@frontmcp/auth 1.10.16 → 1.11.0-rc.1

package/browser/index.mjs

@@ -0,0 +1,573 @@
+// libs/auth/src/index.ts
+import { JwksService, trimSlash, normalizeIssuer, decodeJwtPayloadSafe } from "./jwks/index.mjs";
+import {
+  CDN,
+  DEFAULT_THEME,
+  baseLayout,
+  createLayout,
+  authLayout,
+  centeredCardLayout,
+  wideLayout,
+  extraWideLayout,
+  escapeHtml,
+  BUILT_IN_AUTH_PAGE_CSP,
+  builtInAuthPageHeaders,
+  buildConsentPage,
+  buildIncrementalAuthPage,
+  buildFederatedLoginPage,
+  buildToolConsentPage,
+  buildLoginPage,
+  buildConnectPage,
+  buildConnectSuccessPage,
+  buildErrorPage,
+  renderToHtml,
+  renderLocalLoginPage,
+  toLoginExtraFields,
+  withoutSecretFieldValues
+} from "./ui/index.mjs";
+import {
+  InMemoryAuthorizationStore,
+  RedisAuthorizationStore,
+  StorageAuthorizationStore,
+  sealPendingLogin,
+  openPendingLogin,
+  SIGNIN_BINDING_COOKIE_PREFIX,
+  SIGNIN_BINDING_SECURE_COOKIE_PREFIX,
+  SIGNIN_BINDING_MAX_AGE_SECONDS,
+  createSigninBinding,
+  signinBindingCookieName,
+  signinBindingMatches,
+  verifyPkce,
+  generatePkceChallenge,
+  generateAuthorizationCode,
+  generateRefreshTokenValue,
+  buildCodeRecord,
+  buildPendingRecord,
+  buildRefreshTokenRecord,
+  pkceChallengeSchema,
+  authorizationCodeRecordSchema,
+  credentialTypeSchema,
+  oauthCredentialSchema,
+  apiKeyCredentialSchema,
+  basicAuthCredentialSchema,
+  bearerCredentialSchema,
+  privateKeyCredentialSchema,
+  mtlsCredentialSchema,
+  customCredentialSchema,
+  sshKeyCredentialSchema,
+  serviceAccountCredentialSchema,
+  pkceOAuthCredentialSchema,
+  credentialSchema,
+  appCredentialSchema,
+  vaultConsentRecordSchema,
+  vaultFederatedRecordSchema,
+  pendingIncrementalAuthSchema,
+  authorizationVaultEntrySchema,
+  InMemoryAuthorizationVault,
+  StorageAuthorizationVault,
+  EncryptedTypedStorage,
+  EncryptedStorageError,
+  encryptedDataSchema,
+  encryptedVaultEntrySchema,
+  VaultEncryption,
+  TokenVault,
+  StorageTokenStore,
+  TypedStorage,
+  hkdfSha256,
+  encryptValue,
+  decryptValue,
+  encryptAesGcm,
+  decryptAesGcm,
+  TinyTtlCache,
+  transportProtocolSchema,
+  sseTransportStateSchema,
+  streamableHttpTransportStateSchema,
+  statefulHttpTransportStateSchema,
+  statelessHttpTransportStateSchema,
+  legacySseTransportStateSchema,
+  transportStateSchema,
+  transportSessionSchema,
+  sessionJwtPayloadSchema,
+  encryptedBlobSchema,
+  storedSessionSchema,
+  redisConfigSchema,
+  signSession,
+  verifySession,
+  isSignedSession,
+  verifyOrParseSession,
+  SessionRateLimiter,
+  defaultSessionRateLimiter,
+  TransportIdGenerator,
+  isJwt,
+  getTokenSignatureFingerprint,
+  deriveTypedUser,
+  anonymousCallerClaims,
+  extractBearerToken,
+  getKey,
+  encryptJson,
+  decryptSessionJson,
+  safeDecrypt,
+  resetCachedKey,
+  RedisSessionStore,
+  VercelKvSessionStore,
+  InMemoryOrchestratedTokenStore,
