@frontmcp/sdk 0.2.5 → 0.3.1

package/src/auth/flows/well-known.oauth-authorization-server.flow.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wellKnownAsStateSchema = exports.outputSchema = void 0;
+const tslib_1 = require("tslib");
+// auth/flows/well-known.oauth-authorization-server.flow.ts
+require("reflect-metadata");
+const zod_1 = require("zod");
+const common_1 = require("../../common");
+const path_utils_1 = require("../path.utils");
+const inputSchema = common_1.httpInputSchema;
+// ===== Result =====
+const AuthServerMetadataSchema = zod_1.z.object({
+    kind: zod_1.z.literal('json'),
+    status: zod_1.z.literal(200),
+    contentType: zod_1.z.literal('application/json; charset=utf-8'),
+    body: zod_1.z
+        .object({
+        issuer: zod_1.z.string().min(1),
+        authorization_endpoint: zod_1.z.string().min(1),
+        token_endpoint: zod_1.z.string().min(1),
+        userinfo_endpoint: zod_1.z.string().min(1).optional(),
+        jwks_uri: zod_1.z.string().min(1),
+        registration_endpoint: zod_1.z.string().min(1).optional(),
+        token_endpoint_auth_methods_supported: zod_1.z
+            .array(zod_1.z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))
+            .optional(),
+        response_types_supported: zod_1.z.array(zod_1.z.enum(['code'])).default(['code']),
+        grant_types_supported: zod_1.z
+            .array(zod_1.z.enum(['authorization_code', 'refresh_token']))
+            .default(['authorization_code', 'refresh_token']),
+        scopes_supported: zod_1.z.array(zod_1.z.string()).default(['openid', 'profile', 'email']),
+        code_challenge_methods_supported: zod_1.z.array(zod_1.z.enum(['S256'])).default(['S256']),
+    })
+        .passthrough(),
+});
+exports.outputSchema = zod_1.z.union([AuthServerMetadataSchema, common_1.HttpRedirectSchema, common_1.HttpTextSchema]);
+exports.wellKnownAsStateSchema = zod_1.z.object({
+    baseUrl: zod_1.z.string().min(1), // baseUrl + entryPrefix (unsuffixed)
+    scopesSupported: zod_1.z.array(zod_1.z.string()).default(['openid', 'profile', 'email']),
+    tokenEndpointAuthMethods: zod_1.z
+        .array(zod_1.z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))
+        .default(['client_secret_basic', 'client_secret_post']),
+    dcrEnabled: zod_1.z.boolean().default(true),
+    isOrchestrated: zod_1.z.boolean(),
+});
+const wellKnownAsPlan = {
+    pre: ['parseInput'],
+    execute: ['collectData'],
+};
+const name = 'well-known.oauth-authorization-server';
+const Stage = (0, common_1.StageHookOf)(name);
+let WellKnownAsFlow = class WellKnownAsFlow extends common_1.FlowBase {
+    static canActivate(request, scope) {
+        return (0, path_utils_1.makeWellKnownPaths)('oauth-authorization-server', scope.entryPath, scope.routeBase).has(request.path);
+    }
+    async parseInput() {
+        const { request } = this.rawInput;
+        if (!request)
+            throw new Error('Request is undefined');
+        const baseUrl = (0, path_utils_1.getRequestBaseUrl)(request, this.scope.entryPath);
+        this.state.set(exports.wellKnownAsStateSchema.parse({
+            baseUrl,
+            scopesSupported: [],
+            tokenEndpointAuthMethods: [],
+            dcrEnabled: false, //scope.oauth.dcrEnabled,
+            isOrchestrated: !this.scope.metadata.auth, // scope.orchestrated,
+        }));
+    }
+    async collectData() {
+        const { baseUrl, scopesSupported, tokenEndpointAuthMethods, dcrEnabled, isOrchestrated } = this.state.required;
+        // Orchestrated => gateway is the AS
+        if (isOrchestrated) {
+            const baseIssuer = `${baseUrl}`;
+            this.respond({
+                kind: 'json',
+                contentType: 'application/json; charset=utf-8',
+                status: 200,
+                body: {
+                    issuer: baseIssuer,
+                    authorization_endpoint: `${baseIssuer}/oauth/authorize`,
+                    token_endpoint: `${baseIssuer}/oauth/token`,
+                    userinfo_endpoint: `${baseIssuer}/oauth/userinfo`,
+                    jwks_uri: `${baseIssuer}/.well-known/jwks.json`,
+                    registration_endpoint: `${baseIssuer}/oauth/register`,
+                    token_endpoint_auth_methods_supported: tokenEndpointAuthMethods,
+                    response_types_supported: ['code'],
+                    grant_types_supported: ['authorization_code', 'refresh_token'],
+                    scopes_supported: scopesSupported,
+                    code_challenge_methods_supported: ['S256'],
+                },
+            });
+            return;
+        }
+        const primary = this.scope.auth;
+        this.respond(common_1.httpRespond.redirect(`${primary.issuer}/.well-known/oauth-authorization-server`));
+    }
+};
+tslib_1.__decorate([
+    Stage('parseInput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], WellKnownAsFlow.prototype, "parseInput", null);
+tslib_1.__decorate([
+    Stage('collectData'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], WellKnownAsFlow.prototype, "collectData", null);
+WellKnownAsFlow = tslib_1.__decorate([
+    (0, common_1.Flow)({
+        name,
+        plan: wellKnownAsPlan,
+        inputSchema,
+        outputSchema: exports.outputSchema,
+        access: 'public',
+        middleware: {
+            method: 'GET',
+        },
+    })
+], WellKnownAsFlow);
+exports.default = WellKnownAsFlow;
+//# sourceMappingURL=well-known.oauth-authorization-server.flow.js.map

