@frontmcp/auth 1.10.16 → 1.11.0-rc.1

package/browser/detection/auth-provider-detection.mjs

@@ -0,0 +1,176 @@
+// libs/auth/src/detection/auth-provider-detection.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import { staticAuthOptionsSchema } from "../options/static.schema.mjs";
+import {
+  isOrchestratedMode,
+  isOrchestratedRemote,
+  isPublicMode,
+  isStaticMode,
+  isTransparentMode
+} from "../options/utils.mjs";
+var detectedAuthProviderSchema = z.object({
+  id: z.string(),
+  providerUrl: z.string().optional(),
+  mode: z.enum(["public", "static", "transparent", "local", "remote"]),
+  appIds: z.array(z.string()),
+  scopes: z.array(z.string()),
+  isParentProvider: z.boolean()
+});
+var authProviderDetectionResultSchema = z.object({
+  providers: z.map(z.string(), detectedAuthProviderSchema),
+  requiresOrchestration: z.boolean(),
+  parentProviderId: z.string().optional(),
+  childProviderIds: z.array(z.string()),
+  uniqueProviderCount: z.number(),
+  validationErrors: z.array(z.string()),
+  warnings: z.array(z.string())
+});
+function deriveProviderId(options) {
+  if (isPublicMode(options)) {
+    return options.issuer ?? "public";
+  }
+  if (isTransparentMode(options)) {
+    return options.providerConfig?.id ?? urlToProviderId(options.provider);
+  }
+  if (isOrchestratedMode(options)) {
+    if (isOrchestratedRemote(options)) {
+      return options.providerConfig?.id ?? urlToProviderId(options.provider);
+    }
+    return options.local?.issuer ?? "local";
+  }
+  return "unknown";
+}
+function urlToProviderId(url) {
+  try {
+    const parsed = new URL(url);
+    return parsed.hostname.replace(/\./g, "_");
+  } catch {
+    return url.replace(/[^a-zA-Z0-9]/g, "_");
+  }
+}
+function extractScopes(options) {
+  if (isTransparentMode(options)) {
+    return options.requiredScopes || [];
+  }
+  if (isOrchestratedMode(options)) {
+    if (isOrchestratedRemote(options)) {
+      return options.scopes || [];
+    }
+  }
+  return [];
+}
+function detectAuthProviders(parentAuth, apps) {
+  const providers = /* @__PURE__ */ new Map();
+  const validationErrors = [];
+  const warnings = [];
+  let parentProviderId;
+  if (parentAuth) {
+    parentProviderId = deriveProviderId(parentAuth);
+    providers.set(parentProviderId, {
+      id: parentProviderId,
+      providerUrl: getProviderUrl(parentAuth),
+      mode: parentAuth.mode,
+      appIds: ["__parent__"],
+      scopes: extractScopes(parentAuth),
+      isParentProvider: true
+    });
+  }
+  for (const app of apps) {
+    if (!app.auth) {
+      continue;
+    }
+    const providerId = deriveProviderId(app.auth);
+    const existing = providers.get(providerId);
+    if (existing) {
+      existing.appIds.push(app.id);
+      const newScopes = extractScopes(app.auth);
+      existing.scopes = [.../* @__PURE__ */ new Set([...existing.scopes, ...newScopes])];
+    } else {
+      providers.set(providerId, {
+        id: providerId,
+        providerUrl: getProviderUrl(app.auth),
+        mode: app.auth.mode,
+        appIds: [app.id],
+        scopes: extractScopes(app.auth),
+        isParentProvider: false
+      });
+    }
+  }
+  const childProviderIds = [...providers.keys()].filter((id) => id !== parentProviderId);
+  const uniqueProviderCount = providers.size;
+  const hasMultipleProviders = uniqueProviderCount > 1;
+  const hasChildOnlyProviders = childProviderIds.length > 0 && !parentProviderId;
+  const requiresOrchestration = hasMultipleProviders || hasChildOnlyProviders || childProviderIds.length > 0 && parentProviderId !== void 0;
+  if (requiresOrchestration && parentAuth && isTransparentMode(parentAuth)) {
+    validationErrors.push(
+      `Invalid auth configuration: Parent uses transparent mode but apps have their own auth providers. Transparent mode passes tokens through without modification, which is incompatible with multi-provider setups. Change parent auth to local or remote mode to properly manage tokens for each provider. Detected providers: ${[...providers.keys()].join(", ")}`
+    );
+  }
+  const sharedEndpointUnenforced = !parentAuth || isPublicMode(parentAuth) || isStaticMode(parentAuth);
+  const unenforcedAppIds = apps.filter((app) => app.auth && !isPublicMode(app.auth) && !staticParentEnforces(parentAuth, app.auth)).map((app) => app.id);
+  if (sharedEndpointUnenforced && unenforcedAppIds.length > 0) {
+    validationErrors.push(
+      `App-level auth is not enforced on the shared endpoint of a server in ${parentAuth?.mode ?? "public"} mode, so the tools of ${unenforcedAppIds.join(", ")} would be served without it. Serve the app on its own endpoint with standalone: true or splitByApp: true, or run the server in local or remote mode with incrementalAuth enabled, which checks each tool call against the apps the caller has authorized (without incrementalAuth, local and remote mode do not check app grants per tool call).`
+    );
+  }
+  const tokenMintingAppIds = apps.filter((app) => app.remoteAuthMode === "forward" && !(parentAuth && isTransparentMode(parentAuth))).map((app) => app.id);
+  if (tokenMintingAppIds.length > 0) {
+    validationErrors.push(
+      `remoteAuth: { mode: 'forward' } on ${tokenMintingAppIds.join(", ")} would send the remote a token this server minted or holds itself: only a server in transparent mode receives its callers' tokens from the identity provider. Use remoteAuth: { mode: 'static', credentials } (or transportOptions.headers) for the remote, or run the server in transparent mode.`
+    );
+  }
+  return {
+    providers,
+    requiresOrchestration,
+    parentProviderId,
+    childProviderIds,
+    uniqueProviderCount,
+    validationErrors,
+    warnings
+  };
+}
+function staticParentEnforces(parentAuth, appAuth) {
+  if (!parentAuth || !isStaticMode(parentAuth) || !isStaticMode(appAuth)) return false;
+  const parent = staticAuthOptionsSchema.safeParse(parentAuth);
+  const app = staticAuthOptionsSchema.safeParse(appAuth);
+  if (!parent.success || !app.success) return false;
+  const sameChallenge = parent.data.header.toLowerCase() === app.data.header.toLowerCase() && parent.data.scheme === app.data.scheme;
+  return sameChallenge && parent.data.tokens.every((token) => app.data.tokens.includes(token));
+}
+function getProviderUrl(options) {
+  if (isTransparentMode(options)) {
+    return options.provider;
+  }
+  if (isOrchestratedMode(options) && isOrchestratedRemote(options)) {
+    return options.provider;
+  }
+  return void 0;
+}
+function appRequiresOrchestration(appAuth, parentAuth) {
+  if (!appAuth) {
+    return false;
+  }
+  if (!parentAuth) {
+    return appAuth.mode !== "public";
+  }
+  const appProviderId = deriveProviderId(appAuth);
+  const parentProviderId = deriveProviderId(parentAuth);
+  return appProviderId !== parentProviderId;
+}
+function getProviderScopes(detection, providerId) {
+  const provider = detection.providers.get(providerId);
+  return provider?.scopes ?? [];
+}
+function getProviderApps(detection, providerId) {
+  const provider = detection.providers.get(providerId);
+  return provider?.appIds.filter((id) => id !== "__parent__") ?? [];
+}
+export {
+  appRequiresOrchestration,
+  authProviderDetectionResultSchema,
+  deriveProviderId,
+  detectAuthProviders,
+  detectedAuthProviderSchema,
+  getProviderApps,
+  getProviderScopes
+};

