@frontmcp/auth 1.10.15 → 1.11.0-rc.1

package/browser/cimd/cimd-redis.cache.mjs

@@ -0,0 +1,231 @@
+// libs/auth/src/cimd/cimd-redis.cache.ts
+import { RedisStorageAdapter } from "@frontmcp/utils";
+import { sha256Hex } from "@frontmcp/utils";
+import { extractCacheHeaders, parseCacheHeaders } from "./cimd.cache.mjs";
+var RedisCimdCache = class {
+  redis;
+  keyPrefix;
+  config;
+  constructor(config) {
+    if (!config.redis) {
+      throw new Error("Redis configuration is required for RedisCimdCache");
+    }
+    this.config = {
+      defaultTtlMs: config.defaultTtlMs ?? 36e5,
+      maxTtlMs: config.maxTtlMs ?? 864e5,
+      minTtlMs: config.minTtlMs ?? 6e4
+    };
+    this.keyPrefix = config.redis.keyPrefix ?? "cimd:";
+    const redisOptions = {};
+    if (config.redis.url) {
+      redisOptions.url = config.redis.url;
+    } else if (config.redis.host) {
+      redisOptions.config = {
+        host: config.redis.host,
+        port: config.redis.port,
+        password: config.redis.password,
+        db: config.redis.db,
+        tls: config.redis.tls
+      };
+    }
+    this.redis = new RedisStorageAdapter(redisOptions);
+  }
+  /**
+   * Connect to Redis.
+   * Must be called before using any cache operations.
+   */
+  async connect() {
+    await this.redis.connect();
+  }
+  /**
+   * Generate a Redis key for a client ID.
+   * Uses SHA-256 hash to handle URLs with special characters.
+   */
+  cacheKey(clientId) {
+    const hash = sha256Hex(clientId);
+    return `${this.keyPrefix}${hash}`;
+  }
+  /**
+   * Get a cached entry by client_id.
+   *
+   * @param clientId - The client_id URL
+   * @returns The cached entry if valid, or undefined
+   */
+  async get(clientId) {
+    const key = this.cacheKey(clientId);
+    const data = await this.redis.get(key);
+    if (!data) {
+      return void 0;
+    }
+    try {
+      const entry = JSON.parse(data);
+      if (entry.expiresAt < Date.now()) {
+        return void 0;
+      }
+      return entry;
+    } catch {
+      await this.redis.delete(key);
+      return void 0;
+    }
+  }
+  /**
+   * Get a stale entry for conditional revalidation.
+   *
+   * @param clientId - The client_id URL
+   * @returns The stale entry (even if expired), or undefined if not cached
+   */
+  async getStale(clientId) {
+    const key = this.cacheKey(clientId);
+    const data = await this.redis.get(key);
+    if (!data) {
+      return void 0;
+    }
+    try {
+      return JSON.parse(data);
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Store a document in the cache.
+   *
+   * @param clientId - The client_id URL
+   * @param document - The metadata document
+   * @param headers - HTTP response headers
+   */
+  async set(clientId, document, headers) {
+    const cacheHeaders = extractCacheHeaders(headers);
+    const { ttlMs, etag, lastModified } = parseCacheHeaders(cacheHeaders, this.config);
+    const now = Date.now();
+    const entry = {
+      document,
+      expiresAt: now + ttlMs,
+      etag,
+      lastModified,
+      cachedAt: now
+    };
+    const key = this.cacheKey(clientId);
+    const value = JSON.stringify(entry);
+    const redisTtlSeconds = Math.ceil((ttlMs + this.config.maxTtlMs * 2) / 1e3);
+    await this.redis.set(key, value, { ttlSeconds: redisTtlSeconds });
+  }
+  /**
+   * Update an existing cache entry (after 304 Not Modified).
