@frontmcp/auth 1.10.16 → 1.11.0-rc.2

package/browser/authorization/authorization.class.mjs

@@ -0,0 +1,252 @@
+// libs/auth/src/authorization/authorization.class.ts
+import { base64urlDecode, getMachineId, randomUUID } from "@frontmcp/utils";
+import { TokenLeakDetectedError } from "../errors/auth-internal.errors.mjs";
+import { encryptJson } from "../session/utils/session-crypto.utils.mjs";
+var AuthorizationBase = class _AuthorizationBase {
+  id;
+  isAnonymous;
+  user;
+  claims;
+  expiresAt;
+  scopes;
+  authorizedProviders;
+  authorizedProviderIds;
+  authorizedApps;
+  authorizedAppIds;
+  authorizedTools;
+  authorizedToolIds;
+  authorizedPrompts;
+  authorizedPromptIds;
+  authorizedResources;
+  /** The original bearer token (for transparent mode) */
+  token;
+  /** Active transport sessions for this authorization */
+  #sessions = /* @__PURE__ */ new Map();
+  /** Creation timestamp */
+  createdAt;
+  constructor(ctx) {
+    this.id = ctx.id;
+    this.isAnonymous = ctx.isAnonymous;
+    this.user = ctx.user;
+    this.claims = ctx.claims;
+    this.expiresAt = ctx.expiresAt;
+    this.scopes = ctx.scopes ?? [];
+    this.token = ctx.token;
+    this.createdAt = Date.now();
+    this.authorizedProviders = ctx.authorizedProviders ?? {};
+    this.authorizedProviderIds = ctx.authorizedProviderIds ?? Object.keys(this.authorizedProviders);
+    this.authorizedApps = ctx.authorizedApps ?? {};
+    this.authorizedAppIds = ctx.authorizedAppIds ?? Object.keys(this.authorizedApps);
+    this.authorizedTools = ctx.authorizedTools ?? {};
+    this.authorizedToolIds = ctx.authorizedToolIds ?? Object.keys(this.authorizedTools);
+    this.authorizedPrompts = ctx.authorizedPrompts ?? {};
+    this.authorizedPromptIds = ctx.authorizedPromptIds ?? Object.keys(this.authorizedPrompts);
+    this.authorizedResources = ctx.authorizedResources ?? [];
+  }
+  /**
+   * Create a new transport session for this authorization
+   * @param protocol - Transport protocol (sse, streamable-http, etc.)
+   * @param fingerprint - Optional client fingerprint for tracking
+   */
+  createTransportSession(protocol, fingerprint) {
+    const sessionId = randomUUID();
+    const session = {
+      id: sessionId,
+      authorizationId: this.id,
+      protocol,
+      createdAt: Date.now(),
+      expiresAt: this.expiresAt,
+      nodeId: getMachineId(),
+      clientFingerprint: fingerprint
+    };
+    this.#sessions.set(session.id, session);
+    return session;
+  }
+  /**
+   * Get existing transport session by ID
+   */
+  getTransportSession(sessionId) {
+    return this.#sessions.get(sessionId);
+  }
+  /**
+   * Get all active transport sessions
+   */
+  getAllSessions() {
+    return Array.from(this.#sessions.values());
+  }
+  /**
+   * Remove a transport session
+   */
+  removeTransportSession(sessionId) {
+    return this.#sessions.delete(sessionId);
+  }
+  /**
+   * Get count of active sessions
+   */
+  get sessionCount() {
+    return this.#sessions.size;
+  }
+  /**
+   * Check if a scope is granted
+   */
+  hasScope(scope) {
+    return this.scopes.includes(scope);
+  }
+  /**
+   * Check if all scopes are granted
+   */
+  hasAllScopes(scopes) {
+    return scopes.every((s) => this.scopes.includes(s));
+  }
+  /**
+   * Check if any scope is granted
+   */
+  hasAnyScope(scopes) {
+    return scopes.some((s) => this.scopes.includes(s));
+  }
+  /**
+   * Check if a tool is authorized
+   */
+  canAccessTool(toolId) {
+    return toolId in this.authorizedTools || this.authorizedToolIds.includes(toolId);
+  }
+  /**
+   * Check if a prompt is authorized
+   */
+  canAccessPrompt(promptId) {
+    return promptId in this.authorizedPrompts || this.authorizedPromptIds.includes(promptId);
+  }
+  /**
+   * Check if an app is authorized.
