@frontmcp/auth 1.10.15 → 1.11.0-rc.1

package/browser/session/index.mjs

@@ -0,0 +1,266 @@
+// libs/auth/src/session/index.ts
+import {
+  InMemoryAuthorizationStore,
+  RedisAuthorizationStore,
+  verifyPkce,
+  generatePkceChallenge,
+  generateAuthorizationCode,
+  generateRefreshTokenValue,
+  buildCodeRecord,
+  buildPendingRecord,
+  buildRefreshTokenRecord,
+  AUTH_CODE_TTL_MS,
+  PENDING_AUTH_TTL_MS,
+  REFRESH_TOKEN_TTL_MS,
+  pkceChallengeSchema,
+  authorizationCodeRecordSchema
+} from "./authorization.store.mjs";
+import { sealPendingLogin, openPendingLogin } from "./pending-login.mjs";
+import {
+  SIGNIN_BINDING_COOKIE_PREFIX,
+  SIGNIN_BINDING_SECURE_COOKIE_PREFIX,
+  SIGNIN_BINDING_MAX_AGE_SECONDS,
+  createSigninBinding,
+  signinBindingCookieName,
+  signinBindingMatches
+} from "./signin-binding.mjs";
+import { StorageAuthorizationStore } from "./storage-authorization.store.mjs";
+import {
+  credentialTypeSchema,
+  oauthCredentialSchema,
+  apiKeyCredentialSchema,
+  basicAuthCredentialSchema,
+  bearerCredentialSchema,
+  privateKeyCredentialSchema,
+  mtlsCredentialSchema,
+  customCredentialSchema,
+  sshKeyCredentialSchema,
+  serviceAccountCredentialSchema,
+  pkceOAuthCredentialSchema,
+  credentialSchema,
+  appCredentialSchema,
+  vaultConsentRecordSchema,
+  vaultFederatedRecordSchema,
+  pendingIncrementalAuthSchema,
+  authorizationVaultEntrySchema
+} from "./authorization-vault.mjs";
+import { SessionCredentialVault } from "./session-credential-vault.mjs";
+import { createSessionCredentialVault } from "./session-credential-vault.factory.mjs";
+import {
+  signCredentialResumeToken,
+  verifyCredentialResumeToken,
+  buildCredentialResumeUrl,
+  DEFAULT_RESUME_TTL_MS
+} from "./credential-resume-link.mjs";
+import {
+  signIncrementalAuthTicket,
+  verifyIncrementalAuthTicket,
+  DEFAULT_INCREMENTAL_TICKET_TTL_MS
+} from "./incremental-auth-ticket.mjs";
+import { CREDENTIALS_ACCESSOR } from "./credentials-accessor.mjs";
+import { CredentialsAccessorImpl } from "./credentials-accessor.impl.mjs";
+import { EncryptedStorageSecureStoreBackend } from "./secure-store-backends.mjs";
+import { SECURE_STORE_ACCESSOR } from "./secure-store-accessor.mjs";
+import { SecureStoreAccessorImpl } from "./secure-store-accessor.impl.mjs";
+import { createSecureStore } from "./secure-store.factory.mjs";
+import { encryptedDataSchema, encryptedVaultEntrySchema, VaultEncryption } from "./vault-encryption.mjs";
+import { TokenVault } from "./token.vault.mjs";
+import {
+  hkdfSha256,
+  encryptValue,
+  decryptValue,
+  encryptAesGcm,
+  decryptAesGcm
+} from "@frontmcp/utils";
+import {
+  transportProtocolSchema,
+  sseTransportStateSchema,
+  streamableHttpTransportStateSchema,
+  statefulHttpTransportStateSchema,
+  statelessHttpTransportStateSchema,
+  legacySseTransportStateSchema,
+  transportStateSchema,
+  transportSessionSchema,
+  sessionJwtPayloadSchema,
+  encryptedBlobSchema,
+  storedSessionSchema,
+  redisConfigSchema
+} from "./transport-session.types.mjs";
+import { signSession, verifySession, isSignedSession, verifyOrParseSession } from "./session-crypto.mjs";
+import { SessionRateLimiter, defaultSessionRateLimiter } from "./session-rate-limiter.mjs";
+import { TransportIdGenerator } from "./session.transport.mjs";
+import {
+  isJwt,
+  getTokenSignatureFingerprint,
+  deriveTypedUser,
+  anonymousCallerClaims,
+  extractBearerToken,
+  getKey,
+  encryptJson,
+  decryptSessionJson,
+  safeDecrypt,
+  resetCachedKey,
+  TinyTtlCache
