@frontmcp/sdk 0.4.0 → 0.5.0

package/src/auth/authorization/orchestrated.authorization.js

@@ -0,0 +1,306 @@
+"use strict";
+// auth/authorization/orchestrated.authorization.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrchestratedAuthorization = void 0;
+const crypto_1 = require("crypto");
+const authorization_class_1 = require("./authorization.class");
+/**
+ * OrchestratedAuthorization - Local auth server with secure token storage
+ *
+ * In orchestrated mode:
+ * - The MCP server acts as an OAuth client to upstream providers
+ * - Provider tokens are encrypted and never exposed to the LLM
+ * - Supports token refresh and multi-provider scenarios
+ * - getToken() retrieves decrypted tokens from secure storage
+ * - Ideal for multi-tenant, federated auth, or high-security scenarios
+ */
+class OrchestratedAuthorization extends authorization_class_1.AuthorizationBase {
+    mode = 'orchestrated';
+    /**
+     * Primary provider ID (default for getToken)
+     */
+    primaryProviderId;
+    /**
+     * Token store for secure token retrieval
+     */
+    #tokenStore;
+    /**
+     * Token refresh callback
+     */
+    #onTokenRefresh;
+    /**
+     * Provider states (encrypted tokens)
+     */
+    #providerStates;
+    constructor(ctx) {
+        super(ctx);
+        this.primaryProviderId = ctx.primaryProviderId;
+        this.#tokenStore = ctx.tokenStore;
+        this.#onTokenRefresh = ctx.onTokenRefresh;
+        this.#providerStates = ctx.providerStates ?? new Map();
+    }
+    /**
+     * Create an OrchestratedAuthorization
+     *
+     * @param ctx - Creation context
+     * @returns A new OrchestratedAuthorization instance
+     *
+     * @example
+     * ```typescript
+     * const auth = OrchestratedAuthorization.create({
+     *   token: localJwt,
+     *   user: { sub: 'user123', name: 'John' },
+     *   primaryProviderId: 'github',
+     *   tokenStore: redisTokenStore,
+     *   providers: {
+     *     github: { id: 'github', secretRefId: 'vault:github:user123' },
+     *   },
+     * });
+     *
+     * // Retrieve token securely (never exposed to LLM)
+     * const githubToken = await auth.getToken('github');
+     * ```
+     */
+    static create(ctx) {
+        const { token, user, scopes = [], claims, expiresAt, primaryProviderId, tokenStore, onTokenRefresh, providers = {}, ...projections } = ctx;
+        // Generate authorization ID from token
+        const id = OrchestratedAuthorization.generateAuthorizationId(token);
+        // Build provider states map
+        const providerStates = new Map();
+        const authorizedProviders = {};
+        const authorizedProviderIds = [];
+        for (const [providerId, state] of Object.entries(providers)) {
+            providerStates.set(providerId, state);
+            authorizedProviderIds.push(providerId);
+            // Create snapshot without exposing tokens
+            authorizedProviders[providerId] = {
+                id: providerId,
+                exp: state.expiresAt,
+                embedMode: state.secretRefId ? 'ref' : 'store-only',
+                secretRefId: state.secretRefId,
+                refreshRefId: state.refreshRefId,
+            };
+        }
+        return new OrchestratedAuthorization({
+            id,
+            isAnonymous: false,
+            user,
+            claims,
+            expiresAt,
+            scopes,
+            token,
+            primaryProviderId,
+            tokenStore,
+            onTokenRefresh,
+            providerStates,
+            authorizedProviders,
+            authorizedProviderIds,
+            ...projections,
+        });
+    }
+    /**
+     * Get access token for a provider
+     *
+     * Retrieves the decrypted token from the secure store.
+     * If the token is expired and refresh is available, attempts refresh.
