@frontmcp/auth 1.10.16 → 1.11.0-rc.1

package/browser/utils/audience.validator.mjs

@@ -0,0 +1,110 @@
+// libs/auth/src/utils/audience.validator.ts
+function validateAudience(tokenAudience, options) {
+  const { expectedAudiences, allowNoAudience = false, caseSensitive = true, allowWildcards = false } = options;
+  if (tokenAudience === void 0 || tokenAudience === null) {
+    if (allowNoAudience) {
+      return { valid: true };
+    }
+    return {
+      valid: false,
+      error: "Token is missing audience claim"
+    };
+  }
+  if (expectedAudiences.length === 0) {
+    return {
+      valid: false,
+      error: "No expected audiences configured - cannot validate token"
+    };
+  }
+  const tokenAuds = Array.isArray(tokenAudience) ? tokenAudience : [tokenAudience];
+  for (const tokenAud of tokenAuds) {
+    for (const expectedAud of expectedAudiences) {
+      if (matchesAudience(tokenAud, expectedAud, caseSensitive, allowWildcards)) {
+        return { valid: true, matchedAudience: tokenAud };
+      }
+    }
+  }
+  return {
+    valid: false,
+    error: `Token audience does not match expected audiences. Got: ${tokenAuds.join(
+      ", "
+    )}. Expected one of: ${expectedAudiences.join(", ")}`
+  };
+}
+function matchesAudience(tokenAud, expectedAud, caseSensitive, allowWildcards) {
+  if (caseSensitive) {
+    if (tokenAud === expectedAud) return true;
+  } else {
+    if (tokenAud.toLowerCase() === expectedAud.toLowerCase()) return true;
+  }
+  if (allowWildcards && expectedAud.includes("*")) {
+    const wildcardCount = (expectedAud.match(/\*/g) || []).length;
+    if (wildcardCount > 2) {
+      return false;
+    }
+    const pattern = expectedAud.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^.]*");
+    const regex = new RegExp(`^${pattern}$`, caseSensitive ? "" : "i");
+    if (regex.test(tokenAud)) return true;
+  }
+  return false;
+}
+function createAudienceValidator(options) {
+  return (audience) => validateAudience(audience, options);
+}
+function deriveExpectedAudience(resourceUrl) {
+  const audiences = [];
+  try {
+    const url = new URL(resourceUrl);
+    audiences.push(resourceUrl.replace(/\/$/, ""));
+    if (url.pathname !== "/" && url.pathname !== "") {
+      audiences.push(url.origin);
+    }
+  } catch {
+    audiences.push(resourceUrl);
+  }
+  return [...new Set(audiences)];
+}
+var AudienceValidator = class _AudienceValidator {
+  options;
+  constructor(options = {}) {
+    this.options = {
+      expectedAudiences: [...options.expectedAudiences ?? []],
+      allowNoAudience: options.allowNoAudience ?? false,
+      caseSensitive: options.caseSensitive ?? true,
+      allowWildcards: options.allowWildcards ?? false
+    };
+  }
+  /**
+   * Validate an audience claim
+   */
+  validate(audience) {
+    return validateAudience(audience, this.options);
+  }
+  /**
+   * Add expected audiences
+   */
+  addAudiences(...audiences) {
+    this.options.expectedAudiences.push(...audiences);
+  }
+  /**
+   * Set expected audiences (replace existing)
+   */
+  setAudiences(audiences) {
+    this.options.expectedAudiences = audiences;
+  }
+  /**
+   * Create validator from resource URL
+   */
+  static fromResourceUrl(resourceUrl, options = {}) {
+    return new _AudienceValidator({
+      ...options,
+      expectedAudiences: deriveExpectedAudience(resourceUrl)
+    });
+  }
+};
+export {
+  AudienceValidator,
+  createAudienceValidator,
+  deriveExpectedAudience,
+  validateAudience
+};

package/browser/utils/authorization-id.utils.mjs

@@ -0,0 +1,10 @@
+// libs/auth/src/utils/authorization-id.utils.ts
+import { sha256Hex } from "@frontmcp/utils";
+function deriveAuthorizationId(token) {
+  const parts = token.split(".");
+  const signature = parts[2] || token;
+  return sha256Hex(signature).substring(0, 16);
+}
+export {
+  deriveAuthorizationId
+};

