@frontmcp/auth 1.11.1-rc.1 → 1.11.1-rc.2

package/browser/errors/auth-internal.errors.mjs

@@ -64,8 +64,12 @@ var CredentialProviderAlreadyRegisteredError = class extends AuthInternalError {
   }
 };
 var AuthProvidersNotConfiguredError = class extends AuthInternalError {
-  constructor() {
-    super("Auth providers are not configured", "AUTH_PROVIDERS_NOT_CONFIGURED");
+  constructor(providerName) {
+    const register = "Register it in @FrontMcp({ authProvidersVault: { providers: [...] } }).";
+    super(
+      providerName === void 0 ? "Auth providers are not configured: this server registers no auth providers." : `Auth provider "${providerName}" is not configured: this server registers no auth providers. ${register}`,
+      "AUTH_PROVIDERS_NOT_CONFIGURED"
+    );
   }
 };
 var OrchestratedAuthNotAvailableError = class extends AuthInternalError {

package/browser/jwks/jwks.service.mjs

@@ -42,6 +42,40 @@ function isMissingExpError(error) {
   const { code, claim, reason } = error;
   return code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && claim === "exp" && reason === "missing";
 }
+var FAILURE_DEPTH = [
+  "jwks_unavailable",
+  "malformed",
+  "unsupported_algorithm",
+  "unknown_key",
+  "bad_signature",
+  "missing_claim",
+  "wrong_issuer",
+  "not_yet_valid",
+  "expired"
+];
+function tokenVerifyFailureOf(error) {
+  const { code, claim, reason } = typeof error === "object" && error !== null ? error : {};
+  switch (code) {
+    case "ERR_JWT_EXPIRED":
+      return "expired";
+    case "ERR_JWS_SIGNATURE_VERIFICATION_FAILED":
+      return "bad_signature";
+    case "ERR_JWKS_NO_MATCHING_KEY":
+      return "unknown_key";
+    case "ERR_JOSE_ALG_NOT_ALLOWED":
+    case "ERR_JOSE_NOT_SUPPORTED":
+      return "unsupported_algorithm";
+    case "ERR_JWT_CLAIM_VALIDATION_FAILED":
+      if (claim === "iss") return "wrong_issuer";
+      if (reason === "missing") return "missing_claim";
+      return claim === "nbf" && reason === "check_failed" ? "not_yet_valid" : "malformed";
+    default:
+      return "malformed";
+  }
+}
+function deeperFailure(current, next) {
+  return current && FAILURE_DEPTH.indexOf(current) >= FAILURE_DEPTH.indexOf(next) ? current : next;
+}
 var WEAK_KEY_WARNING = `
 \u26A0\uFE0F  SECURITY WARNING: OAuth provider is using an RSA key smaller than 2048 bits.
     This is considered insecure and should be updated.
@@ -115,6 +149,7 @@ var JwksService = class {
     } catch {
     }
     let missingExp = false;
+    let failure;
     for (const p of candidates) {
       let jwks;
       try {
@@ -122,7 +157,10 @@ var JwksService = class {
         if (kid && !p.jwks?.keys?.length && !jwks?.keys?.some((key) => key.kid === kid)) {
           jwks = await this.refetchForUnknownKid(p) ?? jwks;
         }
-        if (!jwks?.keys?.length) continue;
+        if (!jwks?.keys?.length) {
+          failure = deeperFailure(failure, "jwks_unavailable");
+          continue;
+        }
         const JWKS = createLocalJWKSet(jwks);
         const issuerConstraint = this.issuerConstraintFor(p);
         const { payload, protectedHeader } = await jwtVerify(token, JWKS, {
@@ -150,14 +188,16 @@ var JwksService = class {
               return fallbackResult;
             }
             if (fallbackResult.error === "missing_exp") missingExp = true;
+            if (fallbackResult.failure) failure = deeperFailure(failure, fallbackResult.failure);
           }
         }
         if (isMissingExpError(e)) missingExp = true;
+        failure = deeperFailure(failure, tokenVerifyFailureOf(e));
         this.logger.debug("[JwksService] Failed to verify token for provider: %s", p.id, e);
       }
     }
-    if (missingExp) return { ok: false, error: MISSING_EXP_ERROR };
-    return { ok: false, error: `no_provider_verified${kid ? ` (kid=${kid})` : ""}` };
+    if (missingExp) return { ok: false, error: MISSING_EXP_ERROR, failure };
+    return { ok: false, error: `no_provider_verified${kid ? ` (kid=${kid})` : ""}`, failure };
   }
   /**
    * Issuer constraint passed to `jose` for a provider: the configured issuer
@@ -199,20 +239,20 @@ var JwksService = class {
     try {
       const parts = token.split(".");
       if (parts.length !== 3) {
-        return { ok: false, error: "invalid_token_format" };
+        return { ok: false, error: "invalid_token_format", failure: "malformed" };
       }
       const [headerB64, payloadB64, signatureB64] = parts;
       const header = JSON.parse(Buffer.from(headerB64, "base64url").toString("utf8"));
       const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
       const matchingKey = this.findMatchingKey(jwks, header);
       if (!matchingKey) {
-        return { ok: false, error: "no_matching_key" };
+        return { ok: false, error: "no_matching_key", failure: "unknown_key" };
       }
       const signatureInput = `${headerB64}.${payloadB64}`;
       const signature = Buffer.from(signatureB64, "base64url");
       const jwtAlg = typeof header.alg === "string" ? header.alg : void 0;
       if (!jwtAlg) {
-        return { ok: false, error: "missing_alg" };
+        return { ok: false, error: "missing_alg", failure: "malformed" };
       }
       const isValid = await rsaVerify(
         jwtAlg,
@@ -221,30 +261,30 @@ var JwksService = class {
         signature
       );
       if (!isValid) {
-        return { ok: false, error: "signature_invalid" };
+        return { ok: false, error: "signature_invalid", failure: "bad_signature" };
       }
       if (provider.verifyIssuer !== false) {
         const payloadIssuerRaw = typeof payload.iss === "string" ? payload.iss : void 0;
         if (!payloadIssuerRaw) {
-          return { ok: false, error: "issuer_mismatch" };
+          return { ok: false, error: "issuer_mismatch", failure: "wrong_issuer" };
         }
         const trustedIssuers = new Set(
           [provider.issuerUrl, ...provider.additionalIssuers ?? []].map((issuer) => normalizeIssuer(issuer))
         );
         const payloadIssuer = normalizeIssuer(payloadIssuerRaw);
         if (!trustedIssuers.has(payloadIssuer)) {
-          return { ok: false, error: "issuer_mismatch" };
+          return { ok: false, error: "issuer_mismatch", failure: "wrong_issuer" };
         }
       }
       const nowSec = Math.floor(Date.now() / 1e3);
       if (payload.exp === void 0) {
-        return { ok: false, error: "missing_exp" };
+        return { ok: false, error: "missing_exp", failure: "missing_claim" };
       }
       if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= nowSec) {
-        return { ok: false, error: "token_expired" };
+        return { ok: false, error: "token_expired", failure: "expired" };
       }
       if (payload.nbf !== void 0 && (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > nowSec)) {
-        return { ok: false, error: "token_not_yet_valid" };
+        return { ok: false, error: "token_not_yet_valid", failure: "not_yet_valid" };
       }
       if (!this.warnedProviders.has(provider.id)) {
         this.warnedProviders.add(provider.id);
@@ -261,7 +301,7 @@ var JwksService = class {
       };
     } catch (err) {
       const message = err instanceof Error ? err.message : "unknown";
-      return { ok: false, error: `weak_key_verification_failed: ${message}` };
+      return { ok: false, error: `weak_key_verification_failed: ${message}`, failure: "malformed" };
     }
   }
   /**