+     *
+     * @param providerId - Provider ID (defaults to primaryProviderId)
+     * @returns The decrypted access token
+     * @throws If no token store or no token available
+     */
+    async getToken(providerId) {
+        const targetProviderId = providerId ?? this.primaryProviderId;
+        if (!targetProviderId) {
+            throw new Error('OrchestratedAuthorization: No provider ID specified and no primary provider set');
+        }
+        if (!this.#tokenStore) {
+            throw new Error('OrchestratedAuthorization: Token store not configured. ' +
+                'Orchestrated mode requires a token store for secure token retrieval.');
+        }
+        // Check if token exists
+        const hasToken = await this.#tokenStore.hasTokens(this.id, targetProviderId);
+        if (!hasToken) {
+            throw new Error(`OrchestratedAuthorization: No tokens available for provider "${targetProviderId}"`);
+        }
+        // Get access token
+        const accessToken = await this.#tokenStore.getAccessToken(this.id, targetProviderId);
+        if (accessToken) {
+            // Check if token needs refresh
+            const providerState = this.#providerStates.get(targetProviderId);
+            if (providerState?.expiresAt && providerState.expiresAt < Date.now()) {
+                return this.refreshAndGetToken(targetProviderId);
+            }
+            return accessToken;
+        }
+        // Try to refresh if we have a refresh token
+        return this.refreshAndGetToken(targetProviderId);
+    }
+    /**
+     * Refresh token and return new access token
+     */
+    async refreshAndGetToken(providerId) {
+        if (!this.#tokenStore || !this.#onTokenRefresh) {
+            throw new Error(`OrchestratedAuthorization: Token expired for provider "${providerId}" and refresh not available`);
+        }
+        const refreshToken = await this.#tokenStore.getRefreshToken(this.id, providerId);
+        if (!refreshToken) {
+            throw new Error(`OrchestratedAuthorization: No refresh token available for provider "${providerId}"`);
+        }
+        // Perform refresh
+        const result = await this.#onTokenRefresh(providerId, refreshToken);
+        // Store new tokens
+        await this.#tokenStore.storeTokens(this.id, providerId, {
+            accessToken: result.accessToken,
+            refreshToken: result.refreshToken,
+            expiresAt: result.expiresIn ? Date.now() + result.expiresIn * 1000 : undefined,
+        });
+        // Update provider state
+        const currentState = this.#providerStates.get(providerId);
+        if (currentState) {
+            currentState.expiresAt = result.expiresIn ? Date.now() + result.expiresIn * 1000 : undefined;
+        }
+        return result.accessToken;
+    }
+    /**
+     * Generate authorization ID from token
+     */
+    static generateAuthorizationId(token) {
+        const parts = token.split('.');
+        const signature = parts[2] || token;
+        return (0, crypto_1.createHash)('sha256').update(signature).digest('hex').substring(0, 16);
+    }
+    /**
+     * Check if a provider has tokens stored
+     */
+    hasProvider(providerId) {
+        return this.#providerStates.has(providerId);
+    }
+    /**
+     * Get all provider IDs with tokens
+     */
+    getProviderIds() {
+        return Array.from(this.#providerStates.keys());
+    }
+    /**
+     * Add a new provider to this authorization
+     * Used when user authorizes additional providers after initial auth
+     */
+    async addProvider(providerId, tokens) {
+        if (!this.#tokenStore) {
+            throw new Error('OrchestratedAuthorization: Token store required to add providers');
+        }
+        const expiresAt = tokens.expiresIn ? Date.now() + tokens.expiresIn * 1000 : undefined;
+        // Store tokens
+        await this.#tokenStore.storeTokens(this.id, providerId, {
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            expiresAt,
+        });
+        // Update internal state
+        this.#providerStates.set(providerId, {
+            id: providerId,
+            expiresAt,
+            secretRefId: `${this.id}:${providerId}`,
+        });
+        // Note: authorizedProviders/authorizedProviderIds are readonly
+        // The caller should create a new authorization if these need to be updated
+    }
+    // ============================================
+    // Progressive/Incremental Authorization
+    // ============================================
+    /**
+     * Mutable app authorization state for progressive auth.
+     * This allows expanding authorization without reissuing the session token.