+   * Used for progressive authorization to determine if tools from this app can be executed.
+   * @param appId - App ID to check
+   */
+  isAppAuthorized(appId) {
+    return appId in this.authorizedApps || this.authorizedAppIds.includes(appId);
+  }
+  /**
+   * Build URL for progressive/incremental authorization.
+   * Used when a tool requires authorization for an app that was skipped during initial auth.
+   *
+   * The URL only SKIPS the login step when it carries a valid incremental
+   * ticket (GHSA-2c4g-9c8x-6m8g) \u2014 mint one with
+   * {@link signIncrementalAuthTicket} using the server signing secret and pass
+   * it here. Without a ticket the link still works, but the user completes an
+   * ordinary login; `mode=incremental` alone is no longer an authorization
+   * signal and is not emitted.
+   *
+   * @param appId - App ID that requires authorization
+   * @param baseUrl - Base URL of the server
+   * @param ticket - Signed incremental-authorization ticket for this subject
+   */
+  getProgressiveAuthUrl(appId, baseUrl, ticket) {
+    const params = new URLSearchParams({ app: appId });
+    if (ticket) params.set("ticket", ticket);
+    return `${baseUrl}/oauth/authorize?${params.toString()}`;
+  }
+  /**
+   * Check if the authorization is expired
+   */
+  isExpired() {
+    if (!this.expiresAt) return false;
+    return Date.now() > this.expiresAt;
+  }
+  /**
+   * Get time until expiration in milliseconds
+   * Returns undefined if no expiration, negative if expired
+   */
+  getTimeToExpiry() {
+    if (!this.expiresAt) return void 0;
+    return this.expiresAt - Date.now();
+  }
+  /**
+   * Convert a transport session to encrypted session JWT
+   * This is what gets sent in the Mcp-Session-Id header
+   */
+  toSessionJwt(session) {
+    const payload = {
+      sid: session.id,
+      aid: this.id,
+      proto: session.protocol,
+      nid: session.nodeId,
+      iat: Math.floor(Date.now() / 1e3),
+      exp: this.expiresAt ? Math.floor(this.expiresAt / 1e3) : void 0
+    };
+    return encryptJson(payload);
+  }
+  /**
+   * Convert to LLM-safe context (no tokens exposed)
+   */
+  toLLMSafeContext(session) {
+    return {
+      authorizationId: this.id,
+      sessionId: session.id,
+      mode: this.mode,
+      isAnonymous: this.isAnonymous,
+      user: {
+        sub: this.user.sub,
+        name: this.user.name
+      },
+      scopes: this.scopes,
+      authorizedToolIds: this.authorizedToolIds,
+      authorizedPromptIds: this.authorizedPromptIds
+    };
+  }
+  /**
+   * Check if a base64url segment decodes to a JWT-like header (contains "alg").
+   */
+  static isJwtHeader(segment) {
+    try {
+      const bytes = base64urlDecode(segment);
+      const text = new TextDecoder().decode(bytes);
+      const parsed = JSON.parse(text);
+      return typeof parsed === "object" && parsed !== null && typeof parsed.alg === "string";
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Validate that no tokens are leaked in data
+   * Throws if JWT pattern detected
+   */
+  static validateNoTokenLeakage(data) {
+    const json = JSON.stringify(data);
+    const B64URL = /^[A-Za-z0-9_-]+$/;
+    const MIN_SEG = 2;
+    let dotIdx = json.indexOf(".");
+    while (dotIdx !== -1) {
+      let seg1Start = dotIdx;
+      while (seg1Start > 0 && /[A-Za-z0-9_-]/.test(json[seg1Start - 1])) seg1Start--;
+      const seg1Len = dotIdx - seg1Start;
+      if (seg1Len >= MIN_SEG) {
+        let seg2End = dotIdx + 1;
+        while (seg2End < json.length && /[A-Za-z0-9_-]/.test(json[seg2End])) seg2End++;
+        const seg2Len = seg2End - (dotIdx + 1);
+        if (seg2Len >= MIN_SEG && seg2End < json.length && json[seg2End] === ".") {
+          const dot2 = seg2End;
+          let seg3End = dot2 + 1;