package/browser/detection/index.mjs

@@ -0,0 +1,19 @@
+// libs/auth/src/detection/index.ts
+import {
+  detectedAuthProviderSchema,
+  authProviderDetectionResultSchema,
+  detectAuthProviders,
+  deriveProviderId,
+  appRequiresOrchestration,
+  getProviderScopes,
+  getProviderApps
+} from "./auth-provider-detection.mjs";
+export {
+  appRequiresOrchestration,
+  authProviderDetectionResultSchema,
+  deriveProviderId,
+  detectAuthProviders,
+  detectedAuthProviderSchema,
+  getProviderApps,
+  getProviderScopes
+};

package/browser/errors/auth-internal.error.mjs

@@ -0,0 +1,42 @@
+// libs/auth/src/errors/auth-internal.error.ts
+import { randomBytes, bytesToHex } from "@frontmcp/utils";
+var AuthInternalError = class extends Error {
+  /**
+   * Unique error ID for tracking in logs.
+   */
+  errorId;
+  /**
+   * Whether this error should expose details to the client.
+   */
+  isPublic = false;
+  /**
+   * HTTP status code equivalent.
+   */
+  statusCode = 500;
+  /**
+   * Error code for categorization.
+   */
+  code;
+  constructor(message, code = "AUTH_INTERNAL_ERROR") {
+    super(message);
+    this.name = this.constructor.name;
+    this.code = code;
+    this.errorId = `err_${bytesToHex(randomBytes(8))}`;
+    Error.captureStackTrace(this, this.constructor);
+  }
+  /**
+   * Get the public-facing error message.
+   */
+  getPublicMessage() {
+    return `Internal auth error. Please contact support with error ID: ${this.errorId}`;
+  }
+  /**
+   * Get the internal error message (for logging).
+   */
+  getInternalMessage() {
+    return this.message;
+  }
+};
+export {
+  AuthInternalError
+};

package/browser/errors/auth-internal.errors.mjs

@@ -0,0 +1,150 @@
+// libs/auth/src/errors/auth-internal.errors.ts
+import { AuthInternalError } from "./auth-internal.error.mjs";
+var EncryptionContextNotSetError = class extends AuthInternalError {
+  constructor() {
+    super("Encryption context is not set", "ENCRYPTION_CONTEXT_NOT_SET");
+  }
+};
+var VaultLoadError = class extends AuthInternalError {
+  originalError;
+  constructor(vaultId, originalError) {
+    super(`Failed to load vault "${vaultId}"${originalError ? `: ${originalError.message}` : ""}`, "VAULT_LOAD_ERROR");
+    this.originalError = originalError;
+  }
+};
+var VaultNotFoundError = class extends AuthInternalError {
+  constructor(entityType, id) {
+    super(`${entityType} "${id}" not found in vault`, "VAULT_NOT_FOUND");
+  }
+};
+var TokenNotAvailableError = class extends AuthInternalError {
+  constructor(message) {
+    super(message, "TOKEN_NOT_AVAILABLE");
+  }
+};
+var TokenStoreRequiredError = class extends AuthInternalError {
+  constructor(context) {
+    super(`Token store is required for ${context}`, "TOKEN_STORE_REQUIRED");
+  }
+};
+var NoProviderIdError = class extends AuthInternalError {
+  constructor(message) {
+    super(message, "NO_PROVIDER_ID");
+  }
+};
+var TokenLeakDetectedError = class extends AuthInternalError {
+  constructor(detail) {
+    super(`Token leak detected: ${detail}`, "TOKEN_LEAK_DETECTED");
+  }
+};
+var SessionSecretRequiredError = class extends AuthInternalError {
+  constructor(component) {
+    super(`Session secret is required for ${component}`, "SESSION_SECRET_REQUIRED");
+  }
+};
+var JwtSecretRequiredError = class extends AuthInternalError {
+  constructor(mode) {
+    super(
+      `JWT_SECRET is required in production for auth.mode "${mode}". Without it the server signs tokens with a random per-process secret, so every restart invalidates outstanding tokens and any second instance or isolate rejects tokens the first one minted.`,
