@frontmcp/auth 1.10.16 → 1.11.0-rc.1

package/browser/session/authorization.store.mjs

@@ -0,0 +1,336 @@
+// libs/auth/src/session/authorization.store.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import { randomUUID, sha256Base64url } from "@frontmcp/utils";
+var pkceChallengeSchema = z.object({
+  challenge: z.string().min(43).max(128),
+  method: z.literal("S256")
+});
+var authorizationCodeRecordSchema = z.object({
+  code: z.string().min(1),
+  clientId: z.string().min(1),
+  redirectUri: z.string().url(),
+  scopes: z.array(z.string()),
+  pkce: pkceChallengeSchema,
+  userSub: z.string().min(1),
+  userEmail: z.string().email().optional(),
+  userName: z.string().optional(),
+  state: z.string().optional(),
+  createdAt: z.number(),
+  expiresAt: z.number(),
+  used: z.boolean(),
+  resource: z.string().url().optional(),
+  // Consent and federated login fields
+  selectedToolIds: z.array(z.string()).optional(),
+  selectedProviderIds: z.array(z.string()).optional(),
+  skippedProviderIds: z.array(z.string()).optional(),
+  consentEnabled: z.boolean().optional(),
+  federatedLoginUsed: z.boolean().optional(),
+  pendingAuthId: z.string().optional(),
+  // Progressive/Incremental authorization: granted app-id set.
+  authorizedAppIds: z.array(z.string()).optional(),
+  // Custom claims from a local authenticate() verifier (Checkpoint 3a).
+  customClaims: z.record(z.string(), z.unknown()).optional()
+});
+var AUTH_CODE_TTL_MS = 60 * 1e3;
+var PENDING_AUTH_TTL_MS = 10 * 60 * 1e3;
+var REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+function generateAuthorizationCode() {
+  return randomUUID().replace(/-/g, "") + randomUUID().replace(/-/g, "");
+}
+function generateRefreshTokenValue() {
+  return randomUUID() + "-" + randomUUID();
+}
+function buildCodeRecord(params) {
+  const now = Date.now();
+  return {
+    code: generateAuthorizationCode(),
+    clientId: params.clientId,
+    redirectUri: params.redirectUri,
+    scopes: params.scopes,
+    pkce: params.pkce,
+    userSub: params.userSub,
+    userEmail: params.userEmail,
+    userName: params.userName,
+    state: params.state,
+    resource: params.resource,
+    createdAt: now,
+    expiresAt: now + AUTH_CODE_TTL_MS,
+    used: false,
+    selectedToolIds: params.selectedToolIds,
+    selectedProviderIds: params.selectedProviderIds,
+    skippedProviderIds: params.skippedProviderIds,
+    consentEnabled: params.consentEnabled,
+    federatedLoginUsed: params.federatedLoginUsed,
+    pendingAuthId: params.pendingAuthId,
+    authorizedAppIds: params.authorizedAppIds,
+    customClaims: params.customClaims
+  };
+}
+function buildPendingRecord(params) {
+  const now = Date.now();
+  return {
+    id: randomUUID(),
+    clientId: params.clientId,
+    redirectUri: params.redirectUri,
+    scopes: params.scopes,
+    pkce: params.pkce,
+    state: params.state,
+    resource: params.resource,
+    createdAt: now,
+    expiresAt: now + PENDING_AUTH_TTL_MS,
+    isIncremental: params.isIncremental,
+    incrementalSub: params.incrementalSub,
+    targetAppId: params.targetAppId,
+    targetToolId: params.targetToolId,
+    existingSessionId: params.existingSessionId,
+    existingAuthorizationId: params.existingAuthorizationId,
+    priorAuthorizedAppIds: params.priorAuthorizedAppIds,
+    federatedLogin: params.federatedLogin,
+    consent: params.consent,
+    authUiCsrf: params.authUiCsrf,
+    signinBinding: params.signinBinding
+  };
+}
+function buildRefreshTokenRecord(params) {
+  const now = Date.now();
+  return {
+    token: generateRefreshTokenValue(),
+    clientId: params.clientId,
+    userSub: params.userSub,
+    scopes: params.scopes,
