@frontmcp/auth 1.9.1 → 1.9.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/authorities/authorities.context.d.ts.map +1 -1
- package/authorities/authorities.evaluator.d.ts.map +1 -1
- package/authorization/orchestrated.authorization.d.ts +10 -2
- package/authorization/orchestrated.authorization.d.ts.map +1 -1
- package/cimd/cimd.service.d.ts +13 -1
- package/cimd/cimd.service.d.ts.map +1 -1
- package/context/frontmcp-auth-context.factory.d.ts +7 -5
- package/context/frontmcp-auth-context.factory.d.ts.map +1 -1
- package/context/frontmcp-auth-context.impl.d.ts +2 -1
- package/context/frontmcp-auth-context.impl.d.ts.map +1 -1
- package/detection/auth-provider-detection.d.ts +2 -0
- package/detection/auth-provider-detection.d.ts.map +1 -1
- package/esm/index.mjs +534 -116
- package/esm/package.json +5 -5
- package/fetch/fetch-credential-middleware.d.ts +11 -1
- package/fetch/fetch-credential-middleware.d.ts.map +1 -1
- package/fetch/index.d.ts +2 -2
- package/fetch/index.d.ts.map +1 -1
- package/index.d.ts +3 -3
- package/index.d.ts.map +1 -1
- package/index.js +534 -119
- package/jwks/jwks.service.d.ts +17 -1
- package/jwks/jwks.service.d.ts.map +1 -1
- package/package.json +5 -5
- package/session/authorization.store.d.ts +6 -0
- package/session/authorization.store.d.ts.map +1 -1
- package/session/orchestrated-token.crypto.d.ts +11 -0
- package/session/orchestrated-token.crypto.d.ts.map +1 -1
- package/session/orchestrated-token.store.d.ts +16 -1
- package/session/orchestrated-token.store.d.ts.map +1 -1
- package/session/storage-orchestrated-token.store.d.ts +10 -0
- package/session/storage-orchestrated-token.store.d.ts.map +1 -1
- package/session/utils/auth-token.utils.d.ts.map +1 -1
- package/utils/index.d.ts +1 -0
- package/utils/index.d.ts.map +1 -1
- package/utils/token-scopes.utils.d.ts +11 -0
- package/utils/token-scopes.utils.d.ts.map +1 -0
package/jwks/jwks.service.d.ts
CHANGED
|
@@ -6,6 +6,7 @@ export declare class JwksService {
|
|
|
6
6
|
private warnedProviders;
|
|
7
7
|
private orchestratorKey;
|
|
8
8
|
private providerJwks;
|
|
9
|
+
private unknownKidRefetches;
|
|
9
10
|
private keyInitialized;
|
|
10
11
|
private keyInitPromise;
|
|
11
12
|
private keyPersistence?;
|
|
@@ -57,12 +58,27 @@ export declare class JwksService {
|
|
|
57
58
|
* 1) inline jwks (if provided) → cache & return
|
|
58
59
|
* 2) cached & fresh (TTL) → return
|
|
59
60
|
* 3) explicit jwksUri → fetch, cache, return
|
|
60
|
-
* 4)
|
|
61
|
+
* 4) `<issuer>/.well-known/jwks.json` → fetch, cache, return
|
|
62
|
+
* 5) discover jwks_uri → the issuer's OAuth authorization server
|
|
61
63
|
* metadata (RFC 8414), else its OpenID configuration (OpenID Connect
|
|
62
64
|
* Discovery 1.0 §4, where Google, Okta, Auth0 and Entra publish it),
|
|
63
65
|
* then fetch jwks_uri, cache, return
|
|
64
66
|
*/
|
|
65
67
|
getJwksForProvider(ref: ProviderVerifyRef): Promise<JSONWebKeySet | undefined>;
|
|
68
|
+
/**
|
|
69
|
+
* Fetch a provider's keys again for a token whose `kid` the cached keys don't have (a key the
|
|
70
|
+
* provider started using since), ahead of the cache's TTL. At most one refetch per provider per
|
|
71
|
+
* {@link UNKNOWN_KID_REFETCH_COOLDOWN_MS}: tokens that arrive meanwhile wait for the one in flight or
|
|
72
|
+
* use its result, so a flood of tokens with made-up `kid`s can't hammer the provider. Only freshly
|
|
73
|
+
* fetched keys are returned: a failed refetch never revives cached keys past the stale window.
