@frontmcp/auth 1.10.16 → 1.11.0-rc.2

package/browser/session/encrypted-authorization-vault.mjs

@@ -0,0 +1,405 @@
+// libs/auth/src/session/encrypted-authorization-vault.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import { AsyncLocalStorage, randomUUID } from "@frontmcp/utils";
+import { EncryptionContextNotSetError, VaultLoadError, VaultNotFoundError } from "../errors/auth-internal.errors.mjs";
+import { encryptedDataSchema, VaultEncryption } from "./vault-encryption.mjs";
+var redisVaultEntrySchema = z.object({
+  /** Vault ID */
+  id: z.string(),
+  /** User sub (for lookup) */
+  userSub: z.string(),
+  /** User email (optional, for display) */
+  userEmail: z.string().optional(),
+  /** User name (optional, for display) */
+  userName: z.string().optional(),
+  /** Client ID */
+  clientId: z.string(),
+  /** Creation timestamp */
+  createdAt: z.number(),
+  /** Last access timestamp */
+  lastAccessAt: z.number(),
+  /** Authorized app IDs (unencrypted for quick auth checks) */
+  authorizedAppIds: z.array(z.string()),
+  /** Skipped app IDs (unencrypted for quick checks) */
+  skippedAppIds: z.array(z.string()),
+  /** Pending auth request IDs (unencrypted for lookup) */
+  pendingAuthIds: z.array(z.string()),
+  /** Encrypted sensitive data blob */
+  encrypted: encryptedDataSchema
+});
+var encryptionContextStorage = new AsyncLocalStorage();
+var EncryptedRedisVault = class {
+  constructor(redis, encryption, namespace = "vault:") {
+    this.redis = redis;
+    this.encryption = encryption;
+    this.namespace = namespace;
+  }
+  redis;
+  encryption;
+  namespace;
+  /**
+   * Run a callback with encryption context set for the current async scope.
+   * This is the recommended way to set encryption context as it is safe for
+   * concurrent requests (each request gets its own isolated context).
+   *
+   * @param context - Encryption context with key and vaultId
+   * @param fn - Async function to run with the context
+   * @returns The result of the callback
+   *
+   * @example
+   * ```typescript
+   * const result = await vault.runWithContext({ key, vaultId }, async () => {
+   *   await vault.get(id);
+   *   await vault.update(id, data);
+   *   return 'done';
+   * });
+   * ```
+   */
+  runWithContext(context, fn) {
+    return encryptionContextStorage.run(context, fn);
+  }
+  /**
+   * Get current encryption key from AsyncLocalStorage.
+   */
+  getKey() {
+    const asyncContext = encryptionContextStorage.getStore();
+    if (asyncContext) {
+      return asyncContext.key;
+    }
+    throw new EncryptionContextNotSetError();
+  }
+  /**
+   * Create Redis key from vault ID
+   */
+  redisKey(id) {
+    return `${this.namespace}${id}`;
+  }
+  /**
+   * Create credential key from appId and providerId
+   */
+  credentialKey(appId, providerId) {
+    return `${appId}:${providerId}`;
+  }
+  /**
+   * Encrypt sensitive data
+   */
+  async encryptSensitive(data) {
+    return this.encryption.encryptObject(data, this.getKey());
+  }
+  /**
+   * Decrypt sensitive data
+   */
+  async decryptSensitive(encrypted) {
+    return this.encryption.decryptObject(encrypted, this.getKey());
+  }
+  /**
+   * Convert Redis entry to full vault entry (decrypts sensitive data)
+   */
+  async toVaultEntry(redisEntry) {
+    const sensitive = await this.decryptSensitive(redisEntry.encrypted);
+    return {
+      id: redisEntry.id,
+      userSub: redisEntry.userSub,
+      userEmail: redisEntry.userEmail,
+      userName: redisEntry.userName,
+      clientId: redisEntry.clientId,
+      createdAt: redisEntry.createdAt,
+      lastAccessAt: redisEntry.lastAccessAt,
+      appCredentials: sensitive.appCredentials,
+      consent: sensitive.consent,
+      federated: sensitive.federated,
+      pendingAuths: sensitive.pendingAuths,
+      authorizedAppIds: redisEntry.authorizedAppIds,
+      skippedAppIds: redisEntry.skippedAppIds
+    };
+  }
+  /**
+   * Convert vault entry to Redis entry (encrypts sensitive data)
+   */
+  async toRedisEntry(entry) {
+    const sensitive = {
+      appCredentials: entry.appCredentials,
+      consent: entry.consent,