package/src/auth/flows/well-known.oauth-authorization-server.flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.oauth-authorization-server.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/well-known.oauth-authorization-server.flow.ts"],"names":[],"mappings":";;;;AAAA,2DAA2D;AAC3D,4BAA0B;AAC1B,6BAAsB;AACtB,yCAUsB;AACtB,8CAAoE;AAGpE,MAAM,WAAW,GAAG,wBAAe,CAAC;AAGpC,qBAAqB;AACrB,MAAM,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,OAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACtB,WAAW,EAAE,OAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;IACzD,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,sBAAsB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC/C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACnD,qCAAqC,EAAE,OAAC;aACrC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC;aAC/E,QAAQ,EAAE;QACb,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;QACrE,qBAAqB,EAAE,OAAC;aACrB,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC;aACtD,OAAO,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;QACnD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,gCAAgC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;KAC9E,CAAC;SACD,WAAW,EAAE;CACjB,CAAC,CAAC;AAEU,QAAA,YAAY,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,2BAAkB,EAAE,uBAAc,CAAC,CAAC,CAAC;AAEvF,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qCAAqC;IACjE,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,wBAAwB,EAAE,OAAC;SACxB,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC;SAC/E,OAAO,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IACzD,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,eAAe,GAAG;IACtB,GAAG,EAAE,CAAC,YAAY,CAAC;IACnB,OAAO,EAAE,CAAC,aAAa,CAAC;CACW,CAAC;AAiBtC,MAAM,IAAI,GAAG,uCAAgD,CAAC;AAC9D,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAajB,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,iBAAqB;IAChE,MAAM,CAAC,WAAW,CAAC,OAAsB,EAAE,KAAiB;QAC1D,OAAO,IAAA,+BAAkB,EAAC,4BAA4B,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9G,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,IAAA,8BAAiB,EAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,8BAAsB,CAAC,KAAK,CAAC;YAC1C,OAAO;YACP,eAAe,EAAE,EAAE;YACnB,wBAAwB,EAAE,EAAE;YAC5B,UAAU,EAAE,KAAK,EAAE,yBAAyB;YAC5C,cAAc,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;SAClE,CAAC,CAAC,CAAC;IACN,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW;QACf,MAAM,EAAC,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,UAAU,EAAE,cAAc,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7G,oCAAoC;QACpC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,GAAG,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,iCAAiC;gBAC9C,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,MAAM,EAAE,UAAU;oBAClB,sBAAsB,EAAE,GAAG,UAAU,kBAAkB;oBACvD,cAAc,EAAE,GAAG,UAAU,cAAc;oBAC3C,iBAAiB,EAAE,GAAG,UAAU,iBAAiB;oBACjD,QAAQ,EAAE,GAAG,UAAU,wBAAwB;oBAC/C,qBAAqB,EAAE,GAAG,UAAU,iBAAiB;oBACrD,qCAAqC,EAAE,wBAAwB;oBAC/D,wBAAwB,EAAE,CAAC,MAAM,CAAC;oBAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;oBAC9D,gBAAgB,EAAE,eAAe;oBACjC,gCAAgC,EAAE,CAAC,MAAM,CAAC;iBAC3C;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,yCAAyC,CAAC,CAAC,CAAC;IACjG,CAAC;CACF,CAAA;AA3CO;IADL,KAAK,CAAC,YAAY,CAAC;;;;iDAanB;AAGK;IADL,KAAK,CAAC,aAAa,CAAC;;;;kDA4BpB;AAhDkB,eAAe;IAVnC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI,EAAE,eAAe;QACrB,WAAW;QACX,YAAY,EAAZ,oBAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,KAAK;SACd;KACF,CAAC;GACmB,eAAe,CAiDnC;kBAjDoB,eAAe","sourcesContent":["// auth/flows/well-known.oauth-authorization-server.flow.ts\nimport 'reflect-metadata';\nimport {z} from 'zod';\nimport {\n  HttpRedirectSchema,\n  httpRespond,\n  HttpTextSchema,\n  Flow,\n  FlowBase,\n  FlowRunOptions,\n  ScopeEntry,\n  ServerRequest,\n  StageHookOf, httpInputSchema, FlowPlan,\n} from '../../common';\nimport {getRequestBaseUrl, makeWellKnownPaths} from '../path.utils';\n\n\nconst inputSchema = httpInputSchema;\n\n\n// ===== Result =====\nconst AuthServerMetadataSchema = z.object({\n  kind: z.literal('json'),\n  status: z.literal(200),\n  contentType: z.literal('application/json; charset=utf-8'),\n  body: z\n    .object({\n      issuer: z.string().min(1),\n      authorization_endpoint: z.string().min(1),\n      token_endpoint: z.string().min(1),\n      userinfo_endpoint: z.string().min(1).optional(),\n      jwks_uri: z.string().min(1),\n      registration_endpoint: z.string().min(1).optional(),\n      token_endpoint_auth_methods_supported: z\n        .array(z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))\n        .optional(),\n      response_types_supported: z.array(z.enum(['code'])).default(['code']),\n      grant_types_supported: z\n        .array(z.enum(['authorization_code', 'refresh_token']))\n        .default(['authorization_code', 'refresh_token']),\n      scopes_supported: z.array(z.string()).default(['openid', 'profile', 'email']),\n      code_challenge_methods_supported: z.array(z.enum(['S256'])).default(['S256']),\n    })\n    .passthrough(),\n});\n\nexport const outputSchema = z.union([AuthServerMetadataSchema, HttpRedirectSchema, HttpTextSchema]);\n\nexport const wellKnownAsStateSchema = z.object({\n  baseUrl: z.string().min(1), // baseUrl + entryPrefix (unsuffixed)\n  scopesSupported: z.array(z.string()).default(['openid', 'profile', 'email']),\n  tokenEndpointAuthMethods: z\n    .array(z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))\n    .default(['client_secret_basic', 'client_secret_post']),\n  dcrEnabled: z.boolean().default(true),\n  isOrchestrated: z.boolean(),\n});\n\n\nconst wellKnownAsPlan = {\n  pre: ['parseInput'],\n  execute: ['collectData'],\n} as const satisfies FlowPlan<string>;\n\ntype WellKnownAsPlan = typeof wellKnownAsPlan;\ntype WellKnownAsFlowOptions = FlowRunOptions<\n  WellKnownAsFlow,\n  WellKnownAsPlan,\n  typeof inputSchema,\n  typeof outputSchema,\n  typeof wellKnownAsStateSchema\n>\n\ndeclare global {\n  interface ExtendFlows {\n    'well-known.oauth-authorization-server': WellKnownAsFlowOptions;\n  }\n}\n\nconst name = 'well-known.oauth-authorization-server' as const;\nconst Stage = StageHookOf(name);\n\n\n@Flow({\n  name,\n  plan: wellKnownAsPlan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'GET',\n  },\n})\nexport default class WellKnownAsFlow extends FlowBase<typeof name> {\n  static canActivate(request: ServerRequest, scope: ScopeEntry) {\n    return makeWellKnownPaths('oauth-authorization-server', scope.entryPath, scope.routeBase).has(request.path);\n  }\n\n  @Stage('parseInput')\n  async parseInput() {\n    const {request} = this.rawInput;\n    if (!request) throw new Error('Request is undefined');\n\n    const baseUrl = getRequestBaseUrl(request, this.scope.entryPath);\n    this.state.set(wellKnownAsStateSchema.parse({\n      baseUrl,\n      scopesSupported: [],\n      tokenEndpointAuthMethods: [],\n      dcrEnabled: false, //scope.oauth.dcrEnabled,\n      isOrchestrated: !this.scope.metadata.auth, // scope.orchestrated,\n    }));\n  }\n\n  @Stage('collectData')\n  async collectData() {\n    const {baseUrl, scopesSupported, tokenEndpointAuthMethods, dcrEnabled, isOrchestrated} = this.state.required;\n    // Orchestrated => gateway is the AS\n    if (isOrchestrated) {\n      const baseIssuer = `${baseUrl}`;\n      this.respond({\n        kind: 'json',\n        contentType: 'application/json; charset=utf-8',\n        status: 200,\n        body: {\n          issuer: baseIssuer,\n          authorization_endpoint: `${baseIssuer}/oauth/authorize`,\n          token_endpoint: `${baseIssuer}/oauth/token`,\n          userinfo_endpoint: `${baseIssuer}/oauth/userinfo`,\n          jwks_uri: `${baseIssuer}/.well-known/jwks.json`,\n          registration_endpoint: `${baseIssuer}/oauth/register`,\n          token_endpoint_auth_methods_supported: tokenEndpointAuthMethods,\n          response_types_supported: ['code'],\n          grant_types_supported: ['authorization_code', 'refresh_token'],\n          scopes_supported: scopesSupported,\n          code_challenge_methods_supported: ['S256'],\n        },\n      });\n      return;\n    }\n    const primary = this.scope.auth;\n    this.respond(httpRespond.redirect(`${primary.issuer}/.well-known/oauth-authorization-server`));\n  }\n}\n"]}

