@frontmcp/auth 1.10.16 → 1.11.0-rc.1

package/browser/session/storage/storage-authorization-vault.mjs

@@ -0,0 +1,301 @@
+// libs/auth/src/session/storage/storage-authorization-vault.ts
+import { randomUUID, TypedStorage } from "@frontmcp/utils";
+import { authorizationVaultEntrySchema } from "../authorization-vault.mjs";
+var StorageAuthorizationVault = class {
+  storage;
+  namespace;
+  pendingAuthTtlMs;
+  constructor(storage, options = {}) {
+    this.namespace = options.namespace ?? "vault";
+    this.pendingAuthTtlMs = options.pendingAuthTtlMs ?? 10 * 60 * 1e3;
+    const namespacedStorage = this.isNamespacedStorage(storage) ? storage.namespace(this.namespace) : storage;
+    this.storage = new TypedStorage(namespacedStorage, {
+      schema: options.validateOnRead ? authorizationVaultEntrySchema : void 0,
+      throwOnInvalid: false
+    });
+  }
+  // ============================================
+  // Core CRUD Methods
+  // ============================================
+  async create(params) {
+    const now = Date.now();
+    const entry = {
+      id: randomUUID(),
+      userSub: params.userSub,
+      userEmail: params.userEmail,
+      userName: params.userName,
+      clientId: params.clientId,
+      createdAt: now,
+      lastAccessAt: now,
+      appCredentials: {},
+      consent: params.consent,
+      federated: params.federated,
+      pendingAuths: [],
+      authorizedAppIds: params.authorizedAppIds ?? [],
+      skippedAppIds: params.skippedAppIds ?? []
+    };
+    await this.storage.set(this.key(entry.id), entry);
+    return entry;
+  }
+  async get(id) {
+    return this.storage.get(this.key(id));
+  }
+  async update(id, updates) {
+    const entry = await this.get(id);
+    if (!entry) {
+      console.warn(`[StorageAuthorizationVault] Update failed: vault entry not found for id ${id}`);
+      return;
+    }
+    const updated = {
+      ...entry,
+      ...updates,
+      lastAccessAt: Date.now()
+    };
+    await this.storage.set(this.key(id), updated);
+  }
+  async delete(id) {
+    await this.storage.delete(this.key(id));
+  }
+  // ============================================
+  // Consent Methods
+  // ============================================
+  async updateConsent(vaultId, consent) {
+    const entry = await this.get(vaultId);
+    if (!entry) return;
+    entry.consent = consent;
+    entry.lastAccessAt = Date.now();
+    await this.storage.set(this.key(vaultId), entry);
+  }
+  // ============================================
+  // App Authorization Methods
+  // ============================================
+  async authorizeApp(vaultId, appId) {
+    const entry = await this.get(vaultId);
+    if (!entry) return;
+    entry.skippedAppIds = entry.skippedAppIds.filter((id) => id !== appId);
+    if (!entry.authorizedAppIds.includes(appId)) {
+      entry.authorizedAppIds.push(appId);
+    }
+    entry.lastAccessAt = Date.now();
+    await this.storage.set(this.key(vaultId), entry);
+  }
+  async isAppAuthorized(vaultId, appId) {
+    const entry = await this.get(vaultId);
+    if (!entry) return false;
+    return entry.authorizedAppIds.includes(appId);
+  }
+  // ============================================
+  // Pending Auth Methods
+  // ============================================
+  async createPendingAuth(vaultId, params) {
+    const entry = await this.get(vaultId);
+    if (!entry) {
+      throw new Error(`Vault not found: ${vaultId}`);
+    }
+    const now = Date.now();
+    const pendingAuth = {
+      id: randomUUID(),
+      appId: params.appId,
+      toolId: params.toolId,
+      authUrl: params.authUrl,
+      requiredScopes: params.requiredScopes,
+      elicitId: params.elicitId,
+      createdAt: now,
+      expiresAt: now + (params.ttlMs ?? this.pendingAuthTtlMs),
+      status: "pending"
+    };
+    entry.pendingAuths.push(pendingAuth);
+    entry.lastAccessAt = now;
+    await this.storage.set(this.key(vaultId), entry);
+    return pendingAuth;
+  }
+  async getPendingAuth(vaultId, pendingAuthId) {
+    const entry = await this.get(vaultId);
+    if (!entry) return null;
+    const pendingAuth = entry.pendingAuths.find((p) => p.id === pendingAuthId);
+    if (!pendingAuth) return null;
+    if (Date.now() > pendingAuth.expiresAt && pendingAuth.status === "pending") {
+      pendingAuth.status = "expired";
+      await this.storage.set(this.key(vaultId), entry);
+    }
+    return pendingAuth;
+  }
+  async completePendingAuth(vaultId, pendingAuthId) {
+    const entry = await this.get(vaultId);
+    if (!entry) return;
+    const pendingAuth = entry.pendingAuths.find((p) => p.id === pendingAuthId);
+    if (pendingAuth) {
+      pendingAuth.status = "completed";
+      entry.skippedAppIds = entry.skippedAppIds.filter((id) => id !== pendingAuth.appId);
+      if (!entry.authorizedAppIds.includes(pendingAuth.appId)) {
+        entry.authorizedAppIds.push(pendingAuth.appId);
+      }
+      entry.lastAccessAt = Date.now();
+      await this.storage.set(this.key(vaultId), entry);
+    }
+  }
+  async cancelPendingAuth(vaultId, pendingAuthId) {
+    const entry = await this.get(vaultId);
+    if (!entry) return;
+    const pendingAuth = entry.pendingAuths.find((p) => p.id === pendingAuthId);
+    if (pendingAuth) {
+      pendingAuth.status = "cancelled";
+      await this.storage.set(this.key(vaultId), entry);
+    }
+  }
+  async getPendingAuths(vaultId) {
+    const entry = await this.get(vaultId);
+    if (!entry) return [];
+    const now = Date.now();
+    let updated = false;
