@frontmcp/auth 1.10.16 → 1.11.0-rc.1

package/browser/authorization/orchestrated.authorization.mjs

@@ -0,0 +1,289 @@
+// libs/auth/src/authorization/orchestrated.authorization.ts
+import { NoProviderIdError, TokenNotAvailableError, TokenStoreRequiredError } from "../errors/auth-internal.errors.mjs";
+import { deriveAuthorizationId } from "../utils/authorization-id.utils.mjs";
+import { AuthorizationBase } from "./authorization.class.mjs";
+var OrchestratedAuthorization = class _OrchestratedAuthorization extends AuthorizationBase {
+  mode = "orchestrated";
+  /**
+   * Primary provider ID (default for getToken)
+   */
+  primaryProviderId;
+  /**
+   * Token store for secure token retrieval
+   */
+  #tokenStore;
+  /**
+   * Token refresh callback
+   */
+  #onTokenRefresh;
+  /**
+   * Provider states (encrypted tokens)
+   */
+  #providerStates;
+  constructor(ctx) {
+    super(ctx);
+    this.primaryProviderId = ctx.primaryProviderId;
+    this.#tokenStore = ctx.tokenStore;
+    this.#onTokenRefresh = ctx.onTokenRefresh;
+    this.#providerStates = ctx.providerStates ?? /* @__PURE__ */ new Map();
+  }
+  /**
+   * Create an OrchestratedAuthorization
+   *
+   * @param ctx - Creation context
+   * @returns A new OrchestratedAuthorization instance
+   *
+   * @example
+   * ```typescript
+   * const auth = OrchestratedAuthorization.create({
+   *   token: localJwt,
+   *   user: { sub: 'user123', name: 'John' },
+   *   primaryProviderId: 'github',
+   *   tokenStore: redisTokenStore,
+   *   providers: {
+   *     github: { id: 'github', secretRefId: 'vault:github:user123' },
+   *   },
+   * });
+   *
+   * // Retrieve token securely (never exposed to LLM)
+   * const githubToken = await auth.getToken('github');
+   * ```
+   */
+  static create(ctx) {
+    const {
+      token,
+      user,
+      scopes = [],
+      claims,
+      expiresAt,
+      primaryProviderId,
+      tokenStore,
+      onTokenRefresh,
+      providers = {},
+      authorizedProviderIds,
+      ...projections
+    } = ctx;
+    const id = deriveAuthorizationId(token);
+    const providerStates = /* @__PURE__ */ new Map();
+    const authorizedProviders = {};
+    const providerIdsFromState = [];
+    for (const [providerId, state] of Object.entries(providers)) {
+      providerStates.set(providerId, state);
+      providerIdsFromState.push(providerId);
+      authorizedProviders[providerId] = {
+        id: providerId,
+        exp: state.expiresAt,
+        embedMode: state.secretRefId ? "ref" : "store-only",
+        secretRefId: state.secretRefId,
+        refreshRefId: state.refreshRefId
+      };
+    }
+    const finalAuthorizedProviderIds = authorizedProviderIds ?? (providerIdsFromState.length > 0 ? providerIdsFromState : void 0);
+    return new _OrchestratedAuthorization({
+      id,
+      isAnonymous: false,
+      user,
+      claims,
+      expiresAt,
+      scopes,
+      token,
+      primaryProviderId,
+      tokenStore,
+      onTokenRefresh,
+      providerStates,
+      authorizedProviders,
+      ...projections,
+      authorizedProviderIds: finalAuthorizedProviderIds
+    });
+  }
+  /**
+   * Get access token for a provider
+   *
+   * Retrieves the decrypted token from the secure store.
+   * If the token is expired and refresh is available, attempts refresh.