+    resource: params.resource,
+    createdAt: now,
+    expiresAt: now + REFRESH_TOKEN_TTL_MS,
+    revoked: false,
+    // Preserve grant metadata so a refreshed access token keeps its
+    // consent/authorized_apps/custom claims.
+    userEmail: params.userEmail,
+    userName: params.userName,
+    consentEnabled: params.consentEnabled,
+    selectedToolIds: params.selectedToolIds,
+    authorizedAppIds: params.authorizedAppIds,
+    customClaims: params.customClaims,
+    federatedLoginUsed: params.federatedLoginUsed,
+    selectedProviderIds: params.selectedProviderIds,
+    skippedProviderIds: params.skippedProviderIds,
+    providerTokensId: params.providerTokensId
+  };
+}
+function verifyPkce(codeVerifier, challenge) {
+  if (challenge.method !== "S256") {
+    return false;
+  }
+  const hash = sha256Base64url(codeVerifier);
+  return hash === challenge.challenge;
+}
+function generatePkceChallenge(codeVerifier) {
+  const challenge = sha256Base64url(codeVerifier);
+  return { challenge, method: "S256" };
+}
+var InMemoryAuthorizationStore = class {
+  codes = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  refreshTokens = /* @__PURE__ */ new Map();
+  generateCode() {
+    return generateAuthorizationCode();
+  }
+  generateRefreshToken() {
+    return generateRefreshTokenValue();
+  }
+  async storeAuthorizationCode(record) {
+    this.codes.set(record.code, record);
+  }
+  async getAuthorizationCode(code) {
+    const record = this.codes.get(code);
+    if (!record) return null;
+    if (Date.now() > record.expiresAt) {
+      this.codes.delete(code);
+      return null;
+    }
+    return record;
+  }
+  async markCodeUsed(code, issuedRefreshToken) {
+    const record = this.codes.get(code);
+    if (record) {
+      record.used = true;
+      if (issuedRefreshToken) record.issuedRefreshToken = issuedRefreshToken;
+    }
+  }
+  async deleteAuthorizationCode(code) {
+    this.codes.delete(code);
+  }
+  async storePendingAuthorization(record) {
+    this.pending.set(record.id, record);
+  }
+  async getPendingAuthorization(id) {
+    const record = this.pending.get(id);
+    if (!record) return null;
+    if (Date.now() > record.expiresAt) {
+      this.pending.delete(id);
+      return null;
+    }
+    return record;
+  }
+  async deletePendingAuthorization(id) {
+    this.pending.delete(id);
+  }
+  async storeRefreshToken(record) {
+    this.refreshTokens.set(record.token, record);
+  }
+  async getRefreshToken(token) {
+    const record = this.refreshTokens.get(token);
+    if (!record) return null;
+    if (Date.now() > record.expiresAt || record.revoked) {
+      return null;
+    }
+    return record;
+  }
+  async revokeRefreshToken(token) {
+    const record = this.refreshTokens.get(token);
+    if (record) {
+      record.revoked = true;
+    }
+  }
+  async rotateRefreshToken(oldToken, newRecord) {
+    await this.revokeRefreshToken(oldToken);
+    newRecord.previousToken = oldToken;
+    await this.storeRefreshToken(newRecord);
+  }
+  async cleanup() {
+    const now = Date.now();
+    for (const [code, record] of this.codes) {
+      if (now > record.expiresAt) {
+        this.codes.delete(code);
+      }
+    }
+    for (const [id, record] of this.pending) {
+      if (now > record.expiresAt) {
+        this.pending.delete(id);
+      }
+    }
+    for (const [token, record] of this.refreshTokens) {
+      if (now > record.expiresAt || record.revoked) {
+        this.refreshTokens.delete(token);
+      }
+    }
+  }
+  /**
+   * Create an authorization code record with defaults.
+   */
+  createCodeRecord(params) {
+    return buildCodeRecord(params);
+  }
+  /**