+     */
+    #mutableAuthorizedApps = new Map(Object.entries(this.authorizedApps ?? {}));
+    /**
+     * Add app authorization after initial auth (progressive authorization).
+     * Stores app tokens server-side and updates authorized apps without JWT reissue.
+     *
+     * @param appId - App ID to authorize
+     * @param toolIds - Tool IDs accessible through this app authorization
+     * @param tokens - OAuth tokens from the app's auth provider
+     *
+     * @example
+     * ```typescript
+     * // User clicks auth link for Slack app
+     * await auth.addAppAuthorization('slack', ['slack:send_message', 'slack:list_channels'], {
+     *   accessToken: slackAccessToken,
+     *   refreshToken: slackRefreshToken,
+     *   expiresIn: 3600,
+     * });
+     *
+     * // Now slack tools will work without re-auth
+     * ```
+     */
+    async addAppAuthorization(appId, toolIds, tokens) {
+        if (!this.#tokenStore) {
+            throw new Error('OrchestratedAuthorization: Token store required for progressive authorization');
+        }
+        // Use app ID as provider ID for app-specific token storage
+        const providerId = `app:${appId}`;
+        // Store tokens server-side (SECURITY: never expose in JWT)
+        await this.addProvider(providerId, tokens);
+        // Track app authorization in mutable state
+        this.#mutableAuthorizedApps.set(appId, { id: appId, toolIds });
+    }
+    /**
+     * Get access token for a specific app (for tool execution).
+     * Retrieves the app's OAuth token from server-side storage.
+     *
+     * @param appId - App ID to get token for
+     * @returns The decrypted access token, or null if not authorized
+     */
+    async getAppToken(appId) {
+        if (!this.#mutableAuthorizedApps.has(appId)) {
+            return null;
+        }
+        const providerId = `app:${appId}`;
+        try {
+            return await this.getToken(providerId);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Check if an app is authorized (includes progressively authorized apps).
+     * Overrides base class to include mutable app authorization state.
+     */
+    isAppAuthorized(appId) {
+        return this.#mutableAuthorizedApps.has(appId) || super.isAppAuthorized(appId);
+    }
+    /**
+     * Get all authorized app IDs (includes progressively authorized apps).
+     */
+    getAllAuthorizedAppIds() {
+        const baseIds = new Set(this.authorizedAppIds ?? []);
+        for (const appId of this.#mutableAuthorizedApps.keys()) {
+            baseIds.add(appId);
+        }
+        return Array.from(baseIds);
+    }
+    /**
+     * Get tool IDs authorized through an app.
+     */
+    getAppToolIds(appId) {
+        return this.#mutableAuthorizedApps.get(appId)?.toolIds ?? this.authorizedApps?.[appId]?.toolIds;
+    }
+    /**
+     * Remove a provider from this authorization
+     */
+    async removeProvider(providerId) {
+        if (this.#tokenStore) {
+            await this.#tokenStore.deleteTokens(this.id, providerId);
+        }
+        this.#providerStates.delete(providerId);
+    }
+    /**
+     * Get the issuer (local orchestrator)
+     */
+    get issuer() {
+        return this.claims?.['iss'];
+    }
+}
+exports.OrchestratedAuthorization = OrchestratedAuthorization;
+//# sourceMappingURL=orchestrated.authorization.js.map

