@frontmcp/auth 1.11.1-rc.2 → 1.11.2

package/browser/index.mjs

@@ -242,6 +242,7 @@ import {
   AUTH_PROVIDERS_REGISTRY,
   AuthProvidersVault,
   AUTH_PROVIDERS_VAULT,
+  UNIDENTIFIED_SESSION_PREFIX,
   EagerCredentialLoader,
   LazyCredentialLoader
 } from "./vault/index.mjs";
@@ -383,6 +384,7 @@ export {
   TransparentAuthorization,
   TransportIdGenerator,
   TypedStorage,
+  UNIDENTIFIED_SESSION_PREFIX,
   VaultEncryption,
   VaultLoadError,
   VaultNotFoundError,

package/browser/vault/auth-providers.accessor.impl.mjs

@@ -1,6 +1,6 @@
 // libs/auth/src/vault/auth-providers.accessor.impl.ts
-import { extractCredentialExpiry } from "./credential-helpers.mjs";
 import { base64Encode } from "@frontmcp/utils";
+import { extractCredentialExpiry } from "./credential-helpers.mjs";
 var AuthProvidersAccessorImpl = class {
   constructor(registry, vault, cache, loader, context, logger) {
     this.registry = registry;
@@ -180,7 +180,8 @@ var AuthProvidersAccessorImpl = class {
         providerName,
         resolved.credential,
         config.scope,
-        this.context.userSub
+        this.context.userSub,
+        config.cacheTtl
       );
     } catch (error) {
       this.logger?.warn(`Failed to store in vault "${providerName}":`, error);