package/browser/utils/index.mjs

@@ -0,0 +1,45 @@
+// libs/auth/src/utils/index.ts
+import {
+  buildWwwAuthenticate,
+  buildPrmUrl,
+  buildUnauthorizedHeader,
+  buildInvalidTokenHeader,
+  buildInsufficientScopeHeader,
+  buildInvalidRequestHeader,
+  parseWwwAuthenticate
+} from "./www-authenticate.utils.mjs";
+import {
+  validateAudience,
+  createAudienceValidator,
+  deriveExpectedAudience,
+  AudienceValidator
+} from "./audience.validator.mjs";
+import { deriveAuthorizationId } from "./authorization-id.utils.mjs";
+import {
+  advertisedScopes,
+  DEFAULT_ALLOWED_SCOPES,
+  grantScopes,
+  resourceScopesFor
+} from "./scope-grant.utils.mjs";
+import { isLoopbackRedirectUri } from "./redirect-uri.utils.mjs";
+import { scopesFromClaims } from "./token-scopes.utils.mjs";
+export {
+  AudienceValidator,
+  DEFAULT_ALLOWED_SCOPES,
+  advertisedScopes,
+  buildInsufficientScopeHeader,
+  buildInvalidRequestHeader,
+  buildInvalidTokenHeader,
+  buildPrmUrl,
+  buildUnauthorizedHeader,
+  buildWwwAuthenticate,
+  createAudienceValidator,
+  deriveAuthorizationId,
+  deriveExpectedAudience,
+  grantScopes,
+  isLoopbackRedirectUri,
+  parseWwwAuthenticate,
+  resourceScopesFor,
+  scopesFromClaims,
+  validateAudience
+};

package/browser/utils/redirect-uri.utils.mjs

@@ -0,0 +1,22 @@
+// libs/auth/src/utils/redirect-uri.utils.ts
+function isLoopbackRedirectUri(uri) {
+  let url;
+  try {
+    url = new URL(uri);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  if (url.username || url.password) return false;
+  const host = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host === "::1") return true;
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (m) {
+    const octets = m.slice(1).map((n) => Number(n));
+    return octets.every((o) => o >= 0 && o <= 255) && octets[0] === 127;
+  }
+  return false;
+}
+export {
+  isLoopbackRedirectUri
+};

package/browser/utils/scope-grant.utils.mjs

@@ -0,0 +1,36 @@
+// libs/auth/src/utils/scope-grant.utils.ts
+import { globMatch } from "../authorization/dcr-client.registry.mjs";
+var DEFAULT_ALLOWED_SCOPES = Object.freeze([
+  "openid",
+  "profile",
+  "email",
+  "offline_access"
+]);
+function grantScopes(requested, allowed) {
+  const patterns = allowed ?? DEFAULT_ALLOWED_SCOPES;
+  const granted = [];
+  for (const scope of requested) {
+    if (!scope || granted.includes(scope)) continue;
+    if (patterns.some((pattern) => globMatch(pattern, scope))) granted.push(scope);
+  }
+  return granted;
+}
+function advertisedScopes(allowed) {
+  const scopes = [];
+  for (const scope of allowed ?? DEFAULT_ALLOWED_SCOPES) {
+    if (scope && !scope.includes("*") && !scopes.includes(scope)) scopes.push(scope);
+  }
+  return scopes;
+}
+function resourceScopesFor(options) {
+  const mode = options?.mode ?? "public";
+  if (mode === "local" || mode === "remote") return advertisedScopes(options?.allowedScopes);
+  const listed = mode === "public" ? options?.anonymousScopes ?? ["anonymous"] : mode === "static" ? options?.scopes ?? ["static"] : mode === "transparent" ? [...options?.requiredScopes ?? [], ...options?.scopes ?? []] : [];
+  return advertisedScopes(listed);
+}
+export {
+  DEFAULT_ALLOWED_SCOPES,
+  advertisedScopes,
+  grantScopes,
+  resourceScopesFor
+};

package/browser/utils/token-scopes.utils.mjs

@@ -0,0 +1,12 @@
+// libs/auth/src/utils/token-scopes.utils.ts
+function scopesFromClaims(claims) {
+  const scopes = [claims?.scope, claims?.scp].flatMap((claim) => {
+    if (typeof claim === "string") return claim.split(/\s+/).filter(Boolean);
+    if (Array.isArray(claim)) return claim.filter((scope) => typeof scope === "string");
+    return [];
+  });
+  return [...new Set(scopes)];
+}
+export {
+  scopesFromClaims
+};