+      federated: entry.federated,
+      pendingAuths: entry.pendingAuths
+    };
+    return {
+      id: entry.id,
+      userSub: entry.userSub,
+      userEmail: entry.userEmail,
+      userName: entry.userName,
+      clientId: entry.clientId,
+      createdAt: entry.createdAt,
+      lastAccessAt: entry.lastAccessAt,
+      authorizedAppIds: entry.authorizedAppIds,
+      skippedAppIds: entry.skippedAppIds,
+      pendingAuthIds: entry.pendingAuths.map((p) => p.id),
+      encrypted: await this.encryptSensitive(sensitive)
+    };
+  }
+  /**
+   * Save entry to Redis
+   */
+  async saveEntry(entry) {
+    const redisEntry = await this.toRedisEntry(entry);
+    await this.redis.set(this.redisKey(entry.id), JSON.stringify(redisEntry));
+  }
+  /**
+   * Load entry from Redis
+   */
+  async loadEntry(id) {
+    const data = await this.redis.get(this.redisKey(id));
+    if (!data) return null;
+    try {
+      const redisEntry = redisVaultEntrySchema.parse(JSON.parse(data));
+      return await this.toVaultEntry(redisEntry);
+    } catch (error) {
+      throw new VaultLoadError(id, error instanceof Error ? error : void 0);
+    }
+  }
+  // ============================================
+  // AuthorizationVault Interface Implementation
+  // ============================================
+  async create(params) {
+    const now = Date.now();
+    const entry = {
+      id: randomUUID(),
+      userSub: params.userSub,
+      userEmail: params.userEmail,
+      userName: params.userName,
+      clientId: params.clientId,
+      createdAt: now,
+      lastAccessAt: now,
+      appCredentials: {},
+      consent: params.consent,
+      federated: params.federated,
+      pendingAuths: [],
+      authorizedAppIds: params.authorizedAppIds ?? [],
+      skippedAppIds: params.skippedAppIds ?? []
+    };
+    await this.saveEntry(entry);
+    return entry;
+  }
+  async get(id) {
+    const entry = await this.loadEntry(id);
+    if (!entry) return null;
+    entry.lastAccessAt = Date.now();
+    await this.saveEntry(entry);
+    return entry;
+  }
+  async update(id, updates) {
+    const entry = await this.loadEntry(id);
+    if (!entry) {
+      throw new VaultNotFoundError("Vault entry", id);
+    }
+    Object.assign(entry, updates, { lastAccessAt: Date.now() });
+    await this.saveEntry(entry);
+  }
+  async delete(id) {
+    await this.redis.del(this.redisKey(id));
+  }
+  async updateConsent(vaultId, consent) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return;
+    entry.consent = consent;
+    entry.lastAccessAt = Date.now();
+    await this.saveEntry(entry);
+  }
+  async authorizeApp(vaultId, appId) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return;
+    entry.skippedAppIds = entry.skippedAppIds.filter((id) => id !== appId);
+    if (!entry.authorizedAppIds.includes(appId)) {
+      entry.authorizedAppIds.push(appId);
+    }
+    entry.lastAccessAt = Date.now();
+    await this.saveEntry(entry);
+  }
+  async createPendingAuth(vaultId, params) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) {
+      throw new VaultNotFoundError("Vault", vaultId);
+    }
+    const now = Date.now();
+    const pendingAuth = {
+      id: randomUUID(),
+      appId: params.appId,
+      toolId: params.toolId,
+      authUrl: params.authUrl,
+      requiredScopes: params.requiredScopes,
+      elicitId: params.elicitId,
+      createdAt: now,
+      expiresAt: now + (params.ttlMs ?? 10 * 60 * 1e3),
+      status: "pending"
+    };
+    entry.pendingAuths.push(pendingAuth);
+    entry.lastAccessAt = now;
+    await this.saveEntry(entry);
+    return pendingAuth;
+  }
+  async getPendingAuth(vaultId, pendingAuthId) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return null;
+    const pendingAuth = entry.pendingAuths.find((p) => p.id === pendingAuthId);
+    if (!pendingAuth) return null;
+    if (Date.now() > pendingAuth.expiresAt && pendingAuth.status === "pending") {
+      pendingAuth.status = "expired";
+      await this.saveEntry(entry);
+    }
+    return pendingAuth;
+  }
+  async completePendingAuth(vaultId, pendingAuthId) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return;
