@frontmcp/auth 1.10.16 → 1.11.0-rc.1

package/browser/session/redis-session.store.mjs

@@ -0,0 +1,255 @@
+// libs/auth/src/session/redis-session.store.ts
+import { randomUUID, RedisStorageAdapter } from "@frontmcp/utils";
+import {
+  storedSessionSchema
+} from "./transport-session.types.mjs";
+import { signSession, verifyOrParseSession } from "./session-crypto.mjs";
+import { SessionRateLimiter } from "./session-rate-limiter.mjs";
+import { SessionIdEmptyError } from "../errors/auth-internal.errors.mjs";
+var RedisSessionStore = class {
+  storage;
+  keyPrefix;
+  defaultTtlMs;
+  logger;
+  externalInstance = false;
+  // Security features
+  security;
+  rateLimiter;
+  constructor(config, logger) {
+    this.defaultTtlMs = ("defaultTtlMs" in config ? config.defaultTtlMs : void 0) ?? 36e5;
+    this.logger = logger;
+    this.keyPrefix = ("keyPrefix" in config ? config.keyPrefix : void 0) ?? "mcp:session:";
+    this.security = ("security" in config ? config.security : void 0) ?? {};
+    if (this.security.enableRateLimiting) {
+      this.rateLimiter = new SessionRateLimiter({
+        windowMs: this.security.rateLimiting?.windowMs,
+        maxRequests: this.security.rateLimiting?.maxRequests
+      });
+    }
+    if ("redis" in config && config.redis) {
+      this.storage = new RedisStorageAdapter({
+        client: config.redis,
+        keyPrefix: this.keyPrefix
+      });
+      this.externalInstance = true;
+    } else {
+      const redisConfig = config;
+      this.storage = new RedisStorageAdapter({
+        config: {
+          host: redisConfig.host,
+          port: redisConfig.port ?? 6379,
+          password: redisConfig.password,
+          db: redisConfig.db ?? 0,
+          tls: redisConfig.tls
+        },
+        keyPrefix: this.keyPrefix
+      });
+    }
+  }
+  /**
+   * Get the full key for a session ID (without prefix, adapter handles it)
+   * @throws Error if sessionId is empty
+   */
+  validateSessionId(sessionId) {
+    if (!sessionId || sessionId.trim() === "") {
+      throw new SessionIdEmptyError("RedisSessionStore");
+    }
+  }
+  /**
+   * Ensure the storage adapter is connected
+   */
+  async ensureConnected() {
+    await this.storage.connect();
+  }
+  /**
+   * Get a stored session by ID
+   *
+   * Note: Uses atomic GETEX to extend TTL while reading, preventing race conditions
+   * where concurrent readers might resurrect expired sessions.
+   *
+   * @param sessionId - The session ID to look up
+   * @param options - Optional parameters for rate limiting
+   * @param options.clientIdentifier - Client identifier (e.g., IP address) for rate limiting.
+   *   When provided, rate limiting is applied per-client to prevent session enumeration.
+   *   If not provided, falls back to sessionId which provides DoS protection per-session.
+   */
+  async get(sessionId, options) {
+    this.validateSessionId(sessionId);
+    if (this.rateLimiter) {
+      const rateLimitKey = options?.clientIdentifier || sessionId;
+      const rateLimitResult = this.rateLimiter.check(rateLimitKey);
+      if (!rateLimitResult.allowed) {
+        this.logger?.warn("[RedisSessionStore] Rate limit exceeded for session lookup", {
+          sessionId: sessionId.slice(0, 20),
+          clientIdentifier: options?.clientIdentifier ? options.clientIdentifier.slice(0, 20) : void 0,
+          retryAfterMs: rateLimitResult.retryAfterMs
+        });
+        return null;
+      }
+    }
+    await this.ensureConnected();
+    let raw;
+    const redis = this.storage.getClient();
+    const ttlSeconds = Math.ceil(this.defaultTtlMs / 1e3);
+    if (redis) {
+      try {
+        raw = await redis.getex(this.keyPrefix + sessionId, "EX", ttlSeconds);
+      } catch {
+        raw = await this.storage.get(sessionId);
+        if (raw) {
+          await this.storage.expire(sessionId, ttlSeconds);
+        }
+      }
+    } else {
+      raw = await this.storage.get(sessionId);
+      if (raw) {
+        await this.storage.expire(sessionId, ttlSeconds);
+      }
+    }
+    if (!raw) return null;
+    try {
+      let parsed;
+      if (this.security.enableSigning) {
+        parsed = verifyOrParseSession(raw, { secret: this.security.signingSecret });
+        if (!parsed) {
+          this.logger?.warn("[RedisSessionStore] Session signature verification failed", {