package/browser/vault/auth-providers.vault.mjs

@@ -1,26 +1,52 @@
 // libs/auth/src/vault/auth-providers.vault.ts
-import { extractCredentialExpiry } from "./credential-helpers.mjs";
+import {
+  EncryptedTypedStorage,
+  hkdfSha256,
+  MAX_TTL_SECONDS,
+  randomBytes,
+  sha256Hex
+} from "@frontmcp/utils";
 import { AuthInvalidInputError, CredentialStorageError } from "../errors/auth-internal.errors.mjs";
+import { extractCredentialExpiry } from "./credential-helpers.mjs";
+var UNIDENTIFIED_SESSION_PREFIX = "unidentified:";
+var DEFAULT_CREDENTIAL_TTL_MS = 36e5;
+var ENCRYPTION_KEY_INFO = new TextEncoder().encode("frontmcp-auth-providers-vault-v1");
+function positiveOr(value, fallback) {
+  return value !== void 0 && value > 0 ? value : fallback;
+}
+function encryptionKeyFrom(pepper) {
+  if (!pepper) return randomBytes(32);
+  return hkdfSha256(new TextEncoder().encode(pepper), new Uint8Array(0), ENCRYPTION_KEY_INFO, 32);
+}
 var AuthProvidersVault = class {
-  constructor(baseVault, namespace = "authproviders:", logger) {
-    this.baseVault = baseVault;
-    this.namespace = namespace;
-    this.logger = logger;
-  }
-  baseVault;
+  credentials;
   namespace;
+  defaultCacheTtl;
   logger;
+  constructor(storage, options = {}) {
+    this.credentials = new EncryptedTypedStorage(storage, {
+      keys: [{ kid: "authproviders-v1", key: encryptionKeyFrom(options.pepper) }]
+    });
+    this.namespace = options.namespace ?? "authproviders:";
+    this.defaultCacheTtl = positiveOr(options.defaultCacheTtl, DEFAULT_CREDENTIAL_TTL_MS);
+    this.logger = options.logger;
+  }
   /**
-   * Store a credential in the vault
+   * Store a credential in the vault, until it expires; one without an expiry for `cacheTtl`, else `defaultCacheTtl`
    *
    * @param sessionId - Current session ID
    * @param providerId - Provider name
    * @param credential - Credential to store
    * @param scope - Credential scope
    * @param userId - User ID (required for user scope)
+   * @param cacheTtl - How long to keep a credential without an expiry, in ms
    */
-  async storeCredential(sessionId, providerId, credential, scope, userId) {
-    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+  async storeCredential(sessionId, providerId, credential, scope, userId, cacheTtl) {
+    if (scope === "session" && sessionId.startsWith(UNIDENTIFIED_SESSION_PREFIX)) {
+      this.logger?.debug(`Not storing credential "${providerId}": the caller has no verified session`);
+      return;
+    }
+    const key = this.credentialKey(sessionId, providerId, scope, userId);
     const appCredential = {
       appId: this.namespace,
       providerId,
@@ -30,7 +56,7 @@ var AuthProvidersVault = class {
       expiresAt: extractCredentialExpiry(credential)
     };
     try {
-      await this.baseVault.addAppCredential(vaultKey, appCredential);
+      await this.write(key, appCredential, cacheTtl);
       this.logger?.debug(`Stored credential "${providerId}" with scope "${scope}"`);
     } catch (error) {
       this.logger?.warn(`Failed to store credential "${providerId}":`, error);
@@ -47,9 +73,9 @@ var AuthProvidersVault = class {
    * @returns Credential or null if not found
    */
   async getCredential(sessionId, providerId, scope, userId) {
-    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    const key = this.credentialKey(sessionId, providerId, scope, userId);
     try {
-      const appCredential = await this.baseVault.getCredential(vaultKey, this.namespace, providerId);
+      const appCredential = await this.read(key);
       if (!appCredential) {
         return null;
       }
@@ -81,9 +107,9 @@ var AuthProvidersVault = class {
    * @param userId - User ID (required for user scope)
    */
   async removeCredential(sessionId, providerId, scope, userId) {
-    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    const key = this.credentialKey(sessionId, providerId, scope, userId);
     try {
-      await this.baseVault.removeAppCredential(vaultKey, this.namespace, providerId);
+      await this.credentials.delete(key);
       this.logger?.debug(`Removed credential "${providerId}"`);
     } catch (error) {
       this.logger?.warn(`Failed to remove credential "${providerId}":`, error);
@@ -99,9 +125,11 @@ var AuthProvidersVault = class {
    * @param userId - User ID (required for user scope)
    */
   async invalidateCredential(sessionId, providerId, scope, reason, userId) {
-    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    const key = this.credentialKey(sessionId, providerId, scope, userId);
     try {
-      await this.baseVault.invalidateCredential(vaultKey, this.namespace, providerId, reason);
+      const appCredential = await this.read(key);
+      if (!appCredential) return;
+      await this.write(key, { ...appCredential, isValid: false, invalidReason: reason });
       this.logger?.debug(`Invalidated credential "${providerId}": ${reason}`);
     } catch (error) {
       this.logger?.warn(`Failed to invalidate credential "${providerId}":`, error);
@@ -117,9 +145,25 @@ var AuthProvidersVault = class {
    * @param userId - User ID (required for user scope)
    */
   async refreshOAuthCredential(sessionId, providerId, scope, tokens, userId) {
-    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    const key = this.credentialKey(sessionId, providerId, scope, userId);
     try {
-      await this.baseVault.refreshOAuthCredential(vaultKey, this.namespace, providerId, tokens);
+      const appCredential = await this.read(key);
+      if (!appCredential) return;
+      const credential = appCredential.credential;
+      if (credential.type !== "oauth" && credential.type !== "oauth_pkce") return;
+      const refreshed = {
+        ...appCredential,
+        credential: {
+          ...credential,
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken ?? credential.refreshToken,
+          expiresAt: tokens.expiresAt ?? credential.expiresAt
+        },
+        expiresAt: tokens.expiresAt ?? appCredential.expiresAt,
+        isValid: true,
+        invalidReason: void 0
+      };
+      await this.write(key, refreshed);
       this.logger?.debug(`Refreshed OAuth credential "${providerId}"`);
     } catch (error) {
       this.logger?.warn(`Failed to refresh OAuth credential "${providerId}":`, error);
@@ -135,49 +179,47 @@ var AuthProvidersVault = class {
    */
   async getAllCredentials(sessionId, scope, userId) {
     if (scope) {
-      const vaultKey = this.buildVaultKey(sessionId, scope, userId);
-      try {
-        return await this.baseVault.getAppCredentials(vaultKey, this.namespace);
-      } catch {
-        return [];
-      }
+      return this.listCredentials(this.buildVaultKey(sessionId, scope, userId));
     }
-    const credentials = [];
+    const scopes = userId ? ["session", "user", "global"] : ["session", "global"];
+    const credentialsPerScope = await Promise.all(
+      scopes.map((eachScope) => this.listCredentials(this.buildVaultKey(sessionId, eachScope, userId)))
+    );
+    return credentialsPerScope.flat();
+  }
+  async listCredentials(vaultKey) {
     try {
-      const sessionCreds = await this.baseVault.getAppCredentials(
-        this.buildVaultKey(sessionId, "session"),
-        this.namespace
-      );
-      credentials.push(...sessionCreds);
+      const keys = await this.credentials.keys(`${vaultKey}:*`);
+      const records = await this.credentials.mget(keys);
+      return records.flatMap((record, index) => record?.storageKey === keys[index] ? [record.appCredential] : []);
     } catch {
+      return [];
     }
-    if (userId) {
-      try {
-        const userCreds = await this.baseVault.getAppCredentials(
-          this.buildVaultKey(sessionId, "user", userId),
-          this.namespace
-        );
-        credentials.push(...userCreds);
-      } catch {
-      }
-    }
-    try {
-      const globalCreds = await this.baseVault.getAppCredentials(
-        this.buildVaultKey(sessionId, "global"),
-        this.namespace
-      );
-      credentials.push(...globalCreds);
-    } catch {
+  }
+  async read(key) {
+    const record = await this.credentials.get(key);
+    return record?.storageKey === key ? record.appCredential : null;
+  }
+  /** Writes until the credential expires, else for `cacheTtl` or `defaultCacheTtl`; an expired one is deleted. */
+  async write(key, appCredential, cacheTtl) {
+    const ttlMs = appCredential.expiresAt === void 0 ? positiveOr(cacheTtl, this.defaultCacheTtl) : appCredential.expiresAt - Date.now();
+    if (ttlMs <= 0) {
+      await this.credentials.delete(key);
+      return;
     }
-    return credentials;
+    const ttlSeconds = Math.min(Math.ceil(ttlMs / 1e3), MAX_TTL_SECONDS);
+    await this.credentials.set(key, { storageKey: key, appCredential }, { ttlSeconds });
+  }
+  credentialKey(sessionId, providerId, scope, userId) {
+    return `${this.buildVaultKey(sessionId, scope, userId)}:${providerId}`;
   }
   /**
-   * Build vault key based on scope
+   * Build vault key based on scope; user and session ids are hashed, so no id can reach into another's keys
    *
    * Key patterns:
    * - global: `authproviders:global`
-   * - user: `authproviders:user:{userId}`
-   * - session: `authproviders:session:{sessionId}`
+   * - user: `authproviders:user:{sha256(userId)}`
+   * - session: `authproviders:session:{sha256(sessionId)}`
    */
   buildVaultKey(sessionId, scope, userId) {
     switch (scope) {
@@ -189,9 +231,9 @@ var AuthProvidersVault = class {
             `userId is required for user-scoped credentials (namespace: ${this.namespace})`
           );
         }
-        return `${this.namespace}user:${userId}`;
+        return `${this.namespace}user:${sha256Hex(userId)}`;
       case "session":
-        return `${this.namespace}session:${sessionId}`;
+        return `${this.namespace}session:${sha256Hex(sessionId)}`;
       default: {
         const _exhaustive = scope;
         throw new AuthInvalidInputError(`Unknown credential scope: ${_exhaustive}`);
@@ -202,5 +244,6 @@ var AuthProvidersVault = class {
 var AUTH_PROVIDERS_VAULT = /* @__PURE__ */ Symbol.for("frontmcp:AUTH_PROVIDERS_VAULT");
 export {
   AUTH_PROVIDERS_VAULT,
-  AuthProvidersVault
+  AuthProvidersVault,
+  UNIDENTIFIED_SESSION_PREFIX
 };

