@frontmcp/sdk 0.12.2 → 1.0.0-beta.2

package/common/types/options/auth/interfaces.d.ts

@@ -1,431 +1,2 @@
-import { JSONWebKeySet, JWK } from '../../auth';
-import type { RedisConfig } from '@frontmcp/auth';
-/**
- * Public access configuration for tools/prompts
- */
-export interface PublicAccessConfig {
-    /**
-     * Allow all tools or explicit whitelist
-     * @default 'all'
-     */
-    tools?: 'all' | string[];
-    /**
-     * Allow all prompts or explicit whitelist
-     * @default 'all'
-     */
-    prompts?: 'all' | string[];
-    /**
-     * Rate limit per IP per minute
-     * @default 60
-     */
-    rateLimit?: number;
-}
-/**
- * Local signing configuration (for orchestrated local type)
- */
-export interface LocalSigningConfig {
-    /**
-     * Private key for signing orchestrated tokens
-     * @default auto-generated
-     */
-    signKey?: JWK | Uint8Array;
-    /**
-     * JWKS for token verification
-     * @default auto-generated
-     */
-    jwks?: JSONWebKeySet;
-    /**
-     * Issuer identifier for orchestrated tokens
-     * @default auto-derived from server URL
-     */
-    issuer?: string;
-}
-/**
- * Remote OAuth provider configuration (for orchestrated remote and transparent)
- */
-export interface RemoteProviderConfig {
-    /**
-     * OAuth provider base URL
-     * @example 'https://auth.example.com'
-     */
-    provider: string;
-    /** Provider display name */
-    name?: string;
-    /**
-     * Unique identifier for this provider
-     * @default derived from provider URL
-     */
-    id?: string;
-    /**
-     * Inline JWKS for offline token verification
-     * Falls back to fetching from provider's /.well-known/jwks.json
-     */
-    jwks?: JSONWebKeySet;
-    /** Custom JWKS URI if not at standard path */
-    jwksUri?: string;
-    /** Client ID for this MCP server (for orchestrated mode) */
-    clientId?: string;
-    /** Client secret (for confidential clients in orchestrated mode) */
-    clientSecret?: string;
-    /** Scopes to request from the upstream provider */
-    scopes?: string[];
-    /**
-     * Enable Dynamic Client Registration (DCR)
-     * @default false
-     */
-    dcrEnabled?: boolean;
-    /** Authorization endpoint override */
-    authEndpoint?: string;
-    /** Token endpoint override */
-    tokenEndpoint?: string;
-    /** Registration endpoint override (for DCR) */
-    registrationEndpoint?: string;
-    /** User info endpoint override */
-    userInfoEndpoint?: string;
-}
-/**
- * Token storage - in-memory
- */
-export interface TokenStorageMemory {
-    type: 'memory';
-}
-/**
- * Token storage - Redis
- */
-export interface TokenStorageRedis {
-    type: 'redis';
-    config: RedisConfig;
-}
-/**
- * Token storage configuration for orchestrated mode
- */
-export type TokenStorageConfig = TokenStorageMemory | TokenStorageRedis;
-/**
- * Token refresh configuration
- */
-export interface TokenRefreshConfig {
-    /**
-     * Enable automatic token refresh
-     * @default true
-     */
-    enabled?: boolean;
-    /**
-     * Refresh token before expiry by this many seconds
-     * @default 60
-     */
-    skewSeconds?: number;
-}
-/**
- * Behavior when a tool from a skipped (not yet authorized) app is called
- */
-export type SkippedAppBehavior = 'anonymous' | 'require-auth';
-/**
- * Consent configuration for tool selection
- */
-export interface ConsentConfig {
-    /**
-     * Enable consent flow for tool selection
-     * @default false
-     */
-    enabled?: boolean;
-    /**
-     * Group tools by app in the consent UI
-     * @default true
-     */
-    groupByApp?: boolean;
-    /**
-     * Show tool descriptions in consent UI
-     * @default true
-     */
-    showDescriptions?: boolean;
-    /**
-     * Allow selecting all tools at once
-     * @default true
-     */
-    allowSelectAll?: boolean;
-    /**
-     * Require at least one tool to be selected
-     * @default true
-     */
-    requireSelection?: boolean;
-    /** Custom message to display on consent page */
-    customMessage?: string;
-    /**
-     * Remember consent for future sessions
-     * @default true
-     */
-    rememberConsent?: boolean;
-    /** Tools to exclude from consent (always available) */
-    excludedTools?: string[];
-    /** Tools to always include in consent (pre-selected) */
-    defaultSelectedTools?: string[];
-}
-/**
- * Federated authentication configuration
- */
-export interface FederatedAuthConfig {
-    /**
-     * How strictly to validate the OAuth state parameter on provider callbacks.