+  StorageOrchestratedTokenStore,
+  InMemoryFederatedAuthSessionStore,
+  StorageFederatedAuthSessionStore,
+  toSessionRecord,
+  fromSessionRecord,
+  createFederatedAuthSession,
+  isSessionComplete,
+  getNextProvider,
+  completeCurrentProvider,
+  startNextProvider,
+  InMemoryConsentStore,
+  StorageConsentStore,
+  consentRecordKey,
+  createTokenStorageAdapter,
+  isRedisTokenStorage,
+  isSqliteTokenStorage,
+  isPersistentTokenStorage,
+  redisVaultEntrySchema,
+  EncryptedRedisVault,
+  createEncryptedVault,
+  toEpochSeconds,
+  isSoonExpiring,
+  isSoonExpiringProvider,
+  tryJwtExp,
+  SessionCredentialVault,
+  createSessionCredentialVault,
+  signCredentialResumeToken,
+  verifyCredentialResumeToken,
+  buildCredentialResumeUrl,
+  DEFAULT_RESUME_TTL_MS,
+  signIncrementalAuthTicket,
+  verifyIncrementalAuthTicket,
+  DEFAULT_INCREMENTAL_TICKET_TTL_MS,
+  CREDENTIALS_ACCESSOR,
+  CredentialsAccessorImpl,
+  EncryptedStorageSecureStoreBackend,
+  SECURE_STORE_ACCESSOR,
+  SecureStoreAccessorImpl,
+  createSecureStore
+} from "./session/index.mjs";
+import {
+  AppAuthState,
+  authModeSchema,
+  authUserSchema,
+  authorizedToolSchema,
+  authorizedPromptSchema,
+  llmSafeAuthContextSchema,
+  appAuthStateSchema,
+  appAuthorizationRecordSchema,
+  progressiveAuthStateSchema,
+  AuthorizationBase,
+  PublicAuthorization,
+  TransparentAuthorization,
+  OrchestratedAuthorization,
+  OrchestratedAuthAccessorAdapter,
+  NullOrchestratedAuthAccessor,
+  ORCHESTRATED_AUTH_ACCESSOR,
+  DcrClientRegistry
+} from "./authorization/index.mjs";
+import { jwkParametersSchema, jwkSchema, jsonWebKeySetSchema } from "./common/index.mjs";
+import { aiPlatformTypeSchema, userClaimSchema, sessionIdPayloadSchema } from "./common/index.mjs";
+import {
+  AuthInternalError,
+  EncryptionContextNotSetError,
+  VaultLoadError,
+  VaultNotFoundError,
+  TokenNotAvailableError,
+  TokenStoreRequiredError,
+  NoProviderIdError,
+  TokenLeakDetectedError,
+  JwtSecretRequiredError,
+  JwtSecretWeakError,
+  SessionSecretRequiredError,
+  CredentialProviderAlreadyRegisteredError,
+  AuthProvidersNotConfiguredError,
+  OrchestratedAuthNotAvailableError,
+  EncryptionKeyNotConfiguredError,
+  SessionIdEmptyError,
+  ElicitationSecretRequiredError,
+  ScopeDeniedError,
+  InMemoryStoreRequiredError,
+  OrchestratorJwksNotAvailableError,
+  SecureStoreConfigError,
+  AuthInvalidInputError,
+  CredentialStorageError
+} from "./errors/index.mjs";