+          while (seg3End < json.length && /[A-Za-z0-9_-]/.test(json[seg3End])) seg3End++;
+          const seg3Len = seg3End - (dot2 + 1);
+          if (seg3Len >= MIN_SEG) {
+            const seg1 = json.substring(seg1Start, dotIdx);
+            const seg2 = json.substring(dotIdx + 1, dot2);
+            const seg3 = json.substring(dot2 + 1, seg3End);
+            if (B64URL.test(seg1) && B64URL.test(seg2) && B64URL.test(seg3) && _AuthorizationBase.isJwtHeader(seg1)) {
+              throw new TokenLeakDetectedError("JWT pattern detected in LLM context data");
+            }
+          }
+        }
+      }
+      dotIdx = json.indexOf(".", dotIdx + 1);
+    }
+    const sensitiveFields = ["access_token", "refresh_token", "id_token", "tokenEnc", "secretRefId"];
+    for (const field of sensitiveFields) {
+      if (json.includes(`"${field}"`)) {
+        throw new TokenLeakDetectedError(`Sensitive field "${field}" found in data`);
+      }
+    }
+  }
+};
+export {
+  AuthorizationBase
+};

package/browser/authorization/authorization.types.mjs

@@ -0,0 +1,64 @@
+// libs/auth/src/authorization/authorization.types.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+var authModeSchema = z.enum(["public", "transparent", "orchestrated"]);
+var authUserSchema = z.object({
+  sub: z.string(),
+  name: z.string().optional(),
+  email: z.string().email().optional(),
+  picture: z.string().url().optional(),
+  anonymous: z.boolean().optional()
+});
+var authorizedToolSchema = z.object({
+  executionPath: z.tuple([z.string(), z.string()]),
+  scopes: z.array(z.string()).optional(),
+  details: z.record(z.string(), z.unknown()).optional()
+});
+var authorizedPromptSchema = z.object({
+  executionPath: z.tuple([z.string(), z.string()]),
+  scopes: z.array(z.string()).optional(),
+  details: z.record(z.string(), z.unknown()).optional()
+});
+var llmSafeAuthContextSchema = z.object({
+  authorizationId: z.string(),
+  sessionId: z.string(),
+  mode: authModeSchema,
+  isAnonymous: z.boolean(),
+  user: z.object({
+    sub: z.string(),
+    name: z.string().optional()
+  }),
+  scopes: z.array(z.string()),
+  authorizedToolIds: z.array(z.string()),
+  authorizedPromptIds: z.array(z.string())
+});
+var AppAuthState = /* @__PURE__ */ ((AppAuthState2) => {
+  AppAuthState2["AUTHORIZED"] = "authorized";
+  AppAuthState2["SKIPPED"] = "skipped";
+  AppAuthState2["PENDING"] = "pending";
+  return AppAuthState2;
+})(AppAuthState || {});
+var appAuthStateSchema = z.nativeEnum(AppAuthState);
+var appAuthorizationRecordSchema = z.object({
+  appId: z.string(),
+  state: appAuthStateSchema,
+  stateChangedAt: z.number(),
+  grantedScopes: z.array(z.string()).optional(),
+  authProviderId: z.string().optional(),
+  toolIds: z.array(z.string())
+});
+var progressiveAuthStateSchema = z.object({
+  apps: z.record(z.string(), appAuthorizationRecordSchema),
+  initiallyAuthorized: z.array(z.string()),
+  initiallySkipped: z.array(z.string())
+});
+export {
+  AppAuthState,
+  appAuthStateSchema,
+  appAuthorizationRecordSchema,
+  authModeSchema,
+  authUserSchema,
+  authorizedPromptSchema,
+  authorizedToolSchema,
+  llmSafeAuthContextSchema,
+  progressiveAuthStateSchema
+};

package/browser/authorization/dcr-client.registry.mjs

@@ -0,0 +1,222 @@
+// libs/auth/src/authorization/dcr-client.registry.ts
+import { sha256, timingSafeEqual } from "@frontmcp/utils";
+var DEFAULT_MAX_DYNAMIC_CLIENTS = 1e3;
+function globMatch(pattern, input) {
+  let p = 0;
+  let i = 0;
+  let starIdx = -1;
+  let matchIdx = 0;
+  while (i < input.length) {
+    if (p < pattern.length && pattern[p] === input[i]) {
+      p++;
+      i++;
+    } else if (p < pattern.length && pattern[p] === "*") {
+      starIdx = p;
+      matchIdx = i;
+      p++;
+    } else if (starIdx !== -1) {