-     * - 'strict': Validates the full state parameter matches the session (recommended)
-     * - 'format': Only validates the state format is correct
-     */
-    stateValidation: 'strict' | 'format';
-}
-/**
- * Progressive/Incremental authorization configuration
- */
-export interface IncrementalAuthConfig {
-    /**
-     * Enable incremental (progressive) authorization
-     * @default true
-     */
-    enabled?: boolean;
-    /**
-     * Behavior when a tool from a skipped app is called
-     * @default 'anonymous'
-     */
-    skippedAppBehavior?: SkippedAppBehavior;
-    /**
-     * Allow users to skip app authorization during initial auth flow
-     * @default true
-     */
-    allowSkip?: boolean;
-    /**
-     * Show all apps in a single authorization page (vs step-by-step)
-     * @default true
-     */
-    showAllAppsAtOnce?: boolean;
-}
-/**
- * Public mode - No authentication required
- *
- * Use this for MCP servers that don't require authentication.
- * All tools and prompts are available to anyone.
- *
- * @example
- * ```typescript
- * auth: {
- *   mode: 'public',
- *   sessionTtl: 3600,
- * }
- * ```
- */
-export interface PublicAuthOptionsInterface {
-    mode: 'public';
-    /**
-     * Issuer identifier for anonymous JWTs
-     * @default auto-derived from server URL
-     */
-    issuer?: string;
-    /**
-     * Anonymous session TTL in seconds
-     * @default 3600 (1 hour)
-     */
-    sessionTtl?: number;
-    /**
-     * Scopes granted to anonymous sessions
-     * @default ['anonymous']
-     */
-    anonymousScopes?: string[];
-    /** Tool/prompt access configuration for anonymous users */
-    publicAccess?: PublicAccessConfig;
-    /**
-     * JWKS for token verification
-     * @default auto-generated
-     */
-    jwks?: JSONWebKeySet;
-    /**
-     * Private key for signing anonymous tokens
-     * @default auto-generated
-     */
-    signKey?: JWK | Uint8Array;
-}
-/**
- * Transparent mode - Pass-through OAuth tokens from remote provider
- *
- * Use this when tokens come from an external OAuth provider
- * and you want to validate them without issuing new tokens.
- *
- * @example
- * ```typescript
- * auth: {
- *   mode: 'transparent',
- *   remote: {
- *     provider: 'https://auth.example.com',
- *   },
- * }
- * ```
- */
-export interface TransparentAuthOptionsInterface {
-    mode: 'transparent';
-    /** Remote OAuth provider configuration (required) */
-    remote: RemoteProviderConfig;
-    /** Expected token audience */
-    expectedAudience?: string | string[];
-    /**
-     * Required scopes for access
-     * @default []
-     */
-    requiredScopes?: string[];
-    /**
-     * Allow anonymous fallback when no token is provided
-     * @default false
-     */
-    allowAnonymous?: boolean;
-    /**
-     * Scopes granted to anonymous sessions (when allowAnonymous=true)
-     * @default ['anonymous']
-     */
-    anonymousScopes?: string[];
-    /** Public access config for anonymous users */
-    publicAccess?: PublicAccessConfig;
-}
-/**
- * Orchestrated local mode - Full local authentication
- *
- * Use this when you want the MCP server to handle authentication
- * entirely without any external OAuth provider.