+    const pending = entry.pendingAuths.filter((p) => {
+      if (now > p.expiresAt && p.status === "pending") {
+        p.status = "expired";
+        updated = true;
+      }
+      return p.status === "pending";
+    });
+    if (updated) {
+      await this.storage.set(this.key(vaultId), entry);
+    }
+    return pending;
+  }
+  // ============================================
+  // App Credential Methods
+  // ============================================
+  credentialKey(appId, providerId) {
+    return `${appId}:${providerId}`;
+  }
+  async addAppCredential(vaultId, credential) {
+    const entry = await this.get(vaultId);
+    if (!entry) return;
+    const shouldStore = await this.shouldStoreCredential(vaultId, credential.appId);
+    if (!shouldStore) {
+      return;
+    }
+    const key = this.credentialKey(credential.appId, credential.providerId);
+    entry.appCredentials[key] = credential;
+    entry.lastAccessAt = Date.now();
+    await this.storage.set(this.key(vaultId), entry);
+  }
+  async removeAppCredential(vaultId, appId, providerId) {
+    const entry = await this.get(vaultId);
+    if (!entry) return;
+    const key = this.credentialKey(appId, providerId);
+    delete entry.appCredentials[key];
+    entry.lastAccessAt = Date.now();
+    await this.storage.set(this.key(vaultId), entry);
+  }
+  async getAppCredentials(vaultId, appId) {
+    const entry = await this.get(vaultId);
+    if (!entry) return [];
+    const prefix = `${appId}:`;
+    return Object.entries(entry.appCredentials).filter(([key]) => key.startsWith(prefix)).map(([, cred]) => cred);
+  }
+  async getCredential(vaultId, appId, providerId) {
+    const entry = await this.get(vaultId);
+    if (!entry) return null;
+    const key = this.credentialKey(appId, providerId);
+    return entry.appCredentials[key] ?? null;
+  }
+  async getAllCredentials(vaultId, filterByConsent = false) {
+    const entry = await this.get(vaultId);
+    if (!entry) return [];
+    const allCredentials = Object.values(entry.appCredentials);
+    if (!filterByConsent || !entry.consent?.enabled) {
+      return allCredentials;
+    }
+    const consentedToolIds = new Set(entry.consent.selectedToolIds);
+    return allCredentials.filter((cred) => {
+      return Array.from(consentedToolIds).some((toolId) => toolId.startsWith(`${cred.appId}:`));
+    });
+  }
+  async updateCredential(vaultId, appId, providerId, updates) {
+    const entry = await this.get(vaultId);
+    if (!entry) return;
+    const key = this.credentialKey(appId, providerId);
+    const credential = entry.appCredentials[key];
+    if (!credential) return;
+    Object.assign(credential, updates);
+    entry.lastAccessAt = Date.now();
+    await this.storage.set(this.key(vaultId), entry);
+  }
+  async shouldStoreCredential(vaultId, appId, toolIds) {
+    const entry = await this.get(vaultId);
+    if (!entry) return false;
+    const consent = entry.consent;
+    if (!consent?.enabled) {
+      return true;
+    }
+    if (toolIds && toolIds.length > 0) {
+      return toolIds.some((toolId) => consent.selectedToolIds.includes(toolId));
+    }
+    const consentedToolIds = consent.selectedToolIds;
+    return consentedToolIds.some((toolId) => toolId.startsWith(`${appId}:`));
+  }
+  async invalidateCredential(vaultId, appId, providerId, reason) {
+    await this.updateCredential(vaultId, appId, providerId, {
+      isValid: false,
+      invalidReason: reason
+    });
+  }
+  async refreshOAuthCredential(vaultId, appId, providerId, tokens) {
+    const entry = await this.get(vaultId);
+    if (!entry) return;
+    const key = this.credentialKey(appId, providerId);
+    const credential = entry.appCredentials[key];
+    if (!credential || credential.credential.type !== "oauth" && credential.credential.type !== "oauth_pkce") return;
+    credential.credential.accessToken = tokens.accessToken;
+    if (tokens.refreshToken !== void 0) {
+      credential.credential.refreshToken = tokens.refreshToken;
+    }
+    if (tokens.expiresAt !== void 0) {
+      credential.credential.expiresAt = tokens.expiresAt;
+      credential.expiresAt = tokens.expiresAt;
+    }
+    credential.isValid = true;
+    credential.invalidReason = void 0;
+    entry.lastAccessAt = Date.now();
+    await this.storage.set(this.key(vaultId), entry);
+  }
+  // ============================================
+  // Cleanup
+  // ============================================
+  async cleanup() {
+    const keys = await this.storage.keys("*");
+    const now = Date.now();
+    for (const key of keys) {
+      const entry = await this.storage.get(key);
+      if (!entry) continue;
+      const originalLength = entry.pendingAuths.length;
+      entry.pendingAuths = entry.pendingAuths.filter((p) => {
+        if (now > p.expiresAt && p.status === "pending") {
+          p.status = "expired";
+        }
+        return p.status === "pending";
+      });
+      if (entry.pendingAuths.length !== originalLength) {
+        await this.storage.set(key, entry);
+      }
+    }
+  }
+  // ============================================
+  // Helpers
+  // ============================================
+  /**
+   * Build the storage key for a vault ID.
+   * For non-namespaced storage, includes the namespace prefix.
+   */
+  key(id) {
+    return this.isNamespacedStorage(this.storage.raw) ? id : `${this.namespace}:${id}`;
+  }
+  /**
+   * Type guard to check if storage is a NamespacedStorage.
+   */
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+export {
+  StorageAuthorizationVault
+};