+      p = starIdx + 1;
+      matchIdx++;
+      i = matchIdx;
+    } else {
+      return false;
+    }
+  }
+  while (p < pattern.length && pattern[p] === "*") p++;
+  return p === pattern.length;
+}
+function splitRedirectUri(s) {
+  const schemeSep = s.indexOf("://");
+  if (schemeSep === -1) return null;
+  const scheme = s.slice(0, schemeSep);
+  const afterScheme = s.slice(schemeSep + 3);
+  let boundary = afterScheme.length;
+  for (let i = 0; i < afterScheme.length; i++) {
+    const ch = afterScheme[i];
+    if (ch === "/" || ch === "?" || ch === "#") {
+      boundary = i;
+      break;
+    }
+  }
+  const authority = afterScheme.slice(0, boundary);
+  const rest = afterScheme.slice(boundary);
+  const at = authority.lastIndexOf("@");
+  const userinfo = at === -1 ? "" : authority.slice(0, at);
+  const hostport = at === -1 ? authority : authority.slice(at + 1);
+  let host = hostport;
+  let port = "";
+  if (hostport.startsWith("[")) {
+    const close = hostport.indexOf("]");
+    if (close !== -1) {
+      host = hostport.slice(0, close + 1);
+      if (hostport[close + 1] === ":") port = hostport.slice(close + 2);
+    }
+  } else {
+    const colon = hostport.indexOf(":");
+    if (colon !== -1) {
+      host = hostport.slice(0, colon);
+      port = hostport.slice(colon + 1);
+    }
+  }
+  return { scheme, userinfo, host, port, rest };
+}
+function globMatchRedirectUri(pattern, input) {
+  const p = splitRedirectUri(pattern);
+  if (!p) return globMatch(pattern, input);
+  const u = splitRedirectUri(input);
+  if (!u) return false;
+  return globMatch(p.scheme, u.scheme) && globMatch(p.userinfo, u.userinfo) && globMatch(p.host, u.host) && globMatch(p.port, u.port) && globMatch(p.rest, u.rest);
+}
+var DcrClientRegistry = class {
+  constructor(config = {}) {
+    this.config = config;
+    this.redirectGlobs = config.allowedRedirectUris;
+    this.seedPreRegisteredClients();
+  }
+  config;
+  clients = /* @__PURE__ */ new Map();
+  /** Configured redirect_uri allowlist globs (matched via `globMatch`). */
+  redirectGlobs;
+  /** Seed `dcr.clients` so the authorize/token flows accept them without DCR. */
+  seedPreRegisteredClients() {
+    const clients = this.config.clients ?? [];
+    const now = Math.floor(Date.now() / 1e3);
+    for (const c of clients) {
+      this.clients.set(c.clientId, {
+        client_id: c.clientId,
+        client_secret: c.clientSecret,
+        token_endpoint_auth_method: c.tokenEndpointAuthMethod ?? "none",
+        grant_types: c.grantTypes ?? ["authorization_code"],
+        response_types: c.responseTypes ?? ["code"],
+        redirect_uris: c.redirectUris,
+        client_name: c.clientName,
+        scope: c.scope,
+        created_at: now,
+        dev: false,
+        preRegistered: true
+      });
+    }
+  }
+  /** Look up a client by id (pre-registered or dynamically registered). */
+  get(clientId) {
+    return this.clients.get(clientId);
+  }
+  /**
+   * Authenticate a client at the token endpoint (RFC 6749 \u00a72.3 / \u00a73.2.1).
+   *
+   * - `'unknown'`  \u2014 the client id is not registered (caller decides; today's
+   *   public / CIMD clients are unregistered and treated as "no secret to
+   *   verify").
+   * - `'ok'`       \u2014 public client (`none`), or a confidential client whose
+   *   presented secret matched (constant-time).
+   * - `'invalid'`  \u2014 a confidential client with a missing or wrong secret. The
+   *   caller MUST reject with `invalid_client`.
+   *
+   * SECURITY: previously the token endpoint verified only `client_id` equality,
+   * so a DCR-minted `client_secret` was never checked and a "confidential"
+   * client was effectively public. This restores confidential-client
+   * authentication with a timing-safe comparison.
