@frontmcp/auth 1.10.16 → 1.11.0-rc.2

package/browser/options/static.schema.mjs

@@ -0,0 +1,41 @@
+// libs/auth/src/options/static.schema.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import { publicAccessConfigSchema } from "./shared.schemas.mjs";
+var staticAuthOptionsSchema = z.object({
+  mode: z.literal("static"),
+  /**
+   * Accepted credentials. Compared against the presented one in constant time,
+   * over SHA-256 digests so neither the value nor its length leaks by timing.
+   *
+   * Read these from the environment \u2014 never commit them.
+   */
+  tokens: z.array(z.string().min(1)).min(1),
+  /**
+   * Request header carrying the credential.
+   * @default 'authorization'
+   */
+  header: z.string().min(1).default("authorization"),
+  /**
+   * Scheme prefix to strip before comparing, matched case-insensitively. Set to
+   * an empty string for headers that carry a bare token (e.g. `x-api-key`).
+   * @default 'Bearer'
+   */
+  scheme: z.string().default("Bearer"),
+  /**
+   * Scopes granted to a request that presents a valid token.
+   * @default ['static']
+   */
+  scopes: z.array(z.string()).default(["static"]),
+  /**
+   * Realm reported in the `WWW-Authenticate` challenge on failure.
+   * @default 'mcp'
+   */
+  realm: z.string().default("mcp"),
+  /**
+   * Tool/prompt access configuration, same shape the other modes accept.
+   */
+  publicAccess: publicAccessConfigSchema.optional()
+});
+export {
+  staticAuthOptionsSchema
+};

package/browser/options/transparent.schema.mjs

@@ -0,0 +1,43 @@
+// libs/auth/src/options/transparent.schema.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import { flatRemoteProviderFields, publicAccessConfigSchema } from "./shared.schemas.mjs";
+var transparentAuthOptionsSchema = z.object({
+  mode: z.literal("transparent"),
+  /**
+   * Flattened remote provider fields (provider, clientId, clientSecret, scopes, providerConfig)
+   */
+  ...flatRemoteProviderFields,
+  /**
+   * Expected token audience
+   * If not set, defaults to the resource URL
+   */
+  expectedAudience: z.union([z.string(), z.array(z.string())]).optional(),
+  /**
+   * Require an `aud` claim (reject audience-less tokens). Defaults to `false`
+   * for IdP compatibility; set `true` to reject tokens with no audience.
+   */
+  requireAudience: z.boolean().optional(),
+  /**
+   * Required scopes for access
+   * Empty array means any valid token is accepted
+   * @default []
+   */
+  requiredScopes: z.array(z.string()).default([]),
+  /**
+   * Allow anonymous fallback when no token is provided
+   * @default false
+   */
+  allowAnonymous: z.boolean().default(false),
+  /**
+   * Scopes granted to anonymous sessions (when allowAnonymous=true)
+   * @default ['anonymous']
+   */
+  anonymousScopes: z.array(z.string()).default(["anonymous"]),
+  /**
+   * Public access config for anonymous users (when allowAnonymous=true)
+   */
+  publicAccess: publicAccessConfigSchema.optional()
+});
+export {
+  transparentAuthOptionsSchema
+};