+            sessionId: sessionId.slice(0, 20)
+          });
+          this.delete(sessionId).catch(() => void 0);
+          return null;
+        }
+      } else {
+        parsed = JSON.parse(raw);
+      }
+      const result = storedSessionSchema.safeParse(parsed);
+      if (!result.success) {
+        this.logger?.warn("[RedisSessionStore] Invalid session format", {
+          sessionId: sessionId.slice(0, 20),
+          errors: result.error.issues.slice(0, 3).map((i) => ({ path: i.path, message: i.message }))
+        });
+        this.delete(sessionId).catch(() => void 0);
+        return null;
+      }
+      const session = result.data;
+      if (session.maxLifetimeAt && session.maxLifetimeAt < Date.now()) {
+        this.logger?.info("[RedisSessionStore] Session exceeded max lifetime", {
+          sessionId: sessionId.slice(0, 20),
+          maxLifetimeAt: session.maxLifetimeAt
+        });
+        await this.delete(sessionId);
+        return null;
+      }
+      if (session.session.expiresAt && session.session.expiresAt < Date.now()) {
+        await this.delete(sessionId);
+        return null;
+      }
+      if (session.session.expiresAt) {
+        const ttlMs = Math.min(this.defaultTtlMs, session.session.expiresAt - Date.now());
+        if (ttlMs > 0 && ttlMs < this.defaultTtlMs) {
+          const boundedTtlSeconds = Math.ceil(ttlMs / 1e3);
+          this.storage.expire(sessionId, boundedTtlSeconds).catch((err) => {
+            this.logger?.warn("[RedisSessionStore] TTL extension failed", {
+              sessionId: sessionId.slice(0, 20),
+              error: err.message
+            });
+          });
+        }
+      }
+      const updatedSession = {
+        ...session,
+        lastAccessedAt: Date.now()
+      };
+      return updatedSession;
+    } catch (error) {
+      this.logger?.warn("[RedisSessionStore] Failed to parse session", {
+        sessionId: sessionId.slice(0, 20),
+        error: error.message
+      });
+      this.delete(sessionId).catch(() => void 0);
+      return null;
+    }
+  }
+  /**
+   * Store a session with optional TTL
+   */
+  async set(sessionId, session, ttlMs) {
+    this.validateSessionId(sessionId);
+    await this.ensureConnected();
+    let value;
+    if (this.security.enableSigning) {
+      value = signSession(session, { secret: this.security.signingSecret });
+    } else {
+      value = JSON.stringify(session);
+    }
+    if (ttlMs && ttlMs > 0) {
+      const ttlSeconds = Math.ceil(ttlMs / 1e3);
+      await this.storage.set(sessionId, value, { ttlSeconds });
+    } else if (session.session.expiresAt) {
+      const ttl = session.session.expiresAt - Date.now();
+      if (ttl > 0) {
+        const ttlSeconds = Math.ceil(ttl / 1e3);
+        await this.storage.set(sessionId, value, { ttlSeconds });
+      } else {
+        await this.storage.set(sessionId, value);
+      }
+    } else {
+      await this.storage.set(sessionId, value);
+    }
+  }
+  /**
+   * Delete a session
+   */
+  async delete(sessionId) {
+    this.validateSessionId(sessionId);
+    await this.ensureConnected();
+    await this.storage.delete(sessionId);
+  }
+  /**
+   * Check if a session exists
+   */
+  async exists(sessionId) {
+    this.validateSessionId(sessionId);
+    await this.ensureConnected();
+    return this.storage.exists(sessionId);
+  }
+  /**
+   * Allocate a new session ID
+   */
+  allocId() {
+    return randomUUID();
+  }
+  /**
+   * Disconnect from Redis (only if we created the connection)
+   */
+  async disconnect() {
+    if (!this.externalInstance) {
+      await this.storage.disconnect();
+    }
+  }
+  /**
+   * Get the underlying Redis client (for advanced use cases)
+   */
+  getRedisClient() {
+    return this.storage.getClient();
+  }
+  /**
+   * Test Redis connection by sending a PING command.
+   * Useful for validating connection on startup.
+   *
+   * @returns true if connection is healthy, false otherwise
+   */
+  async ping() {
+    try {
+      await this.ensureConnected();
+      return this.storage.ping();
+    } catch (error) {
+      this.logger?.error("[RedisSessionStore] Connection failed", {
+        error: error.message
+      });
+      return false;
+    }
+  }
+};
+export {
+  RedisSessionStore
+};