+    const pendingAuth = entry.pendingAuths.find((p) => p.id === pendingAuthId);
+    if (pendingAuth) {
+      pendingAuth.status = "completed";
+      entry.skippedAppIds = entry.skippedAppIds.filter((id) => id !== pendingAuth.appId);
+      if (!entry.authorizedAppIds.includes(pendingAuth.appId)) {
+        entry.authorizedAppIds.push(pendingAuth.appId);
+      }
+      entry.lastAccessAt = Date.now();
+      await this.saveEntry(entry);
+    }
+  }
+  async cancelPendingAuth(vaultId, pendingAuthId) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return;
+    const pendingAuth = entry.pendingAuths.find((p) => p.id === pendingAuthId);
+    if (pendingAuth) {
+      pendingAuth.status = "cancelled";
+      await this.saveEntry(entry);
+    }
+  }
+  async isAppAuthorized(vaultId, appId) {
+    const data = await this.redis.get(this.redisKey(vaultId));
+    if (!data) return false;
+    try {
+      const parsed = JSON.parse(data);
+      return Array.isArray(parsed.authorizedAppIds) && parsed.authorizedAppIds.includes(appId);
+    } catch {
+      return false;
+    }
+  }
+  async getPendingAuths(vaultId) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return [];
+    const now = Date.now();
+    let updated = false;
+    const pending = entry.pendingAuths.filter((p) => {
+      if (now > p.expiresAt && p.status === "pending") {
+        p.status = "expired";
+        updated = true;
+      }
+      return p.status === "pending";
+    });
+    if (updated) {
+      await this.saveEntry(entry);
+    }
+    return pending;
+  }
+  // ============================================
+  // App Credential Methods
+  // ============================================
+  async addAppCredential(vaultId, credential) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return;
+    const shouldStore = await this.shouldStoreCredential(vaultId, credential.appId);
+    if (!shouldStore) return;
+    const key = this.credentialKey(credential.appId, credential.providerId);
+    entry.appCredentials[key] = credential;
+    entry.lastAccessAt = Date.now();
+    await this.saveEntry(entry);
+  }
+  async removeAppCredential(vaultId, appId, providerId) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return;
+    const key = this.credentialKey(appId, providerId);
+    delete entry.appCredentials[key];
+    entry.lastAccessAt = Date.now();
+    await this.saveEntry(entry);
+  }
+  async getAppCredentials(vaultId, appId) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return [];
+    const prefix = `${appId}:`;
+    return Object.entries(entry.appCredentials).filter(([key]) => key.startsWith(prefix)).map(([, cred]) => cred);
+  }
+  async getCredential(vaultId, appId, providerId) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return null;
+    const key = this.credentialKey(appId, providerId);
+    return entry.appCredentials[key] ?? null;
+  }
+  async getAllCredentials(vaultId, filterByConsent = false) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return [];
+    const allCredentials = Object.values(entry.appCredentials);
+    if (!filterByConsent || !entry.consent?.enabled) {
+      return allCredentials;
+    }
+    const consentedToolIds = new Set(entry.consent.selectedToolIds);
+    return allCredentials.filter((cred) => {
+      return Array.from(consentedToolIds).some((toolId) => toolId.startsWith(`${cred.appId}:`));
+    });
+  }
+  async updateCredential(vaultId, appId, providerId, updates) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return;
+    const key = this.credentialKey(appId, providerId);
+    const credential = entry.appCredentials[key];
+    if (!credential) return;
+    Object.assign(credential, updates);
+    entry.lastAccessAt = Date.now();
+    await this.saveEntry(entry);
+  }
+  async shouldStoreCredential(vaultId, appId, toolIds) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return false;
+    if (!entry.consent?.enabled) {
+      return true;
+    }
+    if (toolIds && toolIds.length > 0) {
+      return toolIds.some((toolId) => entry.consent.selectedToolIds.includes(toolId));