|
|
74
|
+
*/
|
|
75
|
+
private refetchForUnknownKid;
|
|
76
|
+
/**
|
|
77
|
+
* Fetch a provider's keys, and cache them: from `jwksUri`, else the conventional location, else
|
|
78
|
+
* the `jwks_uri` of the issuer's OAuth or OpenID metadata. Every URL goes through the same scheme
|
|
79
|
+
* and SSRF checks (`fetchJson`), `jwks_uri` included.
|
|
80
|
+
*/
|
|
81
|
+
private fetchProviderJwks;
|
|
66
82
|
/** Return the orchestrator public JWKS (generates/rotates as needed). */
|
|
67
83
|
getOrchestratorJwks(): Promise<JSONWebKeySet>;
|
|
68
84
|
/** Return private signing key + kid for issuing orchestrator tokens. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks.service.d.ts","sourceRoot":"","sources":["../../src/jwks/jwks.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,aAAa,EAAY,MAAM,MAAM,CAAC;AAczG,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"jwks.service.d.ts","sourceRoot":"","sources":["../../src/jwks/jwks.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,aAAa,EAAY,MAAM,MAAM,CAAC;AAczG,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAmDlG,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+C;IAEpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,eAAe,CAAqB;IAG5C,OAAO,CAAC,eAAe,CAKrB;IAGF,OAAO,CAAC,YAAY,CAAiE;IAGrF,OAAO,CAAC,mBAAmB,CAAsF;IAGjH,OAAO,CAAC,cAAc,CAAS;IAE/B,OAAO,CAAC,cAAc,CAA4B;IAElD,OAAO,CAAC,cAAc,CAAC,CAAiB;gBAE5B,IAAI,CAAC,EAAE,kBAAkB;IAcrC;;;OAGG;YACW,iBAAiB;IAc/B,mFAAmF;IAC7E,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;IAQ7C;;;OAGG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAsEnG;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;;OAGG;YACW,iBAAiB;IAwG/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB,kEAAkE;IAClE,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa;IAIvD;;;;;;;;;;OAUG;IACG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA2BpF;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAS5B;;;;OAIG;YACW,iBAAiB;IAwB/B,yEAAyE;IACnE,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC;IAKnD,wEAAwE;IAClE,yBAAyB,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,aAAa,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;YAShG,YAAY;YAaZ,cAAc;YAQd,SAAS;YAgET,qBAAqB;YAyBrB,yBAAyB;IA+DvC,OAAO,CAAC,WAAW;CAgBpB"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@frontmcp/auth",
|
|
3
|
-
"version": "1.9.
|
|
3
|
+
"version": "1.9.3",
|
|
4
4
|
"description": "FrontMCP Auth - Authentication, session management, and credential vault",
|
|
5
5
|
"author": "AgentFront <info@agentfront.dev>",
|
|
6
6
|
"homepage": "https://docs.agentfront.dev",
|
|
@@ -47,8 +47,8 @@
|
|
|
47
47
|
"node": ">=24.0.0"
|
|
48
48
|
},
|
|
49
49
|
"peerDependencies": {
|
|
50
|
-
"@frontmcp/lazy-zod": "1.9.
|
|
51
|
-
"@frontmcp/storage-sqlite": "1.9.
|
|
50
|
+
"@frontmcp/lazy-zod": "1.9.3",
|
|
51
|
+
"@frontmcp/storage-sqlite": "1.9.3",
|
|
52
52
|
"@vercel/kv": "^3.0.0",
|
|
53
53
|
"ioredis": "^5.0.0"
|
|
54
54
|
},
|
|
@@ -64,8 +64,8 @@
|
|
|
64
64
|
}
|
|
65
65
|
},
|
|
66
66
|
"dependencies": {
|
|
67
|
-
"@frontmcp/di": "1.9.