+   *
+   * @param providerId - Provider ID (defaults to primaryProviderId)
+   * @returns The decrypted access token
+   * @throws If no token store or no token available
+   */
+  async getToken(providerId) {
+    const targetProviderId = providerId ?? this.primaryProviderId;
+    if (!targetProviderId) {
+      throw new NoProviderIdError("OrchestratedAuthorization: No provider ID specified and no primary provider set");
+    }
+    if (!this.#tokenStore) {
+      throw new TokenStoreRequiredError("orchestrated token retrieval");
+    }
+    const hasToken = await this.#tokenStore.hasTokens(this.id, targetProviderId);
+    if (!hasToken) {
+      throw new TokenNotAvailableError(
+        `OrchestratedAuthorization: No tokens available for provider "${targetProviderId}"`
+      );
+    }
+    const accessToken = await this.#tokenStore.getAccessToken(this.id, targetProviderId);
+    if (accessToken) {
+      const providerState = this.#providerStates.get(targetProviderId);
+      if (providerState?.expiresAt && providerState.expiresAt < Date.now()) {
+        return this.refreshAndGetToken(targetProviderId);
+      }
+      return accessToken;
+    }
+    return this.refreshAndGetToken(targetProviderId);
+  }
+  /**
+   * Refresh token and return new access token
+   */
+  async refreshAndGetToken(providerId) {
+    if (!this.#tokenStore || !this.#onTokenRefresh) {
+      throw new TokenNotAvailableError(
+        `OrchestratedAuthorization: Token expired for provider "${providerId}" and refresh not available`
+      );
+    }
+    const refreshToken = await this.#tokenStore.getRefreshToken(this.id, providerId);
+    if (!refreshToken) {
+      throw new TokenNotAvailableError(
+        `OrchestratedAuthorization: No refresh token available for provider "${providerId}"`
+      );
+    }
+    const result = await this.#onTokenRefresh(providerId, refreshToken);
+    await this.#tokenStore.storeTokens(this.id, providerId, {
+      accessToken: result.accessToken,
+      refreshToken: result.refreshToken ?? refreshToken,
+      expiresAt: result.expiresIn ? Date.now() + result.expiresIn * 1e3 : void 0
+    });
+    const currentState = this.#providerStates.get(providerId);
+    if (currentState) {
+      currentState.expiresAt = result.expiresIn ? Date.now() + result.expiresIn * 1e3 : void 0;
+    }
+    return result.accessToken;
+  }
+  /**
+   * Check if a provider has tokens stored
+   */
+  hasProvider(providerId) {
+    return this.#providerStates.has(providerId);
+  }
+  /**
+   * Get all provider IDs with tokens
+   */
+  getProviderIds() {
+    return Array.from(this.#providerStates.keys());
+  }
+  /**
+   * Add a new provider to this authorization
+   * Used when user authorizes additional providers after initial auth
+   */
+  async addProvider(providerId, tokens) {
+    if (!this.#tokenStore) {
+      throw new TokenStoreRequiredError("adding providers");
+    }
+    const expiresAt = tokens.expiresIn ? Date.now() + tokens.expiresIn * 1e3 : void 0;
+    await this.#tokenStore.storeTokens(this.id, providerId, {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt
+    });
+    this.#providerStates.set(providerId, {
+      id: providerId,
+      expiresAt,
+      secretRefId: `${this.id}:${providerId}`
+    });
+  }
+  // ============================================
+  // Progressive/Incremental Authorization
+  // ============================================
+  /**
+   * Mutable app authorization state for progressive auth.
+   * This allows expanding authorization without reissuing the session token.
+   */
+  #mutableAuthorizedApps = new Map(
+    Object.entries(this.authorizedApps ?? {})
+  );
+  /**
+   * Add app authorization after initial auth (progressive authorization).
+   * Stores app tokens server-side and updates authorized apps without JWT reissue.
+   *
+   * @param appId - App ID to authorize
+   * @param toolIds - Tool IDs accessible through this app authorization
+   * @param tokens - OAuth tokens from the app's auth provider
+   *
+   * @example
+   * ```typescript
+   * // User clicks auth link for Slack app
+   * await auth.addAppAuthorization('slack', ['slack:send_message', 'slack:list_channels'], {
+   *   accessToken: slackAccessToken,
+   *   refreshToken: slackRefreshToken,
+   *   expiresIn: 3600,
+   * });
+   *
+   * // Now slack tools will work without re-auth
+   * ```
+   */
+  async addAppAuthorization(appId, toolIds, tokens) {
+    if (!this.#tokenStore) {
+      throw new TokenStoreRequiredError("progressive authorization");
+    }
+    const providerId = `app:${appId}`;
+    await this.addProvider(providerId, tokens);
+    this.#mutableAuthorizedApps.set(appId, { id: appId, toolIds });
+  }
+  /**
+   * Get access token for a specific app (for tool execution).
+   * Retrieves the app's OAuth token from server-side storage.
+   *
+   * @param appId - App ID to get token for
+   * @returns The decrypted access token, or null if not authorized
+   */
+  async getAppToken(appId) {
+    if (!this.#mutableAuthorizedApps.has(appId)) {
+      return null;
+    }
+    const providerId = `app:${appId}`;
+    try {
+      return await this.getToken(providerId);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Check if an app is authorized (includes progressively authorized apps).
+   * Overrides base class to include mutable app authorization state.
+   */
+  isAppAuthorized(appId) {
+    return this.#mutableAuthorizedApps.has(appId) || super.isAppAuthorized(appId);
+  }
+  /**
+   * Get all authorized app IDs (includes progressively authorized apps).