+} from "./utils/index.mjs";
+import {
+  TypedStorage,
+  EncryptedTypedStorage,
+  EncryptedStorageError,
+  StorageTokenStore,
+  StorageAuthorizationVault,
+  InMemoryAuthorizationVault
+} from "./storage/index.mjs";
+import { RedisSessionStore } from "./redis-session.store.mjs";
+import { VercelKvSessionStore } from "./vercel-kv-session.store.mjs";
+import { InMemoryOrchestratedTokenStore } from "./orchestrated-token.store.mjs";
+import { StorageOrchestratedTokenStore } from "./storage-orchestrated-token.store.mjs";
+import {
+  InMemoryFederatedAuthSessionStore,
+  toSessionRecord,
+  fromSessionRecord,
+  createFederatedAuthSession,
+  isSessionComplete,
+  getNextProvider,
+  completeCurrentProvider,
+  startNextProvider
+} from "./federated-auth.session.mjs";
+import { StorageFederatedAuthSessionStore } from "./storage-federated-auth.session.mjs";
+import { InMemoryConsentStore, consentRecordKey } from "./consent.store.mjs";
+import { StorageConsentStore } from "./storage-consent.store.mjs";
+import {
+  createTokenStorageAdapter,
+  isRedisTokenStorage,
+  isSqliteTokenStorage,
+  isPersistentTokenStorage
+} from "./token-storage.factory.mjs";
+import { redisVaultEntrySchema, EncryptedRedisVault, createEncryptedVault } from "./encrypted-authorization-vault.mjs";
+import { toEpochSeconds, isSoonExpiring, isSoonExpiringProvider, tryJwtExp } from "./token.refresh.mjs";
+export {
+  AUTH_CODE_TTL_MS,
+  CREDENTIALS_ACCESSOR,
+  CredentialsAccessorImpl,
+  DEFAULT_INCREMENTAL_TICKET_TTL_MS,
+  DEFAULT_RESUME_TTL_MS,
+  EncryptedRedisVault,
+  EncryptedStorageError,
+  EncryptedStorageSecureStoreBackend,
+  EncryptedTypedStorage,
+  InMemoryAuthorizationStore,
+  InMemoryAuthorizationVault,
+  InMemoryConsentStore,
+  InMemoryFederatedAuthSessionStore,
+  InMemoryOrchestratedTokenStore,
+  PENDING_AUTH_TTL_MS,
+  REFRESH_TOKEN_TTL_MS,
+  RedisAuthorizationStore,
+  RedisSessionStore,
+  SECURE_STORE_ACCESSOR,
+  SIGNIN_BINDING_COOKIE_PREFIX,
+  SIGNIN_BINDING_MAX_AGE_SECONDS,
+  SIGNIN_BINDING_SECURE_COOKIE_PREFIX,
+  SecureStoreAccessorImpl,
+  SessionCredentialVault,
+  SessionRateLimiter,
+  StorageAuthorizationStore,
+  StorageAuthorizationVault,
+  StorageConsentStore,
+  StorageFederatedAuthSessionStore,
+  StorageOrchestratedTokenStore,
+  StorageTokenStore,
+  TinyTtlCache,
+  TokenVault,
+  TransportIdGenerator,
+  TypedStorage,
+  VaultEncryption,
+  VercelKvSessionStore,
+  anonymousCallerClaims,
+  apiKeyCredentialSchema,
+  appCredentialSchema,
+  authorizationCodeRecordSchema,
+  authorizationVaultEntrySchema,
+  basicAuthCredentialSchema,
+  bearerCredentialSchema,
+  buildCodeRecord,
+  buildCredentialResumeUrl,
+  buildPendingRecord,
+  buildRefreshTokenRecord,
+  completeCurrentProvider,
+  consentRecordKey,
+  createEncryptedVault,
+  createFederatedAuthSession,
+  createSecureStore,
+  createSessionCredentialVault,
+  createSigninBinding,
+  createTokenStorageAdapter,
+  credentialSchema,
+  credentialTypeSchema,
+  customCredentialSchema,
+  decryptAesGcm,
+  decryptSessionJson,
+  decryptValue,
+  defaultSessionRateLimiter,
+  deriveTypedUser,
+  encryptAesGcm,
+  encryptJson,
+  encryptValue,
+  encryptedBlobSchema,
+  encryptedDataSchema,
+  encryptedVaultEntrySchema,
+  extractBearerToken,
+  fromSessionRecord,
+  generateAuthorizationCode,
+  generatePkceChallenge,
+  generateRefreshTokenValue,
+  getKey,
+  getNextProvider,
+  getTokenSignatureFingerprint,
+  hkdfSha256,
+  isJwt,
+  isPersistentTokenStorage,
+  isRedisTokenStorage,