|
|
68
|
-
"@frontmcp/utils": "1.9.
|
|
67
|
+
"@frontmcp/di": "1.9.3",
|
|
68
|
+
"@frontmcp/utils": "1.9.3",
|
|
69
69
|
"jose": "^6.0.0"
|
|
70
70
|
},
|
|
71
71
|
"devDependencies": {
|
|
@@ -218,6 +218,11 @@ export interface RefreshTokenRecord {
|
|
|
218
218
|
selectedProviderIds?: string[];
|
|
219
219
|
/** Skipped federated provider ids. */
|
|
220
220
|
skippedProviderIds?: string[];
|
|
221
|
+
/**
|
|
222
|
+
* The authorization id the upstream provider tokens of this grant are stored under, so a refresh
|
|
223
|
+
* moves them to the new access token's id.
|
|
224
|
+
*/
|
|
225
|
+
providerTokensId?: string;
|
|
221
226
|
}
|
|
222
227
|
/**
|
|
223
228
|
* Zod schemas for validation
|
|
@@ -315,6 +320,7 @@ export interface CreateRefreshTokenRecordParams {
|
|
|
315
320
|
federatedLoginUsed?: boolean;
|
|
316
321
|
selectedProviderIds?: string[];
|
|
317
322
|
skippedProviderIds?: string[];
|
|
323
|
+
providerTokensId?: string;
|
|
318
324
|
}
|
|
319
325
|
/** Default TTL for authorization codes (60 seconds). */
|
|
320
326
|
export declare const AUTH_CODE_TTL_MS: number;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorization.store.d.ts","sourceRoot":"","sources":["../../src/session/authorization.store.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAKH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAC;IACpB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,0CAA0C;IAC1C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uCAAuC;IACvC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,yCAAyC;IACzC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,6BAA6B;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,2BAA2B;IAC3B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpF;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qBAAqB;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAGlB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAGjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,yBAAyB,CAAC;IAG3C,uCAAuC;IACvC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAE7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IAKvB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kDAAkD;IAClD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4FAA4F;IAC5F,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,uCAAuC;IACvC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"authorization.store.d.ts","sourceRoot":"","sources":["../../src/session/authorization.store.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAKH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAC;IACpB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,0CAA0C;IAC1C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uCAAuC;IACvC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,yCAAyC;IACzC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,6BAA6B;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,2BAA2B;IAC3B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpF;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qBAAqB;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAGlB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAGjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,yBAAyB,CAAC;IAG3C,uCAAuC;IACvC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAE7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IAKvB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kDAAkD;IAClD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4FAA4F;IAC5F,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,uCAAuC;IACvC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;gCAG9B,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;gCAyBxC,CAAC;AAEH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAEjC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjC,cAAc,CAAC,EAAE,yBAAyB,CAAC;IAE3C,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAI7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wDAAwD;AACxD,eAAO,MAAM,gBAAgB,QAAY,CAAC;AAC1C,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAClD,gDAAgD;AAChD,eAAO,MAAM,oBAAoB,QAA2B,CAAC;AAE7D;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,sBAAsB,GAAG,uBAAuB,CAyBvF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,yBAAyB,GAAG,0BAA0B,CAwBhG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,8BAA8B,GAAG,kBAAkB,CAwBlG;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAEjC,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC5E,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGrD,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAC;IAChF,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGtD,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAInF,YAAY,IAAI,MAAM,CAAC;IACvB,oBAAoB,IAAI,MAAM,CAAC;IAC/B,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,uBAAuB,CAAC;IAC1E,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,0BAA0B,CAAC;IACnF,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,kBAAkB,CAAC;IAGrF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAQlF;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,CAGzE;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,YAAW,kBAAkB;IACnE,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,OAAO,CAAiD;IAChE,OAAO,CAAC,aAAa,CAAyC;IAE9D,YAAY,IAAI,MAAM;IAItB,oBAAoB,IAAI,MAAM;IAIxB,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAa3E,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtE,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAa/E,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAYlE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOhD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IASlF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB9B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,uBAAuB;IAIzE;;OAEG;IACH,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,0BAA0B;IAIlF;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,kBAAkB;CAGrF;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,kBAAkB;IAE9D,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,KAAK,EAAE,GAAG,EACV,SAAS,SAAW;IAGvC,OAAO,CAAC,GAAG;IAIX,YAAY,IAAI,MAAM;IAItB,oBAAoB,IAAI,MAAM;IAI9B,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,uBAAuB;IAIzE,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,0BAA0B;IAIlF,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,kBAAkB;IAI9E,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAM3E,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUtE,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAK5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAM/E,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK5D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAQlE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}
|
|
@@ -17,6 +17,17 @@ export interface ProviderTokenRecord {
|
|
|
17
17
|
createdAt: number;
|
|
18
18
|
updatedAt: number;
|
|
19
19
|
}
|
|
20
|
+
/**
|
|
21
|
+
* When a record is dropped. Its access token's expiry, unless it holds a refresh token: the access
|
|
22
|
+
* token is then renewed with it, so the record stays until it hasn't been written for as long as
|
|
23
|
+
* FrontMCP's own refresh tokens live.