package/src/auth/flows/well-known.prm.flow.d.ts

@@ -0,0 +1,159 @@
+import 'reflect-metadata';
+import { z } from 'zod';
+import { FlowBase, FlowRunOptions, ScopeEntry, ServerRequest } from '../../common';
+declare const inputSchema: z.ZodObject<{
+    request: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    next: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    request: {} & {
+        [k: string]: unknown;
+    };
+    response: {} & {
+        [k: string]: unknown;
+    };
+    next?: ((...args: unknown[]) => unknown) | undefined;
+}, {
+    request: {} & {
+        [k: string]: unknown;
+    };
+    response: {} & {
+        [k: string]: unknown;
+    };
+    next?: ((...args: unknown[]) => unknown) | undefined;
+}>;
+declare const stateSchema: z.ZodObject<{
+    resource: z.ZodString;
+    baseUrl: z.ZodString;
+    scopesSupported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    isOrchestrated: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    resource: string;
+    baseUrl: string;
+    scopesSupported: string[];
+    isOrchestrated: boolean;
+}, {
+    resource: string;
+    baseUrl: string;
+    isOrchestrated: boolean;
+    scopesSupported?: string[] | undefined;
+}>;
+declare const outputSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"json">;
+    status: z.ZodEffects<z.ZodNumber, number, number>;
+    contentType: z.ZodDefault<z.ZodString>;
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        path: z.ZodDefault<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        httpOnly: z.ZodDefault<z.ZodBoolean>;
+        secure: z.ZodOptional<z.ZodBoolean>;
+        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        expires: z.ZodOptional<z.ZodDate>;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        path: string;
+        name: string;
+        httpOnly: boolean;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }, {
+        value: string;
+        name: string;
+        path?: string | undefined;
+        domain?: string | undefined;
+        httpOnly?: boolean | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }>, "many">>>;
+} & {
+    body: z.ZodObject<{
+        resource: z.ZodString;
+        authorization_servers: z.ZodArray<z.ZodString, "many">;
+        scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        bearer_methods_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        resource: z.ZodString;
+        authorization_servers: z.ZodArray<z.ZodString, "many">;
+        scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        bearer_methods_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        resource: z.ZodString;
+        authorization_servers: z.ZodArray<z.ZodString, "many">;
+        scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        bearer_methods_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, z.ZodTypeAny, "passthrough">>;
+}, "strip", z.ZodTypeAny, {
+    status: number;
+    kind: "json";
+    body: {
+        resource: string;
+        authorization_servers: string[];
+        scopes_supported: string[];
+        bearer_methods_supported: string[];
+    } & {
+        [k: string]: unknown;
+    };
+    contentType: string;
+    headers?: Record<string, string | string[]> | undefined;
+    cookies?: {
+        value: string;
+        path: string;
+        name: string;
+        httpOnly: boolean;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }[] | undefined;
+}, {
+    status: number;
+    kind: "json";
+    body: {
+        resource: string;
+        authorization_servers: string[];
+        scopes_supported?: string[] | undefined;
+        bearer_methods_supported?: string[] | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    headers?: Record<string, string | string[]> | undefined;
+    cookies?: {
+        value: string;
+        name: string;
+        path?: string | undefined;
+        domain?: string | undefined;
+        httpOnly?: boolean | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }[] | undefined;
+    contentType?: string | undefined;
+}>;
+declare const plan: {
+    readonly pre: ["parseInput"];
+    readonly execute: ["collectData"];
+    readonly post: ["validateOutput"];
+};
+declare global {
+    interface ExtendFlows {
+        'well-known.oauth-protected-resource': FlowRunOptions<WellKnownPrmFlow, typeof plan, typeof inputSchema, typeof outputSchema, typeof stateSchema>;
+    }
+}
+declare const name: "well-known.oauth-protected-resource";
+export default class WellKnownPrmFlow extends FlowBase<typeof name> {
+    static canActivate(request: ServerRequest, scope: ScopeEntry): boolean;
+    parseInput(): Promise<void>;
+    collectData(): Promise<void>;
+}
+export {};