+   */
+  getAllAuthorizedAppIds() {
+    const baseIds = new Set(this.authorizedAppIds ?? []);
+    for (const appId of this.#mutableAuthorizedApps.keys()) {
+      baseIds.add(appId);
+    }
+    return Array.from(baseIds);
+  }
+  /**
+   * Get tool IDs authorized through an app.
+   */
+  getAppToolIds(appId) {
+    return this.#mutableAuthorizedApps.get(appId)?.toolIds ?? this.authorizedApps?.[appId]?.toolIds;
+  }
+  /**
+   * Remove a provider from this authorization
+   */
+  async removeProvider(providerId) {
+    if (this.#tokenStore) {
+      await this.#tokenStore.deleteTokens(this.id, providerId);
+    }
+    this.#providerStates.delete(providerId);
+  }
+  /**
+   * Get the issuer (local orchestrator)
+   */
+  get issuer() {
+    return this.claims?.["iss"];
+  }
+};
+export {
+  OrchestratedAuthorization
+};

package/browser/authorization/public.authorization.mjs

@@ -0,0 +1,124 @@
+// libs/auth/src/authorization/public.authorization.ts
+import { randomUUID } from "@frontmcp/utils";
+import { AuthorizationBase } from "./authorization.class.mjs";
+import { TokenNotAvailableError } from "../errors/auth-internal.errors.mjs";
+var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
+  mode = "public";
+  /**
+   * Issuer identifier for the anonymous authorization
+   */
+  issuer;
+  constructor(ctx) {
+    super(ctx);
+    this.issuer = ctx.issuer;
+  }
+  /**
+   * Create a new PublicAuthorization for anonymous access
+   *
+   * @param ctx - Creation context with optional configuration
+   * @returns A new PublicAuthorization instance
+   *
+   * @example
+   * ```typescript
+   * const auth = PublicAuthorization.create({
+   *   scopes: ['read', 'anonymous'],
+   *   ttlMs: 3600000,
+   *   allowedTools: ['search', 'get-docs'],
+   * });
+   * ```
+   */
+  static create(ctx = {}) {
+    const {
+      prefix = "anon",
+      scopes = ["anonymous"],
+      ttlMs = 36e5,
+      // 1 hour default
+      issuer,
+      allowedTools = "all",
+      allowedPrompts = "all"
+    } = ctx;
+    const uuid = randomUUID();
+    const sub = `${prefix}:${uuid}`;
+    const user = {
+      sub,
+      name: "Anonymous",
+      anonymous: true
+    };
+    const expiresAt = ttlMs ? Date.now() + ttlMs : void 0;
+    const authorizedTools = {};
+    const authorizedToolIds = [];
+    if (allowedTools !== "all" && Array.isArray(allowedTools)) {
+      for (const toolId of allowedTools) {
+        authorizedTools[toolId] = {
+          executionPath: ["public", toolId]
+        };
+        authorizedToolIds.push(toolId);
+      }
+    }
+    const authorizedPrompts = {};
+    const authorizedPromptIds = [];
+    if (allowedPrompts !== "all" && Array.isArray(allowedPrompts)) {
+      for (const promptId of allowedPrompts) {
+        authorizedPrompts[promptId] = {
+          executionPath: ["public", promptId]
+        };
+        authorizedPromptIds.push(promptId);
+      }
+    }
+    return new _PublicAuthorization({
+      id: sub,
+      isAnonymous: true,
+      user,
+      scopes,
+      expiresAt,
+      issuer,
+      authorizedTools: allowedTools === "all" ? void 0 : authorizedTools,
+      authorizedToolIds: allowedTools === "all" ? void 0 : authorizedToolIds,
+      authorizedPrompts: allowedPrompts === "all" ? void 0 : authorizedPrompts,
+      authorizedPromptIds: allowedPrompts === "all" ? void 0 : authorizedPromptIds
+    });
+  }
+  /**
+   * Anonymous users cannot access provider tokens
+   *
+   * @throws TokenNotAvailableError always - anonymous users do not have provider tokens
+   */
+  async getToken(_providerId) {
+    throw new TokenNotAvailableError(
+      "PublicAuthorization: Anonymous users cannot access provider tokens. Use transparent or orchestrated mode for token access."