|
|
24
|
+
*/
|
|
25
|
+
export declare function recordDropAt(record: ProviderTokenRecord): number | undefined;
|
|
26
|
+
/**
|
|
27
|
+
* Whether the record's access token is still usable. One that can be refreshed counts as expired
|
|
28
|
+
* `refreshSkewMs` before its expiry, so it is renewed before it lapses.
|
|
29
|
+
*/
|
|
30
|
+
export declare function hasLiveAccessToken(record: ProviderTokenRecord, refreshSkewMs?: number): boolean;
|
|
20
31
|
/**
|
|
21
32
|
* Derive a per-record AES key from the master key + composite key via HKDF.
|
|
22
33
|
* Results are cached in `cache` (keyed by composite key) to avoid recomputation.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"orchestrated-token.crypto.d.ts","sourceRoot":"","sources":["../../src/session/orchestrated-token.crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;
|
|
1
|
+
{"version":3,"file":"orchestrated-token.crypto.d.ts","sourceRoot":"","sources":["../../src/session/orchestrated-token.crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAG5E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,EAAE,aAAa,SAAI,GAAG,OAAO,CAG1F;AAID;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAC7B,UAAU,CASZ;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,GAAG,MAAM,CASlF;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAOrF"}
|
|
@@ -31,6 +31,12 @@ export interface InMemoryOrchestratedTokenStoreOptions {
|
|
|
31
31
|
* @default 60000 (1 minute)
|
|
32
32
|
*/
|
|
33
33
|
cleanupIntervalMs?: number;
|
|
34
|
+
/**
|
|
35
|
+
* How long before its expiry an access token that can be refreshed stops being returned, so the
|
|
36
|
+
* caller renews it before it lapses (`refresh.skewSeconds`).
|
|
37
|
+
* @default 0
|
|
38
|
+
*/
|
|
39
|
+
refreshSkewMs?: number;
|
|
34
40
|
}
|
|
35
41
|
/**
|
|
36
42
|
* In-Memory Orchestrated Token Store
|
|
@@ -73,6 +79,8 @@ export declare class InMemoryOrchestratedTokenStore implements TokenStore {
|
|
|
73
79
|
private cleanupTimer?;
|
|
74
80
|
/** Default TTL for records */
|
|
75
81
|
private readonly defaultTtlMs?;
|
|
82
|
+
/** How long before its expiry a refreshable access token stops being returned */
|
|
83
|
+
private readonly refreshSkewMs;
|
|
76
84
|
constructor(options?: InMemoryOrchestratedTokenStoreOptions);
|
|
77
85
|
/**
|
|
78
86
|
* Build composite key from authorizationId and providerId
|
|
@@ -95,7 +103,8 @@ export declare class InMemoryOrchestratedTokenStore implements TokenStore {
|
|
|
95
103
|
*/
|
|
96
104
|
private getRecord;
|
|
97
105
|
/**
|
|
98
|
-
* Retrieve decrypted access token for a provider
|
|
106
|
+
* Retrieve decrypted access token for a provider, or null once it has expired (a record with a
|
|
107
|
+
* refresh token keeps that, to renew it)
|
|
99
108
|
*/
|
|
100
109
|
getAccessToken(authorizationId: string, providerId: string): Promise<string | null>;
|
|
101
110
|
/**
|
|
@@ -151,5 +160,11 @@ export declare class InMemoryOrchestratedTokenStore implements TokenStore {
|
|
|
151
160
|
* @param toAuthId - Target authorization ID (e.g., "def456")
|
|
152
161
|
*/
|
|
153
162
|
migrateTokens(fromAuthId: string, toAuthId: string): Promise<void>;
|
|
163
|
+
/**
|
|
164
|
+
* Copy tokens from one authorization ID to another, keeping them under the source ID too.