+   *
+   * @param clientId - The client_id URL
+   * @param headers - New HTTP headers with updated cache directives
+   */
+  async revalidate(clientId, headers) {
+    const key = this.cacheKey(clientId);
+    const data = await this.redis.get(key);
+    if (!data) {
+      return false;
+    }
+    try {
+      const existing = JSON.parse(data);
+      const cacheHeaders = extractCacheHeaders(headers);
+      const { ttlMs, etag, lastModified } = parseCacheHeaders(cacheHeaders, this.config);
+      existing.expiresAt = Date.now() + ttlMs;
+      if (etag) existing.etag = etag;
+      if (lastModified) existing.lastModified = lastModified;
+      const value = JSON.stringify(existing);
+      const redisTtlSeconds = Math.ceil((ttlMs + this.config.maxTtlMs * 2) / 1e3);
+      await this.redis.set(key, value, { ttlSeconds: redisTtlSeconds });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Delete a cache entry.
+   *
+   * @param clientId - The client_id URL
+   * @returns true if an entry was deleted
+   */
+  async delete(clientId) {
+    const key = this.cacheKey(clientId);
+    return this.redis.delete(key);
+  }
+  /**
+   * Get conditional request headers for a cached entry.
+   *
+   * @param clientId - The client_id URL
+   * @returns Headers for conditional request, or undefined if not cached
+   */
+  async getConditionalHeaders(clientId) {
+    const key = this.cacheKey(clientId);
+    const data = await this.redis.get(key);
+    if (!data) {
+      return void 0;
+    }
+    try {
+      const entry = JSON.parse(data);
+      const headers = {};
+      if (entry.etag) {
+        headers["If-None-Match"] = entry.etag;
+      }
+      if (entry.lastModified) {
+        headers["If-Modified-Since"] = entry.lastModified;
+      }
+      return Object.keys(headers).length > 0 ? headers : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Clear all cached entries.
+   * Uses Redis SCAN to find and delete all keys with our prefix.
+   */
+  async clear() {
+    const keys = await this.redis.keys(`${this.keyPrefix}*`);
+    if (keys.length > 0) {
+      await this.redis.mdelete(keys);
+    }
+  }
+  /**
+   * Get the number of cached entries.
+   * Uses Redis SCAN to count keys with our prefix.
+   */
+  async size() {
+    const keys = await this.redis.keys(`${this.keyPrefix}*`);
+    return keys.length;
+  }
+  /**
+   * Remove expired entries.
+   *
+   * Note: Redis handles expiration automatically via TTL.
+   * This method is primarily for explicit cleanup of entries that are
+   * well past their HTTP cache expiration but still within Redis TTL.
+   *
+   * @returns Number of entries removed
+   */
+  async cleanup() {
+    const now = Date.now();
+    let removed = 0;
+    const keys = await this.redis.keys(`${this.keyPrefix}*`);
+    for (const key of keys) {
+      const data = await this.redis.get(key);
+      if (!data) continue;
+      try {
+        const entry = JSON.parse(data);
+        if (entry.expiresAt + this.config.maxTtlMs * 2 < now) {
+          await this.redis.delete(key);
+          removed++;
+        }
+      } catch {
+        await this.redis.delete(key);
+        removed++;
+      }
+    }
+    return removed;
+  }
+  /**
+   * Close the Redis connection.