+      "JWT_SECRET_REQUIRED"
+    );
+  }
+};
+var JwtSecretWeakError = class extends AuthInternalError {
+  constructor(byteLength) {
+    super(
+      `JWT_SECRET is ${byteLength} bytes; HS256 requires at least 32 (RFC 7518 \xA73.2). A shorter secret is guessable, and whoever guesses it can forge tokens for this server. Generate one with \`openssl rand -hex 32\`.`,
+      "JWT_SECRET_INVALID"
+    );
+  }
+};
+var CredentialProviderAlreadyRegisteredError = class extends AuthInternalError {
+  constructor(name) {
+    super(`Credential provider "${name}" is already registered`, "CREDENTIAL_PROVIDER_ALREADY_REGISTERED");
+  }
+};
+var AuthProvidersNotConfiguredError = class extends AuthInternalError {
+  constructor() {
+    super("Auth providers are not configured", "AUTH_PROVIDERS_NOT_CONFIGURED");
+  }
+};
+var OrchestratedAuthNotAvailableError = class extends AuthInternalError {
+  constructor() {
+    super("Orchestrated auth is not available", "ORCHESTRATED_AUTH_NOT_AVAILABLE");
+  }
+};
+var EncryptionKeyNotConfiguredError = class extends AuthInternalError {
+  constructor() {
+    super("Encryption key is not configured", "ENCRYPTION_KEY_NOT_CONFIGURED");
+  }
+};
+var SessionIdEmptyError = class extends AuthInternalError {
+  constructor(storeName) {
+    super(`Session ID must not be empty (${storeName})`, "SESSION_ID_EMPTY");
+  }
+};
+var ElicitationSecretRequiredError = class extends AuthInternalError {
+  constructor() {
+    super("Elicitation secret is required", "ELICITATION_SECRET_REQUIRED");
+  }
+};
+var ScopeDeniedError = class extends AuthInternalError {
+  constructor(providerId) {
+    super(`Scope access denied for provider "${providerId}"`, "SCOPE_DENIED");
+  }
+};
+var InMemoryStoreRequiredError = class extends AuthInternalError {
+  constructor(component) {
+    super(`In-memory store is required for ${component}`, "INMEMORY_STORE_REQUIRED");
+  }
+};
+var OrchestratorJwksNotAvailableError = class extends AuthInternalError {
+  constructor() {
+    super("Orchestrator JWKS is not available", "ORCHESTRATOR_JWKS_NOT_AVAILABLE");
+  }
+};
+var SecureStoreConfigError = class extends AuthInternalError {
+  constructor(message) {
+    super(`Invalid auth.secureStore: ${message}`, "SECURE_STORE_CONFIG_INVALID");
+  }
+};
+var AuthInvalidInputError = class extends AuthInternalError {
+  constructor(message) {
+    super(message, "AUTH_INVALID_INPUT");
+  }
+};
+var CredentialStorageError = class extends AuthInternalError {
+  constructor(message) {
+    super(message, "CREDENTIAL_STORAGE_ERROR");
+  }
+};
+var AuthFlowError = class extends AuthInternalError {
+  constructor(message, code = "AUTH_FLOW_ERROR") {
+    super(message, code);
+  }
+};
+export {
+  AuthFlowError,
+  AuthInvalidInputError,
+  AuthProvidersNotConfiguredError,
+  CredentialProviderAlreadyRegisteredError,
+  CredentialStorageError,
+  ElicitationSecretRequiredError,
+  EncryptionContextNotSetError,
+  EncryptionKeyNotConfiguredError,
+  InMemoryStoreRequiredError,
+  JwtSecretRequiredError,
+  JwtSecretWeakError,
+  NoProviderIdError,
+  OrchestratedAuthNotAvailableError,
+  OrchestratorJwksNotAvailableError,
+  ScopeDeniedError,
+  SecureStoreConfigError,
+  SessionIdEmptyError,
+  SessionSecretRequiredError,
+  TokenLeakDetectedError,
+  TokenNotAvailableError,
+  TokenStoreRequiredError,
+  VaultLoadError,
+  VaultNotFoundError
+};