package/browser/utils/www-authenticate.utils.mjs

@@ -0,0 +1,164 @@
+// libs/auth/src/utils/www-authenticate.utils.ts
+function buildWwwAuthenticate(options = {}) {
+  const parts = ["Bearer"];
+  const params = [];
+  if (options.resourceMetadataUrl) {
+    params.push(`resource_metadata="${escapeQuotedString(options.resourceMetadataUrl)}"`);
+  }
+  if (options.realm) {
+    params.push(`realm="${escapeQuotedString(options.realm)}"`);
+  }
+  if (options.error) {
+    params.push(`error="${options.error}"`);
+  }
+  if (options.errorDescription) {
+    params.push(`error_description="${escapeQuotedString(options.errorDescription)}"`);
+  }
+  if (options.errorUri) {
+    params.push(`error_uri="${escapeQuotedString(options.errorUri)}"`);
+  }
+  if (options.scope) {
+    const scopeValue = Array.isArray(options.scope) ? options.scope.join(" ") : options.scope;
+    params.push(`scope="${escapeQuotedString(scopeValue)}"`);
+  }
+  if (params.length > 0) {
+    parts.push(params.join(", "));
+  }
+  return parts.join(" ");
+}
+function buildPrmUrl(baseUrl, entryPath, routeBase) {
+  const normalizedEntry = normalizePathSegment(entryPath);
+  const normalizedRoute = normalizePathSegment(routeBase);
+  return `${baseUrl}/.well-known/oauth-protected-resource${normalizedEntry}${normalizedRoute}`;
+}
+function buildUnauthorizedHeader(prmUrl) {
+  return buildWwwAuthenticate({
+    resourceMetadataUrl: prmUrl
+  });
+}
+function buildInvalidTokenHeader(prmUrl, description) {
+  return buildWwwAuthenticate({
+    resourceMetadataUrl: prmUrl,
+    error: "invalid_token",
+    errorDescription: description ?? "The access token is invalid or expired"
+  });
+}
+function buildInsufficientScopeHeader(prmUrl, requiredScopes, description) {
+  return buildWwwAuthenticate({
+    resourceMetadataUrl: prmUrl,
+    error: "insufficient_scope",
+    scope: requiredScopes,
+    errorDescription: description ?? "The request requires higher privileges"
+  });
+}
+function buildInvalidRequestHeader(prmUrl, description) {
+  return buildWwwAuthenticate({
+    resourceMetadataUrl: prmUrl,
+    error: "invalid_request",
+    errorDescription: description ?? "The request is missing required parameters"
+  });
+}
+function parseWwwAuthenticate(header) {
+  const result = {};
+  if (!header.toLowerCase().startsWith("bearer")) {
+    return result;
+  }
+  const paramString = header.substring(6).trim();
+  const params = parseQuotedParams(paramString);
+  for (const [key, value] of params) {
+    const unescapedValue = unescapeQuotedString(value);
+    switch (key.toLowerCase()) {
+      case "resource_metadata":
+        result.resourceMetadataUrl = unescapedValue;
+        break;
+      case "realm":
+        result.realm = unescapedValue;
+        break;
+      case "error":
+        result.error = unescapedValue;
+        break;
+      case "error_description":
+        result.errorDescription = unescapedValue;
+        break;
+      case "error_uri":
+        result.errorUri = unescapedValue;
+        break;
+      case "scope":
+        result.scope = unescapedValue;
+        break;
+    }
+  }
+  return result;
+}
+function parseQuotedParams(input) {
+  const result = [];
+  let i = 0;
+  const len = input.length;
+  while (i < len) {
+    while (i < len && (input[i] === " " || input[i] === "," || input[i] === "	")) {
+      i++;
+    }
+    if (i >= len) break;
+    const keyStart = i;
+    while (i < len && /\w/.test(input[i])) {
+      i++;
+    }
+    const key = input.slice(keyStart, i);
+    if (!key) break;
+    while (i < len && (input[i] === " " || input[i] === "	")) {
+      i++;
+    }
+    if (i >= len || input[i] !== "=") {
+      while (i < len && input[i] !== ",") i++;
+      continue;
+    }
+    i++;
+    while (i < len && (input[i] === " " || input[i] === "	")) {
+      i++;
+    }
+    if (i >= len || input[i] !== '"') {
+      while (i < len && input[i] !== ",") i++;
+      continue;
+    }
+    i++;
+    let value = "";
+    while (i < len && input[i] !== '"') {
+      if (input[i] === "\\" && i + 1 < len) {
+        value += input[i + 1];
+        i += 2;
+      } else {
+        value += input[i];
+        i++;
+      }
+    }
+    if (i < len && input[i] === '"') {
+      i++;
+    }
+    result.push([key, value]);
+  }
+  return result;
+}
+function escapeQuotedString(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+function unescapeQuotedString(value) {
+  return value.replace(/\\(.)/g, "$1");
+}
+function normalizePathSegment(path) {
+  if (!path || path === "/") return "";
+  const normalized = path.startsWith("/") ? path : `/${path}`;
+  let end = normalized.length;
+  while (end > 0 && normalized[end - 1] === "/") {
+    end--;
+  }
+  return normalized.slice(0, end);
+}
+export {
+  buildInsufficientScopeHeader,
+  buildInvalidRequestHeader,
+  buildInvalidTokenHeader,
+  buildPrmUrl,
+  buildUnauthorizedHeader,
+  buildWwwAuthenticate,
+  parseWwwAuthenticate
+};

