@frontmcp/auth 1.10.16 → 1.11.0-rc.1

package/browser/vault/auth-providers.registry.mjs

@@ -0,0 +1,140 @@
+// libs/auth/src/vault/auth-providers.registry.ts
+import { CredentialProviderAlreadyRegisteredError } from "../errors/auth-internal.errors.mjs";
+var AuthProvidersRegistry = class {
+  providers = /* @__PURE__ */ new Map();
+  defaultCacheTtl;
+  constructor(options) {
+    this.defaultCacheTtl = options?.defaultCacheTtl ?? 36e5;
+    if (options?.providers) {
+      for (const provider of options.providers) {
+        this.register(provider);
+      }
+    }
+  }
+  /**
+   * Register a credential provider
+   *
+   * @param config - Provider configuration
+   * @throws CredentialProviderAlreadyRegisteredError if provider with same name already registered
+   */
+  register(config) {
+    if (this.providers.has(config.name)) {
+      throw new CredentialProviderAlreadyRegisteredError(config.name);
+    }
+    const normalized = this.normalize(config);
+    this.providers.set(config.name, normalized);
+  }
+  /**
+   * Unregister a credential provider
+   *
+   * @param name - Provider name to unregister
+   * @returns true if provider was unregistered, false if not found
+   */
+  unregister(name) {
+    return this.providers.delete(name);
+  }
+  /**
+   * Get a provider configuration by name
+   *
+   * @param name - Provider name
+   * @returns Provider config or undefined if not found
+   */
+  get(name) {
+    return this.providers.get(name);
+  }
+  /**
+   * Check if a provider is registered
+   *
+   * @param name - Provider name
+   * @returns true if provider is registered
+   */
+  has(name) {
+    return this.providers.has(name);
+  }
+  /**
+   * Get all registered provider names
+   */
+  getNames() {
+    return [...this.providers.keys()];
+  }
+  /**
+   * Get all provider configurations
+   */
+  getAll() {
+    return [...this.providers.values()];
+  }
+  /**
+   * Get providers by scope
+   *
+   * @param scope - Credential scope to filter by
+   */
+  getByScope(scope) {
+    return this.getAll().filter((p) => p.scope === scope);
+  }
+  /**
+   * Get providers by loading strategy
+   *
+   * @param loading - Loading strategy to filter by
+   */
+  getByLoading(loading) {
+    return this.getAll().filter((p) => p.loading === loading);
+  }
+  /**
+   * Get providers that are required
+   */
+  getRequired() {
+    return this.getAll().filter((p) => p.required);
+  }
+  /**
+   * Get providers that should be eagerly loaded
+   */
+  getEager() {
+    return this.getByLoading("eager");
+  }
+  /**
+   * Get providers that should be lazily loaded
+   */
+  getLazy() {
+    return this.getByLoading("lazy");
+  }
+  /**
+   * Get the number of registered providers
+   */
+  get size() {
+    return this.providers.size;
+  }
+  /**
+   * Check if registry is empty
+   */
+  isEmpty() {
+    return this.providers.size === 0;
+  }
+  /**
+   * Clear all registered providers
+   */
+  clear() {
+    this.providers.clear();
+  }
+  /**
+   * Normalize provider config with defaults
+   */
+  normalize(config) {
+    return {
+      name: config.name,
+      description: config.description,
+      scope: config.scope,
+      loading: config.loading,
+      cacheTtl: config.cacheTtl ?? this.defaultCacheTtl,
+      factory: config.factory,
+      refresh: config.refresh,
+      toHeaders: config.toHeaders,
+      metadata: config.metadata,
+      required: config.required ?? false
+    };
+  }
+};
+var AUTH_PROVIDERS_REGISTRY = /* @__PURE__ */ Symbol.for("frontmcp:AUTH_PROVIDERS_REGISTRY");
+export {
+  AUTH_PROVIDERS_REGISTRY,
+  AuthProvidersRegistry
+};