+   */
+  verifyClientSecret(clientId, presentedSecret) {
+    const client = this.clients.get(clientId);
+    if (!client) return "unknown";
+    const method = client.token_endpoint_auth_method;
+    const isConfidential = method === "client_secret_basic" || method === "client_secret_post";
+    if (!isConfidential) return "ok";
+    if (!client.client_secret) return "invalid";
+    if (!presentedSecret) return "invalid";
+    return timingSafeEqual(sha256(presentedSecret), sha256(client.client_secret)) ? "ok" : "invalid";
+  }
+  /** Whether a client id is known to the registry. */
+  has(clientId) {
+    return this.clients.has(clientId);
+  }
+  /**
+   * Add a dynamically-registered client (called by the register flow).
+   *
+   * @returns `true` if the client was registered, `false` if the dynamic-client
+   * capacity is already reached.
+   *
+   * SECURITY: `POST /oauth/register` may be unauthenticated (no
+   * `initialAccessToken`); without a bound an attacker can register unlimited
+   * clients and exhaust memory. Once the cap is reached we REJECT new dynamic
+   * registrations rather than evicting an existing one \u2014 this preserves every
+   * already-registered client (including confidential ones with a
+   * `client_secret`), which eviction would have silently invalidated. The
+   * register flow surfaces `false` as a `temporarily_unavailable` error.
+   * Pre-registered / declarative clients are exempt and never count toward the
+   * cap.
+   */
+  register(client) {
+    const cap = this.dynamicClientCap();
+    const dynamicCount = this.countDynamicClients();
+    const isNew = !this.clients.has(client.client_id);
+    if (isNew && dynamicCount >= cap) {
+      return false;
+    }
+    this.clients.set(client.client_id, client);
+    return true;
+  }
+  /** Configured dynamic-client cap, falling back to the default when invalid. */
+  dynamicClientCap() {
+    const configured = this.config.maxDynamicClients;
+    return Number.isSafeInteger(configured) && configured >= 0 ? configured : DEFAULT_MAX_DYNAMIC_CLIENTS;
+  }
+  countDynamicClients() {
+    let n = 0;
+    for (const c of this.clients.values()) if (c.dev && !c.preRegistered) n++;
+    return n;
+  }
+  /** Whether a redirect_uri allowlist is configured. */
+  hasRedirectAllowlist() {
+    return !!this.redirectGlobs && this.redirectGlobs.length > 0;
+  }
+  /**
+   * Whether `redirectUri` is permitted by the configured allowlist. Always
+   * `true` when no allowlist is configured (preserves default behavior).
+   */
+  isRedirectUriAllowed(redirectUri) {
+    if (!this.redirectGlobs || this.redirectGlobs.length === 0) {
+      return true;
+    }
+    return this.redirectGlobs.some((glob) => globMatchRedirectUri(glob, redirectUri));
+  }
+  /** Whether a client-id allowlist is configured. */
+  hasClientIdAllowlist() {
+    return !!this.config.allowedClientIds && this.config.allowedClientIds.length > 0;
+  }
+  /**
+   * Whether `clientId` is permitted by the configured client-id allowlist.
+   * Always `true` when no allowlist is configured (preserves default behavior).
+   */
+  isClientIdAllowed(clientId) {
+    const allow = this.config.allowedClientIds;
+    if (!allow || allow.length === 0) {
+      return true;
+    }
+    return allow.includes(clientId);
+  }
+  /** Whether an initial access token is required for DCR registration. */
+  requiresInitialAccessToken() {
+    return typeof this.config.initialAccessToken === "string" && this.config.initialAccessToken.length > 0;
+  }
+  /**
+   * Constant-time check of a presented bearer token against the configured
+   * initial access token. Returns `false` when none is configured (callers
+   * should gate on {@link requiresInitialAccessToken} first).