package/browser/vault/auth-providers.accessor.impl.mjs

@@ -0,0 +1,236 @@
+// libs/auth/src/vault/auth-providers.accessor.impl.ts
+import { extractCredentialExpiry } from "./credential-helpers.mjs";
+import { base64Encode } from "@frontmcp/utils";
+var AuthProvidersAccessorImpl = class {
+  constructor(registry, vault, cache, loader, context, logger) {
+    this.registry = registry;
+    this.vault = vault;
+    this.cache = cache;
+    this.loader = loader;
+    this.context = context;
+    this.logger = logger;
+  }
+  registry;
+  vault;
+  cache;
+  loader;
+  context;
+  logger;
+  async get(providerName, options) {
+    const config = this.registry.get(providerName);
+    if (!config) {
+      this.logger?.debug(`Provider "${providerName}" is not registered`);
+      return null;
+    }
+    if (!options?.forceRefresh) {
+      const cached = this.cache.get(providerName);
+      if (cached && this.isValid(cached)) {
+        this.logger?.debug(`Cache hit for "${providerName}"`);
+        return cached;
+      }
+    }
+    if (!options?.forceRefresh) {
+      const fromVault = await this.loadFromVault(providerName, config);
+      if (fromVault && this.isValid(fromVault)) {
+        this.cache.set(providerName, fromVault, config.cacheTtl);
+        this.logger?.debug(`Vault hit for "${providerName}"`);
+        return fromVault;
+      }
+    }
+    const loaded = await this.loader.load(config, this.context);
+    if (!loaded) {
+      return null;
+    }
+    await this.storeInVault(providerName, loaded, config);
+    this.cache.set(providerName, loaded, config.cacheTtl);
+    return loaded;
+  }
+  async getMany(providerNames, options) {
+    const results = /* @__PURE__ */ new Map();
+    const promises = providerNames.map(async (name) => {
+      const result = await this.get(name, options);
+      return { name, result };
+    });
+    const settled = await Promise.allSettled(promises);
+    for (const outcome of settled) {
+      if (outcome.status === "fulfilled") {
+        results.set(outcome.value.name, outcome.value.result);
+      } else {
+        this.logger?.warn("Failed to load credential:", outcome.reason);
+      }
+    }
+    return results;
+  }
+  async headers(providerName) {
+    const resolved = await this.get(providerName);
+    if (!resolved) {
+      return {};
+    }
+    const config = this.registry.get(providerName);
+    if (config?.toHeaders) {
+      return config.toHeaders(resolved.credential);
+    }
+    return this.defaultHeaders(resolved.credential);
+  }
+  async headersMany(providerNames) {
+    const allHeaders = {};
+    for (const name of providerNames) {
+      const headers = await this.headers(name);
+      Object.assign(allHeaders, headers);
+    }
+    return allHeaders;
+  }
+  async refresh(providerName) {
+    const config = this.registry.get(providerName);
+    if (!config) {
+      this.logger?.debug(`Cannot refresh: provider "${providerName}" not registered`);
+      return null;
+    }
+    const existing = this.cache.get(providerName);
+    const existingCredential = existing?.credential;
+    try {
+      const refreshed = await this.loader.refresh(config, {
+        ...this.context,
+        existingCredential
+      });
+      if (!refreshed) {
+        return null;
+      }
+      await this.storeInVault(providerName, refreshed, config);
+      this.cache.set(providerName, refreshed, config.cacheTtl);
+      return refreshed;
+    } catch (error) {
+      this.logger?.warn(`Failed to refresh credential "${providerName}":`, error);
+      return null;
+    }
+  }
+  async has(providerName) {
+    const cached = this.cache.get(providerName);
+    if (cached) {
+      if (this.isValid(cached)) {
+        return true;
+      }
+      this.cache.invalidate(providerName);