package/browser/vault/auth-providers.types.mjs

@@ -0,0 +1,47 @@
+// libs/auth/src/vault/auth-providers.types.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+var credentialScopeSchema = z.enum(["global", "user", "session"]);
+var loadingStrategySchema = z.enum(["eager", "lazy"]);
+var getCredentialOptionsSchema = z.object({
+  forceRefresh: z.boolean().optional(),
+  scopes: z.array(z.string()).optional(),
+  timeout: z.number().positive().optional()
+}).strict();
+var credentialProviderConfigSchema = z.object({
+  name: z.string().min(1),
+  description: z.string().optional(),
+  scope: credentialScopeSchema,
+  loading: loadingStrategySchema,
+  cacheTtl: z.number().nonnegative().optional(),
+  // Functions validated at runtime, not via Zod (Zod 4 compatibility)
+  factory: z.any(),
+  refresh: z.any().optional(),
+  toHeaders: z.any().optional(),
+  metadata: z.record(z.string(), z.unknown()).optional(),
+  required: z.boolean().optional()
+}).strict();
+var authProviderMappingSchema = z.union([
+  z.string(),
+  z.object({
+    name: z.string().min(1),
+    required: z.boolean().optional().default(true),
+    scopes: z.array(z.string()).optional(),
+    alias: z.string().optional()
+  }).strict()
+]);
+var authProvidersVaultOptionsSchema = z.object({
+  enabled: z.boolean().optional(),
+  useSharedStorage: z.boolean().optional().default(true),
+  namespace: z.string().optional().default("authproviders:"),
+  defaultCacheTtl: z.number().nonnegative().optional().default(36e5),
+  maxCredentialsPerSession: z.number().positive().optional().default(100),
+  providers: z.array(credentialProviderConfigSchema).optional()
+}).strict();
+export {
+  authProviderMappingSchema,
+  authProvidersVaultOptionsSchema,
+  credentialProviderConfigSchema,
+  credentialScopeSchema,
+  getCredentialOptionsSchema,
+  loadingStrategySchema
+};