|
|
165
|
+
*/
|
|
166
|
+
copyTokens(fromAuthId: string, toAuthId: string): Promise<void>;
|
|
167
|
+
/** Copy every record of `fromAuthId` to `toAuthId`, skipping a corrupted one; returns the keys copied. */
|
|
168
|
+
private copyRecords;
|
|
154
169
|
}
|
|
155
170
|
//# sourceMappingURL=orchestrated-token.store.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"orchestrated-token.store.d.ts","sourceRoot":"","sources":["../../src/session/orchestrated-token.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;
|
|
1
|
+
{"version":3,"file":"orchestrated-token.store.d.ts","sourceRoot":"","sources":["../../src/session/orchestrated-token.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAe9E;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD;;;OAGG;IACH,aAAa,CAAC,EAAE,UAAU,CAAC;IAE3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,8BAA+B,YAAW,UAAU;IAC/D,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmD;IAE1E,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAa;IAE5C,kCAAkC;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAE7D,6BAA6B;IAC7B,OAAO,CAAC,YAAY,CAAC,CAAiC;IAEtD,8BAA8B;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IAEvC,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,OAAO,GAAE,qCAA0C;IAiB/D;;OAEG;IACH,OAAO,CAAC,QAAQ;IAIhB;;OAEG;YACW,kBAAkB;IAqBhC;;OAEG;YACW,aAAa;IAe3B;;OAEG;YACW,aAAa;IAa3B;;OAEG;YACW,SAAS;IAqCvB;;;OAGG;IACG,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKzF;;OAEG;IACG,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAK1F;;OAEG;IACG,WAAW,CACf,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC;IAsBhB;;OAEG;IACG,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9E;;OAEG;IACG,SAAS,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK9E;;OAEG;IACG,yBAAyB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvE;;OAEG;IACG,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkBhE;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAiC9B;;OAEG;IACH,OAAO,IAAI,IAAI;IAOf;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;;;;;;OAOG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxE;;OAEG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrE,0GAA0G;YAC5F,WAAW;CAyB1B"}
|
|
@@ -32,11 +32,18 @@ export interface StorageOrchestratedTokenStoreOptions {
|
|
|
32
32
|
* @default 'otok'
|
|
33
33
|
*/
|
|
34
34
|
namespace?: string;
|
|
35
|
+
/**
|
|
36
|
+
* How long before its expiry an access token that can be refreshed stops being returned, so the
|
|
37
|
+
* caller renews it before it lapses (`refresh.skewSeconds`).
|
|
38
|
+
* @default 0
|
|
39
|
+
*/
|
|
40
|
+
refreshSkewMs?: number;
|
|
35
41
|
}
|
|
36
42
|
export declare class StorageOrchestratedTokenStore implements TokenStore {
|
|
37
43
|
private readonly storage;
|
|
38
44
|
private readonly encryptionKey?;
|
|
39
45
|
private readonly defaultTtlMs?;
|
|
46
|
+
private readonly refreshSkewMs;
|
|
40
47
|
private readonly namespace;
|
|
41
48
|
private readonly storageIsNamespaced;
|
|
42
49
|
/** HKDF-derived subkey cache, keyed by composite key. */
|
|
@@ -53,10 +60,13 @@ export declare class StorageOrchestratedTokenStore implements TokenStore {
|
|
|
53
60
|
hasTokens(authorizationId: string, providerId: string): Promise<boolean>;
|
|
54
61
|
getProviderIds(authorizationId: string): Promise<string[]>;
|
|
55
62
|
migrateTokens(fromAuthId: string, toAuthId: string): Promise<void>;
|
|
63
|
+
copyTokens(fromAuthId: string, toAuthId: string): Promise<void>;
|
|
56
64
|
/**
|
|
57
65
|
* Delete all tokens for an authorization id.