+    }
+    const config = this.registry.get(providerName);
+    if (!config) {
+      return false;
+    }
+    const fromVault = await this.loadFromVault(providerName, config);
+    return fromVault !== null && this.isValid(fromVault);
+  }
+  isRegistered(providerName) {
+    return this.registry.has(providerName);
+  }
+  invalidate(providerName) {
+    this.cache.invalidate(providerName);
+    this.logger?.debug(`Invalidated cache for "${providerName}"`);
+  }
+  invalidateAll() {
+    this.cache.invalidateAll();
+    this.logger?.debug("Invalidated all cached credentials");
+  }
+  listProviders() {
+    return this.registry.getNames();
+  }
+  async listAvailable() {
+    const available = [];
+    for (const name of this.registry.getNames()) {
+      if (await this.has(name)) {
+        available.push(name);
+      }
+    }
+    return available;
+  }
+  /**
+   * Load credential from vault storage
+   */
+  async loadFromVault(providerName, config) {
+    try {
+      const credential = await this.vault.getCredential(
+        this.context.sessionId,
+        providerName,
+        config.scope,
+        this.context.userSub
+      );
+      if (!credential) {
+        return null;
+      }
+      return {
+        credential,
+        providerId: providerName,
+        acquiredAt: Date.now(),
+        // We don't store acquiredAt in vault
+        expiresAt: extractCredentialExpiry(credential),
+        isValid: true,
+        scope: config.scope
+      };
+    } catch (error) {
+      this.logger?.warn(`Failed to load from vault "${providerName}":`, error);
+      return null;
+    }
+  }
+  /**
+   * Store credential in vault storage
+   */
+  async storeInVault(providerName, resolved, config) {
+    try {
+      await this.vault.storeCredential(
+        this.context.sessionId,
+        providerName,
+        resolved.credential,
+        config.scope,
+        this.context.userSub
+      );
+    } catch (error) {
+      this.logger?.warn(`Failed to store in vault "${providerName}":`, error);
+    }
+  }
+  /**
+   * Check if a resolved credential is still valid
+   */
+  isValid(resolved) {
+    if (!resolved.isValid) {
+      return false;
+    }
+    if (resolved.expiresAt && Date.now() >= resolved.expiresAt) {
+      return false;
+    }
+    return true;
+  }
+  /**
+   * Generate default headers for a credential type
+   */
+  defaultHeaders(credential) {
+    switch (credential.type) {
+      case "oauth":
+      case "oauth_pkce":
+        return { Authorization: `${credential.tokenType} ${credential.accessToken}` };
+      case "bearer":
+        return { Authorization: `Bearer ${credential.token}` };
+      case "api_key":
+        if (credential.headerPrefix) {
+          return { [credential.headerName]: `${credential.headerPrefix}${credential.key}` };
+        }
+        return { [credential.headerName]: credential.key };
+      case "basic": {
+        const value = `${credential.username}:${credential.password}`;
+        const encoded = credential.encodedValue ?? base64Encode(new TextEncoder().encode(value));
+        return { Authorization: `Basic ${encoded}` };
+      }
+      case "custom":
+        return credential.headers ?? {};
+      // SSH keys, mTLS, private keys, service accounts don't have standard HTTP headers
+      case "ssh_key":
+      case "mtls":
+      case "private_key":
+      case "service_account":
+        return {};
+      default:
+        return {};
+    }
+  }
+};
+export {
+  AuthProvidersAccessorImpl
+};

package/browser/vault/auth-providers.accessor.mjs

@@ -0,0 +1,5 @@
+// libs/auth/src/vault/auth-providers.accessor.ts
+var AUTH_PROVIDERS_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:AUTH_PROVIDERS_ACCESSOR");
+export {
+  AUTH_PROVIDERS_ACCESSOR
+};