- *
- * @example
- * ```typescript
- * auth: {
- *   mode: 'orchestrated',
- *   type: 'local',
- *   allowDefaultPublic: false,
- * }
- * ```
- */
-export interface OrchestratedLocalOptionsInterface {
-    mode: 'orchestrated';
-    type: 'local';
-    /** Local signing configuration */
-    local?: LocalSigningConfig;
-    /**
-     * Token storage configuration
-     * @default { type: 'memory' }
-     */
-    tokenStorage?: TokenStorageConfig;
-    /**
-     * Allow default public access for unauthenticated requests
-     * @default false
-     */
-    allowDefaultPublic?: boolean;
-    /**
-     * Scopes granted to anonymous sessions
-     * @default ['anonymous']
-     */
-    anonymousScopes?: string[];
-    /** Public access config */
-    publicAccess?: PublicAccessConfig;
-    /** Consent flow configuration */
-    consent?: ConsentConfig;
-    /** Federated auth configuration */
-    federatedAuth?: FederatedAuthConfig;
-    /** Token refresh settings */
-    refresh?: TokenRefreshConfig;
-    /** Expected token audience */
-    expectedAudience?: string | string[];
-    /** Incremental authorization configuration */
-    incrementalAuth?: IncrementalAuthConfig;
-}
-/**
- * Orchestrated remote mode - Proxy to remote OAuth provider
- *
- * Use this when you want the MCP server to act as an OAuth client
- * that authenticates users via an external provider.
- *
- * @example
- * ```typescript
- * auth: {
- *   mode: 'orchestrated',
- *   type: 'remote',
- *   remote: {
- *     provider: 'https://auth.example.com',
- *     clientId: 'my-mcp-server',
- *   },
- * }
- * ```
- */
-export interface OrchestratedRemoteOptionsInterface {
-    mode: 'orchestrated';
-    type: 'remote';
-    /** Remote OAuth provider configuration (required) */
-    remote: RemoteProviderConfig;
-    /** Local signing configuration */
-    local?: LocalSigningConfig;
-    /**
-     * Token storage configuration
-     * @default { type: 'memory' }
-     */
-    tokenStorage?: TokenStorageConfig;
-    /**
-     * Allow default public access for unauthenticated requests
-     * @default false
-     */
-    allowDefaultPublic?: boolean;
-    /**
-     * Scopes granted to anonymous sessions
-     * @default ['anonymous']
-     */
-    anonymousScopes?: string[];
-    /** Public access config */
-    publicAccess?: PublicAccessConfig;
-    /** Consent flow configuration */
-    consent?: ConsentConfig;
-    /** Federated auth configuration */
-    federatedAuth?: FederatedAuthConfig;
-    /** Token refresh settings */
-    refresh?: TokenRefreshConfig;
-    /** Expected token audience */
-    expectedAudience?: string | string[];
-    /** Incremental authorization configuration */
-    incrementalAuth?: IncrementalAuthConfig;
-}
-/**
- * Authentication configuration for @FrontMcp decorator
- *
- * Choose one of:
- * - `mode: 'public'` - No authentication required
- * - `mode: 'transparent'` - Validate tokens from external OAuth provider
- * - `mode: 'orchestrated', type: 'local'` - Full local authentication
- * - `mode: 'orchestrated', type: 'remote'` - Proxy to external OAuth provider
- *
- * @example Public mode
- * ```typescript
- * auth: { mode: 'public' }
- * ```
- *
- * @example Transparent mode
- * ```typescript
- * auth: {
- *   mode: 'transparent',
- *   remote: { provider: 'https://auth.example.com' },
- * }
- * ```
- *
- * @example Orchestrated remote mode
- * ```typescript
- * auth: {
- *   mode: 'orchestrated',
- *   type: 'remote',
- *   remote: {
- *     provider: 'https://auth.example.com',
- *     clientId: 'my-client',
- *   },
- * }
- * ```
- */
-export type AuthOptionsInterface = PublicAuthOptionsInterface | TransparentAuthOptionsInterface | OrchestratedLocalOptionsInterface | OrchestratedRemoteOptionsInterface;
-/**
- * Orchestrated mode options (local or remote)