package/browser/session/storage/storage-token-store.mjs

@@ -0,0 +1,83 @@
+// libs/auth/src/session/storage/storage-token-store.ts
+import { randomUUID, TypedStorage } from "@frontmcp/utils";
+var StorageTokenStore = class {
+  storage;
+  namespace;
+  defaultTtlSeconds;
+  /** Track if original storage was namespaced to avoid double-prefixing */
+  storageIsNamespaced;
+  constructor(storage, options = {}) {
+    this.namespace = options.namespace ?? "tok";
+    this.defaultTtlSeconds = options.defaultTtlSeconds;
+    this.storageIsNamespaced = "namespace" in storage && typeof storage.namespace === "function";
+    const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+    this.storage = new TypedStorage(namespacedStorage);
+  }
+  /**
+   * Allocate a new unique ID for a token record.
+   */
+  allocId() {
+    return randomUUID();
+  }
+  /**
+   * Store an encrypted token blob.
+   *
+   * TTL is calculated from blob.exp (epoch seconds) if present.
+   * Falls back to defaultTtlSeconds if configured.
+   *
+   * @param id - Token record ID
+   * @param blob - Encrypted token blob
+   */
+  async put(id, blob) {
+    const record = {
+      id,
+      blob,
+      updatedAt: Date.now()
+    };
+    const ttlSeconds = this.calculateTtl(blob.exp);
+    await this.storage.set(this.key(id), record, ttlSeconds ? { ttlSeconds } : void 0);
+  }
+  /**
+   * Retrieve a token record by ID.
+   *
+   * @param id - Token record ID
+   * @returns The secret record, or undefined if not found
+   */
+  async get(id) {
+    const record = await this.storage.get(this.key(id));
+    return record ?? void 0;
+  }
+  /**
+   * Delete a token record.
+   *
+   * @param id - Token record ID
+   */
+  async del(id) {
+    await this.storage.delete(this.key(id));
+  }
+  /**
+   * Calculate TTL in seconds from expiration timestamp.
+   *
+   * @param exp - Expiration timestamp in epoch seconds
+   * @returns TTL in seconds, or undefined if no TTL should be applied
+   */
+  calculateTtl(exp) {
+    if (exp) {
+      const nowSeconds = Math.floor(Date.now() / 1e3);
+      const ttl = exp - nowSeconds;
+      return ttl > 0 ? ttl : 1;
+    }
+    return this.defaultTtlSeconds;
+  }
+  /**
+   * Build the storage key for a token ID.
+   * For namespaced storage, the namespace is handled by the storage layer.
+   * For non-namespaced storage, includes the namespace prefix in the key.
+   */
+  key(id) {
+    return this.storageIsNamespaced ? id : `${this.namespace}:${id}`;
+  }
+};
+export {
+  StorageTokenStore
+};