+export { allowsPublicAccess, appAuthOptionsSchema, authOptionsSchema, authenticateFnSchema, consentConfigSchema, federatedAuthConfigSchema, flatRemoteProviderFields, incrementalAuthConfigSchema, isLocalMode, isOrchestratedLocal, isOrchestratedMode, isOrchestratedRemote, isPublicMode, isRemoteMode, isStaticMode, isTransparentMode, localAuthSchema, localDcrClientSchema, localDcrConfigSchema, localSigningConfigSchema, loginConfigSchema, orchestratedLocalSchema, orchestratedRemoteSchema, parseAuthOptions, providerConfigSchema, publicAccessConfigSchema, publicAuthOptionsSchema, remoteAuthSchema, remoteProviderConfigSchema, secureStoreConfigSchema, secureStoreCustomBackendSchema, secureStoreEncryptionSchema, secureStoreScopeSchema, skippedAppBehaviorSchema, staticAuthOptionsSchema, tokenRefreshConfigSchema, tokenStorageConfigSchema, tokenStorageSqliteSchema, transparentAuthOptionsSchema, upstreamProviderSchema } from "./options/index.mjs";
+import {
+  consentToolItemSchema,
+  consentSelectionSchema,
+  consentStateSchema,
+  federatedProviderItemSchema,
+  federatedLoginStateSchema,
+  federatedSelectionSchema
+} from "./consent/index.mjs";
+export { appRequiresOrchestration, authProviderDetectionResultSchema, deriveProviderId, detectAuthProviders, detectedAuthProviderSchema, getProviderApps, getProviderScopes } from "./detection/index.mjs";
+import {
+  buildWwwAuthenticate,
+  buildPrmUrl,
+  buildUnauthorizedHeader,
+  buildInvalidTokenHeader,
+  buildInsufficientScopeHeader,
+  buildInvalidRequestHeader,
+  parseWwwAuthenticate,
+  validateAudience,
+  createAudienceValidator,
+  deriveExpectedAudience,
+  AudienceValidator,
+  deriveAuthorizationId,
+  advertisedScopes,
+  DEFAULT_ALLOWED_SCOPES,
+  grantScopes,
+  resourceScopesFor,
+  scopesFromClaims,
+  isLoopbackRedirectUri
+} from "./utils/index.mjs";
+import {
+  credentialScopeSchema,
+  loadingStrategySchema,
+  getCredentialOptionsSchema,
+  credentialProviderConfigSchema,
+  authProviderMappingSchema,
+  authProvidersVaultOptionsSchema,
+  extractCredentialExpiry,
+  CredentialCache,
+  AUTH_PROVIDERS_ACCESSOR,
+  AuthProvidersAccessorImpl,
+  AuthProvidersRegistry,
+  AUTH_PROVIDERS_REGISTRY,
+  AuthProvidersVault,
+  AUTH_PROVIDERS_VAULT,
+  EagerCredentialLoader,
+  LazyCredentialLoader
+} from "./vault/index.mjs";
+import {
+  noopLogger,
+  clientMetadataDocumentSchema,
+  cimdCacheConfigSchema,
+  cimdSecurityConfigSchema,
+  cimdNetworkConfigSchema,
+  cimdConfigSchema,
+  CimdError,
+  InvalidClientIdUrlError,
+  CimdFetchError,
+  CimdValidationError,
+  CimdClientIdMismatchError,
+  CimdSecurityError,
+  RedirectUriMismatchError,
+  CimdResponseTooLargeError,
+  CimdDisabledError,
+  isCimdClientId,
+  validateClientIdUrl,
+  checkSsrfProtection,
+  hasOnlyLocalhostRedirectUris,
+  InMemoryCimdCache,
+  extractCacheHeaders,
+  parseCacheHeaders,
+  CimdService
+} from "./cimd/index.mjs";
+import { FrontMcpAuthContextImpl, buildAuthContext } from "./context/index.mjs";
+export { AuthoritiesContextBuilder, AuthoritiesEngine, AuthoritiesEvaluatorRegistry, AuthoritiesProfileRegistry, AuthorityDeniedError, abacConditionSchema, abacOperatorSchema, abacPolicySchema, authoritiesClaimsMappingSchema, authoritiesConfigSchema, authoritiesMetadataSchema, authoritiesPolicySchema, findAuthoritiesProfileProblems, findAuthoritiesRuleProblems, isAnonymousSubject, rbacPermissionsPolicySchema, rbacRolesPolicySchema, rebacPolicySchema, resolveRequiredScopes, resourceIdRefSchema } from "./authorities/index.mjs";