package/browser/vault/auth-providers.vault.mjs

@@ -0,0 +1,206 @@
+// libs/auth/src/vault/auth-providers.vault.ts
+import { extractCredentialExpiry } from "./credential-helpers.mjs";
+import { AuthInvalidInputError, CredentialStorageError } from "../errors/auth-internal.errors.mjs";
+var AuthProvidersVault = class {
+  constructor(baseVault, namespace = "authproviders:", logger) {
+    this.baseVault = baseVault;
+    this.namespace = namespace;
+    this.logger = logger;
+  }
+  baseVault;
+  namespace;
+  logger;
+  /**
+   * Store a credential in the vault
+   *
+   * @param sessionId - Current session ID
+   * @param providerId - Provider name
+   * @param credential - Credential to store
+   * @param scope - Credential scope
+   * @param userId - User ID (required for user scope)
+   */
+  async storeCredential(sessionId, providerId, credential, scope, userId) {
+    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    const appCredential = {
+      appId: this.namespace,
+      providerId,
+      credential,
+      acquiredAt: Date.now(),
+      isValid: true,
+      expiresAt: extractCredentialExpiry(credential)
+    };
+    try {
+      await this.baseVault.addAppCredential(vaultKey, appCredential);
+      this.logger?.debug(`Stored credential "${providerId}" with scope "${scope}"`);
+    } catch (error) {
+      this.logger?.warn(`Failed to store credential "${providerId}":`, error);
+      throw error;
+    }
+  }
+  /**
+   * Get a credential from the vault
+   *
+   * @param sessionId - Current session ID
+   * @param providerId - Provider name
+   * @param scope - Credential scope
+   * @param userId - User ID (required for user scope)
+   * @returns Credential or null if not found
+   */
+  async getCredential(sessionId, providerId, scope, userId) {
+    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    try {
+      const appCredential = await this.baseVault.getCredential(vaultKey, this.namespace, providerId);
+      if (!appCredential) {
+        return null;
+      }
+      if (!appCredential.isValid) {
+        this.logger?.debug(`Credential "${providerId}" is marked as invalid`);
+        return null;
+      }
+      if (appCredential.expiresAt && Date.now() >= appCredential.expiresAt) {
+        this.logger?.debug(`Credential "${providerId}" has expired`);
+        return null;
+      }
+      return appCredential.credential;
+    } catch (error) {
+      this.logger?.warn(`Failed to get credential "${providerId}":`, error);
+      if (error instanceof CredentialStorageError) {
+        throw error;
+      }
+      throw new CredentialStorageError(
+        `Storage error while retrieving credential "${providerId}": ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  /**
+   * Remove a credential from the vault
+   *
+   * @param sessionId - Current session ID
+   * @param providerId - Provider name
+   * @param scope - Credential scope
+   * @param userId - User ID (required for user scope)
+   */
+  async removeCredential(sessionId, providerId, scope, userId) {
+    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    try {
+      await this.baseVault.removeAppCredential(vaultKey, this.namespace, providerId);
+      this.logger?.debug(`Removed credential "${providerId}"`);
+    } catch (error) {
+      this.logger?.warn(`Failed to remove credential "${providerId}":`, error);
+    }
+  }
+  /**
+   * Invalidate a credential (mark as invalid without removing)
+   *
+   * @param sessionId - Current session ID
+   * @param providerId - Provider name
+   * @param scope - Credential scope
+   * @param reason - Reason for invalidation
+   * @param userId - User ID (required for user scope)
+   */
+  async invalidateCredential(sessionId, providerId, scope, reason, userId) {
+    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    try {
+      await this.baseVault.invalidateCredential(vaultKey, this.namespace, providerId, reason);
+      this.logger?.debug(`Invalidated credential "${providerId}": ${reason}`);
+    } catch (error) {
+      this.logger?.warn(`Failed to invalidate credential "${providerId}":`, error);
+    }
+  }
+  /**
+   * Update OAuth credential tokens (for refresh)
+   *
+   * @param sessionId - Current session ID
+   * @param providerId - Provider name
+   * @param scope - Credential scope
+   * @param tokens - New tokens
+   * @param userId - User ID (required for user scope)
+   */
+  async refreshOAuthCredential(sessionId, providerId, scope, tokens, userId) {
+    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    try {
+      await this.baseVault.refreshOAuthCredential(vaultKey, this.namespace, providerId, tokens);
+      this.logger?.debug(`Refreshed OAuth credential "${providerId}"`);
+    } catch (error) {
+      this.logger?.warn(`Failed to refresh OAuth credential "${providerId}":`, error);
+      throw error;
+    }
+  }
+  /**
+   * Get all credentials for a session
+   *
+   * @param sessionId - Current session ID
+   * @param scope - Optional scope filter
+   * @param userId - User ID (required for user scope)
+   */
+  async getAllCredentials(sessionId, scope, userId) {
+    if (scope) {
+      const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+      try {
+        return await this.baseVault.getAppCredentials(vaultKey, this.namespace);
+      } catch {
+        return [];
+      }
+    }
+    const credentials = [];
+    try {
+      const sessionCreds = await this.baseVault.getAppCredentials(
+        this.buildVaultKey(sessionId, "session"),
+        this.namespace
+      );
+      credentials.push(...sessionCreds);
+    } catch {
+    }
+    if (userId) {
+      try {
+        const userCreds = await this.baseVault.getAppCredentials(
+          this.buildVaultKey(sessionId, "user", userId),
+          this.namespace
+        );
+        credentials.push(...userCreds);
+      } catch {
+      }
+    }
+    try {
+      const globalCreds = await this.baseVault.getAppCredentials(
+        this.buildVaultKey(sessionId, "global"),
+        this.namespace
+      );
+      credentials.push(...globalCreds);
+    } catch {
+    }
+    return credentials;
+  }
+  /**
+   * Build vault key based on scope
+   *
+   * Key patterns:
+   * - global: `authproviders:global`
+   * - user: `authproviders:user:{userId}`
+   * - session: `authproviders:session:{sessionId}`
+   */
+  buildVaultKey(sessionId, scope, userId) {
+    switch (scope) {
+      case "global":
+        return `${this.namespace}global`;
+      case "user":
+        if (!userId) {
+          throw new AuthInvalidInputError(
+            `userId is required for user-scoped credentials (namespace: ${this.namespace})`
+          );
+        }
+        return `${this.namespace}user:${userId}`;
+      case "session":
+        return `${this.namespace}session:${sessionId}`;
+      default: {
+        const _exhaustive = scope;
+        throw new AuthInvalidInputError(`Unknown credential scope: ${_exhaustive}`);
+      }
+    }
+  }
+};
+var AUTH_PROVIDERS_VAULT = /* @__PURE__ */ Symbol.for("frontmcp:AUTH_PROVIDERS_VAULT");
+export {
+  AUTH_PROVIDERS_VAULT,
+  AuthProvidersVault
+};