package/browser/session/credentials-accessor.impl.mjs

@@ -29,16 +29,20 @@ var CredentialsAccessorImpl = class {
   async requireConnect(options) {
     const { key, context } = options;
     const sub = this.resolveSub();
-    if (sub) {
-      const existing = await this.vault.get(sub, key);
-      if (existing) {
-        return { connected: true, key, credential: existing };
-      }
+    if (!sub) {
+      return {
+        connected: false,
+        key,
+        resumeUrl: "",
+        signInRequired: true,
+        message: `Sign in to this server to connect credential "${key}".`
+      };
     }
-    const token = signCredentialResumeToken(
-      { sub: sub ?? "", key, context, ttlMs: this.resumeTtlMs },
-      this.signingSecret
-    );
+    const existing = await this.vault.get(sub, key);
+    if (existing) {
+      return { connected: true, key, credential: existing };
+    }
+    const token = signCredentialResumeToken({ sub, key, context, ttlMs: this.resumeTtlMs }, this.signingSecret);
     const resumeUrl = buildCredentialResumeUrl(this.basePath, token);
     this.logger.debug(`CredentialsAccessor: credential "${key}" not connected; issued resume link`);
     return {

package/browser/session/session-credential-vault.mjs

@@ -83,6 +83,14 @@ var SessionCredentialVault = class {
     await this.storage.set(this.indexKey(sub), vaultId, this.credentialSetOpts);
     return vaultId;
   }
+  /** The subject's vaultId, or a new vault when it has none; unlike {@link rotateVault}, it never replaces one. */
+  async ensureVault(sub) {
+    const currentVaultId = await this.getVaultId(sub);
+    if (currentVaultId) return currentVaultId;
+    const createdVaultId = randomUUID();
+    await this.storage.set(this.indexKey(sub), createdVaultId, { ...this.credentialSetOpts, ifNotExists: true });
+    return await this.getVaultId(sub) ?? createdVaultId;
+  }
   // ============================================
   // Credential CRUD (committed vault)
   // ============================================