package/browser/options/utils.mjs

@@ -0,0 +1,47 @@
+// libs/auth/src/options/utils.ts
+import { authOptionsSchema } from "./schema.mjs";
+function parseAuthOptions(input) {
+  return authOptionsSchema.parse(input);
+}
+function isPublicMode(options) {
+  return options.mode === "public";
+}
+function isStaticMode(options) {
+  return options.mode === "static";
+}
+function isTransparentMode(options) {
+  return options.mode === "transparent";
+}
+function isLocalMode(options) {
+  return options.mode === "local";
+}
+function isRemoteMode(options) {
+  return options.mode === "remote";
+}
+function isOrchestratedMode(options) {
+  return options.mode === "local" || options.mode === "remote";
+}
+function isOrchestratedLocal(options) {
+  return options.mode === "local";
+}
+function isOrchestratedRemote(options) {
+  return options.mode === "remote";
+}
+function allowsPublicAccess(options) {
+  if (options.mode === "public") return true;
+  if (options.mode === "transparent") return options.allowAnonymous;
+  if (options.mode === "local" || options.mode === "remote") return options.allowDefaultPublic;
+  return false;
+}
+export {
+  allowsPublicAccess,
+  isLocalMode,
+  isOrchestratedLocal,
+  isOrchestratedMode,
+  isOrchestratedRemote,
+  isPublicMode,
+  isRemoteMode,
+  isStaticMode,
+  isTransparentMode,
+  parseAuthOptions
+};

package/browser/people/index.mjs

@@ -0,0 +1,15 @@
+// libs/auth/src/people/index.ts
+import {
+  peopleAuthOptionsSchema
+} from "./people-auth.options.mjs";
+import {
+  LoopbackTokenAuth,
+  PEOPLE_SESSION_COOKIE,
+  peopleSessionCookie
+} from "./loopback-token.auth.mjs";
+export {
+  LoopbackTokenAuth,
+  PEOPLE_SESSION_COOKIE,
+  peopleAuthOptionsSchema,
+  peopleSessionCookie
+};