+   */
+  async close() {
+    await this.redis.disconnect();
+  }
+};
+export {
+  RedisCimdCache
+};

package/browser/cimd/cimd.cache.mjs

@@ -0,0 +1,215 @@
+// libs/auth/src/cimd/cimd.cache.ts
+function extractCacheHeaders(headers) {
+  return {
+    "cache-control": headers.get("cache-control") ?? void 0,
+    expires: headers.get("expires") ?? void 0,
+    etag: headers.get("etag") ?? void 0,
+    "last-modified": headers.get("last-modified") ?? void 0,
+    age: headers.get("age") ?? void 0
+  };
+}
+function parseCacheHeaders(headers, config) {
+  let ttlMs = config.defaultTtlMs;
+  if (headers["cache-control"]) {
+    const cacheControl = parseCacheControlHeader(headers["cache-control"]);
+    if (cacheControl["no-store"] || cacheControl["no-cache"]) {
+      ttlMs = config.minTtlMs;
+    } else if (typeof cacheControl["max-age"] === "number") {
+      let maxAgeSecs = cacheControl["max-age"];
+      if (headers.age) {
+        const ageSeconds = parseInt(headers.age, 10);
+        if (!isNaN(ageSeconds)) {
+          maxAgeSecs = Math.max(0, maxAgeSecs - ageSeconds);
+        }
+      }
+      ttlMs = maxAgeSecs * 1e3;
+    }
+    if (typeof cacheControl["s-maxage"] === "number") {
+      let sMaxAgeSecs = cacheControl["s-maxage"];
+      if (headers.age) {
+        const ageSeconds = parseInt(headers.age, 10);
+        if (!isNaN(ageSeconds)) {
+          sMaxAgeSecs = Math.max(0, sMaxAgeSecs - ageSeconds);
+        }
+      }
+      ttlMs = sMaxAgeSecs * 1e3;
+    }
+  } else if (headers.expires) {
+    const expiresDate = new Date(headers.expires);
+    if (!isNaN(expiresDate.getTime())) {
+      ttlMs = Math.max(0, expiresDate.getTime() - Date.now());
+    }
+  }
+  ttlMs = Math.max(config.minTtlMs, Math.min(config.maxTtlMs, ttlMs));
+  return {
+    ttlMs,
+    etag: headers.etag,
+    lastModified: headers["last-modified"]
+  };
+}
+function parseCacheControlHeader(value) {
+  const result = {};
+  const directives = value.toLowerCase().split(",").map((d) => d.trim());
+  for (const directive of directives) {
+    const [key, val] = directive.split("=").map((s) => s.trim());
+    if (val !== void 0) {
+      const numVal = parseInt(val, 10);
+      if (!isNaN(numVal)) {
+        result[key] = numVal;
+      }
+    } else {
+      result[key] = true;
+    }
+  }
+  return result;
+}
+var InMemoryCimdCache = class {
+  cache = /* @__PURE__ */ new Map();
+  config;
+  constructor(config) {
+    this.config = {
+      defaultTtlMs: config?.defaultTtlMs ?? 36e5,
+      maxTtlMs: config?.maxTtlMs ?? 864e5,
+      minTtlMs: config?.minTtlMs ?? 6e4
+    };
+  }
+  /**
+   * Get a cached entry by client_id.
+   *
+   * @param clientId - The client_id URL
+   * @returns The cached entry if valid, or undefined
+   */
+  async get(clientId) {
+    const entry = this.cache.get(clientId);
+    if (!entry) {
+      return void 0;
+    }
+    if (entry.expiresAt < Date.now()) {
+      return void 0;
+    }
+    return entry;
+  }
+  /**
+   * Get a stale entry for conditional revalidation.
+   *
+   * @param clientId - The client_id URL
+   * @returns The stale entry (even if expired), or undefined if not cached
+   */
+  async getStale(clientId) {
+    return this.cache.get(clientId);
+  }
+  /**
+   * Store a document in the cache.
+   *
+   * @param clientId - The client_id URL
+   * @param document - The metadata document
+   * @param headers - HTTP response headers
+   */
+  async set(clientId, document, headers) {
+    const cacheHeaders = extractCacheHeaders(headers);
+    const { ttlMs, etag, lastModified } = parseCacheHeaders(cacheHeaders, this.config);
+    const now = Date.now();
+    const entry = {
+      document,
+      expiresAt: now + ttlMs,
+      etag,
+      lastModified,
+      cachedAt: now
+    };
+    this.cache.set(clientId, entry);
+  }
+  /**
+   * Update an existing cache entry (after 304 Not Modified).