+  isSessionComplete,
+  isSignedSession,
+  isSoonExpiring,
+  isSoonExpiringProvider,
+  isSqliteTokenStorage,
+  legacySseTransportStateSchema,
+  mtlsCredentialSchema,
+  oauthCredentialSchema,
+  openPendingLogin,
+  pendingIncrementalAuthSchema,
+  pkceChallengeSchema,
+  pkceOAuthCredentialSchema,
+  privateKeyCredentialSchema,
+  redisConfigSchema,
+  redisVaultEntrySchema,
+  resetCachedKey,
+  safeDecrypt,
+  sealPendingLogin,
+  serviceAccountCredentialSchema,
+  sessionJwtPayloadSchema,
+  signCredentialResumeToken,
+  signIncrementalAuthTicket,
+  signSession,
+  signinBindingCookieName,
+  signinBindingMatches,
+  sseTransportStateSchema,
+  sshKeyCredentialSchema,
+  startNextProvider,
+  statefulHttpTransportStateSchema,
+  statelessHttpTransportStateSchema,
+  storedSessionSchema,
+  streamableHttpTransportStateSchema,
+  toEpochSeconds,
+  toSessionRecord,
+  transportProtocolSchema,
+  transportSessionSchema,
+  transportStateSchema,
+  tryJwtExp,
+  vaultConsentRecordSchema,
+  vaultFederatedRecordSchema,
+  verifyCredentialResumeToken,
+  verifyIncrementalAuthTicket,
+  verifyOrParseSession,
+  verifyPkce,
+  verifySession
+};

package/browser/session/orchestrated-token.crypto.mjs

@@ -0,0 +1,47 @@
+// libs/auth/src/session/orchestrated-token.crypto.ts
+import { decryptAesGcm, encryptAesGcm, hkdfSha256, randomBytes } from "@frontmcp/utils";
+import { REFRESH_TOKEN_TTL_MS } from "./authorization.store.mjs";
+function recordDropAt(record) {
+  if (!record.refreshToken) return record.expiresAt;
+  return Math.max(record.expiresAt ?? 0, record.updatedAt + REFRESH_TOKEN_TTL_MS);
+}
+function hasLiveAccessToken(record, refreshSkewMs = 0) {
+  if (record.expiresAt === void 0) return true;
+  return record.expiresAt - (record.refreshToken ? refreshSkewMs : 0) > Date.now();
+}
+var HKDF_SALT = new TextEncoder().encode("frontmcp-token-store");
+function deriveKeyForRecord(masterKey, compositeKey, cache) {
+  const cached = cache.get(compositeKey);
+  if (cached) {
+    return cached;
+  }
+  const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
+  const derived = hkdfSha256(masterKey, HKDF_SALT, info, 32);
+  cache.set(compositeKey, derived);
+  return derived;
+}
+function encryptRecord(key, record) {
+  const plaintext = JSON.stringify(record);
+  const iv = randomBytes(12);
+  const { ciphertext, tag } = encryptAesGcm(key, new TextEncoder().encode(plaintext), iv);
+  return JSON.stringify({
+    iv: Buffer.from(iv).toString("base64url"),
+    tag: Buffer.from(tag).toString("base64url"),
+    data: Buffer.from(ciphertext).toString("base64url")
+  });
+}
+function decryptRecord(key, encrypted) {
+  const { iv, tag, data } = JSON.parse(encrypted);
+  const ivBytes = Buffer.from(iv, "base64url");
+  const tagBytes = Buffer.from(tag, "base64url");
+  const ciphertextBytes = Buffer.from(data, "base64url");
+  const plaintext = decryptAesGcm(key, ciphertextBytes, ivBytes, tagBytes);
+  return JSON.parse(new TextDecoder().decode(plaintext));
+}
+export {
+  decryptRecord,
+  deriveKeyForRecord,
+  encryptRecord,
+  hasLiveAccessToken,
+  recordDropAt
+};

package/browser/session/orchestrated-token.store.mjs

@@ -0,0 +1,286 @@
+// libs/auth/src/session/orchestrated-token.store.ts
+import { decryptAesGcm, encryptAesGcm, hkdfSha256, randomBytes } from "@frontmcp/utils";
+import { EncryptionKeyNotConfiguredError } from "../errors/auth-internal.errors.mjs";
+import { hasLiveAccessToken, recordDropAt } from "./orchestrated-token.crypto.mjs";
+var InMemoryOrchestratedTokenStore = class {