+    }
+    const consentedToolIds = entry.consent.selectedToolIds;
+    return consentedToolIds.some((toolId) => toolId.startsWith(`${appId}:`));
+  }
+  async invalidateCredential(vaultId, appId, providerId, reason) {
+    await this.updateCredential(vaultId, appId, providerId, {
+      isValid: false,
+      invalidReason: reason
+    });
+  }
+  async refreshOAuthCredential(vaultId, appId, providerId, tokens) {
+    const entry = await this.loadEntry(vaultId);
+    if (!entry) return;
+    const key = this.credentialKey(appId, providerId);
+    const credential = entry.appCredentials[key];
+    if (!credential || credential.credential.type !== "oauth") return;
+    credential.credential.accessToken = tokens.accessToken;
+    if (tokens.refreshToken !== void 0) {
+      credential.credential.refreshToken = tokens.refreshToken;
+    }
+    if (tokens.expiresAt !== void 0) {
+      credential.credential.expiresAt = tokens.expiresAt;
+      credential.expiresAt = tokens.expiresAt;
+    }
+    credential.isValid = true;
+    credential.invalidReason = void 0;
+    entry.lastAccessAt = Date.now();
+    await this.saveEntry(entry);
+  }
+  async cleanup() {
+  }
+};
+function createEncryptedVault(redis, config = {}) {
+  const encryption = new VaultEncryption({ pepper: config.pepper });
+  const vault = new EncryptedRedisVault(redis, encryption, config.namespace);
+  return { vault, encryption };
+}
+export {
+  EncryptedRedisVault,
+  createEncryptedVault,
+  redisVaultEntrySchema
+};

package/browser/session/federated-auth.session.mjs

@@ -0,0 +1,176 @@
+// libs/auth/src/session/federated-auth.session.ts
+import { randomUUID } from "@frontmcp/utils";
+import { AuthFlowError } from "../errors/auth-internal.errors.mjs";
+function toSessionRecord(session) {
+  return {
+    ...session,
+    completedProviders: Array.from(session.completedProviders.entries())
+  };
+}
+function fromSessionRecord(record) {
+  return {
+    ...record,
+    completedProviders: new Map(record.completedProviders)
+  };
+}
+var InMemoryFederatedAuthSessionStore = class {
+  sessions = /* @__PURE__ */ new Map();
+  /** Default TTL for sessions (15 minutes) */
+  sessionTtlMs = 15 * 60 * 1e3;
+  /** Cleanup interval timer */
+  cleanupTimer;
+  constructor() {
+    this.cleanupTimer = setInterval(() => {
+      void this.cleanup();
+    }, 6e4);
+    if (this.cleanupTimer.unref) {
+      this.cleanupTimer.unref();
+    }
+  }
+  async store(session) {
+    const record = toSessionRecord(session);
+    this.sessions.set(session.id, record);
+  }
+  async get(id) {
+    const record = this.sessions.get(id);
+    if (!record) {
+      return null;
+    }
+    if (Date.now() > record.expiresAt) {
+      this.sessions.delete(id);
+      return null;
+    }
+    return fromSessionRecord(record);
+  }
+  async delete(id) {
+    this.sessions.delete(id);
+  }
+  async update(session) {
+    const record = toSessionRecord(session);
+    this.sessions.set(session.id, record);
+  }
+  /**
+   * Clean up expired sessions
+   */
+  async cleanup() {
+    const now = Date.now();
+    for (const [id, record] of this.sessions) {
+      if (now > record.expiresAt) {
+        this.sessions.delete(id);
+      }
+    }
+  }
+  /**
+   * Stop the cleanup timer
+   */
+  dispose() {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = void 0;
+    }
+  }
+  /**
+   * Create a new federated auth session
+   */
+  createSession(params) {
+    const now = Date.now();
+    return {
+      id: randomUUID(),
+      pendingAuthId: params.pendingAuthId,
+      clientId: params.clientId,
+      redirectUri: params.redirectUri,
+      scopes: params.scopes,
+      state: params.state,
+      resource: params.resource,
+      userInfo: params.userInfo,
+      frontmcpPkce: params.frontmcpPkce,
+      providerQueue: [...params.providerIds],
+      completedProviders: /* @__PURE__ */ new Map(),
+      skippedProviders: [],
+      signinBinding: params.signinBinding,
+      createdAt: now,
+      expiresAt: now + this.sessionTtlMs
+    };
+  }
+  /**
+   * Get count (for testing/monitoring)
+   */
+  get size() {