+import {
+  FetchCredentialMiddleware,
+  providerHeadersCredentials,
+  isFrontMcpCredentials,
+  bearerApplier,
+  basicApplier,
+  headerApplier,
+  queryApplier
+} from "./fetch/index.mjs";
+import { LoopbackTokenAuth, PEOPLE_SESSION_COOKIE, peopleAuthOptionsSchema, peopleSessionCookie } from "./people/index.mjs";
+import {
+  createSharedServerNonce,
+  createSharedServerSecret,
+  deriveSharedServerKeys,
+  isSharedServerNonce,
+  proveSharedServerIdentity,
+  verifySharedServerIdentity
+} from "./shared-server/index.mjs";
+export {
+  AUTH_PROVIDERS_ACCESSOR,
+  AUTH_PROVIDERS_REGISTRY,
+  AUTH_PROVIDERS_VAULT,
+  AppAuthState,
+  AudienceValidator,
+  AuthInternalError,
+  AuthInvalidInputError,
+  AuthProvidersAccessorImpl,
+  AuthProvidersNotConfiguredError,
+  AuthProvidersRegistry,
+  AuthProvidersVault,
+  AuthorizationBase,
+  BUILT_IN_AUTH_PAGE_CSP,
+  CDN,
+  CREDENTIALS_ACCESSOR,
+  CimdClientIdMismatchError,
+  CimdDisabledError,
+  CimdError,
+  CimdFetchError,
+  CimdResponseTooLargeError,
+  CimdSecurityError,
+  CimdService,
+  CimdValidationError,
+  CredentialCache,
+  CredentialProviderAlreadyRegisteredError,
+  CredentialStorageError,
+  CredentialsAccessorImpl,
+  DEFAULT_ALLOWED_SCOPES,
+  DEFAULT_INCREMENTAL_TICKET_TTL_MS,
+  DEFAULT_RESUME_TTL_MS,
+  DEFAULT_THEME,
+  DcrClientRegistry,
+  EagerCredentialLoader,
+  ElicitationSecretRequiredError,
+  EncryptedRedisVault,
+  EncryptedStorageError,
+  EncryptedStorageSecureStoreBackend,
+  EncryptedTypedStorage,
+  EncryptionContextNotSetError,
+  EncryptionKeyNotConfiguredError,
+  FetchCredentialMiddleware,
+  FrontMcpAuthContextImpl,
+  InMemoryAuthorizationStore,
+  InMemoryAuthorizationVault,
+  InMemoryCimdCache,
+  InMemoryConsentStore,
+  InMemoryFederatedAuthSessionStore,
+  InMemoryOrchestratedTokenStore,
+  InMemoryStoreRequiredError,
+  InvalidClientIdUrlError,
+  JwksService,
+  JwtSecretRequiredError,
+  JwtSecretWeakError,
+  LazyCredentialLoader,
+  LoopbackTokenAuth,
+  NoProviderIdError,
+  NullOrchestratedAuthAccessor,
+  ORCHESTRATED_AUTH_ACCESSOR,
+  OrchestratedAuthAccessorAdapter,
+  OrchestratedAuthNotAvailableError,
+  OrchestratedAuthorization,
+  OrchestratorJwksNotAvailableError,
+  PEOPLE_SESSION_COOKIE,
+  PublicAuthorization,
+  RedirectUriMismatchError,
+  RedisAuthorizationStore,
+  RedisSessionStore,
+  SECURE_STORE_ACCESSOR,
+  SIGNIN_BINDING_COOKIE_PREFIX,
+  SIGNIN_BINDING_MAX_AGE_SECONDS,
+  SIGNIN_BINDING_SECURE_COOKIE_PREFIX,
+  ScopeDeniedError,
+  SecureStoreAccessorImpl,
+  SecureStoreConfigError,
+  SessionCredentialVault,
+  SessionIdEmptyError,
+  SessionRateLimiter,