package/browser/session/secure-store-accessor.impl.mjs

@@ -0,0 +1,78 @@
+// libs/auth/src/session/secure-store-accessor.impl.ts
+import { sha256Hex } from "@frontmcp/utils";
+import { noopAuthLogger } from "../common/auth-logger.interface.mjs";
+var GLOBAL_NAMESPACE = "global";
+var SecureStoreAccessorImpl = class {
+  backend;
+  scope;
+  resolveSub;
+  resolveSessionId;
+  ttlMs;
+  logger;
+  constructor(deps) {
+    this.backend = deps.backend;
+    this.scope = deps.scope ?? "user";
+    this.resolveSub = deps.resolveSub;
+    this.resolveSessionId = deps.resolveSessionId;
+    this.ttlMs = deps.ttlMs;
+    this.logger = deps.logger ?? noopAuthLogger;
+  }
+  /**
+   * Resolve the namespace for the current request from the configured scope.
+   * Returns undefined when the scope's identity is unavailable (anonymous user
+   * under `user` scope, or no session under `session` scope), in which case
+   * reads return empty and writes are skipped.
+   */
+  resolveNamespace() {
+    switch (this.scope) {
+      case "global":
+        return GLOBAL_NAMESPACE;
+      case "session": {
+        const sid = this.resolveSessionId();
+        return sid ? `s:${sha256Hex(sid).slice(0, 32)}` : void 0;
+      }
+      case "user":
+      default: {
+        const sub = this.resolveSub();
+        return sub ? `u:${sha256Hex(sub).slice(0, 32)}` : void 0;
+      }
+    }
+  }
+  async get(key) {
+    const namespace = this.resolveNamespace();
+    if (!namespace) return void 0;
+    const raw = await this.backend.get(namespace, key);
+    if (raw === null) return void 0;
+    try {
+      return JSON.parse(raw);
+    } catch (err) {
+      this.logger.warn(`SecureStore: failed to parse secret "${key}": ${errMsg(err)}`);
+      return void 0;
+    }
+  }
+  async set(key, value, options) {
+    const namespace = this.resolveNamespace();
+    if (!namespace) {
+      this.logger.debug(`SecureStore: no ${this.scope} scope for request; skipping set("${key}")`);
+      return;
+    }
+    const ttlMs = options?.ttlMs ?? this.ttlMs;
+    await this.backend.set(namespace, key, JSON.stringify(value), ttlMs);
+  }
+  async delete(key) {
+    const namespace = this.resolveNamespace();
+    if (!namespace) return false;
+    return this.backend.delete(namespace, key);
+  }
+  async list() {
+    const namespace = this.resolveNamespace();
+    if (!namespace) return [];
+    return this.backend.list(namespace);
+  }
+};
+function errMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+export {
+  SecureStoreAccessorImpl
+};

package/browser/session/secure-store-accessor.mjs

@@ -0,0 +1,5 @@
+// libs/auth/src/session/secure-store-accessor.ts
+var SECURE_STORE_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:SECURE_STORE_ACCESSOR");
+export {
+  SECURE_STORE_ACCESSOR
+};