package/browser/session/storage-authorization.store.mjs

@@ -0,0 +1,134 @@
+// libs/auth/src/session/storage-authorization.store.ts
+import { TypedStorage } from "@frontmcp/utils";
+import {
+  buildCodeRecord,
+  buildPendingRecord,
+  buildRefreshTokenRecord,
+  generateAuthorizationCode,
+  generateRefreshTokenValue
+} from "./authorization.store.mjs";
+var StorageAuthorizationStore = class {
+  codeStore;
+  pendingStore;
+  refreshStore;
+  namespace;
+  storageIsNamespaced;
+  constructor(storage, options = {}) {
+    this.namespace = options.namespace ?? "oauth";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    const base = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+    this.codeStore = new TypedStorage(base);
+    this.pendingStore = new TypedStorage(base);
+    this.refreshStore = new TypedStorage(base);
+  }
+  // ============================================
+  // Record builders (pure; shared with in-memory store)
+  // ============================================
+  generateCode() {
+    return generateAuthorizationCode();
+  }
+  generateRefreshToken() {
+    return generateRefreshTokenValue();
+  }
+  createCodeRecord(params) {
+    return buildCodeRecord(params);
+  }
+  createPendingRecord(params) {
+    return buildPendingRecord(params);
+  }
+  createRefreshTokenRecord(params) {
+    return buildRefreshTokenRecord(params);
+  }
+  // ============================================
+  // Authorization code operations
+  // ============================================
+  async storeAuthorizationCode(record) {
+    await this.codeStore.set(this.key("code", record.code), record, this.ttl(record.expiresAt));
+  }
+  async getAuthorizationCode(code) {
+    const record = await this.codeStore.get(this.key("code", code));
+    if (!record) return null;
+    if (Date.now() > record.expiresAt) {
+      await this.codeStore.delete(this.key("code", code));
+      return null;
+    }
+    return record;
+  }
+  async markCodeUsed(code, issuedRefreshToken) {
+    const record = await this.getAuthorizationCode(code);
+    if (record) {
+      record.used = true;
+      if (issuedRefreshToken) record.issuedRefreshToken = issuedRefreshToken;
+      await this.codeStore.set(this.key("code", code), record, this.ttl(record.expiresAt));
+    }
+  }
+  async deleteAuthorizationCode(code) {
+    await this.codeStore.delete(this.key("code", code));
+  }
+  // ============================================
+  // Pending authorization operations
+  // ============================================
+  async storePendingAuthorization(record) {
+    await this.pendingStore.set(this.key("pending", record.id), record, this.ttl(record.expiresAt));
+  }
+  async getPendingAuthorization(id) {
+    const record = await this.pendingStore.get(this.key("pending", id));
+    if (!record) return null;
+    if (Date.now() > record.expiresAt) {
+      await this.pendingStore.delete(this.key("pending", id));
+      return null;
+    }
+    return record;
+  }
+  async deletePendingAuthorization(id) {
+    await this.pendingStore.delete(this.key("pending", id));
+  }
+  // ============================================
+  // Refresh token operations
+  // ============================================
+  async storeRefreshToken(record) {
+    await this.refreshStore.set(this.key("refresh", record.token), record, this.ttl(record.expiresAt));
+  }
+  async getRefreshToken(token) {
+    const record = await this.refreshStore.get(this.key("refresh", token));
+    if (!record) return null;
+    if (Date.now() > record.expiresAt || record.revoked) {
+      return null;
+    }
+    return record;
+  }
+  async revokeRefreshToken(token) {
+    const record = await this.refreshStore.get(this.key("refresh", token));
+    if (record) {
+      record.revoked = true;
+      await this.refreshStore.set(this.key("refresh", token), record, this.ttl(record.expiresAt));
+    }
+  }
+  async rotateRefreshToken(oldToken, newRecord) {
+    await this.revokeRefreshToken(oldToken);
+    newRecord.previousToken = oldToken;
+    await this.storeRefreshToken(newRecord);
+  }
+  // ============================================
+  // Utility
+  // ============================================
+  async cleanup() {
+  }
+  // ============================================
+  // Internals
+  // ============================================
+  ttl(expiresAtMs) {
+    const ttl = Math.ceil((expiresAtMs - Date.now()) / 1e3);
+    return { ttlSeconds: ttl > 0 ? ttl : 1 };
+  }
+  key(type, id) {
+    const composite = `${type}:${id}`;
+    return this.storageIsNamespaced ? composite : `${this.namespace}:${composite}`;
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+export {
+  StorageAuthorizationStore
+};

