@frontmcp/plugin-approval 1.8.1 → 1.8.2

package/approval.identity.d.ts

@@ -10,14 +10,12 @@ export interface ApprovalIdentity {
     /** Key for user-scoped approvals, when the call has an authenticated principal. */
     userId: string | undefined;
 }
-type ApprovalCallerContext = Pick<FrontMcpContext, 'sessionId' | 'authInfo'>;
+type ApprovalCallerContext = Pick<FrontMcpContext, 'verifiedSessionId' | 'authInfo'>;
 /**
  * The session and user that a call's approvals are read from and granted to.
  *
- * The stateless transport gives every request the same session id, so keying session
- * approvals on it let one caller's approval admit every other stateless caller. A stateless
- * call is keyed by its authenticated principal instead, and a call with neither a session nor
- * a principal gets a key of its own that no other call can match.
+ * Only a verified session keys session approvals; a stateless call (shared or per-request session
+ * id) is keyed by its principal, and a call with neither gets a key no other call can match.
  */
 export declare function resolveApprovalIdentity(ctx: ApprovalCallerContext | undefined): ApprovalIdentity;
 export {};

package/approval.identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval.identity.d.ts","sourceRoot":"","sources":["../src/approval.identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAG3E,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,KAAK,qBAAqB,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,UAAU,CAAC,CAAC;AAM7E;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,qBAAqB,GAAG,SAAS,GAAG,gBAAgB,CAWhG"}
+{"version":3,"file":"approval.identity.d.ts","sourceRoot":"","sources":["../src/approval.identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,KAAK,qBAAqB,GAAG,IAAI,CAAC,eAAe,EAAE,mBAAmB,GAAG,UAAU,CAAC,CAAC;AAMrF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,qBAAqB,GAAG,SAAS,GAAG,gBAAgB,CAWhG"}

package/esm/index.mjs

@@ -26,7 +26,6 @@ import {
 } from "@frontmcp/sdk";
 
 // plugins/plugin-approval/src/approval.identity.ts
-import { STATELESS_SESSION_ID } from "@frontmcp/sdk";
 import { randomUUID } from "@frontmcp/utils";
 function nonEmptyString(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
@@ -34,8 +33,8 @@ function nonEmptyString(value) {
 function resolveApprovalIdentity(ctx) {
   const extra = ctx?.authInfo?.extra;
   const userId = nonEmptyString(extra?.["userId"]) ?? nonEmptyString(extra?.["sub"]) ?? nonEmptyString(ctx?.authInfo?.clientId);
-  const sessionId = nonEmptyString(ctx?.sessionId);
-  if (sessionId && sessionId !== STATELESS_SESSION_ID) {
+  const sessionId = nonEmptyString(ctx?.verifiedSessionId);
+  if (sessionId) {
     return { sessionId, userId };
   }
   return { sessionId: userId ? `stateless-user:${userId}` : `unidentified:${randomUUID()}`, userId };

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-approval",
-  "version": "1.8.1",
+  "version": "1.8.2",
   "description": "Approval plugin for FrontMCP - tool authorization workflow with PKCE webhook security",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.8.1",
-    "@frontmcp/utils": "1.8.1",
+    "@frontmcp/sdk": "1.8.2",
+    "@frontmcp/utils": "1.8.2",
     "ioredis": "^5.8.0",
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.1",
+    "@frontmcp/lazy-zod": "1.8.2",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {

package/index.js

@@ -76,10 +76,9 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // plugins/plugin-approval/src/approval.plugin.ts
-var import_sdk6 = require("@frontmcp/sdk");
+var import_sdk5 = require("@frontmcp/sdk");
 
 // plugins/plugin-approval/src/approval.identity.ts
-var import_sdk = require("@frontmcp/sdk");
 var import_utils = require("@frontmcp/utils");
 function nonEmptyString(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
@@ -87,8 +86,8 @@ function nonEmptyString(value) {
 function resolveApprovalIdentity(ctx) {
   const extra = ctx?.authInfo?.extra;
   const userId = nonEmptyString(extra?.["userId"]) ?? nonEmptyString(extra?.["sub"]) ?? nonEmptyString(ctx?.authInfo?.clientId);
-  const sessionId = nonEmptyString(ctx?.sessionId);
-  if (sessionId && sessionId !== import_sdk.STATELESS_SESSION_ID) {
+  const sessionId = nonEmptyString(ctx?.verifiedSessionId);
+  if (sessionId) {
     return { sessionId, userId };
   }
   return { sessionId: userId ? `stateless-user:${userId}` : `unidentified:${(0, import_utils.randomUUID)()}`, userId };
@@ -106,7 +105,7 @@ var ChallengeServiceToken = /* @__PURE__ */ Symbol.for(
 );
 
 // plugins/plugin-approval/src/hooks/approval-check.hook.ts
-var import_sdk2 = require("@frontmcp/sdk");
+var import_sdk = require("@frontmcp/sdk");
 
 // plugins/plugin-approval/src/approval/types.ts
 var ApprovalScope = /* @__PURE__ */ ((ApprovalScope2) => {
@@ -473,7 +472,7 @@ var ChallengeValidationError = class extends ApprovalError {
 