|
|
58
66
|
*/
|
|
59
67
|
deleteAllForAuthorization(authorizationId: string): Promise<void>;
|
|
68
|
+
/** Copy every record of `fromAuthId` to `toAuthId`, skipping a corrupted one; returns the composite keys copied. */
|
|
69
|
+
private copyRecords;
|
|
60
70
|
private getRecord;
|
|
61
71
|
private keyFor;
|
|
62
72
|
private compositeKey;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"storage-orchestrated-token.store.d.ts","sourceRoot":"","sources":["../../src/session/storage-orchestrated-token.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;
|
|
1
|
+
{"version":3,"file":"storage-orchestrated-token.store.d.ts","sourceRoot":"","sources":["../../src/session/storage-orchestrated-token.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAW9E,MAAM,WAAW,oCAAoC;IACnD;;;OAGG;IACH,aAAa,CAAC,EAAE,UAAU,CAAC;IAE3B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,6BAA8B,YAAW,UAAU;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAa;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAE9C,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;gBAEjD,OAAO,EAAE,cAAc,GAAG,iBAAiB,EAAE,OAAO,GAAE,oCAAyC;IAarG,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKnF,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKpF,WAAW,CACf,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,IAAI,CAAC;IAgBV,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxE,SAAS,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKxE,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkB1D,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlE,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrE;;OAEG;IACG,yBAAyB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcvE,oHAAoH;YACtG,WAAW;YAsCX,SAAS;IAmCvB,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,UAAU;IAIlB;;;OAGG;YACW,iBAAiB;IAU/B,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,mBAAmB;CAG5B"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-token.utils.d.ts","sourceRoot":"","sources":["../../../src/session/utils/auth-token.utils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlE;AAkBD,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,
|
|
1
|
+
{"version":3,"file":"auth-token.utils.d.ts","sourceRoot":"","sources":["../../../src/session/utils/auth-token.utils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlE;AAkBD,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAoB1E;AAED,uEAAuE;AACvE,MAAM,WAAW,4BAA4B;IAC3C,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,EACrC,WAAW,EAAE,MAAM,GAClB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAQ3D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItE"}
|
package/utils/index.d.ts
CHANGED
|
@@ -8,4 +8,5 @@ export type { AudienceValidationResult, AudienceValidatorOptions } from './audie
|
|
|
8
8
|
export { deriveAuthorizationId } from './authorization-id.utils';
|
|
9
9
|
export { advertisedScopes, DEFAULT_ALLOWED_SCOPES, grantScopes, resourceScopesFor, type ResourceScopeOptions, } from './scope-grant.utils';
|
|
10
10
|
export { isLoopbackRedirectUri } from './redirect-uri.utils';
|
|
11
|
+
export { scopesFromClaims } from './token-scopes.utils';
|
|
11
12
|
//# sourceMappingURL=index.d.ts.map
|
package/utils/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The scopes a token's claims grant: `scope` (RFC 9068 §2.2.3) and `scp` (Entra ID, Okta), each as
|
|
3
|
+
* a space-delimited string or an array, merged without duplicates.
|
|
4
|
+
*
|
|
5
|
+
* @param claims The token's claims (a JWT payload, or the verified user claim built from it).
|
|
6
|
+
*/
|
|
7
|
+
export declare function scopesFromClaims(claims: {
|
|
8
|
+
scope?: unknown;
|
|
9
|
+
scp?: unknown;
|
|
10
|
+
} | undefined): string[];
|
|
11
|
+
//# sourceMappingURL=token-scopes.utils.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"token-scopes.utils.d.ts","sourceRoot":"","sources":["../../src/utils/token-scopes.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAOjG"}
|