package/src/auth/authorization/orchestrated.authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrated.authorization.js","sourceRoot":"","sources":["../../../../src/auth/authorization/orchestrated.authorization.ts"],"names":[],"mappings":";AAAA,mDAAmD;;;AAEnD,mCAAoC;AACpC,+DAA0D;AAwI1D;;;;;;;;;GASG;AACH,MAAa,yBAA0B,SAAQ,uCAAiB;IACrD,IAAI,GAAa,cAAc,CAAC;IAEzC;;OAEG;IACM,iBAAiB,CAAU;IAEpC;;OAEG;IACM,WAAW,CAAc;IAElC;;OAEG;IACM,eAAe,CAAwB;IAEhD;;OAEG;IACM,eAAe,CAAyC;IAEjE,YACE,GAKC;QAED,KAAK,CAAC,GAAG,CAAC,CAAC;QACX,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,cAAc,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,cAAc,IAAI,IAAI,GAAG,EAAE,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,CAAC,MAAM,CAAC,GAAuC;QACnD,MAAM,EACJ,KAAK,EACL,IAAI,EACJ,MAAM,GAAG,EAAE,EACX,MAAM,EACN,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,SAAS,GAAG,EAAE,EACd,GAAG,WAAW,EACf,GAAG,GAAG,CAAC;QAER,uCAAuC;QACvC,MAAM,EAAE,GAAG,yBAAyB,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAEpE,4BAA4B;QAC5B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqC,CAAC;QACpE,MAAM,mBAAmB,GAAqC,EAAE,CAAC;QACjE,MAAM,qBAAqB,GAAa,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACtC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAEvC,0CAA0C;YAC1C,mBAAmB,CAAC,UAAU,CAAC,GAAG;gBAChC,EAAE,EAAE,UAAU;gBACd,GAAG,EAAE,KAAK,CAAC,SAAS;gBACpB,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;gBACnD,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,yBAAyB,CAAC;YACnC,EAAE;YACF,WAAW,EAAE,KAAK;YAClB,IAAI;YACJ,MAAM;YACN,SAAS;YACT,MAAM;YACN,KAAK;YACL,iBAAiB;YACjB,UAAU;YACV,cAAc;YACd,cAAc;YACd,mBAAmB;YACnB,qBAAqB;YACrB,GAAG,WAAW;SACf,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAmB;QAChC,MAAM,gBAAgB,GAAG,UAAU,IAAI,IAAI,CAAC,iBAAiB,CAAC;QAE9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,yDAAyD;gBACvD,sEAAsE,CACzE,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,gEAAgE,gBAAgB,GAAG,CAAC,CAAC;QACvG,CAAC;QAED,mBAAmB;QACnB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAErF,IAAI,WAAW,EAAE,CAAC;YAChB,+BAA+B;YAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACjE,IAAI,aAAa,EAAE,SAAS,IAAI,aAAa,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,4CAA4C;QAC5C,OAAO,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,UAAkB;QACjD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,0DAA0D,UAAU,6BAA6B,CAClG,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACjF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,uEAAuE,UAAU,GAAG,CAAC,CAAC;QACxG,CAAC;QAED,kBAAkB;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEpE,mBAAmB;QACnB,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE;YACtD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SAC/E,CAAC,CAAC;QAEH,wBAAwB;QACxB,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,YAAY,EAAE,CAAC;YACjB,YAAY,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,uBAAuB,CAAC,KAAa;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QACpC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,UAAkB;QAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CACf,UAAkB,EAClB,MAIC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtF,eAAe;QACf,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE;YACtD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS;SACV,CAAC,CAAC;QAEH,wBAAwB;QACxB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE;YACnC,EAAE,EAAE,UAAU;YACd,SAAS;YACT,WAAW,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE;SACxC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,2EAA2E;IAC7E,CAAC;IAED,+CAA+C;IAC/C,wCAAwC;IACxC,+CAA+C;IAE/C;;;OAGG;IACH,sBAAsB,GAAmD,IAAI,GAAG,CAC9E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAC1C,CAAC;IAEF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,mBAAmB,CACvB,KAAa,EACb,OAAiB,EACjB,MAIC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QAED,2DAA2D;QAC3D,MAAM,UAAU,GAAG,OAAO,KAAK,EAAE,CAAC;QAElC,2DAA2D;QAC3D,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAE3C,2CAA2C;QAC3C,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,KAAK,EAAE,CAAC;QAElC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACM,eAAe,CAAC,KAAa;QACpC,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC;IAED;;OAEG;IACH,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAa;QACzB,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAClG,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAuB,CAAC;IACpD,CAAC;CACF;AAnXD,8DAmXC","sourcesContent":["// auth/authorization/orchestrated.authorization.ts\n\nimport { createHash } from 'crypto';\nimport { AuthorizationBase } from './authorization.class';\nimport { AuthorizationCreateCtx, AuthUser } from './authorization.types';\nimport { ProviderSnapshot } from '../session/session.types';\nimport { EncryptedBlob } from '../session';\nimport { AuthMode } from '../../common';\n\n/**\n * Token store interface for orchestrated mode\n * Implementations can be memory-based, Redis, or custom stores\n */\nexport interface TokenStore {\n  /**\n   * Retrieve decrypted access token for a provider\n   */\n  getAccessToken(authorizationId: string, providerId: string): Promise<string | null>;\n\n  /**\n   * Retrieve decrypted refresh token for a provider\n   */\n  getRefreshToken(authorizationId: string, providerId: string): Promise<string | null>;\n\n  /**\n   * Store tokens for a provider (encrypted)\n   */\n  storeTokens(\n    authorizationId: string,\n    providerId: string,\n    tokens: {\n      accessToken: string;\n      refreshToken?: string;\n      expiresAt?: number;\n    },\n  ): Promise<void>;\n\n  /**\n   * Delete tokens for a provider\n   */\n  deleteTokens(authorizationId: string, providerId: string): Promise<void>;\n\n  /**\n   * Check if tokens exist for a provider\n   */\n  hasTokens(authorizationId: string, providerId: string): Promise<boolean>;\n}\n\n/**\n * Token refresh callback type\n */\nexport type TokenRefreshCallback = (\n  providerId: string,\n  refreshToken: string,\n) => Promise<{\n  accessToken: string;\n  refreshToken?: string;\n  expiresIn?: number;\n}>;\n\n/**\n * Provider token state for orchestrated authorization\n */\nexport interface OrchestratedProviderState {\n  /** Provider ID */\n  id: string;\n  /** Encrypted access token blob */\n  accessTokenEnc?: EncryptedBlob;\n  /** Encrypted refresh token blob */\n  refreshTokenEnc?: EncryptedBlob;\n  /** Token expiration (epoch ms) */\n  expiresAt?: number;\n  /** External reference ID (for vault/store) */\n  secretRefId?: string;\n  /** Refresh reference ID */\n  refreshRefId?: string;\n}\n\n/**\n * Context for creating an OrchestratedAuthorization\n */\nexport interface OrchestratedAuthorizationCreateCtx {\n  /**\n   * The local JWT issued by the orchestrating server\n   */\n  token: string;\n\n  /**\n   * User identity from upstream provider\n   */\n  user: AuthUser;\n\n  /**\n   * Scopes granted to this authorization\n   */\n  scopes?: string[];\n\n  /**\n   * JWT claims\n   */\n  claims?: Record<string, unknown>;\n\n  /**\n   * Expiration (epoch ms)\n   */\n  expiresAt?: number;\n\n  /**\n   * Primary provider ID (default for getToken)\n   */\n  primaryProviderId?: string;\n\n  /**\n   * Token store for retrieving/storing provider tokens\n   */\n  tokenStore?: TokenStore;\n\n  /**\n   * Token refresh callback\n   */\n  onTokenRefresh?: TokenRefreshCallback;\n\n  /**\n   * Provider states (with encrypted tokens)\n   */\n  providers?: Record<string, OrchestratedProviderState>;\n\n  /**\n   * Precomputed authorization projections\n   */\n  authorizedTools?: AuthorizationCreateCtx['authorizedTools'];\n  authorizedToolIds?: string[];\n  authorizedPrompts?: AuthorizationCreateCtx['authorizedPrompts'];\n  authorizedPromptIds?: string[];\n  authorizedApps?: AuthorizationCreateCtx['authorizedApps'];\n  authorizedAppIds?: string[];\n  authorizedResources?: string[];\n}\n\n/**\n * OrchestratedAuthorization - Local auth server with secure token storage\n *\n * In orchestrated mode:\n * - The MCP