package/browser/vault/credential-cache.mjs

@@ -0,0 +1,187 @@
+// libs/auth/src/vault/credential-cache.ts
+var CredentialCache = class {
+  cache = /* @__PURE__ */ new Map();
+  maxSize;
+  stats = { hits: 0, misses: 0, evictions: 0, size: 0 };
+  constructor(maxSize = 100) {
+    this.maxSize = maxSize;
+  }
+  /**
+   * Get a cached credential
+   *
+   * @param providerId - Provider name
+   * @returns Resolved credential or undefined if not cached or expired
+   */
+  get(providerId) {
+    const entry = this.cache.get(providerId);
+    if (!entry) {
+      this.stats.misses++;
+      return void 0;
+    }
+    if (this.isExpired(entry)) {
+      this.cache.delete(providerId);
+      this.stats.size = this.cache.size;
+      this.stats.misses++;
+      this.stats.evictions++;
+      return void 0;
+    }
+    if (entry.resolved.expiresAt && Date.now() >= entry.resolved.expiresAt) {
+      this.cache.delete(providerId);
+      this.stats.size = this.cache.size;
+      this.stats.misses++;
+      this.stats.evictions++;
+      return void 0;
+    }
+    this.stats.hits++;
+    return entry.resolved;
+  }
+  /**
+   * Cache a resolved credential
+   *
+   * @param providerId - Provider name
+   * @param resolved - Resolved credential to cache
+   * @param ttl - TTL in milliseconds (0 = no TTL, rely on credential expiry)
+   */
+  set(providerId, resolved, ttl = 0) {
+    if (this.cache.size >= this.maxSize && !this.cache.has(providerId)) {
+      this.evictOldest();
+    }
+    const entry = {
+      resolved,
+      cachedAt: Date.now(),
+      ttl
+    };
+    this.cache.set(providerId, entry);
+    this.stats.size = this.cache.size;
+  }
+  /**
+   * Check if a credential is cached and valid
+   *
+   * @param providerId - Provider name
+   * @returns true if cached and not expired
+   */
+  has(providerId) {
+    const entry = this.cache.get(providerId);
+    if (!entry) return false;
+    if (this.isExpired(entry)) {
+      this.cache.delete(providerId);
+      this.stats.size = this.cache.size;
+      this.stats.evictions++;
+      return false;
+    }
+    return true;
+  }
+  /**
+   * Invalidate (remove) a cached credential
+   *
+   * @param providerId - Provider name to invalidate
+   * @returns true if credential was removed
+   */
+  invalidate(providerId) {
+    const deleted = this.cache.delete(providerId);
+    if (deleted) {
+      this.stats.size = this.cache.size;
+    }
+    return deleted;
+  }
+  /**
+   * Invalidate all cached credentials
+   */
+  invalidateAll() {
+    this.cache.clear();
+    this.stats.size = 0;
+  }
+  /**
+   * Invalidate credentials by scope
+   *
+   * @param scope - Credential scope to invalidate
+   */
+  invalidateByScope(scope) {
+    for (const [key, entry] of this.cache) {
+      if (entry.resolved.scope === scope) {
+        this.cache.delete(key);
+      }
+    }
+    this.stats.size = this.cache.size;
+  }
+  /**
+   * Get all cached provider IDs
+   */
+  keys() {
+    this.cleanup();
+    return [...this.cache.keys()];
+  }
+  /**
+   * Get cache size
+   */
+  get size() {
+    return this.cache.size;
+  }
+  /**
+   * Get cache statistics
+   */
+  getStats() {
+    return { ...this.stats };
+  }
+  /**
+   * Reset cache statistics
+   */
+  resetStats() {
+    this.stats = { hits: 0, misses: 0, evictions: 0, size: this.cache.size };
+  }
+  /**
+   * Clean up expired entries
+   */
+  cleanup() {
+    const now = Date.now();
+    for (const [key, entry] of this.cache) {
+      if (this.isExpiredAt(entry, now)) {
+        this.cache.delete(key);
+        this.stats.evictions++;
+      }
+    }
+    this.stats.size = this.cache.size;
+  }
+  /**
+   * Check if entry is expired based on TTL
+   */
+  isExpired(entry) {
+    return this.isExpiredAt(entry, Date.now());
+  }
+  /**
+   * Check if entry is expired at a given timestamp
+   */
+  isExpiredAt(entry, now) {
+    if (entry.ttl > 0 && now - entry.cachedAt >= entry.ttl) {
+      return true;
+    }
+    if (entry.resolved.expiresAt && now >= entry.resolved.expiresAt) {
+      return true;
+    }
+    if (!entry.resolved.isValid) {
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Evict the oldest entry from cache
+   */
+  evictOldest() {
+    let oldestKey;
+    let oldestTime = Infinity;
+    for (const [key, entry] of this.cache) {
+      if (entry.cachedAt < oldestTime) {
+        oldestTime = entry.cachedAt;
+        oldestKey = key;
+      }
+    }
+    if (oldestKey) {
+      this.cache.delete(oldestKey);
+      this.stats.evictions++;
+      this.stats.size = this.cache.size;
+    }
+  }
+};
+export {
+  CredentialCache
+};