package/browser/session/secure-store-backends.mjs

@@ -0,0 +1,111 @@
+// libs/auth/src/session/secure-store-backends.ts
+import { noopAuthLogger } from "../common/auth-logger.interface.mjs";
+import { VaultEncryption } from "./vault-encryption.mjs";
+var DEFAULT_KEY_PREFIX = "mcp:secret:";
+var EncryptedStorageSecureStoreBackend = class {
+  storage;
+  encryption;
+  keyPrefix;
+  logger;
+  /** Cache of derived AES keys, keyed by namespace. */
+  keyCache = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.storage = options.storage;
+    this.keyPrefix = options.keyPrefix ?? DEFAULT_KEY_PREFIX;
+    this.logger = options.logger ?? noopAuthLogger;
+    this.encryption = new VaultEncryption({
+      pepper: options.pepper,
+      hkdfInfo: "frontmcp-secure-store-v1"
+    });
+  }
+  // ============================================
+  // Storage-key helpers
+  // ============================================
+  /** `secret:keys:<namespace>` \u2192 JSON array of key names. */
+  keysKey(namespace) {
+    return `${this.keyPrefix}keys:${namespace}`;
+  }
+  /** `secret:data:<namespace>:<key>` \u2192 encrypted record. */
+  dataKey(namespace, key) {
+    return `${this.keyPrefix}data:${namespace}:${key}`;
+  }
+  /**
+   * Derive (and cache) the AES-256 key for a namespace. The namespace acts as
+   * the HKDF salt material, so values are cryptographically isolated per scope.
+   */
+  deriveKey(namespace) {
+    const cached = this.keyCache.get(namespace);
+    if (cached) return cached;
+    const promise = this.encryption.deriveKey({ jti: namespace, vaultKey: namespace, sub: namespace, iat: 0 });
+    this.keyCache.set(namespace, promise);
+    return promise;
+  }
+  setOpts(ttlMs) {
+    return ttlMs && ttlMs > 0 ? { ttlSeconds: Math.ceil(ttlMs / 1e3) } : void 0;
+  }
+  // ============================================
+  // SecureStoreBackend
+  // ============================================
+  async get(namespace, key) {
+    const raw = await this.storage.get(this.dataKey(namespace, key));
+    if (!raw) return null;
+    try {
+      const record = JSON.parse(raw);
+      const aesKey = await this.deriveKey(namespace);
+      return await this.encryption.decrypt(record.enc, aesKey);
+    } catch (err) {
+      this.logger.warn(`SecureStore: failed to read secret "${key}": ${errMsg(err)}`);
+      return null;
+    }
+  }
+  async set(namespace, key, value, ttlMs) {
+    const aesKey = await this.deriveKey(namespace);
+    const enc = await this.encryption.encrypt(value, aesKey);
+    const record = { enc };
+    const opts = this.setOpts(ttlMs);
+    await this.storage.set(this.dataKey(namespace, key), JSON.stringify(record), opts);
+    await this.addKeyToSet(namespace, key, opts);
+  }
+  async delete(namespace, key) {
+    const existed = await this.storage.delete(this.dataKey(namespace, key));
+    const keys = await this.readKeySet(namespace);
+    const next = keys.filter((k) => k !== key);
+    if (next.length !== keys.length) {
+      await this.writeKeySet(namespace, next);
+    }
+    return existed;
+  }
+  async list(namespace) {
+    return this.readKeySet(namespace);
+  }
+  // ============================================
+  // Key-set helpers (the namespace's key SET)
+  // ============================================
+  async readKeySet(namespace) {
+    const raw = await this.storage.get(this.keysKey(namespace));
+    if (!raw) return [];
+    try {
+      const parsed = JSON.parse(raw);
+      return Array.isArray(parsed) ? parsed.filter((k) => typeof k === "string") : [];
+    } catch {
+      return [];
+    }
+  }
+  async writeKeySet(namespace, keys, opts) {
+    const unique = [...new Set(keys)];
+    await this.storage.set(this.keysKey(namespace), JSON.stringify(unique), opts);
+  }
+  async addKeyToSet(namespace, key, opts) {
+    const keys = await this.readKeySet(namespace);
+    if (!keys.includes(key)) {
+      keys.push(key);
+      await this.writeKeySet(namespace, keys, opts);
+    }
+  }
+};
+function errMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+export {
+  EncryptedStorageSecureStoreBackend
+};