package/browser/vault/credential-loaders/lazy-loader.mjs

@@ -1,32 +1,36 @@
 // libs/auth/src/vault/credential-loaders/lazy-loader.ts
 import { extractCredentialExpiry } from "../credential-helpers.mjs";
+function inFlightKey(providerName, context) {
+  return JSON.stringify([providerName, context.sessionId, context.userSub ?? null]);
+}
 var LazyCredentialLoader = class {
   constructor(logger) {
     this.logger = logger;
   }
   logger;
-  /** In-flight loading promises for deduplication */
+  /** In-flight loading promises for deduplication, by provider and caller */
   loading = /* @__PURE__ */ new Map();
   /**
    * Load a credential lazily.
-   * If already loading, returns the in-flight promise (deduplication).
+   * If already loading for the same caller, returns the in-flight promise (deduplication).
    *
    * @param config - Provider configuration
    * @param context - Factory context
    * @returns Resolved credential or null
    */
   async load(config, context) {
-    const existing = this.loading.get(config.name);
+    const key = inFlightKey(config.name, context);
+    const existing = this.loading.get(key);
     if (existing) {
       this.logger?.debug(`Waiting for in-flight load: ${config.name}`);
       return existing;
     }
     const promise = this.doLoad(config, context);
-    this.loading.set(config.name, promise);
+    this.loading.set(key, promise);
     try {
       return await promise;
     } finally {
-      this.loading.delete(config.name);
+      this.loading.delete(key);
     }
   }
   /**
@@ -100,13 +104,14 @@ var LazyCredentialLoader = class {
     }
   }
   /**
-   * Check if a credential is currently being loaded
+   * Check if a credential is currently being loaded for a caller
    *
    * @param name - Provider name
+   * @param context - Factory context of the caller
    * @returns true if loading is in progress
    */
-  isLoading(name) {
-    return this.loading.has(name);
+  isLoading(name, context) {
+    return this.loading.has(inFlightKey(name, context));
   }
   /**
    * Cancel all in-flight loads (for cleanup)

package/errors/auth-internal.errors.d.ts

@@ -67,10 +67,10 @@ export declare class CredentialProviderAlreadyRegisteredError extends AuthIntern
     constructor(name: string);
 }
 /**
- * Thrown when auth providers are not configured.
+ * Thrown when a tool reads an auth provider's credential on a server that registers no auth providers.
  */
 export declare class AuthProvidersNotConfiguredError extends AuthInternalError {
-    constructor();
+    constructor(providerName?: string);
 }
 /**
  * Thrown when orchestrated auth is not available.

package/errors/auth-internal.errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-internal.errors.d.ts","sourceRoot":"","sources":["../../src/errors/auth-internal.errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,iBAAiB;;CAIlE;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,iBAAiB;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;gBAEnB,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK;CAInD;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;gBAC3C,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM;CAG3C;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,iBAAiB;gBAChD,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,iBAAiB;gBAC1C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,MAAM,EAAE,MAAM;CAG3B;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;gBACnD,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,IAAI,EAAE,MAAM;CAQzB;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;gBAC3C,UAAU,EAAE,MAAM;CAQ/B;AAED;;GAEG;AACH,qBAAa,wCAAyC,SAAQ,iBAAiB;gBACjE,IAAI,EAAE,MAAM;CAGzB;AAED;;GAEG;AACH,qBAAa,+BAAgC,SAAQ,iBAAiB;;CAIrE;AAED;;GAEG;AACH,qBAAa,iCAAkC,SAAQ,iBAAiB;;CAIvE;AAED;;GAEG;AACH,qBAAa,+BAAgC,SAAQ,iBAAiB;;CAIrE;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;gBAC5C,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,8BAA+B,SAAQ,iBAAiB;;CAIpE;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,iBAAiB;gBACzC,UAAU,EAAE,MAAM;CAG/B;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;gBACnD,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,iCAAkC,SAAQ,iBAAiB;;CAIvE;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,iBAAiB;gBAC9C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,iBAAiB;gBACtC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAoB;CAGtD"}
+{"version":3,"file":"auth-internal.errors.d.ts","sourceRoot":"","sources":["../../src/errors/auth-internal.errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,iBAAiB;;CAIlE;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,iBAAiB;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;gBAEnB,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK;CAInD;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;gBAC3C,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM;CAG3C;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,iBAAiB;gBAChD,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,iBAAiB;gBAC1C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,MAAM,EAAE,MAAM;CAG3B;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;gBACnD,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,IAAI,EAAE,MAAM;CAQzB;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;gBAC3C,UAAU,EAAE,MAAM;CAQ/B;AAED;;GAEG;AACH,qBAAa,wCAAyC,SAAQ,iBAAiB;gBACjE,IAAI,EAAE,MAAM;CAGzB;AAED;;GAEG;AACH,qBAAa,+BAAgC,SAAQ,iBAAiB;gBACxD,YAAY,CAAC,EAAE,MAAM;CASlC;AAED;;GAEG;AACH,qBAAa,iCAAkC,SAAQ,iBAAiB;;CAIvE;AAED;;GAEG;AACH,qBAAa,+BAAgC,SAAQ,iBAAiB;;CAIrE;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;gBAC5C,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,8BAA+B,SAAQ,iBAAiB;;CAIpE;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,iBAAiB;gBACzC,UAAU,EAAE,MAAM;CAG/B;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;gBACnD,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,iCAAkC,SAAQ,iBAAiB;;CAIvE;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,iBAAiB;gBAC9C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,iBAAiB;gBACtC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAoB;CAGtD"}