package/browser/errors/index.mjs

@@ -0,0 +1,53 @@
+// libs/auth/src/errors/index.ts
+import { AuthInternalError } from "./auth-internal.error.mjs";
+import {
+  EncryptionContextNotSetError,
+  VaultLoadError,
+  VaultNotFoundError,
+  TokenNotAvailableError,
+  TokenStoreRequiredError,
+  NoProviderIdError,
+  TokenLeakDetectedError,
+  JwtSecretRequiredError,
+  JwtSecretWeakError,
+  SessionSecretRequiredError,
+  CredentialProviderAlreadyRegisteredError,
+  AuthProvidersNotConfiguredError,
+  OrchestratedAuthNotAvailableError,
+  EncryptionKeyNotConfiguredError,
+  SessionIdEmptyError,
+  ElicitationSecretRequiredError,
+  ScopeDeniedError,
+  InMemoryStoreRequiredError,
+  OrchestratorJwksNotAvailableError,
+  SecureStoreConfigError,
+  AuthInvalidInputError,
+  CredentialStorageError,
+  AuthFlowError
+} from "./auth-internal.errors.mjs";
+export {
+  AuthFlowError,
+  AuthInternalError,
+  AuthInvalidInputError,
+  AuthProvidersNotConfiguredError,
+  CredentialProviderAlreadyRegisteredError,
+  CredentialStorageError,
+  ElicitationSecretRequiredError,
+  EncryptionContextNotSetError,
+  EncryptionKeyNotConfiguredError,
+  InMemoryStoreRequiredError,
+  JwtSecretRequiredError,
+  JwtSecretWeakError,
+  NoProviderIdError,
+  OrchestratedAuthNotAvailableError,
+  OrchestratorJwksNotAvailableError,
+  ScopeDeniedError,
+  SecureStoreConfigError,
+  SessionIdEmptyError,
+  SessionSecretRequiredError,
+  TokenLeakDetectedError,
+  TokenNotAvailableError,
+  TokenStoreRequiredError,
+  VaultLoadError,
+  VaultNotFoundError
+};