+   */
+  verifyInitialAccessToken(presented) {
+    const expected = this.config.initialAccessToken;
+    if (!expected) {
+      return false;
+    }
+    if (typeof presented !== "string" || presented.length === 0) {
+      return false;
+    }
+    return timingSafeEqual(sha256(presented), sha256(expected));
+  }
+};
+export {
+  DcrClientRegistry,
+  globMatch
+};

package/browser/authorization/index.mjs

@@ -0,0 +1,41 @@
+// libs/auth/src/authorization/index.ts
+import { AppAuthState } from "./authorization.types.mjs";
+import {
+  authModeSchema,
+  authUserSchema,
+  authorizedToolSchema,
+  authorizedPromptSchema,
+  llmSafeAuthContextSchema,
+  appAuthStateSchema,
+  appAuthorizationRecordSchema,
+  progressiveAuthStateSchema
+} from "./authorization.types.mjs";
+import { AuthorizationBase } from "./authorization.class.mjs";
+import { PublicAuthorization } from "./public.authorization.mjs";
+import { TransparentAuthorization } from "./transparent.authorization.mjs";
+import { OrchestratedAuthorization } from "./orchestrated.authorization.mjs";
+import {
+  OrchestratedAuthAccessorAdapter,
+  NullOrchestratedAuthAccessor,
+  ORCHESTRATED_AUTH_ACCESSOR
+} from "./orchestrated.accessor.mjs";
+import { DcrClientRegistry } from "./dcr-client.registry.mjs";
+export {
+  AppAuthState,
+  AuthorizationBase,
+  DcrClientRegistry,
+  NullOrchestratedAuthAccessor,
+  ORCHESTRATED_AUTH_ACCESSOR,
+  OrchestratedAuthAccessorAdapter,
+  OrchestratedAuthorization,
+  PublicAuthorization,
+  TransparentAuthorization,
+  appAuthStateSchema,
+  appAuthorizationRecordSchema,
+  authModeSchema,
+  authUserSchema,
+  authorizedPromptSchema,
+  authorizedToolSchema,
+  llmSafeAuthContextSchema,
+  progressiveAuthStateSchema
+};

package/browser/authorization/orchestrated.accessor.mjs

@@ -0,0 +1,86 @@
+// libs/auth/src/authorization/orchestrated.accessor.ts
+import { OrchestratedAuthNotAvailableError } from "../errors/auth-internal.errors.mjs";
+var ORCHESTRATED_AUTH_ACCESSOR = /* @__PURE__ */ Symbol.for(
+  "frontmcp:ORCHESTRATED_AUTH_ACCESSOR"
+);
+var NullOrchestratedAuthAccessor = class {
+  primaryProviderId = void 0;
+  issuer = void 0;
+  authorizationId = "null";
+  isAuthenticated = false;
+  async getToken(providerId) {
+    throw new OrchestratedAuthNotAvailableError();
+  }
+  async tryGetToken(providerId) {
+    return null;
+  }
+  async getAppToken(appId) {
+    return null;
+  }
+  hasProvider(providerId) {
+    return false;
+  }
+  getProviderIds() {
+    return [];
+  }
+  isAppAuthorized(appId) {
+    return false;
+  }
+  getAllAuthorizedAppIds() {
+    return [];
+  }
+  getAppToolIds(appId) {
+    return void 0;
+  }
+};
+var OrchestratedAuthAccessorAdapter = class {
+  constructor(authorization) {
+    this.authorization = authorization;
+  }
+  authorization;
+  get primaryProviderId() {
+    return this.authorization.primaryProviderId;
+  }
+  get issuer() {
+    return this.authorization.issuer;
+  }
+  get authorizationId() {
+    return this.authorization.id;
+  }
+  get isAuthenticated() {
+    return !this.authorization.isAnonymous;
+  }
+  async getToken(providerId) {
+    return this.authorization.getToken(providerId);
+  }
+  async tryGetToken(providerId) {
+    try {
+      return await this.authorization.getToken(providerId);
+    } catch {
+      return null;
+    }
+  }
+  async getAppToken(appId) {
+    return this.authorization.getAppToken(appId);
+  }
+  hasProvider(providerId) {
+    return this.authorization.hasProvider(providerId);
+  }
+  getProviderIds() {
+    return this.authorization.getProviderIds();
+  }
+  isAppAuthorized(appId) {
+    return this.authorization.isAppAuthorized(appId);
+  }
+  getAllAuthorizedAppIds() {
+    return this.authorization.getAllAuthorizedAppIds();
+  }
+  getAppToolIds(appId) {
+    return this.authorization.getAppToolIds(appId);
+  }
+};
+export {
+  NullOrchestratedAuthAccessor,
+  ORCHESTRATED_AUTH_ACCESSOR,
+  OrchestratedAuthAccessorAdapter
+};