@frontmcp/auth 1.3.0 → 1.4.1

package/ui/templates.d.ts

@@ -97,7 +97,33 @@ export declare function buildFederatedLoginPage(params: {
     callbackPath: string;
 }): string;
 /**
- * Build consent page for tool selection
+ * A hidden field to round-trip on the consent form (identity / federated
+ * context) so the consent POST back to `/oauth/callback` carries everything the
+ * mint step needs.
+ */
+export interface ConsentHiddenField {
+    /** Form field name. */
+    name: string;
+    /** Field value (rendered escaped). */
+    value: string;
+}
+/**
+ * Build consent page for tool selection.
+ *
+ * The form GETs/POSTs back to `callbackPath` (`/oauth/callback`) carrying
+ * `pending_auth_id`, the chosen `tools=` checkboxes, and any caller-supplied
+ * {@link ConsentHiddenField hidden context} (identity / `federated=true` /
+ * `providers=`). Honors the `auth.consent` config flags:
+ *
+ * - `groupByApp`      — group tools under per-app cards (default) or render a flat list.
+ * - `showDescriptions`— show tool descriptions (default) or hide them.
+ * - `customMessage`   — replace the default subtitle.
+ * - `allowSelectAll`  — render the select-all + per-app toggle controls (default).
+ * - `requireSelection`— require ≥1 tool; disables the submit button at 0 selected.
+ * - `defaultSelectedTools` — the set of tool ids to pre-check (others unchecked).
+ *   When omitted, ALL tools are pre-checked (the historical default).
+ *
+ * Note: `excludedTools` are filtered out by the caller and never appear here.
  */
 export declare function buildToolConsentPage(params: {
     tools: ToolCard[];
@@ -107,15 +133,105 @@ export declare function buildToolConsentPage(params: {
     callbackPath: string;
     userName?: string;
     userEmail?: string;
+    /** Group tools by app (default true). When false, a single flat list is rendered. */
+    groupByApp?: boolean;
+    /** Show per-tool descriptions (default true). */
+    showDescriptions?: boolean;
+    /** Replace the default subtitle with a custom message. */
+    customMessage?: string;
+    /** Render the select-all / toggle-all controls (default true). */
+    allowSelectAll?: boolean;
+    /** Require at least one tool to be selected (default true). */
+    requireSelection?: boolean;
+    /**
+     * Tool ids to pre-check. When omitted, every tool is pre-checked (historical
+     * default). When provided, only listed ids are checked.
+     */
+    defaultSelectedTools?: string[];
+    /** Optional error banner (e.g. re-render after an empty `requireSelection` submit). */
+    error?: string;
+    /** Hidden fields to round-trip (identity / federated context) back to the callback. */
+    hiddenFields?: ConsentHiddenField[];
 }): string;
 /**
- * Build simple login page
+ * A custom login field rendered on the built-in login page (Checkpoint 3a).
+ * Mirrors `LoginFieldConfig` from `@frontmcp/auth` options, plus the field `name`.
+ */
+export interface LoginExtraField {
+    /** Field name (form key submitted to the callback). */
+    name: string;
+    /** HTML input type. `hidden` is submitted but not shown. */
+    type: 'text' | 'password' | 'email' | 'select' | 'hidden';
+    /** Field label. Defaults to the field name. */
+    label?: string;
+    /** Whether the field is required. */
+    required?: boolean;
+    /** Placeholder text. */
+    placeholder?: string;
+    /** Options for a `select` field. */
+    options?: Array<{
+        value: string;
+        label: string;
+    }>;
+    /** Pre-filled value (e.g. when re-rendering after an error). */
+    value?: string;
+}
+/**
+ * Build simple login page.
+ *
+ * The default email/name form is rendered when no `extraFields` are supplied —
+ * byte-for-byte identical to the historical page (the optional params below all
+ * default to falsy). When `extraFields` is provided (Checkpoint 3a local-login
+ * customization), the built-in email/name fields are REPLACED by the supplied
+ * fields and `title`/`subtitle`/`logoUri`/`error` customize the chrome.
  */
 export declare function buildLoginPage(params: {
     clientName: string;
     scope: string;
     pendingAuthId: string;
     callbackPath: string;
+    /** Optional page heading override. Defaults to "Sign In". */
+    title?: string;
+    /** Optional sub-heading. Defaults to "Authorize access to {clientName}". */
+    subtitle?: string;
+    /** Optional logo image URL shown above the form. */
+    logoUri?: string;
+    /** Optional error banner shown above the form (re-render after failed authenticate()). */
+    error?: string;
+    /**
+     * Optional custom fields. When provided, these REPLACE the default
+     * email/name inputs and are submitted to the callback as form values.
+     */
+    extraFields?: LoginExtraField[];
+}): string;
+/**
+ * Build the mid-session "connect credential" page (Checkpoint 3b).
+ *
+ * Renders a single-field form (reusing the {@link LoginExtraField} renderer) that
+ * POSTs the framework-signed `token` plus the credential field value back to the
+ * `/oauth/connect` handler. Mirrors the login page chrome so the experience is
+ * consistent with the initial sign-in.
+ *
+ * @param params.token  The framework-signed resume token (round-tripped as a hidden field).
+ * @param params.field  The single credential field to render (e.g. an API key / password input).
+ * @param params.action The connect endpoint path the form submits to.
+ */
+export declare function buildConnectPage(params: {
+    token: string;
+    field: LoginExtraField;
+    action: string;
+    title?: string;
+    subtitle?: string;
+    logoUri?: string;
+    error?: string;
+}): string;
+/**
+ * Build the success page shown after a credential is connected mid-session
+ * (Checkpoint 3b). No secrets are rendered — only a confirmation message.
+ */
+export declare function buildConnectSuccessPage(params: {
+    key: string;
+    message?: string;
 }): string;
 /**
  * Build error page