+  /** Token storage: Map<compositeKey, ProviderTokenRecord> */
+  tokens = /* @__PURE__ */ new Map();
+  /** Encryption key for secure storage */
+  encryptionKey;
+  /** Derived keys cache for HKDF */
+  derivedKeys = /* @__PURE__ */ new Map();
+  /** Cleanup interval timer */
+  cleanupTimer;
+  /** Default TTL for records */
+  defaultTtlMs;
+  /** How long before its expiry a refreshable access token stops being returned */
+  refreshSkewMs;
+  constructor(options = {}) {
+    this.encryptionKey = options.encryptionKey;
+    this.defaultTtlMs = options.defaultTtlMs;
+    this.refreshSkewMs = options.refreshSkewMs ?? 0;
+    const cleanupIntervalMs = options.cleanupIntervalMs ?? 6e4;
+    this.cleanupTimer = setInterval(() => {
+      void this.cleanup();
+    }, cleanupIntervalMs);
+    if (this.cleanupTimer.unref) {
+      this.cleanupTimer.unref();
+    }
+  }
+  /**
+   * Build composite key from authorizationId and providerId
+   */
+  buildKey(authorizationId, providerId) {
+    return `${authorizationId}:${providerId}`;
+  }
+  /**
+   * Derive encryption key for a specific composite key using HKDF
+   */
+  async deriveKeyForRecord(compositeKey) {
+    if (!this.encryptionKey) {
+      throw new EncryptionKeyNotConfiguredError();
+    }
+    const cached = this.derivedKeys.get(compositeKey);
+    if (cached) {
+      return cached;
+    }
+    const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
+    const salt = new TextEncoder().encode("frontmcp-token-store");
+    const derivedKey = hkdfSha256(this.encryptionKey, salt, info, 32);
+    this.derivedKeys.set(compositeKey, derivedKey);
+    return derivedKey;
+  }
+  /**
+   * Encrypt a token record
+   */
+  async encryptRecord(compositeKey, record) {
+    const key = await this.deriveKeyForRecord(compositeKey);
+    const plaintext = JSON.stringify(record);
+    const iv = randomBytes(12);
+    const { ciphertext, tag } = encryptAesGcm(key, new TextEncoder().encode(plaintext), iv);
+    return JSON.stringify({
+      iv: Buffer.from(iv).toString("base64url"),
+      tag: Buffer.from(tag).toString("base64url"),
+      data: Buffer.from(ciphertext).toString("base64url")
+    });
+  }
+  /**
+   * Decrypt a token record
+   */
+  async decryptRecord(compositeKey, encrypted) {
+    const key = await this.deriveKeyForRecord(compositeKey);
+    const { iv, tag, data } = JSON.parse(encrypted);
+    const ivBytes = Buffer.from(iv, "base64url");
+    const tagBytes = Buffer.from(tag, "base64url");
+    const ciphertextBytes = Buffer.from(data, "base64url");
+    const plaintext = decryptAesGcm(key, ciphertextBytes, ivBytes, tagBytes);
+    return JSON.parse(new TextDecoder().decode(plaintext));
+  }
+  /**
+   * Get raw record (handles encryption if enabled)
+   */
+  async getRecord(authorizationId, providerId) {
+    const key = this.buildKey(authorizationId, providerId);
+    const stored = this.tokens.get(key);
+    if (!stored) {
+      return null;
+    }
+    let record;
+    if (this.encryptionKey) {
+      if (typeof stored !== "string") {
+        return null;
+      }
+      try {
+        record = await this.decryptRecord(key, stored);
+      } catch {
+        this.tokens.delete(key);
+        return null;
+      }
+    } else {
+      record = stored;
+    }
+    const dropAt = recordDropAt(record);
+    if (dropAt && dropAt < Date.now()) {
+      this.tokens.delete(key);
+      return null;
+    }
+    return record;
+  }
+  /**