package/browser/people/loopback-token.auth.mjs

@@ -0,0 +1,115 @@
+// libs/auth/src/people/loopback-token.auth.ts
+import { base64urlEncode, randomBytes, sha256, timingSafeEqual } from "@frontmcp/utils";
+var PEOPLE_SESSION_COOKIE = "frontmcp_people";
+var INVALID = { ok: false, reason: "invalid" };
+var LOCKED = { ok: false, reason: "locked" };
+var MAX_TRACKED_CLIENTS = 1024;
+function newSecret() {
+  return base64urlEncode(randomBytes(32));
+}
+function matches(presented, digest) {
+  return timingSafeEqual(sha256(presented), digest);
+}
+function unexpired(secrets) {
+  const now = Date.now();
+  return secrets.filter((secret) => secret.expiresAt > now);
+}
+var LoopbackTokenAuth = class {
+  constructor(options) {
+    this.options = options;
+    const token = newSecret();
+    this.token = token;
+    this.tokenDigest = sha256(token);
+  }
+  options;
+  token;
+  tokenDigest;
+  codes = [];
+  sessions = [];
+  failures = /* @__PURE__ */ new Map();
+  /** The token, the first time it is asked for: the server prints it at startup, and nothing can read it after. */
+  takeToken() {
+    const token = this.token;
+    this.token = void 0;
+    return token;
+  }
+  /**
+   * A one-time sign-in code, for a caller this process already trusts, such as a tool. A code made for a `subject`
+   * signs the person in for that subject only; a code without one, such as the token's, for none.
+   */
+  createCode(options = {}) {
+    const code = newSecret();
+    const expiresAt = Date.now() + this.options.codeTtlMs;
+    const { subject } = options;
+    this.codes = [...unexpired(this.codes), { digest: sha256(code), expiresAt, ...subject ? { subject } : {} }];
+    return { code, expiresAt };
+  }
+  /** A one-time sign-in code for the holder of the token. */
+  exchangeToken(presented, client) {
+    if (this.isLocked(client)) return LOCKED;
+    if (presented === void 0 || !matches(presented, this.tokenDigest)) return this.refuse(client);
+    this.failures.delete(client);
+    return { ok: true, ...this.createCode() };
+  }
+  /** A session for the holder of a code; the code is spent. */
+  exchangeCode(presented, client) {
+    if (this.isLocked(client)) return LOCKED;
+    this.codes = unexpired(this.codes);
+    const index = presented === void 0 ? -1 : this.codes.findIndex((code) => matches(presented, code.digest));
+    if (index === -1) return this.refuse(client);
+    const [{ subject }] = this.codes.splice(index, 1);
+    this.failures.delete(client);
+    const cookieValue = newSecret();
+    const expiresAt = Date.now() + this.options.sessionTtlMs;
+    this.sessions = [
+      ...unexpired(this.sessions),
+      { digest: sha256(cookieValue), expiresAt, ...subject ? { subject } : {} }
+    ];
+    return { ok: true, cookieValue, expiresAt };
+  }
+  verifySession(presented) {
+    if (!presented) return void 0;
+    this.sessions = unexpired(this.sessions);
+    const session = this.sessions.find((stored) => matches(presented, stored.digest));
+    if (!session) return void 0;
+    return session.subject ? { expiresAt: session.expiresAt, subject: session.subject } : { expiresAt: session.expiresAt };
+  }
+  endSession(presented) {