package/ui/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/ui/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAmD,UAAU,IAAI,cAAc,EAAE,MAAM,eAAe,CAAC;AAM9G;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;GAGG;AACH,eAAO,MAAM,UAAU,uBAAiB,CAAC;AAMzC;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAoBT;AA6DD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAwDT;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAkFT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAgHT;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAkDT;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAsBrF;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhF"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/ui/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,IAAI,cAAc,EAAmD,MAAM,eAAe,CAAC;AAM9G;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;GAGG;AACH,eAAO,MAAM,UAAU,uBAAiB,CAAC;AAMzC;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAoBT;AA6DD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAwDT;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAkFT;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACrC,GAAG,MAAM,CAmLT;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1D,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC,GAAG,MAAM,CA2ET;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAoCT;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAezF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAsBrF;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhF"}

package/vault/auth-providers.types.d.ts

@@ -14,8 +14,8 @@ import type { AuthorizationVault, Credential } from '../session';
  */
 export type CredentialScope = 'global' | 'user' | 'session';
 export declare const credentialScopeSchema: import("@frontmcp/lazy-zod").ZodEnum<{
-    session: "session";
     user: "user";
+    session: "session";
     global: "global";
 }>;
 /**
@@ -140,8 +140,8 @@ export declare const credentialProviderConfigSchema: import("@frontmcp/lazy-zod"
     name: import("@frontmcp/lazy-zod").ZodString;
     description: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
     scope: import("@frontmcp/lazy-zod").ZodEnum<{
-        session: "session";
         user: "user";
+        session: "session";
         global: "global";
     }>;
     loading: import("@frontmcp/lazy-zod").ZodEnum<{
@@ -226,8 +226,8 @@ export declare const authProvidersVaultOptionsSchema: import("@frontmcp/lazy-zod
         name: import("@frontmcp/lazy-zod").ZodString;
         description: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
         scope: import("@frontmcp/lazy-zod").ZodEnum<{
-            session: "session";
             user: "user";
+            session: "session";
             global: "global";
         }>;
         loading: import("@frontmcp/lazy-zod").ZodEnum<{