+   * Create a pending authorization record with defaults.
+   */
+  createPendingRecord(params) {
+    return buildPendingRecord(params);
+  }
+  /**
+   * Create a refresh token record with defaults.
+   */
+  createRefreshTokenRecord(params) {
+    return buildRefreshTokenRecord(params);
+  }
+};
+var RedisAuthorizationStore = class {
+  constructor(redis, namespace = "oauth:") {
+    this.redis = redis;
+    this.namespace = namespace;
+  }
+  redis;
+  namespace;
+  key(type, id) {
+    return `${this.namespace}${type}:${id}`;
+  }
+  generateCode() {
+    return generateAuthorizationCode();
+  }
+  generateRefreshToken() {
+    return generateRefreshTokenValue();
+  }
+  createCodeRecord(params) {
+    return buildCodeRecord(params);
+  }
+  createPendingRecord(params) {
+    return buildPendingRecord(params);
+  }
+  createRefreshTokenRecord(params) {
+    return buildRefreshTokenRecord(params);
+  }
+  async storeAuthorizationCode(record) {
+    const ttl = Math.max(Math.ceil((record.expiresAt - Date.now()) / 1e3), 1);
+    await this.redis.set(this.key("code", record.code), JSON.stringify(record), "EX", Math.max(ttl, 1));
+  }
+  async getAuthorizationCode(code) {
+    const data = await this.redis.get(this.key("code", code));
+    if (!data) return null;
+    return JSON.parse(data);
+  }
+  async markCodeUsed(code, issuedRefreshToken) {
+    const record = await this.getAuthorizationCode(code);
+    if (record) {
+      record.used = true;
+      if (issuedRefreshToken) record.issuedRefreshToken = issuedRefreshToken;
+      const ttl = Math.ceil((record.expiresAt - Date.now()) / 1e3);
+      await this.redis.set(this.key("code", code), JSON.stringify(record), "EX", Math.max(ttl, 1));
+    }
+  }
+  async deleteAuthorizationCode(code) {
+    await this.redis.del(this.key("code", code));
+  }
+  async storePendingAuthorization(record) {
+    const ttl = Math.max(Math.ceil((record.expiresAt - Date.now()) / 1e3), 1);
+    await this.redis.set(this.key("pending", record.id), JSON.stringify(record), "EX", ttl);
+  }
+  async getPendingAuthorization(id) {
+    const data = await this.redis.get(this.key("pending", id));
+    if (!data) return null;
+    return JSON.parse(data);
+  }
+  async deletePendingAuthorization(id) {
+    await this.redis.del(this.key("pending", id));
+  }
+  async storeRefreshToken(record) {
+    const ttl = Math.ceil((record.expiresAt - Date.now()) / 1e3);
+    await this.redis.set(this.key("refresh", record.token), JSON.stringify(record), "EX", ttl);
+  }
+  async getRefreshToken(token) {
+    const data = await this.redis.get(this.key("refresh", token));
+    if (!data) return null;
+    const record = JSON.parse(data);
+    if (record.revoked) return null;
+    return record;
+  }
+  async revokeRefreshToken(token) {
+    const record = await this.getRefreshToken(token);
+    if (record) {
+      record.revoked = true;
+      const ttl = Math.ceil((record.expiresAt - Date.now()) / 1e3);
+      await this.redis.set(this.key("refresh", token), JSON.stringify(record), "EX", Math.max(ttl, 1));
+    }
+  }
+  async rotateRefreshToken(oldToken, newRecord) {
+    await this.revokeRefreshToken(oldToken);
+    newRecord.previousToken = oldToken;
+    await this.storeRefreshToken(newRecord);
+  }
+  async cleanup() {
+  }
+};
+export {
+  AUTH_CODE_TTL_MS,
+  InMemoryAuthorizationStore,
+  PENDING_AUTH_TTL_MS,
+  REFRESH_TOKEN_TTL_MS,
+  RedisAuthorizationStore,
+  authorizationCodeRecordSchema,
+  buildCodeRecord,
+  buildPendingRecord,
+  buildRefreshTokenRecord,
+  generateAuthorizationCode,
+  generatePkceChallenge,
+  generateRefreshTokenValue,
+  pkceChallengeSchema,
+  verifyPkce
+};