+   * Retrieve decrypted access token for a provider, or null once it has expired (a record with a
+   * refresh token keeps that, to renew it)
+   */
+  async getAccessToken(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record && hasLiveAccessToken(record, this.refreshSkewMs) ? record.accessToken : null;
+  }
+  /**
+   * Retrieve decrypted refresh token for a provider
+   */
+  async getRefreshToken(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record?.refreshToken ?? null;
+  }
+  /**
+   * Store tokens for a provider
+   */
+  async storeTokens(authorizationId, providerId, tokens) {
+    const key = this.buildKey(authorizationId, providerId);
+    const now = Date.now();
+    const record = {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: tokens.expiresAt ?? (this.defaultTtlMs ? now + this.defaultTtlMs : void 0),
+      createdAt: now,
+      updatedAt: now
+    };
+    if (this.encryptionKey) {
+      const encrypted = await this.encryptRecord(key, record);
+      this.tokens.set(key, encrypted);
+    } else {
+      this.tokens.set(key, record);
+    }
+  }
+  /**
+   * Delete tokens for a provider
+   */
+  async deleteTokens(authorizationId, providerId) {
+    const key = this.buildKey(authorizationId, providerId);
+    this.tokens.delete(key);
+    this.derivedKeys.delete(key);
+  }
+  /**
+   * Check if tokens exist for a provider
+   */
+  async hasTokens(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record !== null;
+  }
+  /**
+   * Delete all tokens for an authorization
+   */
+  async deleteAllForAuthorization(authorizationId) {
+    const prefix = `${authorizationId}:`;
+    for (const key of this.tokens.keys()) {
+      if (key.startsWith(prefix)) {
+        this.tokens.delete(key);
+        this.derivedKeys.delete(key);
+      }
+    }
+  }
+  /**
+   * Get all provider IDs for an authorization
+   */
+  async getProviderIds(authorizationId) {
+    const prefix = `${authorizationId}:`;
+    const providerIds = [];
+    for (const key of this.tokens.keys()) {
+      if (key.startsWith(prefix)) {
+        const providerId = key.slice(prefix.length);
+        const record = await this.getRecord(authorizationId, providerId);
+        if (record) {
+          providerIds.push(providerId);
+        }
+      }
+    }
+    return providerIds;
+  }
+  /**
+   * Clean up expired tokens
+   */
+  async cleanup() {
+    const now = Date.now();
+    const keysToDelete = [];
+    for (const [key, stored] of this.tokens.entries()) {
+      let record = null;
+      if (this.encryptionKey) {
+        if (typeof stored === "string") {
+          try {
+            record = await this.decryptRecord(key, stored);
+          } catch {
+            keysToDelete.push(key);
+            continue;
+          }
+        }
+      } else {
+        record = stored;
+      }
+      const dropAt = record ? recordDropAt(record) : void 0;
+      if (dropAt && dropAt < now) {
+        keysToDelete.push(key);
+      }
+    }
+    for (const key of keysToDelete) {
+      this.tokens.delete(key);
+      this.derivedKeys.delete(key);
+    }
+  }
+  /**
+   * Stop the cleanup timer
+   */
+  dispose() {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = void 0;
+    }
+  }
+  /**
+   * Get total number of stored token records (for testing/monitoring)
+   */
+  get size() {
+    return this.tokens.size;
+  }
+  /**
+   * Clear all tokens (for testing)
+   */
+  clear() {
+    this.tokens.clear();
+    this.derivedKeys.clear();
+  }
+  /**
+   * Migrate tokens from one authorization ID to another.