package/browser/vault/index.mjs

@@ -12,7 +12,11 @@ import { CredentialCache } from "./credential-cache.mjs";
 import { AUTH_PROVIDERS_ACCESSOR } from "./auth-providers.accessor.mjs";
 import { AuthProvidersAccessorImpl } from "./auth-providers.accessor.impl.mjs";
 import { AuthProvidersRegistry, AUTH_PROVIDERS_REGISTRY } from "./auth-providers.registry.mjs";
-import { AuthProvidersVault, AUTH_PROVIDERS_VAULT } from "./auth-providers.vault.mjs";
+import {
+  AuthProvidersVault,
+  AUTH_PROVIDERS_VAULT,
+  UNIDENTIFIED_SESSION_PREFIX
+} from "./auth-providers.vault.mjs";
 import { EagerCredentialLoader } from "./credential-loaders/eager-loader.mjs";
 import { LazyCredentialLoader } from "./credential-loaders/lazy-loader.mjs";
 export {
@@ -25,6 +29,7 @@ export {
   CredentialCache,
   EagerCredentialLoader,
   LazyCredentialLoader,
+  UNIDENTIFIED_SESSION_PREFIX,
   authProviderMappingSchema,
   authProvidersVaultOptionsSchema,
   credentialProviderConfigSchema,