UAAU;gBACV,MAAM;gBACN,cAAc,EAAE,MAAM;gBACtB,mBAAmB;aACpB,CACF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC;aAC9C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,mBAAmB,CAC3B,qDAAqD,IAAI,CAAC,MAAM,CAAC,UAAU,wBAAwB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1K;gBACE,UAAU;gBACV,MAAM;gBACN,cAAc,EAAE,CAAC,GAAG,aAAa,EAAE,GAAG,aAAa,CAAC;gBACpD,mBAAmB;aACpB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,0EAA0E;QAC1E,IAAI,YAAgC,CAAC;QACrC,IAAI,gBAAwB,CAAC;QAE7B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;YAC1D,gBAAgB,GAAG,gDAAgD,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACzD,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,6BAA6B,CACtD,GAAG,WAAW,CACf,CAAW,CAAC;YACb,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACvD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvC,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,oFAAoF;YACpF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,UAAU;YACzC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gBAAgB;YACpC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,iGAAiG;QACjG,IACE,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU;YAC9C,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;gBAC7C,IAAI,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,mBAAmB,CAAC,yBAAyB,CAAC,EAClD,CAAC;YACD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,wFAAwF;YACxF,aAAa,GAAG,CAAC,MAAM,gBAAgB,CACrC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAkB,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,yBAAyB,CAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAG,WAA4B;QAE/B,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAClC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;aACrD,CAAC;YAEF,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;YAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,aAAa,CACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;wBACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE;4BACrD,UAAU,EAAE,UAAU,CAAC,UAAU;4BACjC,MAAM,EAAE,UAAU,CAAC,MAAM;4BACzB,cAAc,EAAE,UAAU,CAAC,MAAM;4BACjC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;yBACpD,CAAC,CAAC;wBACH,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n TokenResponse,\n TokenSet,\n tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n Auth0Interrupt,\n TokenVaultError,\n TokenVaultInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport {\n SUBJECT_TOKEN_TYPES,\n TokenVaultAuthorizerParams,\n} from \"./TokenVaultAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Token Vault.\n */\n\nexport class TokenVaultAuthorizerBase<ToolExecuteArgs extends any[]> {\n private readonly auth0: Auth0ClientParams;\n private readonly params: RequireFields<\n TokenVaultAuthorizerParams<ToolExecuteArgs>,\n \"credentialsContext\"\n >;\n private readonly credentialsStore: SubStore<TokenSet>;\n\n constructor(\n auth0: Partial<Auth0ClientParams>,\n params: TokenVaultAuthorizerParams<ToolExecuteArgs>,\n ) {\n this.auth0 = Auth0ClientSchema.parse(auth0);\n this.params = {\n credentialsContext: \"thread\",\n ...params,\n };\n\n const instanceID = this.getInstanceID();\n\n this.credentialsStore = new SubStore<TokenSet>(params.store, {\n baseNamespace: [instanceID, \"Credentials\"],\n getTTL: (credentials) =>\n credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n });\n\n // Validate that exactly one token source is provided\n const hasRefreshToken = typeof params.refreshToken !== \"undefined\";\n const hasAccessToken = typeof params.accessToken !== \"undefined\";\n const hasSubjectTokenType = typeof params.subjectTokenType !== \"undefined\";\n\n if (!hasRefreshToken && !hasAccessToken) {\n throw new Error(\n \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\",\n );\n }\n\n if (hasRefreshToken && hasAccessToken) {\n throw new Error(\n \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\",\n );\n }\n\n // Validate resource server client credentials when using access tokens for token exchange w/ Token Vault\n if (\n hasAccessToken &&\n hasSubjectTokenType &&\n params.subjectTokenType === SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN\n ) {\n if (!this.auth0.clientId || !this.auth0.clientSecret) {\n throw new Error(\n \"clientId and clientSecret must currently be provided when using accessToken for token exchange with Token Vault.\",\n );\n }\n }\n }\n\n private getInstanceID(): string {\n const props = {\n auth0: this.auth0,\n params: omit(this.params, [\n \"store\",\n \"refreshToken\",\n \"accessToken\",\n \"loginHint\",\n ]),\n };\n const sh = stableHash(props);\n return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n }\n\n protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n throw err;\n }\n\n protected validateToken(tokenResponse?: TokenResponse) {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\n \"The tool must be wrapped with the FederationConnectionAuthorizer.