+   *
+   * @param clientId - The client_id URL
+   * @param headers - New HTTP headers with updated cache directives
+   */
+  async revalidate(clientId, headers) {
+    const existing = this.cache.get(clientId);
+    if (!existing) {
+      return false;
+    }
+    const cacheHeaders = extractCacheHeaders(headers);
+    const { ttlMs, etag, lastModified } = parseCacheHeaders(cacheHeaders, this.config);
+    existing.expiresAt = Date.now() + ttlMs;
+    if (etag) existing.etag = etag;
+    if (lastModified) existing.lastModified = lastModified;
+    return true;
+  }
+  /**
+   * Delete a cache entry.
+   *
+   * @param clientId - The client_id URL
+   * @returns true if an entry was deleted
+   */
+  async delete(clientId) {
+    return this.cache.delete(clientId);
+  }
+  /**
+   * Get conditional request headers for a cached entry.
+   *
+   * @param clientId - The client_id URL
+   * @returns Headers for conditional request, or undefined if not cached
+   */
+  async getConditionalHeaders(clientId) {
+    const entry = this.cache.get(clientId);
+    if (!entry) {
+      return void 0;
+    }
+    const headers = {};
+    if (entry.etag) {
+      headers["If-None-Match"] = entry.etag;
+    }
+    if (entry.lastModified) {
+      headers["If-Modified-Since"] = entry.lastModified;
+    }
+    return Object.keys(headers).length > 0 ? headers : void 0;
+  }
+  /**
+   * Clear all cached entries.
+   */
+  async clear() {
+    this.cache.clear();
+  }
+  /**
+   * Get the number of cached entries.
+   */
+  async size() {
+    return this.cache.size;
+  }
+  /**
+   * Remove expired entries.
+   *
+   * @returns Number of entries removed
+   */
+  async cleanup() {
+    const now = Date.now();
+    let removed = 0;
+    for (const [clientId, entry] of this.cache) {
+      if (entry.expiresAt + this.config.maxTtlMs * 2 < now) {
+        this.cache.delete(clientId);
+        removed++;
+      }
+    }
+    return removed;
+  }
+};
+async function createCimdCache(config) {
+  const cacheType = config?.type ?? "memory";
+  if (cacheType === "redis") {
+    if (!config?.redis) {
+      throw new Error('Redis configuration is required when cache type is "redis"');
+    }
+    const { RedisCimdCache } = await import("./cimd-redis.cache.mjs");
+    const cache = new RedisCimdCache(config);
+    await cache.connect();
+    return cache;
+  }
+  return new InMemoryCimdCache(config);
+}
+export {
+  InMemoryCimdCache,
+  createCimdCache,
+  extractCacheHeaders,
+  parseCacheHeaders
+};

package/browser/cimd/cimd.errors.mjs

@@ -0,0 +1,142 @@
+// libs/auth/src/cimd/cimd.errors.ts
+var CimdError = class extends Error {
+  /**
+   * Error code for machine-readable identification.
+   */
+  code;
+  /**
+   * HTTP status code to return when this error occurs.
+   */
+  statusCode;
+  /**
+   * The client_id URL that caused the error.
+   */
+  clientIdUrl;
+  constructor(message, code, statusCode, clientIdUrl) {
+    super(message);
+    this.name = this.constructor.name;
+    this.code = code;
+    this.statusCode = statusCode;
+    this.clientIdUrl = clientIdUrl;
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, this.constructor);
+    }
+  }
+  /**
+   * Get a message safe to return to clients.
+   * Override in subclasses to provide user-friendly messages.