package/browser/session/secure-store.factory.mjs

@@ -0,0 +1,77 @@
+// libs/auth/src/session/secure-store.factory.ts
+import { MemoryStorageAdapter } from "@frontmcp/utils";
+import { SecureStoreConfigError } from "../errors/auth-internal.errors.mjs";
+import { secureStoreConfigSchema } from "../options/shared.schemas.mjs";
+import { EncryptedStorageSecureStoreBackend } from "./secure-store-backends.mjs";
+import { createTokenStorageAdapter } from "./token-storage.factory.mjs";
+function isCustomBackendConfig(config) {
+  return typeof config === "object" && config !== null && "backend" in config && !!config.backend;
+}
+function isSqliteConfig(config) {
+  return typeof config === "object" && config !== null && "sqlite" in config && !!config.sqlite;
+}
+function isRedisConfig(config) {
+  return typeof config === "object" && config !== null && "redis" in config && !!config.redis;
+}
+function readScope(config) {
+  if (typeof config === "object" && config !== null && "scope" in config && config.scope) {
+    return config.scope;
+  }
+  return "user";
+}
+function readTtlMs(config) {
+  if (typeof config === "object" && config !== null && "ttlMs" in config) {
+    return config.ttlMs;
+  }
+  return void 0;
+}
+function readPepper(config) {
+  if (typeof config === "object" && config !== null && "encryption" in config && config.encryption) {
+    return config.encryption.pepper;
+  }
+  return void 0;
+}
+function toTokenStorageConfig(config) {
+  if (isSqliteConfig(config)) {
+    return { sqlite: config.sqlite };
+  }
+  if (isRedisConfig(config)) {
+    return { redis: config.redis };
+  }
+  return "memory";
+}
+function refuseUnusableConfig(config) {
+  if (config === void 0) return;
+  const issue = secureStoreConfigSchema.safeParse(config).error?.issues[0];
+  if (!issue) return;
+  const where = issue.path.length > 0 ? `secureStore.${issue.path.map(String).join(".")}: ` : "";
+  throw new SecureStoreConfigError(`${where}${issue.message}`);
+}
+async function createSecureStore(options) {
+  const { config, pepper, storage, logger } = options;
+  refuseUnusableConfig(config);
+  const scope = readScope(config);
+  const ttlMs = readTtlMs(config);
+  if (isCustomBackendConfig(config)) {
+    return { backend: config.backend, scope, ttlMs, kind: "custom" };
+  }
+  const kind = isSqliteConfig(config) ? "sqlite" : isRedisConfig(config) ? "redis" : "memory";
+  let adapter;
+  if (storage) {
+    adapter = storage;
+  } else if (kind === "memory") {
+    adapter = new MemoryStorageAdapter();
+    await adapter.connect();
+  } else {
+    adapter = await createTokenStorageAdapter(toTokenStorageConfig(config));
+  }
+  const backend = new EncryptedStorageSecureStoreBackend({
+    storage: adapter,
+    pepper: readPepper(config) ?? pepper,
+    logger
+  });
+  return { backend, scope, ttlMs, kind, ...storage ? {} : { close: () => adapter.disconnect() } };
+}
+export {
+  createSecureStore
+};

package/browser/session/session-credential-vault.factory.mjs

@@ -0,0 +1,18 @@
+// libs/auth/src/session/session-credential-vault.factory.ts
+import { SessionCredentialVault } from "./session-credential-vault.mjs";
+import { createTokenStorageAdapter } from "./token-storage.factory.mjs";
+async function createSessionCredentialVault(options) {
+  const storage = options.storage ?? await createTokenStorageAdapter(options.tokenStorage);
+  const vault = new SessionCredentialVault({
+    storage,
+    pepper: options.pepper,
+    keyPrefix: options.keyPrefix,
+    ttlMs: options.ttlMs,
+    logger: options.logger
+  });
+  const type = options.tokenStorage === void 0 || options.tokenStorage === "memory" ? "memory" : "sqlite" in options.tokenStorage ? "sqlite" : "redis";
+  return { vault, type };
+}
+export {
+  createSessionCredentialVault
+};