package/src/auth/flows/well-known.prm.flow.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+// auth/flows/well-known.prm.flow.ts
+require("reflect-metadata");
+const zod_1 = require("zod");
+const common_1 = require("../../common");
+const path_utils_1 = require("../path.utils");
+const inputSchema = common_1.httpInputSchema;
+const stateSchema = zod_1.z.object({
+    resource: zod_1.z.string().min(1),
+    baseUrl: zod_1.z.string().min(1),
+    scopesSupported: zod_1.z.array(zod_1.z.string()).default(['openid', 'profile', 'email']),
+    isOrchestrated: zod_1.z.boolean(),
+});
+const outputSchema = common_1.HttpJsonSchema.extend({
+    body: zod_1.z
+        .object({
+        resource: zod_1.z.string().min(1),
+        authorization_servers: zod_1.z.array(zod_1.z.string().min(1)).min(1),
+        scopes_supported: zod_1.z.array(zod_1.z.string()).default(['openid', 'profile', 'email']),
+        bearer_methods_supported: zod_1.z.array(zod_1.z.string()).default(['header']),
+    })
+        .passthrough(),
+});
+const plan = {
+    pre: ['parseInput'],
+    execute: ['collectData'],
+    post: ['validateOutput'],
+};
+const name = 'well-known.oauth-protected-resource';
+const Stage = (0, common_1.StageHookOf)(name);
+let WellKnownPrmFlow = class WellKnownPrmFlow extends common_1.FlowBase {
+    static canActivate(request, scope) {
+        return (0, path_utils_1.makeWellKnownPaths)('oauth-protected-resource', scope.entryPath, scope.routeBase).has(request.path);
+    }
+    async parseInput() {
+        const { request } = this.rawInput;
+        const scope = this.scope;
+        if (!request)
+            throw new Error('Request is undefined');
+        const resource = (0, path_utils_1.computeResource)(request, scope.entryPath, scope.routeBase);
+        const baseUrl = (0, path_utils_1.getRequestBaseUrl)(request, scope.entryPath);
+        this.state.set(stateSchema.parse({
+            resource,
+            baseUrl,
+            scopesSupported: ['openid', 'profile', 'email'],
+            isOrchestrated: false, //scope.orchestrated,// TODO: fix
+        }));
+    }
+    async collectData() {
+        const { resource, baseUrl, scopesSupported, isOrchestrated } = this.state.required;
+        if (isOrchestrated) {
+            this.respond({
+                kind: 'json',
+                contentType: 'application/json; charset=utf-8',
+                status: 200,
+                body: {
+                    resource,
+                    authorization_servers: [baseUrl],
+                    scopes_supported: scopesSupported,
+                    bearer_methods_supported: ['header'],
+                },
+            });
+            return;
+        }
+        const issuer = this.scope.auth.issuer;
+        // Transparent scope
+        this.respond({
+            kind: 'json',
+            status: 200,
+            contentType: 'application/json; charset=utf-8',
+            body: {
+                resource,
+                authorization_servers: [issuer],
+                scopes_supported: scopesSupported,
+                bearer_methods_supported: ['header'],
+            },
+        });
+    }
+};
+tslib_1.__decorate([
+    Stage('parseInput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], WellKnownPrmFlow.prototype, "parseInput", null);
+tslib_1.__decorate([
+    Stage('collectData'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], WellKnownPrmFlow.prototype, "collectData", null);
+WellKnownPrmFlow = tslib_1.__decorate([
+    (0, common_1.Flow)({
+        name,
+        plan,
+        inputSchema,
+        outputSchema,
+        access: 'public',
+        middleware: {
+            method: 'GET',
+        },
+    })
+], WellKnownPrmFlow);
+exports.default = WellKnownPrmFlow;
+//# sourceMappingURL=well-known.prm.flow.js.map