+   */
+  getPublicMessage() {
+    return this.message;
+  }
+};
+var InvalidClientIdUrlError = class extends CimdError {
+  reason;
+  constructor(clientIdUrl, reason) {
+    super(`Invalid CIMD client_id URL: ${reason}`, "INVALID_CLIENT_ID_URL", 400, clientIdUrl);
+    this.reason = reason;
+  }
+  getPublicMessage() {
+    return `Invalid client_id URL: ${this.reason}`;
+  }
+};
+var CimdFetchError = class extends CimdError {
+  httpStatus;
+  originalError;
+  constructor(clientIdUrl, message, options) {
+    super(`Failed to fetch CIMD document from ${clientIdUrl}: ${message}`, "CIMD_FETCH_ERROR", 502, clientIdUrl);
+    this.httpStatus = options?.httpStatus;
+    this.originalError = options?.originalError;
+  }
+  getPublicMessage() {
+    if (this.httpStatus) {
+      return `Failed to fetch client metadata: HTTP ${this.httpStatus}`;
+    }
+    return "Failed to fetch client metadata document";
+  }
+};
+var CimdValidationError = class extends CimdError {
+  validationErrors;
+  constructor(clientIdUrl, errors) {
+    super(`CIMD document validation failed: ${errors.join("; ")}`, "CIMD_VALIDATION_ERROR", 400, clientIdUrl);
+    this.validationErrors = errors;
+  }
+  getPublicMessage() {
+    return `Client metadata document validation failed: ${this.validationErrors.join("; ")}`;
+  }
+};
+var CimdClientIdMismatchError = class extends CimdError {
+  documentClientId;
+  constructor(urlClientId, documentClientId) {
+    super(
+      `CIMD client_id mismatch: URL is "${urlClientId}" but document contains "${documentClientId}"`,
+      "CIMD_CLIENT_ID_MISMATCH",
+      400,
+      urlClientId
+    );
+    this.documentClientId = documentClientId;
+  }
+  getPublicMessage() {
+    return "Client ID in metadata document does not match the request";
+  }
+};
+var CimdSecurityError = class extends CimdError {
+  securityReason;
+  constructor(clientIdUrl, reason) {
+    super(`CIMD security check failed for ${clientIdUrl}: ${reason}`, "CIMD_SECURITY_ERROR", 403, clientIdUrl);
+    this.securityReason = reason;
+  }
+  getPublicMessage() {
+    return "Client ID URL is not allowed by security policy";
+  }
+};
+var RedirectUriMismatchError = class extends CimdError {
+  requestedRedirectUri;
+  allowedRedirectUris;
+  constructor(clientIdUrl, requestedRedirectUri, allowedRedirectUris) {
+    super(
+      `Redirect URI "${requestedRedirectUri}" is not registered for client "${clientIdUrl}"`,
+      "REDIRECT_URI_MISMATCH",
+      400,
+      clientIdUrl
+    );
+    this.requestedRedirectUri = requestedRedirectUri;
+    this.allowedRedirectUris = allowedRedirectUris;
+  }
+  getPublicMessage() {
+    return "The redirect_uri is not registered for this client";
+  }
+};
+var CimdResponseTooLargeError = class extends CimdError {
+  maxBytes;
+  actualBytes;
+  constructor(clientIdUrl, maxBytes, actualBytes) {
+    super(
+      `CIMD response from ${clientIdUrl} exceeds maximum size of ${maxBytes} bytes${actualBytes ? ` (received ${actualBytes} bytes)` : ""}`,
+      "CIMD_RESPONSE_TOO_LARGE",
+      502,
+      clientIdUrl
+    );
+    this.maxBytes = maxBytes;
+    this.actualBytes = actualBytes;
+  }
+  getPublicMessage() {
+    return "Client metadata document is too large";
+  }
+};
+var CimdDisabledError = class extends CimdError {
+  constructor() {
+    super("CIMD (Client ID Metadata Documents) is disabled on this server", "CIMD_DISABLED", 400);
+  }
+};
+export {
+  CimdClientIdMismatchError,
+  CimdDisabledError,
+  CimdError,
+  CimdFetchError,
+  CimdResponseTooLargeError,
+  CimdSecurityError,
+  CimdValidationError,
+  InvalidClientIdUrlError,
+  RedirectUriMismatchError
+};

package/browser/cimd/cimd.logger.mjs

@@ -0,0 +1,15 @@
+// libs/auth/src/cimd/cimd.logger.ts
+var noopLogger = {
+  child: () => noopLogger,
+  debug: () => {
+  },
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+export {
+  noopLogger
+};