+   * Used when tokens are stored with a pending ID during federated auth
+   * and need to be accessible under the real authorization ID.
+   *
+   * @param fromAuthId - Source authorization ID (e.g., "pending:abc123")
+   * @param toAuthId - Target authorization ID (e.g., "def456")
+   */
+  async migrateTokens(fromAuthId, toAuthId) {
+    for (const oldKey of await this.copyRecords(fromAuthId, toAuthId)) {
+      this.tokens.delete(oldKey);
+      this.derivedKeys.delete(oldKey);
+    }
+  }
+  /**
+   * Copy tokens from one authorization ID to another, keeping them under the source ID too.
+   */
+  async copyTokens(fromAuthId, toAuthId) {
+    await this.copyRecords(fromAuthId, toAuthId);
+  }
+  /** Copy every record of `fromAuthId` to `toAuthId`, skipping a corrupted one; returns the keys copied. */
+  async copyRecords(fromAuthId, toAuthId) {
+    const prefix = `${fromAuthId}:`;
+    const sourceKeys = [...this.tokens.keys()].filter((key) => key.startsWith(prefix));
+    const copiedKeys = [];
+    for (const oldKey of sourceKeys) {
+      const stored = this.tokens.get(oldKey);
+      if (!stored) continue;
+      const newKey = this.buildKey(toAuthId, oldKey.slice(prefix.length));
+      if (this.encryptionKey) {
+        try {
+          const record = await this.decryptRecord(oldKey, stored);
+          this.tokens.set(newKey, await this.encryptRecord(newKey, record));
+        } catch {
+          continue;
+        }
+      } else {
+        this.tokens.set(newKey, stored);
+      }
+      copiedKeys.push(oldKey);
+    }
+    return copiedKeys;
+  }
+};
+export {
+  InMemoryOrchestratedTokenStore
+};

package/browser/session/pending-login.mjs

@@ -0,0 +1,37 @@
+// libs/auth/src/session/pending-login.ts
+import {
+  base64urlDecode,
+  base64urlEncode,
+  decryptAesGcm,
+  encryptAesGcm,
+  hkdfSha256,
+  randomBytes
+} from "@frontmcp/utils";
+var SALT = new TextEncoder().encode("frontmcp-pending-login");
+function keyFor(secret, pendingAuthId) {
+  return hkdfSha256(secret, SALT, new TextEncoder().encode(`pending-login:${pendingAuthId}`), 32);
+}
+function sealPendingLogin(secret, pendingAuthId, state) {
+  const iv = randomBytes(12);
+  const { ciphertext, tag } = encryptAesGcm(
+    keyFor(secret, pendingAuthId),
+    new TextEncoder().encode(JSON.stringify(state)),
+    iv
+  );
+  return [iv, tag, ciphertext].map((part) => base64urlEncode(part)).join(".");
+}
+function openPendingLogin(secret, pendingAuthId, sealed) {
+  try {
+    const [iv, tag, ciphertext] = sealed.split(".").map((part) => base64urlDecode(part));
+    if (!iv || !tag || !ciphertext) return void 0;
+    const plaintext = decryptAesGcm(keyFor(secret, pendingAuthId), ciphertext, iv, tag);
+    const state = JSON.parse(new TextDecoder().decode(plaintext));
+    return typeof state?.sub === "string" && state.sub.length > 0 ? state : void 0;
+  } catch {
+    return void 0;
+  }
+}
+export {
+  openPendingLogin,
+  sealPendingLogin
+};