- */
-export type OrchestratedAuthOptionsInterface = OrchestratedLocalOptionsInterface | OrchestratedRemoteOptionsInterface;
-/**
- * Authentication mode
- */
-export type AuthMode = 'public' | 'transparent' | 'orchestrated';
-/**
- * Orchestrated type
- */
-export type OrchestratedType = 'local' | 'remote';
+export type { PublicAccessConfig, LocalSigningConfig, ProviderConfig, RemoteProviderConfig, TokenStorageConfig, TokenRefreshConfig, SkippedAppBehavior, ConsentConfig, FederatedAuthConfig, IncrementalAuthConfig, PublicAuthOptionsInterface, TransparentAuthOptionsInterface, LocalAuthOptionsInterface, RemoteAuthOptionsInterface, LocalOrRemoteAuthOptionsInterface, AuthOptionsInterface, AuthMode, OrchestratedLocalOptionsInterface, OrchestratedRemoteOptionsInterface, OrchestratedAuthOptionsInterface, OrchestratedType, } from '@frontmcp/auth';
 //# sourceMappingURL=interfaces.d.ts.map

package/common/types/options/auth/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../../../../src/common/types/options/auth/interfaces.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAMlD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,GAAG,GAAG,UAAU,CAAC;IAE3B;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,+CAA+C;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,cAAc,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,wDAAwD;IACxD,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,eAAe,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IAExC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAMD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,QAAQ,CAAC;IAEf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,2DAA2D;IAC3D,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB;;;OAGG;IACH,OAAO,CAAC,EAAE,GAAG,GAAG,UAAU,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,aAAa,CAAC;IAEpB,qDAAqD;IACrD,MAAM,EAAE,oBAAoB,CAAC;IAE7B,8BAA8B;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAErC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,+CAA+C;IAC/C,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IAEd,kCAAkC;IAClC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAE3B;;;OAGG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,2BAA2B;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC,iCAAiC;IACjC,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,mCAAmC;IACnC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC,6BAA6B;IAC7B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAE7B,8BAA8B;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAErC,8CAA8C;IAC9C,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,kCAAkC;IACjD,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,QAAQ,CAAC;IAEf,qDAAqD;IACrD,MAAM,EAAE,oBAAoB,CAAC;IAE7B,kCAAkC;IAClC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAE3B;;;OAGG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,2BAA2B;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC,iCAAiC;IACjC,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,mCAAmC;IACnC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC,6BAA6B;IAC7B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAE7B,8BAA8B;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAErC,8CAA8C;IAC9C,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,MAAM,oBAAoB,GAC5B,0BAA0B,GAC1B,+BAA+B,GAC/B,iCAAiC,GACjC,kCAAkC,CAAC;AAEvC;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,iCAAiC,GAAG,kCAAkC,CAAC;AAEtH;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,cAAc,CAAC;AAEjE;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../../../../src/common/types/options/auth/interfaces.ts"],"names":[],"mappings":"AACA,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,0BAA0B,EAC1B,iCAAiC,EACjC,oBAAoB,EACpB,QAAQ,EAER,iCAAiC,EACjC,kCAAkC,EAClC,gCAAgC,EAChC,gBAAgB,GACjB,MAAM,gBAAgB,CAAC"}