 // plugins/plugin-approval/src/hooks/approval-check.hook.ts
 var passedApprovalStores = /* @__PURE__ */ new WeakMap();
-var ApprovalCheckPlugin = class extends import_sdk2.DynamicPlugin {
+var ApprovalCheckPlugin = class extends import_sdk.DynamicPlugin {
   async checkApproval(flowCtx) {
     const { tool, toolContext } = flowCtx.state;
     if (!tool || !toolContext) return;
@@ -579,17 +578,17 @@ var ApprovalCheckPlugin = class extends import_sdk2.DynamicPlugin {
   }
 };
 __decorateClass([
-  import_sdk2.ToolHook.Will("execute", { priority: 100 })
+  import_sdk.ToolHook.Will("execute", { priority: 100 })
 ], ApprovalCheckPlugin.prototype, "checkApproval", 1);
 ApprovalCheckPlugin = __decorateClass([
-  (0, import_sdk2.Plugin)({
+  (0, import_sdk.Plugin)({
     name: "approval:check",
     description: "Checks tool approval state before execution"
   })
 ], ApprovalCheckPlugin);
 
 // plugins/plugin-approval/src/services/approval.service.ts
-var import_sdk3 = require("@frontmcp/sdk");
+var import_sdk2 = require("@frontmcp/sdk");
 var ApprovalService = class {
   constructor(store, sessionId, userId) {
     this.store = store;
@@ -731,10 +730,10 @@ var ApprovalService = class {
   }
 };
 ApprovalService = __decorateClass([
-  (0, import_sdk3.Provider)({
+  (0, import_sdk2.Provider)({
     name: "provider:approval:service",
     description: "Service for managing tool approvals",
-    scope: import_sdk3.ProviderScope.CONTEXT
+    scope: import_sdk2.ProviderScope.CONTEXT
   })
 ], ApprovalService);
 function createApprovalService(store, sessionId, userId) {
@@ -742,7 +741,7 @@ function createApprovalService(store, sessionId, userId) {
 }
 
 // plugins/plugin-approval/src/services/challenge.service.ts
-var import_sdk4 = require("@frontmcp/sdk");
+var import_sdk3 = require("@frontmcp/sdk");
 var import_utils2 = require("@frontmcp/utils");
 var ChallengeService = class {
   storage;
@@ -876,10 +875,10 @@ var ChallengeService = class {
   }
 };
 ChallengeService = __decorateClass([
-  (0, import_sdk4.Provider)({
+  (0, import_sdk3.Provider)({
     name: "provider:approval:challenge-service",
     description: "PKCE challenge service for webhook approval flows",
-    scope: import_sdk4.ProviderScope.GLOBAL
+    scope: import_sdk3.ProviderScope.GLOBAL
   })
 ], ChallengeService);
 function generatePkcePairFromVerifier(codeVerifier) {
@@ -897,7 +896,7 @@ function createMemoryChallengeService(options = {}) {
 }
 
 // plugins/plugin-approval/src/stores/approval-storage.store.ts
-var import_sdk5 = require("@frontmcp/sdk");
+var import_sdk4 = require("@frontmcp/sdk");
 var import_utils3 = require("@frontmcp/utils");
 function escapePattern(str) {
   return str.replace(/[*?[\]\\]/g, "\\$&");
@@ -1146,10 +1145,10 @@ var ApprovalStorageStore = class {
   }
 };
 ApprovalStorageStore = __decorateClass([
-  (0, import_sdk5.Provider)({
+  (0, import_sdk4.Provider)({
     name: "provider:approval:store:storage",
     description: "Storage-backed approval store (supports Memory, Redis, Vercel KV, Upstash)",
-    scope: import_sdk5.ProviderScope.GLOBAL
+    scope: import_sdk4.ProviderScope.GLOBAL
   })
 ], ApprovalStorageStore);
 function createApprovalMemoryStore(options = {}) {
@@ -1161,7 +1160,7 @@ function createApprovalMemoryStore(options = {}) {
 }
 
 // plugins/plugin-approval/src/approval.plugin.ts
-var ApprovalPlugin = class extends import_sdk6.DynamicPlugin {
+var ApprovalPlugin = class extends import_sdk5.DynamicPlugin {
   options;
   constructor(options = {}) {
     super();
@@ -1222,8 +1221,8 @@ __publicField(ApprovalPlugin, "dynamicProviders", (options) => {
   providers.push({
     name: "approval:service",
     provide: ApprovalServiceToken,
-    scope: import_sdk6.ProviderScope.CONTEXT,
-    inject: () => [ApprovalStoreToken, import_sdk6.FRONTMCP_CONTEXT],
+    scope: import_sdk5.ProviderScope.CONTEXT,
+    inject: () => [ApprovalStoreToken, import_sdk5.FRONTMCP_CONTEXT],
     useFactory: (store, ctx) => {
       const { sessionId, userId } = resolveApprovalIdentity(ctx);
       return createApprovalService(store, sessionId, userId);
@@ -1232,7 +1231,7 @@ __publicField(ApprovalPlugin, "dynamicProviders", (options) => {
   return providers;
 });
 ApprovalPlugin = __decorateClass([
-  (0, import_sdk6.Plugin)({
+  (0, import_sdk5.Plugin)({
     name: "approval",
     description: "Tool authorization workflow with PKCE webhook security",
     plugins: [ApprovalCheckPlugin],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-approval",
-  "version": "1.8.1",
+  "version": "1.8.2",
   "description": "Approval plugin for FrontMCP - tool authorization workflow with PKCE webhook security",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.8.1",
-    "@frontmcp/utils": "1.8.1",
+    "@frontmcp/sdk": "1.8.2",
+    "@frontmcp/utils": "1.8.2",
     "ioredis": "^5.8.0",
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.1",
+    "@frontmcp/lazy-zod": "1.8.2",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {