@frontmcp/sdk 0.2.5 → 0.3.0

package/src/auth/flows/session.verify.flow.d.ts

@@ -0,0 +1,404 @@
+import { FlowBase, FlowRunOptions } from '../../common';
+import 'reflect-metadata';
+import { z } from 'zod';
+declare const inputSchema: z.ZodObject<{
+    request: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+}, "strip", z.ZodTypeAny, {
+    request: {} & {
+        [k: string]: unknown;
+    };
+}, {
+    request: {} & {
+        [k: string]: unknown;
+    };
+}>;
+declare const stateSchema: z.ZodObject<{
+    baseUrl: z.ZodString;
+    authorizationHeader: z.ZodOptional<z.ZodString>;
+    token: z.ZodOptional<z.ZodString>;
+    sessionIdHeader: z.ZodOptional<z.ZodString>;
+    sessionProtocol: z.ZodOptional<z.ZodString>;
+    prmMetadataPath: z.ZodOptional<z.ZodString>;
+    prmMetadataHeader: z.ZodOptional<z.ZodString>;
+    jwtPayload: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
+    user: z.ZodOptional<z.ZodObject<{
+        iss: z.ZodString;
+        sid: z.ZodOptional<z.ZodString>;
+        sub: z.ZodString;
+        exp: z.ZodOptional<z.ZodNumber>;
+        iat: z.ZodOptional<z.ZodNumber>;
+        aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+        email: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+        preferred_username: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        picture: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        iss: z.ZodString;
+        sid: z.ZodOptional<z.ZodString>;
+        sub: z.ZodString;
+        exp: z.ZodOptional<z.ZodNumber>;
+        iat: z.ZodOptional<z.ZodNumber>;
+        aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+        email: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+        preferred_username: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        picture: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        iss: z.ZodString;
+        sid: z.ZodOptional<z.ZodString>;
+        sub: z.ZodString;
+        exp: z.ZodOptional<z.ZodNumber>;
+        iat: z.ZodOptional<z.ZodNumber>;
+        aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+        email: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+        preferred_username: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        picture: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>>;
+    session: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        payload: z.ZodObject<{
+            nodeId: z.ZodString;
+            authSig: z.ZodString;
+            uuid: z.ZodString;
+            iat: z.ZodNumber;
+            protocol: z.ZodEnum<["legacy-sse", "sse", "streamable-http", "stateful-http", "stateless-http"]>;
+        }, "strip", z.ZodTypeAny, {
+            uuid: string;
+            nodeId: string;
+            authSig: string;
+            iat: number;
+            protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+        }, {
+            uuid: string;
+            nodeId: string;
+            authSig: string;
+            iat: number;
+            protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        payload: {
+            uuid: string;
+            nodeId: string;
+            authSig: string;
+            iat: number;
+            protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+        };
+    }, {
+        id: string;
+        payload: {
+            uuid: string;
+            nodeId: string;
+            authSig: string;
+            iat: number;
+            protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+        };
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    baseUrl: string;
+    session?: {
+        id: string;
+        payload: {
+            uuid: string;
+            nodeId: string;
+            authSig: string;
+            iat: number;
+            protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+        };
+    } | undefined;
+    prmMetadataHeader?: string | undefined;
+    token?: string | undefined;
+    user?: z.objectOutputType<{
+        iss: z.ZodString;
+        sid: z.ZodOptional<z.ZodString>;
+        sub: z.ZodString;
+        exp: z.ZodOptional<z.ZodNumber>;
+        iat: z.ZodOptional<z.ZodNumber>;
+        aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+        email: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+        preferred_username: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        picture: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
+    authorizationHeader?: string | undefined;
+    sessionIdHeader?: string | undefined;
+    sessionProtocol?: string | undefined;
+    prmMetadataPath?: string | undefined;
+    jwtPayload?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
+}, {
+    baseUrl: string;
+    session?: {
+        id: string;
+        payload: {
+            uuid: string;
+            nodeId: string;
+            authSig: string;
+            iat: number;
+            protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+        };
+    } | undefined;
+    prmMetadataHeader?: string | undefined;
+    token?: string | undefined;
+    user?: z.objectInputType<{
+        iss: z.ZodString;
+        sid: z.ZodOptional<z.ZodString>;
+        sub: z.ZodString;
+        exp: z.ZodOptional<z.ZodNumber>;
+        iat: z.ZodOptional<z.ZodNumber>;
+        aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+        email: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+        preferred_username: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        picture: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
+    authorizationHeader?: string | undefined;
+    sessionIdHeader?: string | undefined;
+    sessionProtocol?: string | undefined;
+    prmMetadataPath?: string | undefined;
+    jwtPayload?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
+}>;
+export declare const sessionVerifyOutputSchema: z.ZodUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"unauthorized">;
+    prmMetadataHeader: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    kind: "unauthorized";
+    prmMetadataHeader: string;
+}, {
+    kind: "unauthorized";
+    prmMetadataHeader: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"authorized">;
+    authorization: z.ZodObject<{
+        token: z.ZodString;
+        session: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+            payload: z.ZodObject<{
+                nodeId: z.ZodString;
+                authSig: z.ZodString;
+                uuid: z.ZodString;
+                iat: z.ZodNumber;
+                protocol: z.ZodEnum<["legacy-sse", "sse", "streamable-http", "stateful-http", "stateless-http"]>;
+            }, "strip", z.ZodTypeAny, {
+                uuid: string;
+                nodeId: string;
+                authSig: string;
+                iat: number;
+                protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+            }, {
+                uuid: string;
+                nodeId: string;
+                authSig: string;
+                iat: number;
+                protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+            }>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            payload: {
+                uuid: string;
+                nodeId: string;
+                authSig: string;
+                iat: number;
+                protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+            };
+        }, {
+            id: string;
+            payload: {
+                uuid: string;
+                nodeId: string;
+                authSig: string;
+                iat: number;
+                protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+            };
+        }>>;
+        user: z.ZodObject<{
+            iss: z.ZodString;
+            sid: z.ZodOptional<z.ZodString>;
+            sub: z.ZodString;
+            exp: z.ZodOptional<z.ZodNumber>;
+            iat: z.ZodOptional<z.ZodNumber>;
+            aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+            email: z.ZodOptional<z.ZodString>;
+            username: z.ZodOptional<z.ZodString>;
+            preferred_username: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+            picture: z.ZodOptional<z.ZodString>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            iss: z.ZodString;
+            sid: z.ZodOptional<z.ZodString>;
+            sub: z.ZodString;
+            exp: z.ZodOptional<z.ZodNumber>;
+            iat: z.ZodOptional<z.ZodNumber>;
+            aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+            email: z.ZodOptional<z.ZodString>;
+            username: z.ZodOptional<z.ZodString>;
+            preferred_username: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+            picture: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            iss: z.ZodString;
+            sid: z.ZodOptional<z.ZodString>;
+            sub: z.ZodString;
+            exp: z.ZodOptional<z.ZodNumber>;
+            iat: z.ZodOptional<z.ZodNumber>;
+            aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+            email: z.ZodOptional<z.ZodString>;
+            username: z.ZodOptional<z.ZodString>;
+            preferred_username: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+            picture: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">>;
+    }, "strip", z.ZodTypeAny, {
+        token: string;
+        user: {
+            sub: string;
+            iss: string;
+            name?: string | undefined;
+            email?: string | undefined;
+            iat?: number | undefined;
+            sid?: string | undefined;
+            exp?: number | undefined;
+            aud?: string | string[] | undefined;
+            username?: string | undefined;
+            preferred_username?: string | undefined;
+            picture?: string | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        session?: {
+            id: string;
+            payload: {
+                uuid: string;
+                nodeId: string;
+                authSig: string;
+                iat: number;
+                protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+            };
+        } | undefined;
+    }, {
+        token: string;
+        user: {
+            sub: string;
+            iss: string;
+            name?: string | undefined;
+            email?: string | undefined;
+            iat?: number | undefined;
+            sid?: string | undefined;
+            exp?: number | undefined;
+            aud?: string | string[] | undefined;
+            username?: string | undefined;
+            preferred_username?: string | undefined;
+            picture?: string | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        session?: {
+            id: string;
+            payload: {
+                uuid: string;
+                nodeId: string;
+                authSig: string;
+                iat: number;
+                protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+            };
+        } | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    kind: "authorized";
+    authorization: {
+        token: string;
+        user: {
+            sub: string;
+            iss: string;
+            name?: string | undefined;
+            email?: string | undefined;
+            iat?: number | undefined;
+            sid?: string | undefined;
+            exp?: number | undefined;
+            aud?: string | string[] | undefined;
+            username?: string | undefined;
+            preferred_username?: string | undefined;
+            picture?: string | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        session?: {
+            id: string;
+            payload: {
+                uuid: string;
+                nodeId: string;
+                authSig: string;
+                iat: number;
+                protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+            };
+        } | undefined;
+    };
+}, {
+    kind: "authorized";
+    authorization: {
+        token: string;
+        user: {
+            sub: string;
+            iss: string;
+            name?: string | undefined;
+            email?: string | undefined;
+            iat?: number | undefined;
+            sid?: string | undefined;
+            exp?: number | undefined;
+            aud?: string | string[] | undefined;
+            username?: string | undefined;
+            preferred_username?: string | undefined;
+            picture?: string | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        session?: {
+            id: string;
+            payload: {
+                uuid: string;
+                nodeId: string;
+                authSig: string;
+                iat: number;
+                protocol: "sse" | "legacy-sse" | "streamable-http" | "stateful-http" | "stateless-http";
+            };
+        } | undefined;
+    };
+}>]>;
+declare const plan: {
+    readonly pre: ["parseInput", "requireAuthorizationHeader", "verifyIfJwt"];
+    readonly execute: ["deriveUser", "parseSessionHeader", "buildAuthorizedOutput"];
+};
+declare global {
+    interface ExtendFlows {
+        'session:verify': FlowRunOptions<SessionVerifyFlow, typeof plan, typeof inputSchema, typeof sessionVerifyOutputSchema, typeof stateSchema>;
+    }
+}
+declare const name: "session:verify";
+export default class SessionVerifyFlow extends FlowBase<typeof name> {
+    parseInput(): Promise<void>;
+    requireAuthorizationOrChallenge(): Promise<void>;
+    /**
+     * If Authorization is a JWT:
+     *  - Attempt verification against any known / cached public keys we have (gateway/local)
+     *  - If verification fails → 401
+     *  - If verification ok → capture payload
+     * If NOT a JWT:
+     *  - we do NOT attempt verification, just pass the raw token through
+     */
+    verifyIfJwt(): Promise<void>;
+    deriveUser(): Promise<void>;
+    /**
+     * Parse the session header (mcp-session-id)
+     * - If session id is present, validate it
+     * - If valid, capture the session info
+     * - If NOT valid, ignore (no session)
+     */
+    parseSessionHeader(): Promise<void>;
+    buildAuthorizedOutput(): Promise<void>;
+}
+export {};

package/src/auth/flows/session.verify.flow.js

@@ -0,0 +1,205 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionVerifyOutputSchema = void 0;
+const tslib_1 = require("tslib");
+// auth/flows/session.verify.flow.ts
+const common_1 = require("../../common");
+require("reflect-metadata");
+const zod_1 = require("zod");
+const path_utils_1 = require("../path.utils");
+const auth_token_utils_1 = require("../session/utils/auth-token.utils");
+const jwks_1 = require("../jwks");
+const session_id_utils_1 = require("../session/utils/session-id.utils");
+const inputSchema = common_1.httpRequestInputSchema;
+const stateSchema = zod_1.z.object({
+    baseUrl: zod_1.z.string().min(1),
+    authorizationHeader: zod_1.z.string().optional(),
+    token: zod_1.z.string().optional(),
+    sessionIdHeader: zod_1.z.string().optional(), // 'mcp-session-id'
+    sessionProtocol: zod_1.z.string().optional(), // 'sse/http/streamable-http'
+    prmMetadataPath: zod_1.z.string().optional(),
+    prmMetadataHeader: zod_1.z.string().optional(),
+    jwtPayload: zod_1.z.object({}).passthrough().optional(),
+    user: common_1.userClaimSchema.optional(),
+    session: common_1.sessionIdSchema.optional(),
+});
+const UnauthorizedSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal('unauthorized'),
+    prmMetadataHeader: zod_1.z.string().describe('Path to protected resource metadata'),
+})
+    .describe('401 Unauthorized with \'WWW-Authenticate\' header for requesting authentication\'');
+const AuthorizedSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal('authorized'),
+    authorization: common_1.authorizationSchema.describe('Session information if session id is present'),
+})
+    .describe('Authorized session information');
+exports.sessionVerifyOutputSchema = zod_1.z.union([UnauthorizedSchema, AuthorizedSchema]);
+const plan = {
+    pre: ['parseInput', 'requireAuthorizationHeader', 'verifyIfJwt'],
+    execute: ['deriveUser', 'parseSessionHeader', 'buildAuthorizedOutput'],
+};
+const name = 'session:verify';
+const Stage = (0, common_1.StageHookOf)(name);
+let SessionVerifyFlow = class SessionVerifyFlow extends common_1.FlowBase {
+    async parseInput() {
+        const { request } = this.rawInput;
+        const entryPath = (0, path_utils_1.normalizeEntryPrefix)(this.scope.entryPath);
+        const routeBase = (0, path_utils_1.normalizeScopeBase)(this.scope.routeBase);
+        const baseUrl = (0, path_utils_1.getRequestBaseUrl)(request, entryPath);
+        const authorizationHeader = request.headers?.['authorization'] ?? undefined;
+        const httpTransportHeader = request.headers?.['http-transport'];
+        const sessionIdRawHeader = request.headers?.['mcp-session-id'];
+        const sessionIdQuery = request.query['sessionId'];
+        const sessionIdHeader = sessionIdRawHeader ?? sessionIdQuery ?? undefined;
+        const sessionProtocol = httpTransportHeader
+            ? 'http'
+            : sessionIdHeader
+                ? 'streamable-http'
+                : sessionIdQuery
+                    ? 'sse'
+                    : undefined;
+        const token = (0, auth_token_utils_1.extractBearerToken)(authorizationHeader);
+        const prmMetadataPath = `/.well-known/oauth-protected-resource${entryPath}${routeBase}`;
+        const prmMetadataHeader = `Bearer resource_metadata="${baseUrl}${prmMetadataPath}"`;
+        this.state.set({
+            baseUrl,
+            authorizationHeader,
+            token,
+            sessionIdHeader,
+            sessionProtocol,
+            prmMetadataPath,
+            prmMetadataHeader,
+        });
+    }
+    async requireAuthorizationOrChallenge() {
+        this.respond({
+            kind: 'unauthorized',
+            prmMetadataHeader: this.state.required.prmMetadataHeader,
+        });
+    }
+    /**
+     * If Authorization is a JWT:
+     *  - Attempt verification against any known / cached public keys we have (gateway/local)
+     *  - If verification fails → 401
+     *  - If verification ok → capture payload
+     * If NOT a JWT:
+     *  - we do NOT attempt verification, just pass the raw token through
+     */
+    async verifyIfJwt() {
+        const jwks = this.get(jwks_1.JwksService); // TODO: fix providers
+        const token = this.state.required.token;
+        if (!(0, auth_token_utils_1.isJwt)(token)) {
+            // Non-JWT tokens are passed through; user will be mostly empty (the best effort later).
+            this.respond({
+                kind: 'unauthorized',
+                prmMetadataHeader: this.state.required.prmMetadataHeader,
+            });
+            return;
+        }
+        // Best-effort verification using locally known keys (gateway/local provider cache).
+        let verify;
+        if (this.scope.auth.options.type === 'local') { // TODO: fix
+            verify = jwks.verifyGatewayToken(token, this.state.required.baseUrl);
+        }
+        else {
+            const primary = this.scope.auth.options;
+            const issuer = this.scope.auth.issuer;
+            const providerRefs = [
+                {
+                    id: primary.id ?? 'default',
+                    issuerUrl: issuer,
+                    jwks: primary.jwks,
+                    jwksUri: primary.jwksUri,
+                },
+            ];
+            verify = jwks.verifyTransparentToken(token, providerRefs);
+        }
+        const result = await verify;
+        if (result.ok) {
+            this.state.set({ jwtPayload: result.payload });
+            return;
+        }
+        this.respond({
+            kind: 'unauthorized',
+            prmMetadataHeader: this.state.required.prmMetadataHeader,
+        });
+    }
+    async deriveUser() {
+        this.state.set('user', (0, auth_token_utils_1.deriveTypedUser)(this.state.required.jwtPayload ?? {}));
+    }
+    /**
+     * Parse the session header (mcp-session-id)
+     * - If session id is present, validate it
+     * - If valid, capture the session info
+     * - If NOT valid, ignore (no session)
+     */
+    async parseSessionHeader() {
+        const { sessionIdHeader, required: { token } } = this.state;
+        const session = (0, session_id_utils_1.parseSessionHeader)(sessionIdHeader, token);
+        if (session) {
+            this.state.set('session', session);
+        }
+    }
+    async buildAuthorizedOutput() {
+        const { required: { token, user }, session, } = this.state;
+        this.respond({
+            kind: 'authorized',
+            authorization: {
+                token,
+                user,
+                session,
+            },
+        });
+    }
+};
+tslib_1.__decorate([
+    Stage('parseInput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], SessionVerifyFlow.prototype, "parseInput", null);
+tslib_1.__decorate([
+    Stage('requireAuthorizationHeader', {
+        filter: ({ state }) => !state.authorizationHeader,
+    }),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], SessionVerifyFlow.prototype, "requireAuthorizationOrChallenge", null);
+tslib_1.__decorate([
+    Stage('verifyIfJwt'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], SessionVerifyFlow.prototype, "verifyIfJwt", null);
+tslib_1.__decorate([
+    Stage('deriveUser'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], SessionVerifyFlow.prototype, "deriveUser", null);
+tslib_1.__decorate([
+    Stage('parseSessionHeader'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], SessionVerifyFlow.prototype, "parseSessionHeader", null);
+tslib_1.__decorate([
+    Stage('buildAuthorizedOutput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], SessionVerifyFlow.prototype, "buildAuthorizedOutput", null);
+SessionVerifyFlow = tslib_1.__decorate([
+    (0, common_1.Flow)({
+        name,
+        plan,
+        inputSchema,
+        outputSchema: exports.sessionVerifyOutputSchema,
+        access: 'authorized',
+    })
+], SessionVerifyFlow);
+exports.default = SessionVerifyFlow;
+//# sourceMappingURL=session.verify.flow.js.map

package/src/auth/flows/session.verify.flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.verify.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/session.verify.flow.ts"],"names":[],"mappings":";;;;AAAA,oCAAoC;AACpC,yCAMsB;AACtB,4BAA0B;AAC1B,6BAAsB;AACtB,8CAA0F;AAC1F,wEAI2C;AAC3C,kCAAqE;AACrE,wEAAqE;AAGrE,MAAM,WAAW,GAAG,+BAAsB,CAAC;AAE3C,MAAM,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,mBAAmB;IAC3D,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,6BAA6B;IACrE,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACjD,IAAI,EAAE,wBAAe,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,wBAAe,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,OAAC;KACzB,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;CAC9E,CAAC;KACD,QAAQ,CAAC,mFAAmF,CAAC,CAAC;AAEjG,MAAM,gBAAgB,GAAG,OAAC;KACvB,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,aAAa,EAAE,4BAAmB,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAC5F,CAAC;KACD,QAAQ,CAAC,gCAAgC,CAAC,CAAC;AAGjC,QAAA,yBAAyB,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEzF,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,CAAC,YAAY,EAAE,4BAA4B,EAAE,aAAa,CAAC;IAChE,OAAO,EAAE,CAAC,YAAY,EAAE,oBAAoB,EAAE,uBAAuB,CAAC;CACnC,CAAC;AActC,MAAM,IAAI,GAAG,gBAAyB,CAAC;AACvC,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AASjB,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,iBAAqB;IAI5D,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,SAAS,GAAG,IAAA,iCAAoB,EAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAA,+BAAkB,EAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAA,8BAAiB,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEtD,MAAM,mBAAmB,GAAI,OAAO,CAAC,OAAO,EAAE,CAAC,eAAe,CAAwB,IAAI,SAAS,CAAC;QACpG,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAuB,CAAC;QACtF,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAuB,CAAC;QACrF,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAuB,CAAC;QAExE,MAAM,eAAe,GAAG,kBAAkB,IAAI,cAAc,IAAI,SAAS,CAAC;QAC1E,MAAM,eAAe,GAAG,mBAAmB;YACzC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,eAAe;gBACf,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,cAAc;oBACd,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,SAAS,CAAC;QAElB,MAAM,KAAK,GAAG,IAAA,qCAAkB,EAAC,mBAAmB,CAAC,CAAC;QAEtD,MAAM,eAAe,GAAG,wCAAwC,SAAS,GAAG,SAAS,EAAE,CAAC;QACxF,MAAM,iBAAiB,GAAG,6BAA6B,OAAO,GAAG,eAAe,GAAG,CAAC;QAEpF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACb,OAAO;YACP,mBAAmB;YACnB,KAAK;YACL,eAAe;YACf,eAAe;YACf,eAAe;YACf,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAKK,AAAN,KAAK,CAAC,+BAA+B;QACnC,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB;SACzD,CAAC,CAAC;IACL,CAAC;IAGD;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAW,CAAC,CAAC,CAAC,sBAAsB;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAExC,IAAI,CAAC,IAAA,wBAAK,EAAC,KAAK,CAAC,EAAE,CAAC;YAClB,wFAAwF;YACxF,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB;aACzD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oFAAoF;QACpF,IAAI,MAA6B,CAAC;QAClC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC,YAAY;YAC1D,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEvE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAA4B,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YACtC,MAAM,YAAY,GAAwB;gBACxC;oBACE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS;oBAC3B,SAAS,EAAE,MAAM;oBACjB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB;aACF,CAAC;YACF,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;QAE5B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAC,UAAU,EAAE,MAAM,CAAC,OAAO,EAAC,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB;SACzD,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,kCAAe,EAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,kBAAkB;QACtB,MAAM,EAAC,eAAe,EAAE,QAAQ,EAAE,EAAC,KAAK,EAAC,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QAExD,MAAM,OAAO,GAAG,IAAA,qCAAkB,EAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAGK,AAAN,KAAK,CAAC,qBAAqB;QACzB,MAAM,EACJ,QAAQ,EAAE,EAAC,KAAK,EAAE,IAAI,EAAC,EACvB,OAAO,GACR,GAAG,IAAI,CAAC,KAAK,CAAC;QAEf,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,YAAY;YAClB,aAAa,EAAE;gBACb,KAAK;gBACL,IAAI;gBACJ,OAAO;aACR;SACF,CAAC,CAAC;IACL,CAAC;CAEF,CAAA;AAzIO;IADL,KAAK,CAAC,YAAY,CAAC;;;;mDAmCnB;AAKK;IAHL,KAAK,CAAC,4BAA4B,EAAE;QACnC,MAAM,EAAE,CAAC,EAAC,KAAK,EAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB;KAChD,CAAC;;;;wEAMD;AAYK;IADL,KAAK,CAAC,aAAa,CAAC;;;;oDA0CpB;AAGK;IADL,KAAK,CAAC,YAAY,CAAC;;;;mDAGnB;AASK;IADL,KAAK,CAAC,oBAAoB,CAAC;;;;2DAQ3B;AAGK;IADL,KAAK,CAAC,uBAAuB,CAAC;;;;8DAe9B;AA3IkB,iBAAiB;IAPrC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,YAAY,EAAE,iCAAyB;QACvC,MAAM,EAAE,YAAY;KACrB,CAAC;GACmB,iBAAiB,CA6IrC;kBA7IoB,iBAAiB","sourcesContent":["// auth/flows/session.verify.flow.ts\nimport {\n  authorizationSchema,\n  Flow, FlowBase,\n  FlowRunOptions,\n  StageHookOf, userClaimSchema,\n  RemoteAuthOptions, sessionIdSchema, httpRequestInputSchema, FlowPlan,\n} from '../../common';\nimport 'reflect-metadata';\nimport {z} from 'zod';\nimport {getRequestBaseUrl, normalizeEntryPrefix, normalizeScopeBase} from '../path.utils';\nimport {\n  deriveTypedUser,\n  extractBearerToken,\n  isJwt,\n} from '../session/utils/auth-token.utils';\nimport {JwksService, ProviderVerifyRef, VerifyResult} from '../jwks';\nimport {parseSessionHeader} from '../session/utils/session-id.utils';\n\n\nconst inputSchema = httpRequestInputSchema;\n\nconst stateSchema = z.object({\n  baseUrl: z.string().min(1),\n  authorizationHeader: z.string().optional(),\n  token: z.string().optional(),\n  sessionIdHeader: z.string().optional(), // 'mcp-session-id'\n  sessionProtocol: z.string().optional(), // 'sse/http/streamable-http'\n  prmMetadataPath: z.string().optional(),\n  prmMetadataHeader: z.string().optional(),\n  jwtPayload: z.object({}).passthrough().optional(),\n  user: userClaimSchema.optional(),\n  session: sessionIdSchema.optional(),\n});\n\nconst UnauthorizedSchema = z\n  .object({\n    kind: z.literal('unauthorized'),\n    prmMetadataHeader: z.string().describe('Path to protected resource metadata'),\n  })\n  .describe('401 Unauthorized with \\'WWW-Authenticate\\' header for requesting authentication\\'');\n\nconst AuthorizedSchema = z\n  .object({\n    kind: z.literal('authorized'),\n    authorization: authorizationSchema.describe('Session information if session id is present'),\n  })\n  .describe('Authorized session information');\n\n\nexport const sessionVerifyOutputSchema = z.union([UnauthorizedSchema, AuthorizedSchema]);\n\nconst plan = {\n  pre: ['parseInput', 'requireAuthorizationHeader', 'verifyIfJwt'],\n  execute: ['deriveUser', 'parseSessionHeader', 'buildAuthorizedOutput'],\n} as const satisfies FlowPlan<string>;\n\ndeclare global {\n  interface ExtendFlows {\n    'session:verify': FlowRunOptions<\n      SessionVerifyFlow,\n      typeof plan,\n      typeof inputSchema,\n      typeof sessionVerifyOutputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\nconst name = 'session:verify' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan,\n  inputSchema,\n  outputSchema: sessionVerifyOutputSchema,\n  access: 'authorized',\n})\nexport default class SessionVerifyFlow extends FlowBase<typeof name> {\n\n\n  @Stage('parseInput')\n  async parseInput() {\n    const {request} = this.rawInput;\n    const entryPath = normalizeEntryPrefix(this.scope.entryPath);\n    const routeBase = normalizeScopeBase(this.scope.routeBase);\n    const baseUrl = getRequestBaseUrl(request, entryPath);\n\n    const authorizationHeader = (request.headers?.['authorization'] as string | undefined) ?? undefined;\n    const httpTransportHeader = request.headers?.['http-transport'] as string | undefined;\n    const sessionIdRawHeader = request.headers?.['mcp-session-id'] as string | undefined;\n    const sessionIdQuery = request.query['sessionId'] as string | undefined;\n\n    const sessionIdHeader = sessionIdRawHeader ?? sessionIdQuery ?? undefined;\n    const sessionProtocol = httpTransportHeader\n      ? 'http'\n      : sessionIdHeader\n        ? 'streamable-http'\n        : sessionIdQuery\n          ? 'sse'\n          : undefined;\n\n    const token = extractBearerToken(authorizationHeader);\n\n    const prmMetadataPath = `/.well-known/oauth-protected-resource${entryPath}${routeBase}`;\n    const prmMetadataHeader = `Bearer resource_metadata=\"${baseUrl}${prmMetadataPath}\"`;\n\n    this.state.set({\n      baseUrl,\n      authorizationHeader,\n      token,\n      sessionIdHeader,\n      sessionProtocol,\n      prmMetadataPath,\n      prmMetadataHeader,\n    });\n  }\n\n  @Stage('requireAuthorizationHeader', {\n    filter: ({state}) => !state.authorizationHeader,\n  })\n  async requireAuthorizationOrChallenge() {\n    this.respond({\n      kind: 'unauthorized',\n      prmMetadataHeader: this.state.required.prmMetadataHeader,\n    });\n  }\n\n\n  /**\n   * If Authorization is a JWT:\n   *  - Attempt verification against any known / cached public keys we have (gateway/local)\n   *  - If verification fails → 401\n   *  - If verification ok → capture payload\n   * If NOT a JWT:\n   *  - we do NOT attempt verification, just pass the raw token through\n   */\n  @Stage('verifyIfJwt')\n  async verifyIfJwt() {\n    const jwks = this.get(JwksService); // TODO: fix providers\n    const token = this.state.required.token;\n\n    if (!isJwt(token)) {\n      // Non-JWT tokens are passed through; user will be mostly empty (the best effort later).\n      this.respond({\n        kind: 'unauthorized',\n        prmMetadataHeader: this.state.required.prmMetadataHeader,\n      });\n      return;\n    }\n\n    // Best-effort verification using locally known keys (gateway/local provider cache).\n    let verify: Promise<VerifyResult>;\n    if (this.scope.auth.options.type === 'local') { // TODO: fix\n      verify = jwks.verifyGatewayToken(token, this.state.required.baseUrl);\n\n    } else {\n      const primary = this.scope.auth.options as RemoteAuthOptions;\n      const issuer = this.scope.auth.issuer;\n      const providerRefs: ProviderVerifyRef[] = [\n        {\n          id: primary.id ?? 'default',\n          issuerUrl: issuer,\n          jwks: primary.jwks,\n          jwksUri: primary.jwksUri,\n        },\n      ];\n      verify = jwks.verifyTransparentToken(token, providerRefs);\n    }\n    const result = await verify;\n\n    if (result.ok) {\n      this.state.set({jwtPayload: result.payload});\n      return;\n    }\n    this.respond({\n      kind: 'unauthorized',\n      prmMetadataHeader: this.state.required.prmMetadataHeader,\n    });\n  }\n\n  @Stage('deriveUser')\n  async deriveUser() {\n    this.state.set('user', deriveTypedUser(this.state.required.jwtPayload ?? {}));\n  }\n\n  /**\n   * Parse the session header (mcp-session-id)\n   * - If session id is present, validate it\n   * - If valid, capture the session info\n   * - If NOT valid, ignore (no session)\n   */\n  @Stage('parseSessionHeader')\n  async parseSessionHeader() {\n    const {sessionIdHeader, required: {token}} = this.state;\n\n    const session = parseSessionHeader(sessionIdHeader, token);\n    if (session) {\n      this.state.set('session', session);\n    }\n  }\n\n  @Stage('buildAuthorizedOutput')\n  async buildAuthorizedOutput() {\n    const {\n      required: {token, user},\n      session,\n    } = this.state;\n\n    this.respond({\n      kind: 'authorized',\n      authorization: {\n        token,\n        user,\n        session,\n      },\n    });\n  }\n\n}\n"]}