+    if (!presented) return;
+    this.sessions = this.sessions.filter((stored) => !matches(presented, stored.digest));
+  }
+  isLocked(client) {
+    return (this.failures.get(client)?.lockedUntil ?? 0) > Date.now();
+  }
+  refuse(client) {
+    const now = Date.now();
+    const { maxFailedAttempts, lockoutMs } = this.options;
+    const previous = this.failures.get(client);
+    const count = previous && now - previous.lastAt <= lockoutMs ? previous.count + 1 : 1;
+    const locked = count >= maxFailedAttempts;
+    if (!previous && this.failures.size >= MAX_TRACKED_CLIENTS) this.forgetIdleClients(now);
+    this.failures.set(client, { count: locked ? 0 : count, lastAt: now, lockedUntil: locked ? now + lockoutMs : 0 });
+    return locked ? LOCKED : INVALID;
+  }
+  forgetIdleClients(now) {
+    for (const [client, failures] of this.failures) {
+      if (failures.lockedUntil <= now && now - failures.lastAt > this.options.lockoutMs) this.failures.delete(client);
+    }
+  }
+};
+function peopleSessionCookie(value, options) {
+  return {
+    name: PEOPLE_SESSION_COOKIE,
+    value,
+    path: options.path,
+    httpOnly: true,
+    sameSite: "strict",
+    secure: options.secure,
+    maxAge: Math.floor(options.maxAgeMs / 1e3)
+  };
+}
+export {
+  LoopbackTokenAuth,
+  PEOPLE_SESSION_COOKIE,
+  peopleSessionCookie
+};

package/browser/people/people-auth.options.mjs

@@ -0,0 +1,37 @@
+// libs/auth/src/people/people-auth.options.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+var MINUTE_MS = 6e4;
+function milliseconds(field) {
+  return z.number({ message: `${field} must be a number of milliseconds` }).int(`${field} must be a whole number of milliseconds`).positive(`${field} must be greater than 0`);
+}
+function createPeopleAuthOptionsSchema() {
+  const loopbackToken = z.object({
+    mode: z.literal("loopback-token"),
+    codeTtlMs: milliseconds("codeTtlMs").max(10 * MINUTE_MS, "codeTtlMs must be at most 600000 (10 minutes): a sign-in code is for one hand-off").optional(),
+    sessionTtlMs: milliseconds("sessionTtlMs").optional(),
+    maxFailedAttempts: z.number({ message: "maxFailedAttempts must be a number" }).int("maxFailedAttempts must be a whole number").positive("maxFailedAttempts must be greater than 0").optional(),
+    lockoutMs: milliseconds("lockoutMs").optional(),
+    cookiePath: z.string().startsWith("/", 'cookiePath must start with "/"').optional()
+  }).strict();
+  return z.union([z.literal("loopback-token"), loopbackToken], {
+    message: "http.auth.people must be 'loopback-token' or { mode: 'loopback-token', ... }"
+  }).transform((value) => {
+    const settings = typeof value === "string" ? {} : value;
+    return {
+      mode: "loopback-token",
+      codeTtlMs: settings.codeTtlMs ?? MINUTE_MS,
+      sessionTtlMs: settings.sessionTtlMs ?? 12 * 60 * MINUTE_MS,
+      maxFailedAttempts: settings.maxFailedAttempts ?? 5,
+      lockoutMs: settings.lockoutMs ?? MINUTE_MS,
+      cookiePath: settings.cookiePath ?? "/"
+    };
+  });
+}
+var schema;
+function peopleAuthOptionsSchema() {
+  schema ??= createPeopleAuthOptionsSchema();
+  return schema;
+}
+export {
+  peopleAuthOptionsSchema
+};

package/browser/session/authorization-vault.mjs

@@ -0,0 +1,279 @@
+// libs/auth/src/session/authorization-vault.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+var credentialTypeSchema = z.enum([
+  "oauth",
+  // OAuth 2.0 tokens
+  "api_key",
+  // API key (header or query param)
+  "basic",
+  // Basic auth (username:password)
+  "bearer",
+  // Bearer token (static)
+  "private_key",
+  // Private key for signing (JWT, etc.)
+  "mtls",
+  // Mutual TLS certificate
+  "custom",
+  // Custom credential type
+  "ssh_key",
+  // SSH key for authentication
+  "service_account",
+  // Cloud provider service accounts
+  "oauth_pkce"
+  // OAuth 2.0 with PKCE for public clients
+]);
+var oauthCredentialSchema = z.object({
+  type: z.literal("oauth"),
+  /** Access token */
+  accessToken: z.string(),
+  /** Refresh token (optional) */
+  refreshToken: z.string().optional(),
+  /** Token type (usually 'Bearer') */
+  tokenType: z.string().default("Bearer"),
+  /** Token expiration timestamp (epoch ms) */
+  expiresAt: z.number().optional(),
+  /** Granted scopes */
+  scopes: z.array(z.string()).default([]),
+  /** ID token for OIDC (optional) */
+  idToken: z.string().optional()
+});
+var apiKeyCredentialSchema = z.object({
+  type: z.literal("api_key"),
+  /** The API key value */
+  key: z.string().min(1),
+  /** Header name to use (e.g., 'X-API-Key', 'Authorization') */
+  headerName: z.string().default("X-API-Key"),
+  /** Prefix for the header value (e.g., 'Bearer ', 'Api-Key ') */
+  headerPrefix: z.string().optional(),
+  /** Alternative: send as query parameter */
+  queryParam: z.string().optional()
+});
+var basicAuthCredentialSchema = z.object({
+  type: z.literal("basic"),
+  /** Username */
+  username: z.string().min(1),
+  /** Password */
+  password: z.string(),
+  /** Pre-computed base64 encoded value (optional, for caching) */
+  encodedValue: z.string().optional()
+});
+var bearerCredentialSchema = z.object({
+  type: z.literal("bearer"),
+  /** The bearer token value */
+  token: z.string().min(1),
+  /** Token expiration (optional, for static tokens that expire) */
+  expiresAt: z.number().optional()
+});
+var privateKeyCredentialSchema = z.object({
+  type: z.literal("private_key"),
+  /** Key format */
+  format: z.enum(["pem", "jwk", "pkcs8", "pkcs12"]),
+  /** The key data (PEM string or JWK JSON) */
+  keyData: z.string(),
+  /** Key ID (for JWK) */
+  keyId: z.string().optional(),
+  /** Algorithm to use for signing */
+  algorithm: z.string().optional(),
+  /** Passphrase if key is encrypted */
+  passphrase: z.string().optional(),
+  /** Associated certificate (for mTLS) */
+  certificate: z.string().optional()
+});
+var mtlsCredentialSchema = z.object({
+  type: z.literal("mtls"),
+  /** Client certificate (PEM format) */
+  certificate: z.string(),
+  /** Private key (PEM format) */
+  privateKey: z.string(),
+  /** Passphrase if private key is encrypted */
+  passphrase: z.string().optional(),
+  /** CA certificate chain (optional) */
+  caCertificate: z.string().optional()
+});
+var customCredentialSchema = z.object({
+  type: z.literal("custom"),
+  /** Custom type identifier */
+  customType: z.string().min(1),
+  /** Arbitrary credential data */
+  data: z.record(z.string(), z.unknown()),
+  /** Headers to include in requests */
+  headers: z.record(z.string(), z.string()).optional()
+});
+var sshKeyCredentialSchema = z.object({
+  type: z.literal("ssh_key"),
+  /** Private key (PEM format) */
+  privateKey: z.string().min(1),
+  /** Public key (optional, can be derived from private key) */
+  publicKey: z.string().optional(),
+  /** Passphrase if private key is encrypted */
+  passphrase: z.string().optional(),
+  /** Key type */
+  keyType: z.enum(["rsa", "ed25519", "ecdsa", "dsa"]).default("ed25519"),
+  /** Key fingerprint (SHA256 hash) */
+  fingerprint: z.string().optional(),
+  /** Username for SSH connections */
+  username: z.string().optional()
+});
+var serviceAccountCredentialSchema = z.object({
+  type: z.literal("service_account"),
+  /** Cloud provider */
+  provider: z.enum(["gcp", "aws", "azure", "custom"]),
+  /** Raw credentials (JSON key file content, access keys, etc.) */
+  credentials: z.record(z.string(), z.unknown()),
+  /** Project/Account ID */
+  projectId: z.string().optional(),
+  /** Region for regional services */
+  region: z.string().optional(),
+  /** AWS: Role ARN to assume */
+  assumeRoleArn: z.string().optional(),
+  /** AWS: External ID for cross-account access */
+  externalId: z.string().optional(),
+  /** Service account email (GCP) or ARN (AWS) */
+  serviceAccountId: z.string().optional(),
+  /** Expiration timestamp for temporary credentials */
+  expiresAt: z.number().optional()
+});
+var pkceOAuthCredentialSchema = z.object({
+  type: z.literal("oauth_pkce"),
+  /** Access token */
+  accessToken: z.string(),