+    );
+  }
+  /**
+   * Check if all tools are allowed (public access)
+   */
+  get allowsAllTools() {
+    return this.authorizedToolIds.length === 0 && Object.keys(this.authorizedTools).length === 0;
+  }
+  /**
+   * Check if all prompts are allowed (public access)
+   */
+  get allowsAllPrompts() {
+    return this.authorizedPromptIds.length === 0 && Object.keys(this.authorizedPrompts).length === 0;
+  }
+  /**
+   * Override canAccessTool to support 'all' mode
+   */
+  canAccessTool(toolId) {
+    if (this.allowsAllTools) {
+      return true;
+    }
+    return super.canAccessTool(toolId);
+  }
+  /**
+   * Override canAccessPrompt to support 'all' mode
+   */
+  canAccessPrompt(promptId) {
+    if (this.allowsAllPrompts) {
+      return true;
+    }
+    return super.canAccessPrompt(promptId);
+  }
+};
+export {
+  PublicAuthorization
+};

package/browser/authorization/transparent.authorization.mjs

@@ -0,0 +1,130 @@
+// libs/auth/src/authorization/transparent.authorization.ts
+import { sha256Hex } from "@frontmcp/utils";
+import { AuthorizationBase } from "./authorization.class.mjs";
+import { TokenNotAvailableError } from "../errors/auth-internal.errors.mjs";
+var TransparentAuthorization = class _TransparentAuthorization extends AuthorizationBase {
+  mode = "transparent";
+  /**
+   * Provider ID that issued the token
+   */
+  providerId;
+  /**
+   * Provider display name
+   */
+  providerName;
+  constructor(ctx) {
+    super(ctx);
+    this.providerId = ctx.providerId;
+    this.providerName = ctx.providerName;
+  }
+  /**
+   * Create a TransparentAuthorization from a verified JWT
+   *
+   * @param ctx - Creation context with token and verified payload
+   * @returns A new TransparentAuthorization instance
+   *
+   * @example
+   * ```typescript
+   * const auth = TransparentAuthorization.fromVerifiedToken({
+   *   token: bearerToken,
+   *   payload: verifiedClaims,
+   *   providerId: 'auth0',
+   * });
+   *
+   * // Pass token through to downstream
+   * const token = await auth.getToken();
+   * ```
+   */
+  static fromVerifiedToken(ctx) {
+    const { token, payload, providerId, providerName, ...projections } = ctx;
+    const user = {
+      sub: payload.sub,
+      name: payload.name,
+      email: payload.email,
+      picture: payload.picture,
+      anonymous: false
+    };
+    const scopes = _TransparentAuthorization.parseScopes(payload.scope);
+    const expiresAt = payload.exp ? payload.exp * 1e3 : void 0;
+    const id = _TransparentAuthorization.generateAuthorizationId(token);
+    const providerSnapshot = {
+      id: providerId,
+      exp: expiresAt,
+      payload,
+      embedMode: "plain",
+      // transparent mode keeps token in memory
+      token
+      // the original token
+    };
+    return new _TransparentAuthorization({
+      id,
+      isAnonymous: false,
+      user,
+      claims: payload,
+      expiresAt,
+      scopes,
+      token,
+      providerId,
+      providerName,
+      authorizedProviders: { [providerId]: providerSnapshot },
+      authorizedProviderIds: [providerId],
+      ...projections
+    });
+  }
+  /**
+   * Get the original bearer token for pass-through
+   *
+   * In transparent mode, the same token is returned regardless of providerId
+   * since only one provider (the upstream) issued the token.
+   *
+   * @param _providerId - Ignored in transparent mode
+   * @returns The original bearer token
+   */
+  async getToken(_providerId) {
+    if (!this.token) {
+      throw new TokenNotAvailableError("TransparentAuthorization: Token not available");
+    }
+    return this.token;
+  }
+  /**
+   * Parse scope claim from JWT payload
+   */
+  static parseScopes(scope) {
+    if (!scope) return [];
+    if (Array.isArray(scope)) return scope;
+    return scope.split(/\s+/).filter(Boolean);
+  }
+  /**
+   * Generate authorization ID from token signature
+   * Uses SHA-256 fingerprint of the token signature for uniqueness
+   */
+  static generateAuthorizationId(token) {
+    const parts = token.split(".");
+    const signature = parts[2] || token;
+    return sha256Hex(signature).substring(0, 16);
+  }
+  /**
+   * Get the issuer from the token claims
+   */
+  get issuer() {
+    return this.claims?.["iss"];
+  }
+  /**
+   * Get the audience from the token claims
+   */
+  get audience() {
+    return this.claims?.["aud"];
+  }
+  /**
+   * Check if the token was issued for a specific audience
+   */
+  hasAudience(aud) {
+    const tokenAud = this.audience;
+    if (!tokenAud) return false;
+    if (Array.isArray(tokenAud)) return tokenAud.includes(aud);
+    return tokenAud === aud;
+  }
+};
+export {
+  TransparentAuthorization
+};