package/browser/session/consent.store.mjs

@@ -0,0 +1,34 @@
+// libs/auth/src/session/consent.store.ts
+function consentRecordKey(userSub, clientId) {
+  return `consent:${userSub}:${clientId}`;
+}
+var InMemoryConsentStore = class {
+  records = /* @__PURE__ */ new Map();
+  async get(userSub, clientId) {
+    const record = this.records.get(consentRecordKey(userSub, clientId));
+    if (!record) return null;
+    return { ...record, selectedToolIds: [...record.selectedToolIds], seenToolIds: [...record.seenToolIds] };
+  }
+  async set(record) {
+    this.records.set(consentRecordKey(record.userSub, record.clientId), {
+      ...record,
+      selectedToolIds: [...record.selectedToolIds],
+      seenToolIds: [...record.seenToolIds]
+    });
+  }
+  async delete(userSub, clientId) {
+    this.records.delete(consentRecordKey(userSub, clientId));
+  }
+  /** Number of remembered records (for testing/monitoring). */
+  get size() {
+    return this.records.size;
+  }
+  /** Clear all remembered records (for testing). */
+  clear() {
+    this.records.clear();
+  }
+};
+export {
+  InMemoryConsentStore,
+  consentRecordKey
+};

package/browser/session/credential-resume-link.mjs

@@ -0,0 +1,43 @@
+// libs/auth/src/session/credential-resume-link.ts
+import { signData, verifyData } from "@frontmcp/utils";
+var DEFAULT_RESUME_TTL_MS = 6e5;
+function signCredentialResumeToken(input, secret) {
+  const payload = {
+    sub: input.sub,
+    key: input.key,
+    ...input.context !== void 0 ? { context: input.context } : {},
+    exp: Date.now() + (input.ttlMs ?? DEFAULT_RESUME_TTL_MS)
+  };
+  const signedJson = signData(payload, { secret });
+  return Buffer.from(signedJson, "utf8").toString("base64url");
+}
+function verifyCredentialResumeToken(token, secret, now = Date.now()) {
+  let signedJson;
+  try {
+    signedJson = Buffer.from(token, "base64url").toString("utf8");
+  } catch {
+    return null;
+  }
+  const payload = verifyData(signedJson, { secret });
+  if (!payload) return null;
+  if (typeof payload.sub !== "string" || typeof payload.key !== "string" || !Number.isFinite(payload.exp)) {
+    return null;
+  }
+  if (payload.context !== void 0 && typeof payload.context !== "string") {
+    return null;
+  }
+  if (now >= payload.exp) {
+    return null;
+  }
+  return payload;
+}
+function buildCredentialResumeUrl(basePath, token) {
+  const trimmed = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
+  return `${trimmed}/oauth/connect?token=${encodeURIComponent(token)}`;
+}
+export {
+  DEFAULT_RESUME_TTL_MS,
+  buildCredentialResumeUrl,
+  signCredentialResumeToken,
+  verifyCredentialResumeToken
+};

package/browser/session/credentials-accessor.impl.mjs

@@ -0,0 +1,54 @@
+// libs/auth/src/session/credentials-accessor.impl.ts
+import { noopAuthLogger } from "../common/auth-logger.interface.mjs";
+import { buildCredentialResumeUrl, signCredentialResumeToken } from "./credential-resume-link.mjs";
+var CredentialsAccessorImpl = class {
+  vault;
+  resolveSub;
+  signingSecret;
+  basePath;
+  resumeTtlMs;
+  logger;
+  constructor(deps) {
+    this.vault = deps.vault;
+    this.resolveSub = deps.resolveSub;
+    this.signingSecret = deps.signingSecret;
+    this.basePath = deps.basePath;
+    this.resumeTtlMs = deps.resumeTtlMs;
+    this.logger = deps.logger ?? noopAuthLogger;
+  }
+  async get(key) {
+    const sub = this.resolveSub();
+    if (!sub) return void 0;
+    return this.vault.get(sub, key);
+  }
+  async list() {
+    const sub = this.resolveSub();
+    if (!sub) return [];
+    return this.vault.list(sub);
+  }
+  async requireConnect(options) {
+    const { key, context } = options;
+    const sub = this.resolveSub();
+    if (sub) {
+      const existing = await this.vault.get(sub, key);
+      if (existing) {
+        return { connected: true, key, credential: existing };
+      }
+    }
+    const token = signCredentialResumeToken(
+      { sub: sub ?? "", key, context, ttlMs: this.resumeTtlMs },
+      this.signingSecret
+    );
+    const resumeUrl = buildCredentialResumeUrl(this.basePath, token);
+    this.logger.debug(`CredentialsAccessor: credential "${key}" not connected; issued resume link`);
+    return {
+      connected: false,
+      key,
+      resumeUrl,
+      message: `Credential "${key}" is not connected. Open the resume URL to connect it.`
+    };
+  }
+};
+export {
+  CredentialsAccessorImpl
+};

package/browser/session/credentials-accessor.mjs

@@ -0,0 +1,5 @@
+// libs/auth/src/session/credentials-accessor.ts
+var CREDENTIALS_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:CREDENTIALS_ACCESSOR");
+export {
+  CREDENTIALS_ACCESSOR
+};