+  SessionSecretRequiredError,
+  StorageAuthorizationStore,
+  StorageAuthorizationVault,
+  StorageConsentStore,
+  StorageFederatedAuthSessionStore,
+  StorageOrchestratedTokenStore,
+  StorageTokenStore,
+  TinyTtlCache,
+  TokenLeakDetectedError,
+  TokenNotAvailableError,
+  TokenStoreRequiredError,
+  TokenVault,
+  TransparentAuthorization,
+  TransportIdGenerator,
+  TypedStorage,
+  VaultEncryption,
+  VaultLoadError,
+  VaultNotFoundError,
+  VercelKvSessionStore,
+  advertisedScopes,
+  aiPlatformTypeSchema,
+  anonymousCallerClaims,
+  apiKeyCredentialSchema,
+  appAuthStateSchema,
+  appAuthorizationRecordSchema,
+  appCredentialSchema,
+  authLayout,
+  authModeSchema,
+  authProviderMappingSchema,
+  authProvidersVaultOptionsSchema,
+  authUserSchema,
+  authorizationCodeRecordSchema,
+  authorizationVaultEntrySchema,
+  authorizedPromptSchema,
+  authorizedToolSchema,
+  baseLayout,
+  basicApplier,
+  basicAuthCredentialSchema,
+  bearerApplier,
+  bearerCredentialSchema,
+  buildAuthContext,
+  buildCodeRecord,
+  buildConnectPage,
+  buildConnectSuccessPage,
+  buildConsentPage,
+  buildCredentialResumeUrl,
+  buildErrorPage,
+  buildFederatedLoginPage,
+  buildIncrementalAuthPage,
+  buildInsufficientScopeHeader,
+  buildInvalidRequestHeader,
+  buildInvalidTokenHeader,
+  buildLoginPage,
+  buildPendingRecord,
+  buildPrmUrl,
+  buildRefreshTokenRecord,
+  buildToolConsentPage,
+  buildUnauthorizedHeader,
+  buildWwwAuthenticate,
+  builtInAuthPageHeaders,
+  centeredCardLayout,
+  checkSsrfProtection,
+  cimdCacheConfigSchema,
+  cimdConfigSchema,
+  cimdNetworkConfigSchema,
+  cimdSecurityConfigSchema,
+  clientMetadataDocumentSchema,
+  completeCurrentProvider,
+  consentRecordKey,
+  consentSelectionSchema,
+  consentStateSchema,
+  consentToolItemSchema,
+  createAudienceValidator,
+  createEncryptedVault,
+  createFederatedAuthSession,
+  createLayout,
+  createSecureStore,
+  createSessionCredentialVault,
+  createSharedServerNonce,
+  createSharedServerSecret,
+  createSigninBinding,
+  createTokenStorageAdapter,
+  credentialProviderConfigSchema,
+  credentialSchema,
+  credentialScopeSchema,
+  credentialTypeSchema,
+  customCredentialSchema,
+  decodeJwtPayloadSafe,
+  decryptAesGcm,
+  decryptSessionJson,
+  decryptValue,
+  defaultSessionRateLimiter,
+  deriveAuthorizationId,
+  deriveExpectedAudience,
+  deriveSharedServerKeys,
+  deriveTypedUser,
+  encryptAesGcm,
+  encryptJson,
+  encryptValue,
+  encryptedBlobSchema,
+  encryptedDataSchema,
+  encryptedVaultEntrySchema,
+  escapeHtml,
+  extraWideLayout,
+  extractBearerToken,
+  extractCacheHeaders,
+  extractCredentialExpiry,
+  federatedLoginStateSchema,
+  federatedProviderItemSchema,
+  federatedSelectionSchema,
+  fromSessionRecord,
+  generateAuthorizationCode,
+  generatePkceChallenge,
+  generateRefreshTokenValue,