package/browser/vault/credential-helpers.mjs

@@ -0,0 +1,15 @@
+// libs/auth/src/vault/credential-helpers.ts
+function extractCredentialExpiry(credential) {
+  switch (credential.type) {
+    case "oauth":
+    case "oauth_pkce":
+    case "bearer":
+    case "service_account":
+      return credential.expiresAt;
+    default:
+      return void 0;
+  }
+}
+export {
+  extractCredentialExpiry
+};

package/browser/vault/credential-loaders/eager-loader.mjs

@@ -0,0 +1,91 @@
+// libs/auth/src/vault/credential-loaders/eager-loader.ts
+import { extractCredentialExpiry } from "../credential-helpers.mjs";
+var EagerCredentialLoader = class {
+  constructor(registry, cache, logger) {
+    this.registry = registry;
+    this.cache = cache;
+    this.logger = logger;
+  }
+  registry;
+  cache;
+  logger;
+  /**
+   * Load all eager credentials for a session.
+   * Called during session initialization.
+   *
+   * @param context - Factory context with session/user info
+   * @returns Map of provider name to resolved credential
+   */
+  async loadForSession(context) {
+    const startTime = Date.now();
+    const eagerProviders = this.registry.getEager();
+    if (eagerProviders.length === 0) {
+      return {
+        loaded: /* @__PURE__ */ new Map(),
+        failed: /* @__PURE__ */ new Map(),
+        duration: Date.now() - startTime
+      };
+    }
+    this.logger?.debug(`Loading ${eagerProviders.length} eager credential providers`);
+    const loaded = /* @__PURE__ */ new Map();
+    const failed = /* @__PURE__ */ new Map();
+    const results = await Promise.allSettled(
+      eagerProviders.map(async (config) => {
+        const credential = await this.loadOne(config, context);
+        return { name: config.name, credential, config };
+      })
+    );
+    for (const result of results) {
+      if (result.status === "fulfilled") {
+        const { name, credential, config } = result.value;
+        if (credential) {
+          const resolved = this.wrapCredential(name, credential, config);
+          loaded.set(name, resolved);
+          this.cache.set(name, resolved, config.cacheTtl);
+          this.logger?.debug(`Loaded eager credential: ${name}`);
+        } else if (config.required) {
+          failed.set(name, new Error(`Required credential "${name}" returned null`));
+          this.logger?.warn(`Required eager credential "${name}" returned null`);
+        }
+      } else {
+        const providerName = result.reason?.providerName || "unknown";
+        const error = result.reason instanceof Error ? result.reason : new Error(String(result.reason));
+        failed.set(providerName, error);
+        this.logger?.warn(`Failed to load eager credential "${providerName}":`, error.message);
+      }
+    }
+    const duration = Date.now() - startTime;
+    this.logger?.debug(`Eager loading complete: ${loaded.size} loaded, ${failed.size} failed, ${duration}ms`);
+    return { loaded, failed, duration };
+  }
+  /**
+   * Load a single credential
+   */
+  async loadOne(config, context) {
+    try {
+      return await config.factory({
+        ...context,
+        metadata: config.metadata
+      });
+    } catch (error) {
+      error.providerName = config.name;
+      throw error;
+    }
+  }
+  /**
+   * Wrap credential with resolved metadata
+   */
+  wrapCredential(providerId, credential, config) {
+    return {
+      credential,
+      providerId,
+      acquiredAt: Date.now(),
+      expiresAt: extractCredentialExpiry(credential),
+      isValid: true,
+      scope: config.scope
+    };
+  }
+};
+export {
+  EagerCredentialLoader
+};