+    return this.sessions.size;
+  }
+  /**
+   * Clear all sessions (for testing)
+   */
+  clear() {
+    this.sessions.clear();
+  }
+};
+function createFederatedAuthSession(params, ttlMs = 15 * 60 * 1e3) {
+  const now = Date.now();
+  return {
+    id: randomUUID(),
+    pendingAuthId: params.pendingAuthId,
+    clientId: params.clientId,
+    redirectUri: params.redirectUri,
+    scopes: params.scopes,
+    state: params.state,
+    resource: params.resource,
+    userInfo: params.userInfo,
+    frontmcpPkce: params.frontmcpPkce,
+    providerQueue: [...params.providerIds],
+    completedProviders: /* @__PURE__ */ new Map(),
+    skippedProviders: [],
+    signinBinding: params.signinBinding,
+    createdAt: now,
+    expiresAt: now + ttlMs
+  };
+}
+function isSessionComplete(session) {
+  return session.providerQueue.length === 0 && !session.currentProviderId;
+}
+function getNextProvider(session) {
+  if (session.currentProviderId) {
+    return session.currentProviderId;
+  }
+  return session.providerQueue[0];
+}
+function completeCurrentProvider(session, tokens, userInfo) {
+  if (!session.currentProviderId) {
+    throw new AuthFlowError("No current provider to complete", "AUTH_FLOW_ERROR");
+  }
+  session.completedProviders.set(session.currentProviderId, {
+    providerId: session.currentProviderId,
+    tokens,
+    userInfo,
+    completedAt: Date.now()
+  });
+  session.currentProviderId = void 0;
+  session.currentProviderPkce = void 0;
+  session.currentProviderState = void 0;
+}
+function startNextProvider(session, pkce, state) {
+  if (session.currentProviderId) {
+    throw new AuthFlowError("Cannot start next provider while current is in progress", "AUTH_FLOW_ERROR");
+  }
+  if (session.providerQueue.length === 0) {
+    throw new AuthFlowError("No more providers in queue", "AUTH_FLOW_ERROR");
+  }
+  const providerId = session.providerQueue.shift();
+  if (!providerId) {
+    throw new AuthFlowError("No more providers in queue", "AUTH_FLOW_ERROR");
+  }
+  session.currentProviderId = providerId;
+  session.currentProviderPkce = pkce;
+  session.currentProviderState = state;
+  return providerId;
+}
+export {
+  InMemoryFederatedAuthSessionStore,
+  completeCurrentProvider,
+  createFederatedAuthSession,
+  fromSessionRecord,
+  getNextProvider,
+  isSessionComplete,
+  startNextProvider,
+  toSessionRecord
+};

package/browser/session/incremental-auth-ticket.mjs

@@ -0,0 +1,42 @@
+// libs/auth/src/session/incremental-auth-ticket.ts
+import { randomUUID, signData, verifyData } from "@frontmcp/utils";
+var DEFAULT_INCREMENTAL_TICKET_TTL_MS = 3e5;
+function signIncrementalAuthTicket(input, secret) {
+  const payload = {
+    sub: input.sub,
+    appId: input.appId,
+    ...input.toolId !== void 0 ? { toolId: input.toolId } : {},
+    ...input.priorAppIds !== void 0 ? { priorAppIds: input.priorAppIds } : {},
+    jti: randomUUID(),
+    exp: Date.now() + (input.ttlMs ?? DEFAULT_INCREMENTAL_TICKET_TTL_MS)
+  };
+  const signedJson = signData(payload, { secret });
+  return Buffer.from(signedJson, "utf8").toString("base64url");
+}
+function verifyIncrementalAuthTicket(token, secret, now = Date.now()) {
+  let signedJson;
+  try {
+    signedJson = Buffer.from(token, "base64url").toString("utf8");
+  } catch {
+    return null;
+  }
+  const payload = verifyData(signedJson, { secret });
+  if (!payload) return null;
+  if (typeof payload.sub !== "string" || payload.sub.length === 0) return null;
+  if (typeof payload.appId !== "string" || payload.appId.length === 0) return null;
+  if (typeof payload.jti !== "string" || payload.jti.length === 0) return null;
+  if (!Number.isFinite(payload.exp)) return null;
+  if (payload.toolId !== void 0 && typeof payload.toolId !== "string") return null;
+  if (payload.priorAppIds !== void 0 && (!Array.isArray(payload.priorAppIds) || payload.priorAppIds.some((id) => typeof id !== "string"))) {
+    return null;
+  }
+  if (now >= payload.exp) {
+    return null;
+  }
+  return payload;
+}
+export {
+  DEFAULT_INCREMENTAL_TICKET_TTL_MS,
+  signIncrementalAuthTicket,
+  verifyIncrementalAuthTicket
+};