+  getCredentialOptionsSchema,
+  getKey,
+  getNextProvider,
+  getTokenSignatureFingerprint,
+  grantScopes,
+  hasOnlyLocalhostRedirectUris,
+  headerApplier,
+  hkdfSha256,
+  isCimdClientId,
+  isFrontMcpCredentials,
+  isJwt,
+  isLoopbackRedirectUri,
+  isPersistentTokenStorage,
+  isRedisTokenStorage,
+  isSessionComplete,
+  isSharedServerNonce,
+  isSignedSession,
+  isSoonExpiring,
+  isSoonExpiringProvider,
+  isSqliteTokenStorage,
+  jsonWebKeySetSchema,
+  jwkParametersSchema,
+  jwkSchema,
+  legacySseTransportStateSchema,
+  llmSafeAuthContextSchema,
+  loadingStrategySchema,
+  mtlsCredentialSchema,
+  noopLogger,
+  normalizeIssuer,
+  oauthCredentialSchema,
+  openPendingLogin,
+  parseCacheHeaders,
+  parseWwwAuthenticate,
+  pendingIncrementalAuthSchema,
+  peopleAuthOptionsSchema,
+  peopleSessionCookie,
+  pkceChallengeSchema,
+  pkceOAuthCredentialSchema,
+  privateKeyCredentialSchema,
+  progressiveAuthStateSchema,
+  proveSharedServerIdentity,
+  providerHeadersCredentials,
+  queryApplier,
+  redisConfigSchema,
+  redisVaultEntrySchema,
+  renderLocalLoginPage,
+  renderToHtml,
+  resetCachedKey,
+  resourceScopesFor,
+  safeDecrypt,
+  scopesFromClaims,
+  sealPendingLogin,
+  serviceAccountCredentialSchema,
+  sessionIdPayloadSchema,
+  sessionJwtPayloadSchema,
+  signCredentialResumeToken,
+  signIncrementalAuthTicket,
+  signSession,
+  signinBindingCookieName,
+  signinBindingMatches,
+  sseTransportStateSchema,
+  sshKeyCredentialSchema,
+  startNextProvider,
+  statefulHttpTransportStateSchema,
+  statelessHttpTransportStateSchema,
+  storedSessionSchema,
+  streamableHttpTransportStateSchema,
+  toEpochSeconds,
+  toLoginExtraFields,
+  toSessionRecord,
+  transportProtocolSchema,
+  transportSessionSchema,
+  transportStateSchema,
+  trimSlash,
+  tryJwtExp,
+  userClaimSchema,
+  validateAudience,
+  validateClientIdUrl,
+  vaultConsentRecordSchema,
+  vaultFederatedRecordSchema,
+  verifyCredentialResumeToken,
+  verifyIncrementalAuthTicket,
+  verifyOrParseSession,
+  verifyPkce,
+  verifySession,
+  verifySharedServerIdentity,
+  wideLayout,
+  withoutSecretFieldValues
+};

package/browser/jwks/index.mjs

@@ -0,0 +1,9 @@
+// libs/auth/src/jwks/index.ts
+import { JwksService } from "./jwks.service.mjs";
+import { trimSlash, normalizeIssuer, decodeJwtPayloadSafe } from "./jwks.utils.mjs";
+export {
+  JwksService,
+  decodeJwtPayloadSafe,
+  normalizeIssuer,
+  trimSlash
+};

package/browser/jwks/jose.loader.mjs

@@ -0,0 +1,28 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// libs/auth/src/jwks/jose.loader.ts
+var jose;
+function loadJose() {
+  jose ??= import("jose").catch((importError) => {
+    try {
+      return __require("jose");
+    } catch {
+      throw importError;
+    }
+  }).catch((error) => {
+    jose = void 0;
+    throw error;
+  });
+  return jose;
+}
+export {
+  loadJose
+};