package/src/auth/flows/well-known.prm.flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.prm.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/well-known.prm.flow.ts"],"names":[],"mappings":";;;AAAA,oCAAoC;AACpC,4BAA0B;AAC1B,6BAAsB;AACtB,yCASsB;AACtB,8CAAqF;AAErF,MAAM,WAAW,GAAG,wBAAe,CAAC;AAEpC,MAAM,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,uBAAc,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,qBAAqB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;KAClE,CAAC;SACD,WAAW,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,CAAC,YAAY,CAAC;IACnB,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,IAAI,EAAE,CAAC,gBAAgB,CAAC;CACW,CAAC;AActC,MAAM,IAAI,GAAG,qCAA8C,CAAC;AAC5D,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAYjB,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,iBAAqB;IACjE,MAAM,CAAC,WAAW,CAAC,OAAsB,EAAE,KAAiB;QAC1D,OAAO,IAAA,+BAAkB,EAAC,0BAA0B,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5G,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEtD,MAAM,QAAQ,GAAG,IAAA,4BAAe,EAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAA,8BAAiB,EAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC;YAC/B,QAAQ;YACR,OAAO;YACP,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YAC/C,cAAc,EAAE,KAAK,EAAC,iCAAiC;SACxD,CAAC,CAAC,CAAC;IACN,CAAC;IAE2B,AAAN,KAAK,CAAC,WAAW;QACrC,MAAM,EAAC,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAEjF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,iCAAiC;gBAC9C,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,QAAQ;oBACR,qBAAqB,EAAE,CAAC,OAAO,CAAC;oBAChC,gBAAgB,EAAE,eAAe;oBACjC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;iBACrC;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QACtC,oBAAoB;QACpB,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,iCAAiC;YAC9C,IAAI,EAAE;gBACJ,QAAQ;gBACR,qBAAqB,EAAE,CAAC,MAAM,CAAC;gBAC/B,gBAAgB,EAAE,eAAe;gBACjC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;aACrC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA9CO;IADL,KAAK,CAAC,YAAY,CAAC;;;;kDAcnB;AAE2B;IAA3B,KAAK,CAAC,aAAa,CAAC;;;;mDA8BpB;AAnDkB,gBAAgB;IAVpC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,KAAK;SACd;KACF,CAAC;GACmB,gBAAgB,CAoDpC;kBApDoB,gBAAgB","sourcesContent":["// auth/flows/well-known.prm.flow.ts\nimport 'reflect-metadata';\nimport {z} from 'zod';\nimport {\n  Flow,\n  FlowBase, FlowPlan,\n  FlowRunOptions,\n  httpInputSchema,\n  HttpJsonSchema,\n  ScopeEntry,\n  ServerRequest,\n  StageHookOf,\n} from '../../common';\nimport {computeResource, getRequestBaseUrl, makeWellKnownPaths} from '../path.utils';\n\nconst inputSchema = httpInputSchema;\n\nconst stateSchema = z.object({\n  resource: z.string().min(1),\n  baseUrl: z.string().min(1),\n  scopesSupported: z.array(z.string()).default(['openid', 'profile', 'email']),\n  isOrchestrated: z.boolean(),\n});\n\nconst outputSchema = HttpJsonSchema.extend({\n  body: z\n    .object({\n      resource: z.string().min(1),\n      authorization_servers: z.array(z.string().min(1)).min(1),\n      scopes_supported: z.array(z.string()).default(['openid', 'profile', 'email']),\n      bearer_methods_supported: z.array(z.string()).default(['header']),\n    })\n    .passthrough(),\n});\n\nconst plan = {\n  pre: ['parseInput'],\n  execute: ['collectData'],\n  post: ['validateOutput'],\n} as const satisfies FlowPlan<string>;\n\ndeclare global {\n  interface ExtendFlows {\n    'well-known.oauth-protected-resource': FlowRunOptions<\n      WellKnownPrmFlow,\n      typeof plan,\n      typeof inputSchema,\n      typeof outputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\nconst name = 'well-known.oauth-protected-resource' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'GET',\n  },\n})\nexport default class WellKnownPrmFlow extends FlowBase<typeof name> {\n  static canActivate(request: ServerRequest, scope: ScopeEntry) {\n    return makeWellKnownPaths('oauth-protected-resource', scope.entryPath, scope.routeBase).has(request.path);\n  }\n\n  @Stage('parseInput')\n  async parseInput() {\n    const {request} = this.rawInput;\n    const scope = this.scope;\n    if (!request) throw new Error('Request is undefined');\n\n    const resource = computeResource(request, scope.entryPath, scope.routeBase);\n    const baseUrl = getRequestBaseUrl(request, scope.entryPath);\n    this.state.set(stateSchema.parse({\n      resource,\n      baseUrl,\n      scopesSupported: ['openid', 'profile', 'email'],\n      isOrchestrated: false,//scope.orchestrated,// TODO: fix\n    }));\n  }\n\n  @Stage('collectData') async collectData() {\n    const {resource, baseUrl, scopesSupported, isOrchestrated} = this.state.required;\n\n    if (isOrchestrated) {\n      this.respond({\n        kind: 'json',\n        contentType: 'application/json; charset=utf-8',\n        status: 200,\n        body: {\n          resource,\n          authorization_servers: [baseUrl],\n          scopes_supported: scopesSupported,\n          bearer_methods_supported: ['header'],\n        },\n      });\n      return;\n    }\n    const issuer = this.scope.auth.issuer;\n    // Transparent scope\n    this.respond({\n      kind: 'json',\n      status: 200,\n      contentType: 'application/json; charset=utf-8',\n      body: {\n        resource,\n        authorization_servers: [issuer],\n        scopes_supported: scopesSupported,\n        bearer_methods_supported: ['header'],\n      },\n    });\n  }\n}\n"]}

package/src/auth/instances/instance.local-primary-auth.d.ts

@@ -0,0 +1,20 @@
+import { URL } from 'url';
+import { FrontMcpAuth, FrontMcpLogger, LocalAuthOptions, ScopeEntry, ServerRequest } from '../../common';
+import ProviderRegistry from '../../provider/provider.registry';
+export declare class LocalPrimaryAuth extends FrontMcpAuth {
+    private scope;
+    private providers;
+    readonly host: string;
+    readonly port: number;
+    readonly issuer: string;
+    readonly keys: any[];
+    readonly secret: Uint8Array;
+    readonly logger: FrontMcpLogger;
+    private jwks;
+    constructor(scope: ScopeEntry, providers: ProviderRegistry, metadata: LocalAuthOptions);
+    signAnonymousJwt(): Promise<string>;
+    protected initialize(): Promise<void>;
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    validate(request: ServerRequest): Promise<void>;
+    private registerAuthFlows;
+}

package/src/auth/instances/instance.local-primary-auth.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalPrimaryAuth = void 0;
+const tslib_1 = require("tslib");
+const jose_1 = require("jose");
+const crypto_1 = require("crypto");
+const common_1 = require("../../common");
+const well_known_prm_flow_1 = tslib_1.__importDefault(require("../flows/well-known.prm.flow"));
+const well_known_oauth_authorization_server_flow_1 = tslib_1.__importDefault(require("../flows/well-known.oauth-authorization-server.flow"));
+const well_known_jwks_flow_1 = tslib_1.__importDefault(require("../flows/well-known.jwks.flow"));
+const session_verify_flow_1 = tslib_1.__importDefault(require("../flows/session.verify.flow"));
+const oauth_authorize_flow_1 = tslib_1.__importDefault(require("../flows/oauth.authorize.flow"));
+const oauth_register_flow_1 = tslib_1.__importDefault(require("../flows/oauth.register.flow"));
+const oauth_token_flow_1 = tslib_1.__importDefault(require("../flows/oauth.token.flow"));
+const jwks_1 = require("../jwks");
+const DEFAULT_NO_AUTH_SECRET = (0, crypto_1.randomBytes)(32);
+class LocalPrimaryAuth extends common_1.FrontMcpAuth {
+    scope;
+    providers;
+    host;
+    port;
+    issuer;
+    keys = [];
+    secret;
+    logger;
+    jwks = new jwks_1.JwksService();
+    constructor(scope, providers, metadata) {
+        super(metadata);
+        this.scope = scope;
+        this.providers = providers;
+        this.logger = this.providers.getActiveScope().logger.child('LocalPrimaryAuth');
+        this.port = this.providers.getActiveScope().metadata.http?.port ?? 3001;
+        this.host = 'localhost';
+        this.issuer = `http://${this.host}:${this.port}${scope.fullPath}`;
+        if (process.env["JWT_SECRET"]) {
+            this.secret = new TextEncoder().encode(process.env["JWT_SECRET"]);
+        }
+        else {
+            this.logger.warn('JWT_SECRET is not set, using default secret');
+            this.secret = DEFAULT_NO_AUTH_SECRET;
+        }
+        this.ready = this.initialize();
+    }
+    async signAnonymousJwt() {
+        const sub = (0, crypto_1.randomUUID)();
+        return new jose_1.SignJWT({ sub, role: 'user', anonymous: true })
+            .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
+            .setIssuedAt()
+            .setIssuer(this.issuer)
+            .setExpirationTime('1d')
+            .sign(this.secret);
+    }
+    async initialize() {
+        // TODO: create separated jwk service for local/remote auth options
+        this.providers.injectProvider({
+            value: this.jwks,
+            metadata: {
+                scope: common_1.ProviderScope.GLOBAL,
+                name: 'auth:jwk-service',
+            },
+            provide: jwks_1.JwksService,
+        });
+        await this.registerAuthFlows();
+        return Promise.resolve();
+    }
+    fetch(input, init) {
+        return fetch(input, init);
+    }
+    validate(request) {
+        return Promise.resolve();
+    }
+    async registerAuthFlows() {
+        const scope = this.providers.getActiveScope();
+        await scope.registryFlows(well_known_prm_flow_1.default, /** /.well-known/oauth-protected-resource */ well_known_oauth_authorization_server_flow_1.default, /** /.well-known/oauth-authorization-server */ well_known_jwks_flow_1.default, /** /.well-known/jwks.json */ session_verify_flow_1.default, /** Session verification flow */ oauth_authorize_flow_1.default, oauth_token_flow_1.default, oauth_register_flow_1.default);
+    }
+}
+exports.LocalPrimaryAuth = LocalPrimaryAuth;
+//# sourceMappingURL=instance.local-primary-auth.js.map

package/src/auth/instances/instance.local-primary-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.local-primary-auth.js","sourceRoot":"","sources":["../../../../src/auth/instances/instance.local-primary-auth.ts"],"names":[],"mappings":";;;;AAAA,+BAA6B;AAE7B,mCAA+C;AAC/C,yCAAsH;AAEtH,+FAA4D;AAC5D,6IAAkF;AAClF,iGAA8D;AAC9D,+FAA6D;AAC7D,iGAA+D;AAC/D,+FAA6D;AAC7D,yFAAuD;AACvD,kCAAoC;AAGpC,MAAM,sBAAsB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAA;AAE9C,MAAa,gBAAiB,SAAQ,qBAAY;IAS5B;IAAyB;IARpC,IAAI,CAAS;IACb,IAAI,CAAS;IACb,MAAM,CAAS;IACf,IAAI,GAAU,EAAE,CAAC;IACjB,MAAM,CAAa;IACnB,MAAM,CAAiB;IACxB,IAAI,GAAG,IAAI,kBAAW,EAAE,CAAC;IAEjC,YAAoB,KAAgB,EAAS,SAA2B,EAAE,QAA0B;QAClG,KAAK,CAAC,QAAQ,CAAC,CAAC;QADE,UAAK,GAAL,KAAK,CAAW;QAAS,cAAS,GAAT,SAAS,CAAkB;QAEtE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;QAEjE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;QACnE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,GAAG,sBAAsB,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IAGD,KAAK,CAAC,gBAAgB;QACpB,MAAM,GAAG,GAAG,IAAA,mBAAU,GAAE,CAAA;QACxB,OAAO,IAAI,cAAO,CAAC,EAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAC,CAAC;aACrD,kBAAkB,CAAC,EAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAC,CAAC;aAC9C,WAAW,EAAE;aACb,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;aACtB,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAES,KAAK,CAAC,UAAU;QACxB,mEAAmE;QACnE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;YAC5B,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,QAAQ,EAAE;gBACR,KAAK,EAAE,sBAAa,CAAC,MAAM;gBAC3B,IAAI,EAAE,kBAAkB;aACzB;YACD,OAAO,EAAE,kBAAW;SACrB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAG/B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEQ,KAAK,CAAC,KAAwB,EAAE,IAAkB;QACzD,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAEQ,QAAQ,CAAC,OAAsB;QACtC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAGO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;QAC9C,MAAM,KAAK,CAAC,aAAa,CACvB,6BAAgB,EAAE,4CAA4C,CAC9D,oDAAe,EAAE,8CAA8C,CAC/D,8BAAiB,EAAE,6BAA6B,CAChD,6BAAiB,EAAE,gCAAgC,CAEnD,8BAAkB,EAClB,0BAAc,EACd,6BAAiB,CAClB,CAAC;IACJ,CAAC;CACF;AA3ED,4CA2EC","sourcesContent":["import {SignJWT} from \"jose\";\nimport {URL} from 'url';\nimport {randomBytes, randomUUID} from \"crypto\";\nimport {FrontMcpAuth, FrontMcpLogger, LocalAuthOptions, ProviderScope, ScopeEntry, ServerRequest} from '../../common';\nimport ProviderRegistry from '../../provider/provider.registry';\nimport WellKnownPrmFlow from '../flows/well-known.prm.flow';\nimport WellKnownAsFlow from '../flows/well-known.oauth-authorization-server.flow';\nimport WellKnownJwksFlow from '../flows/well-known.jwks.flow';\nimport SessionVerifyFlow from '../flows/session.verify.flow';\nimport OauthAuthorizeFlow from \"../flows/oauth.authorize.flow\";\nimport OauthRegisterFlow from \"../flows/oauth.register.flow\";\nimport OauthTokenFlow from \"../flows/oauth.token.flow\";\nimport {JwksService} from \"../jwks\";\n\n\nconst DEFAULT_NO_AUTH_SECRET = randomBytes(32)\n\nexport class LocalPrimaryAuth extends FrontMcpAuth {\n  readonly host: string;\n  readonly port: number;\n  readonly issuer: string;\n  readonly keys: any[] = [];\n  readonly secret: Uint8Array;\n  readonly logger: FrontMcpLogger;\n  private jwks = new JwksService();\n\n  constructor(private scope:ScopeEntry,private providers: ProviderRegistry, metadata: LocalAuthOptions) {\n    super(metadata);\n    this.logger = this.providers.getActiveScope().logger.child('LocalPrimaryAuth');\n    this.port = this.providers.getActiveScope().metadata.http?.port ?? 3001;\n    this.host = 'localhost';\n    this.issuer = `http://${this.host}:${this.port}${scope.fullPath}`\n\n    if (process.env[\"JWT_SECRET\"]) {\n      this.secret = new TextEncoder().encode(process.env[\"JWT_SECRET\"])\n    } else {\n      this.logger.warn('JWT_SECRET is not set, using default secret')\n      this.secret = DEFAULT_NO_AUTH_SECRET;\n    }\n    this.ready = this.initialize();\n  }\n\n\n  async signAnonymousJwt() {\n    const sub = randomUUID()\n    return new SignJWT({sub, role: 'user', anonymous: true})\n      .setProtectedHeader({alg: 'HS256', typ: 'JWT'})\n      .setIssuedAt()\n      .setIssuer(this.issuer)\n      .setExpirationTime('1d')\n      .sign(this.secret)\n  }\n\n  protected async initialize(): Promise<void> {\n    // TODO: create separated jwk service for local/remote auth options\n    this.providers.injectProvider({\n      value: this.jwks,\n      metadata: {\n        scope: ProviderScope.GLOBAL,\n        name: 'auth:jwk-service',\n      },\n      provide: JwksService,\n    });\n\n    await this.registerAuthFlows();\n\n\n    return Promise.resolve();\n  }\n\n  override fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {\n    return fetch(input, init);\n  }\n\n  override validate(request: ServerRequest): Promise<void> {\n    return Promise.resolve();\n  }\n\n\n  private async registerAuthFlows() {\n    const scope = this.providers.getActiveScope();\n    await scope.registryFlows(\n      WellKnownPrmFlow, /** /.well-known/oauth-protected-resource */\n      WellKnownAsFlow, /** /.well-known/oauth-authorization-server */\n      WellKnownJwksFlow, /** /.well-known/jwks.json */\n      SessionVerifyFlow, /** Session verification flow */\n\n      OauthAuthorizeFlow,\n      OauthTokenFlow,\n      OauthRegisterFlow\n    );\n  }\n}"]}

package/src/auth/instances/instance.remote-primary-auth.d.ts

@@ -0,0 +1,15 @@
+import { FrontMcpAuth, RemoteAuthOptions, ScopeEntry, ServerRequest } from '../../common';
+import { URL } from 'url';
+import ProviderRegistry from '../../provider/provider.registry';
+export declare class RemotePrimaryAuth extends FrontMcpAuth<RemoteAuthOptions> {
+    private readonly scope;
+    private readonly providers;
+    ready: Promise<void>;
+    private jwks;
+    constructor(scope: ScopeEntry, providers: ProviderRegistry, options: RemoteAuthOptions);
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    validate(request: ServerRequest): Promise<void>;
+    get issuer(): string;
+    protected initialize(): Promise<void>;
+    private registerAuthFlows;
+}

package/src/auth/instances/instance.remote-primary-auth.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemotePrimaryAuth = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("../../common");
+const jwks_1 = require("../jwks");
+const well_known_prm_flow_1 = tslib_1.__importDefault(require("../flows/well-known.prm.flow"));
+const well_known_oauth_authorization_server_flow_1 = tslib_1.__importDefault(require("../flows/well-known.oauth-authorization-server.flow"));
+const well_known_jwks_flow_1 = tslib_1.__importDefault(require("../flows/well-known.jwks.flow"));
+const session_verify_flow_1 = tslib_1.__importDefault(require("../flows/session.verify.flow"));
+class RemotePrimaryAuth extends common_1.FrontMcpAuth {
+    scope;
+    providers;
+    ready;
+    jwks = new jwks_1.JwksService();
+    constructor(scope, providers, options) {
+        super(options);
+        this.scope = scope;
+        this.providers = providers;
+        this.ready = this.initialize();
+    }
+    fetch(input, init) {
+        return fetch(input, init);
+    }
+    validate(request) {
+        return Promise.resolve();
+    }
+    get issuer() {
+        return this.options.baseUrl;
+    }
+    async initialize() {
+        const scope = this.providers.getActiveScope();
+        this.providers.injectProvider({
+            value: this.jwks,
+            metadata: {
+                scope: common_1.ProviderScope.GLOBAL,
+                name: 'auth:jwk-service',
+            },
+            provide: jwks_1.JwksService,
+        });
+        await this.registerAuthFlows(scope);
+        return Promise.resolve();
+    }
+    async registerAuthFlows(scope) {
+        await scope.registryFlows(well_known_prm_flow_1.default, /** /.well-known/oauth-protected-resource */ well_known_oauth_authorization_server_flow_1.default, /** /.well-known/oauth-authorization-server */ well_known_jwks_flow_1.default, /** /.well-known/jwks.json */ session_verify_flow_1.default);
+    }
+}
+exports.RemotePrimaryAuth = RemotePrimaryAuth;
+//# sourceMappingURL=instance.remote-primary-auth.js.map

package/src/auth/instances/instance.remote-primary-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.remote-primary-auth.js","sourceRoot":"","sources":["../../../../src/auth/instances/instance.remote-primary-auth.ts"],"names":[],"mappings":";;;;AAAA,yCAAuG;AAGvG,kCAAoC;AACpC,+FAA4D;AAC5D,6IAAkF;AAClF,iGAA8D;AAC9D,+FAA6D;AAI7D,MAAa,iBAAkB,SAAQ,qBAA+B;IAIvC;IAAoC;IAHxD,KAAK,CAAgB;IACtB,IAAI,GAAG,IAAI,kBAAW,EAAE,CAAC;IAEjC,YAA6B,KAAiB,EAAmB,SAA2B,EAAE,OAA0B;QACtH,KAAK,CAAC,OAAO,CAAC,CAAC;QADY,UAAK,GAAL,KAAK,CAAY;QAAmB,cAAS,GAAT,SAAS,CAAkB;QAE1F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IAEQ,KAAK,CAAC,KAAwB,EAAE,IAAkB;QACzD,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAEQ,QAAQ,CAAC,OAAsB;QACtC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAGD,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,CAAC;IAES,KAAK,CAAC,UAAU;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;QAE9C,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;YAC5B,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,QAAQ,EAAE;gBACR,KAAK,EAAE,sBAAa,CAAC,MAAM;gBAC3B,IAAI,EAAE,kBAAkB;aACzB;YACD,OAAO,EAAE,kBAAW;SACrB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAGO,KAAK,CAAC,iBAAiB,CAAC,KAAY;QAC1C,MAAM,KAAK,CAAC,aAAa,CACvB,6BAAgB,EAAE,4CAA4C,CAC9D,oDAAe,EAAE,8CAA8C,CAC/D,8BAAiB,EAAE,6BAA6B,CAChD,6BAAiB,CAClB,CAAC;IACJ,CAAC;CACF;AA/CD,8CA+CC","sourcesContent":["import {FrontMcpAuth, ProviderScope, RemoteAuthOptions, ScopeEntry, ServerRequest} from '../../common';\nimport {URL} from 'url';\nimport ProviderRegistry from '../../provider/provider.registry';\nimport {JwksService} from '../jwks';\nimport WellKnownPrmFlow from '../flows/well-known.prm.flow';\nimport WellKnownAsFlow from '../flows/well-known.oauth-authorization-server.flow';\nimport WellKnownJwksFlow from '../flows/well-known.jwks.flow';\nimport SessionVerifyFlow from '../flows/session.verify.flow';\nimport {Scope} from '../../scope';\n\n\nexport class RemotePrimaryAuth extends FrontMcpAuth<RemoteAuthOptions> {\n  override ready: Promise<void>;\n  private jwks = new JwksService();\n\n  constructor(private readonly scope: ScopeEntry, private readonly providers: ProviderRegistry, options: RemoteAuthOptions) {\n    super(options);\n    this.ready = this.initialize();\n  }\n\n  override fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {\n    return fetch(input, init);\n  }\n\n  override validate(request: ServerRequest): Promise<void> {\n    return Promise.resolve();\n  }\n\n\n  get issuer(): string {\n    return this.options.baseUrl;\n  }\n\n  protected async initialize() {\n    const scope = this.providers.getActiveScope();\n\n    this.providers.injectProvider({\n      value: this.jwks,\n      metadata: {\n        scope: ProviderScope.GLOBAL,\n        name: 'auth:jwk-service',\n      },\n      provide: JwksService,\n    });\n\n    await this.registerAuthFlows(scope);\n    return Promise.resolve();\n  }\n\n\n  private async registerAuthFlows(scope: Scope) {\n    await scope.registryFlows(\n      WellKnownPrmFlow, /** /.well-known/oauth-protected-resource */\n      WellKnownAsFlow, /** /.well-known/oauth-authorization-server */\n      WellKnownJwksFlow, /** /.well-known/jwks.json */\n      SessionVerifyFlow, /** Session verification flow */\n    );\n  }\n}"]}

package/src/auth/jwks/index.d.ts

@@ -0,0 +1,2 @@
+export * from './jwks.service';
+export * from './jwks.types';

package/src/auth/jwks/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./jwks.service"), exports);
+tslib_1.__exportStar(require("./jwks.types"), exports);
+//# sourceMappingURL=index.js.map

package/src/auth/jwks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/auth/jwks/index.ts"],"names":[],"mappings":";;;AAAA,yDAA+B;AAC/B,uDAA6B","sourcesContent":["export * from './jwks.service';\nexport * from './jwks.types';\n"]}