\",\n );\n }\n\n const { scopes, connection, authorizationParams } = store;\n\n if (!tokenResponse) {\n throw new TokenVaultInterrupt(\n `Authorization required to access the Token Vault: ${this.params.connection}`,\n {\n connection,\n scopes,\n requiredScopes: scopes,\n authorizationParams,\n },\n );\n }\n\n const currentScopes = (tokenResponse.scope ?? \"\")\n .replace(/,/g, \" \")\n .split(\" \");\n const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n store.currentScopes = currentScopes;\n\n if (missingScopes.length > 0) {\n throw new TokenVaultInterrupt(\n `Authorization required to access the Token Vault: ${this.params.connection}. Authorized scopes: ${currentScopes.join(\", \")}. Missing scopes: ${missingScopes.join(\", \")}`,\n {\n connection,\n scopes,\n requiredScopes: [...currentScopes, ...missingScopes],\n authorizationParams,\n },\n );\n }\n }\n\n private async getAccessTokenImpl(\n ...toolContext: ToolExecuteArgs\n ): Promise<TokenResponse | undefined> {\n const store = asyncLocalStorage.getStore();\n if (!store) {\n throw new Error(\n \"The tool must be wrapped with the FederationConnectionAuthorizer.\",\n );\n }\n\n const { connection } = store;\n\n // Determine which token type to use and get the appropriate subject token\n let subjectToken: string | undefined;\n let subjectTokenType: string;\n\n if (typeof this.params.refreshToken === \"function\") {\n subjectToken = await this.getRefreshToken(...toolContext);\n subjectTokenType = \"urn:ietf:params:oauth:token-type:refresh_token\";\n } else if (typeof this.params.accessToken === \"function\") {\n subjectToken = (await this.getAccessTokenWithToolContext(\n ...toolContext,\n )) as string;\n subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n } else if (typeof this.params.accessToken === \"string\") {\n subjectToken = this.params.accessToken;\n subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n } else {\n // This should never happen due to constructor validation, but TypeScript needs this\n throw new Error(\"Either refreshToken or accessToken must be configured\");\n }\n\n if (!subjectToken) {\n return;\n }\n\n // Get optional login hint if provided\n const loginHint =\n typeof this.params.loginHint === \"function\"\n ? await resolveParameter(this.params.loginHint, toolContext)\n : undefined;\n\n const exchangeParams = {\n grant_type:\n \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n client_id: this.auth0.clientId,\n client_secret: this.auth0.clientSecret,\n subject_token_type: subjectTokenType,\n subject_token: subjectToken,\n login_hint: loginHint,\n connection: connection,\n requested_token_type:\n \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n };\n\n const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(exchangeParams),\n });\n\n if (!res.ok) {\n //TODO: handle all type of response errors.\n return;\n }\n\n const tokenResponse: TokenResponse = await res.json();\n return tokenResponse;\n }\n\n protected async getAccessToken(\n ...toolContext: ToolExecuteArgs\n ): Promise<TokenSet> {\n let tokenResponse: TokenResponse | undefined;\n // Use token exchange for both refresh tokens and access tokens when subjectTokenType is provided\n if (\n typeof this.params.refreshToken === \"function\" ||\n (typeof this.params.accessToken !== \"undefined\" &&\n this.params.subjectTokenType ===\n SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN)\n ) {\n tokenResponse = await this.getAccessTokenImpl(...toolContext);\n } else {\n // fallback to existing behavior, where third party accessToken can be provided directly\n tokenResponse = (await resolveParameter(\n this.params.accessToken!,\n toolContext,\n )) as TokenResponse;\n }\n this.validateToken(tokenResponse);\n return tokenSetFromTokenResponse(tokenResponse!);\n }\n\n protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n return await resolveParameter(this.params.refreshToken, toolContext);\n }\n\n protected async getAccessTokenWithToolContext(\n ...toolContext: ToolExecuteArgs\n ) {\n return await resolveParameter(this.params.accessToken, toolContext);\n }\n\n /**\n *\n * Wraps the execute method of an AI tool to handle Token Vaults authorization.\n *\n * @param getContext - A function that returns the context of the tool execution.\n * @param execute - The tool execute method.\n * @returns The wrapped execute method.\n */\n protect(\n getContext: ContextGetter<ToolExecuteArgs>,\n execute: (...args: ToolExecuteArgs) => any,\n ): (...args: ToolExecuteArgs) => any {\n return async (...args: ToolExecuteArgs) => {\n const context = getContext(...args);\n const asyncStore: AsyncStorageValue = {\n context: context,\n scopes: this.params.scopes,\n connection: this.params.connection,\n authorizationParams: this.params.authorizationParams,\n };\n\n if (asyncLocalStorage.getStore()) {\n throw new Error(\n \"Cannot nest tool calls that require Token Vault authorization.\",\n );\n }\n\n return asyncLocalStorage.run(asyncStore, async () => {\n const credentialsNS = nsFromContext(\n this.params.credentialsContext,\n context,\n );\n try {\n let credentials: TokenSet = await this.credentialsStore.get(\n credentialsNS,\n \"credential\",\n );\n if (!credentials) {\n credentials = await this.getAccessToken(...args);\n await this.credentialsStore.put(\n credentialsNS,\n \"credential\",\n credentials,\n );\n }\n asyncStore.credentials = credentials;\n return await execute(...args);\n } catch (err) {\n if (err instanceof TokenVaultError) {\n this.credentialsStore.delete(credentialsNS, \"credential\");\n const interrupt = new TokenVaultInterrupt(err.message, {\n connection: asyncStore.connection,\n scopes: asyncStore.scopes,\n requiredScopes: asyncStore.scopes,\n authorizationParams: asyncStore.authorizationParams,\n });\n return this.handleAuthorizationInterrupts(interrupt);\n }\n if (err instanceof Auth0Interrupt) {\n this.credentialsStore.delete(credentialsNS, \"credential\");\n return this.handleAuthorizationInterrupts(err);\n }\n throw err;\n }\n });\n };\n }\n}\n"]}
|