package/browser/session/storage-consent.store.mjs

@@ -0,0 +1,33 @@
+// libs/auth/src/session/storage-consent.store.ts
+import { TypedStorage } from "@frontmcp/utils";
+import { consentRecordKey } from "./consent.store.mjs";
+var StorageConsentStore = class {
+  storage;
+  namespace;
+  storageIsNamespaced;
+  constructor(storage, options = {}) {
+    this.namespace = options.namespace ?? "remembered-consent";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+    this.storage = new TypedStorage(namespacedStorage);
+  }
+  async get(userSub, clientId) {
+    return this.storage.get(this.key(userSub, clientId));
+  }
+  async set(record) {
+    await this.storage.set(this.key(record.userSub, record.clientId), record);
+  }
+  async delete(userSub, clientId) {
+    await this.storage.delete(this.key(userSub, clientId));
+  }
+  key(userSub, clientId) {
+    const base = consentRecordKey(userSub, clientId);
+    return this.storageIsNamespaced ? base : `${this.namespace}:${base}`;
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+export {
+  StorageConsentStore
+};

package/browser/session/storage-federated-auth.session.mjs

@@ -0,0 +1,55 @@
+// libs/auth/src/session/storage-federated-auth.session.ts
+import { TypedStorage } from "@frontmcp/utils";
+import {
+  fromSessionRecord,
+  toSessionRecord
+} from "./federated-auth.session.mjs";
+var StorageFederatedAuthSessionStore = class {
+  storage;
+  namespace;
+  storageIsNamespaced;
+  constructor(storage, options = {}) {
+    this.namespace = options.namespace ?? "fed";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+    this.storage = new TypedStorage(namespacedStorage);
+  }
+  async store(session) {
+    await this.put(session);
+  }
+  async update(session) {
+    await this.put(session);
+  }
+  async get(id) {
+    const record = await this.storage.get(this.key(id));
+    if (!record) {
+      return null;
+    }
+    if (Date.now() > record.expiresAt) {
+      await this.storage.delete(this.key(id));
+      return null;
+    }
+    return fromSessionRecord(record);
+  }
+  async delete(id) {
+    await this.storage.delete(this.key(id));
+  }
+  async put(session) {
+    const record = toSessionRecord(session);
+    const ttlSeconds = this.calculateTtl(record.expiresAt);
+    await this.storage.set(this.key(session.id), record, ttlSeconds ? { ttlSeconds } : void 0);
+  }
+  calculateTtl(expiresAtMs) {
+    const ttl = Math.ceil((expiresAtMs - Date.now()) / 1e3);
+    return ttl > 0 ? ttl : 1;
+  }
+  key(id) {
+    return this.storageIsNamespaced ? id : `${this.namespace}:${id}`;
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+export {
+  StorageFederatedAuthSessionStore
+};