+  /** Refresh token (optional) */
+  refreshToken: z.string().optional(),
+  /** Token type (usually 'Bearer') */
+  tokenType: z.string().default("Bearer"),
+  /** Token expiration timestamp (epoch ms) */
+  expiresAt: z.number().optional(),
+  /** Granted scopes */
+  scopes: z.array(z.string()).default([]),
+  /** ID token for OIDC (optional) */
+  idToken: z.string().optional(),
+  /** Authorization server issuer */
+  issuer: z.string().optional()
+});
+var credentialSchema = z.discriminatedUnion("type", [
+  oauthCredentialSchema,
+  apiKeyCredentialSchema,
+  basicAuthCredentialSchema,
+  bearerCredentialSchema,
+  privateKeyCredentialSchema,
+  mtlsCredentialSchema,
+  customCredentialSchema,
+  sshKeyCredentialSchema,
+  serviceAccountCredentialSchema,
+  pkceOAuthCredentialSchema
+]);
+var appCredentialSchema = z.object({
+  /** App ID this credential belongs to */
+  appId: z.string().min(1),
+  /** Provider ID within the app (for apps with multiple auth providers) */
+  providerId: z.string().min(1),
+  /** The credential data */
+  credential: credentialSchema,
+  /** Timestamp when credential was acquired */
+  acquiredAt: z.number(),
+  /** Timestamp when credential was last used */
+  lastUsedAt: z.number().optional(),
+  /** Credential expiration (if applicable) */
+  expiresAt: z.number().optional(),
+  /** Whether this credential is currently valid */
+  isValid: z.boolean().default(true),
+  /** Error message if credential is invalid */
+  invalidReason: z.string().optional(),
+  /** User info associated with this credential */
+  userInfo: z.object({
+    sub: z.string().optional(),
+    email: z.string().optional(),
+    name: z.string().optional()
+  }).optional(),
+  /** Metadata for tracking/debugging */
+  metadata: z.record(z.string(), z.unknown()).optional()
+});
+var vaultConsentRecordSchema = z.object({
+  /** Whether consent was enabled */
+  enabled: z.boolean(),
+  /** Selected tool IDs (user approved these) */
+  selectedToolIds: z.array(z.string()),
+  /** Available tool IDs at time of consent */
+  availableToolIds: z.array(z.string()),
+  /** Timestamp when consent was given */
+  consentedAt: z.number(),
+  /** Consent version for tracking changes */
+  version: z.string().default("1.0")
+});
+var vaultFederatedRecordSchema = z.object({
+  /** Provider IDs that were selected */
+  selectedProviderIds: z.array(z.string()),
+  /** Provider IDs that were skipped (can be authorized later) */
+  skippedProviderIds: z.array(z.string()),
+  /** Primary provider ID */
+  primaryProviderId: z.string().optional(),
+  /** Timestamp when federated login was completed */
+  completedAt: z.number()
+});
+var pendingIncrementalAuthSchema = z.object({
+  /** Unique ID for this request */
+  id: z.string(),
+  /** App ID being authorized */
+  appId: z.string(),
+  /** Tool ID that triggered the auth request */
+  toolId: z.string().optional(),
+  /** Authorization URL */
+  authUrl: z.string(),
+  /** Required scopes */
+  requiredScopes: z.array(z.string()).optional(),
+  /** Whether elicit is being used */
+  elicitId: z.string().optional(),
+  /** Timestamp when request was created */
+  createdAt: z.number(),
+  /** Expiration timestamp */
+  expiresAt: z.number(),
+  /** Status of the request */
+  status: z.enum(["pending", "completed", "cancelled", "expired"])
+});
+var authorizationVaultEntrySchema = z.object({
+  /** Vault ID (maps to access token jti claim) */
+  id: z.string(),
+  /** User subject identifier */
+  userSub: z.string(),
+  /** User email */
+  userEmail: z.string().optional(),
+  /** User name */
+  userName: z.string().optional(),
+  /** Client ID that created this session */
+  clientId: z.string(),
+  /** Creation timestamp */
+  createdAt: z.number(),
+  /** Last access timestamp */
+  lastAccessAt: z.number(),
+  /** App credentials (keyed by `${appId}:${providerId}`) */
+  appCredentials: z.record(z.string(), appCredentialSchema).default({}),
+  /** Consent record */
+  consent: vaultConsentRecordSchema.optional(),
+  /** Federated login record */
+  federated: vaultFederatedRecordSchema.optional(),
+  /** Pending incremental authorization requests */
+  pendingAuths: z.array(pendingIncrementalAuthSchema),
+  /** Apps that are fully authorized */
+  authorizedAppIds: z.array(z.string()),
+  /** Apps that were skipped (not yet authorized) */
+  skippedAppIds: z.array(z.string())
+});
+export {
+  apiKeyCredentialSchema,
+  appCredentialSchema,
+  authorizationVaultEntrySchema,
+  basicAuthCredentialSchema,
+  bearerCredentialSchema,
+  credentialSchema,
+  credentialTypeSchema,
+  customCredentialSchema,
+  mtlsCredentialSchema,
+  oauthCredentialSchema,
+  pendingIncrementalAuthSchema,
+  pkceOAuthCredentialSchema,
+  privateKeyCredentialSchema,
+  serviceAccountCredentialSchema,
+  sshKeyCredentialSchema,
+  vaultConsentRecordSchema,
+  vaultFederatedRecordSchema
+};