package/browser/fetch/fetch-credential-middleware.mjs

@@ -0,0 +1,91 @@
+// libs/auth/src/fetch/fetch-credential-middleware.ts
+var bearerApplier = {
+  apply(token, _url, init) {
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return { init: { ...init, headers } };
+  }
+};
+function headerApplier(headerName, prefix) {
+  return {
+    apply(token, _url, init) {
+      const headers = new Headers(init.headers);
+      headers.set(headerName, prefix ? `${prefix} ${token}` : token);
+      return { init: { ...init, headers } };
+    }
+  };
+}
+function queryApplier(paramName) {
+  return {
+    apply(token, url, init) {
+      const urlObj = new URL(url);
+      urlObj.searchParams.set(paramName, token);
+      return { init, url: urlObj.toString() };
+    }
+  };
+}
+var basicApplier = {
+  apply(token, _url, init) {
+    const headers = new Headers(init.headers);
+    const encoded = typeof btoa === "function" ? btoa(token) : Buffer.from(token).toString("base64");
+    headers.set("Authorization", `Basic ${encoded}`);
+    return { init: { ...init, headers } };
+  }
+};
+function isFrontMcpCredentials(creds) {
+  return typeof creds === "object" && creds !== null && "provider" in creds && typeof creds.provider === "string" && creds.provider.length > 0;
+}
+function providerHeadersCredentials(resolveHeaders) {
+  return {
+    async applyCredentials(_url, init) {
+      const { credentials, ...cleanInit } = init;
+      if (!isFrontMcpCredentials(credentials)) {
+        return { init: typeof credentials === "string" ? init : cleanInit };
+      }
+      const headers = new Headers(cleanInit.headers);
+      for (const [name, value] of Object.entries(await resolveHeaders(credentials.provider))) {
+        headers.set(name, value);
+      }
+      return { init: { ...cleanInit, headers } };
+    }
+  };
+}
+var FetchCredentialMiddleware = class {
+  constructor(tokenAccessor, appliers) {
+    this.tokenAccessor = tokenAccessor;
+    this.appliers = new Map(Object.entries(appliers ?? {}));
+  }
+  tokenAccessor;
+  appliers;
+  /**
+   * Inspect the `credentials` field. If it references a named provider,
+   * resolve the token and delegate to the provider's applier.
+   */
+  async applyCredentials(url, init) {
+    const creds = init.credentials;
+    if (!creds || typeof creds === "string") {
+      return { init };
+    }
+    if (!isFrontMcpCredentials(creds)) {
+      const { credentials: _removed2, ...rest } = init;
+      return { init: rest };
+    }
+    const token = await this.tokenAccessor.getToken(creds.provider);
+    if (!token) {
+      const { credentials: _removed2, ...rest } = init;
+      return { init: rest };
+    }
+    const applier = this.appliers.get(creds.provider) ?? bearerApplier;
+    const { credentials: _removed, ...cleanInit } = init;
+    return applier.apply(token, url, cleanInit);
+  }
+};
+export {
+  FetchCredentialMiddleware,
+  basicApplier,
+  bearerApplier,
+  headerApplier,
+  isFrontMcpCredentials,
+  providerHeadersCredentials,
+  queryApplier
+};

package/browser/fetch/index.mjs

@@ -0,0 +1,19 @@
+// libs/auth/src/fetch/index.ts
+import {
+  FetchCredentialMiddleware,
+  providerHeadersCredentials,
+  isFrontMcpCredentials,
+  bearerApplier,
+  basicApplier,
+  headerApplier,
+  queryApplier
+} from "./fetch-credential-middleware.mjs";
+export {
+  FetchCredentialMiddleware,
+  basicApplier,
+  bearerApplier,
+  headerApplier,
+  isFrontMcpCredentials,
+  providerHeadersCredentials,
+  queryApplier
+};