server acts as an OAuth client to upstream providers\n * - Provider tokens are encrypted and never exposed to the LLM\n * - Supports token refresh and multi-provider scenarios\n * - getToken() retrieves decrypted tokens from secure storage\n * - Ideal for multi-tenant, federated auth, or high-security scenarios\n */\nexport class OrchestratedAuthorization extends AuthorizationBase {\n  readonly mode: AuthMode = 'orchestrated';\n\n  /**\n   * Primary provider ID (default for getToken)\n   */\n  readonly primaryProviderId?: string;\n\n  /**\n   * Token store for secure token retrieval\n   */\n  readonly #tokenStore?: TokenStore;\n\n  /**\n   * Token refresh callback\n   */\n  readonly #onTokenRefresh?: TokenRefreshCallback;\n\n  /**\n   * Provider states (encrypted tokens)\n   */\n  readonly #providerStates: Map<string, OrchestratedProviderState>;\n\n  private constructor(\n    ctx: AuthorizationCreateCtx & {\n      primaryProviderId?: string;\n      tokenStore?: TokenStore;\n      onTokenRefresh?: TokenRefreshCallback;\n      providerStates?: Map<string, OrchestratedProviderState>;\n    },\n  ) {\n    super(ctx);\n    this.primaryProviderId = ctx.primaryProviderId;\n    this.#tokenStore = ctx.tokenStore;\n    this.#onTokenRefresh = ctx.onTokenRefresh;\n    this.#providerStates = ctx.providerStates ?? new Map();\n  }\n\n  /**\n   * Create an OrchestratedAuthorization\n   *\n   * @param ctx - Creation context\n   * @returns A new OrchestratedAuthorization instance\n   *\n   * @example\n   * ```typescript\n   * const auth = OrchestratedAuthorization.create({\n   *   token: localJwt,\n   *   user: { sub: 'user123', name: 'John' },\n   *   primaryProviderId: 'github',\n   *   tokenStore: redisTokenStore,\n   *   providers: {\n   *     github: { id: 'github', secretRefId: 'vault:github:user123' },\n   *   },\n   * });\n   *\n   * // Retrieve token securely (never exposed to LLM)\n   * const githubToken = await auth.getToken('github');\n   * ```\n   */\n  static create(ctx: OrchestratedAuthorizationCreateCtx): OrchestratedAuthorization {\n    const {\n      token,\n      user,\n      scopes = [],\n      claims,\n      expiresAt,\n      primaryProviderId,\n      tokenStore,\n      onTokenRefresh,\n      providers = {},\n      ...projections\n    } = ctx;\n\n    // Generate authorization ID from token\n    const id = OrchestratedAuthorization.generateAuthorizationId(token);\n\n    // Build provider states map\n    const providerStates = new Map<string, OrchestratedProviderState>();\n    const authorizedProviders: Record<string, ProviderSnapshot> = {};\n    const authorizedProviderIds: string[] = [];\n\n    for (const [providerId, state] of Object.entries(providers)) {\n      providerStates.set(providerId, state);\n      authorizedProviderIds.push(providerId);\n\n      // Create snapshot without exposing tokens\n      authorizedProviders[providerId] = {\n        id: providerId,\n        exp: state.expiresAt,\n        embedMode: state.secretRefId ? 'ref' : 'store-only',\n        secretRefId: state.secretRefId,\n        refreshRefId: state.refreshRefId,\n      };\n    }\n\n    return new OrchestratedAuthorization({\n      id,\n      isAnonymous: false,\n      user,\n      claims,\n      expiresAt,\n      scopes,\n      token,\n      primaryProviderId,\n      tokenStore,\n      onTokenRefresh,\n      providerStates,\n      authorizedProviders,\n      authorizedProviderIds,\n      ...projections,\n    });\n  }\n\n  /**\n   * Get access token for a provider\n   *\n   * Retrieves the decrypted token from the secure store.\n   * If the token is expired and refresh is available, attempts refresh.\n   *\n   * @param providerId - Provider ID (defaults to primaryProviderId)\n   * @returns The decrypted access token\n   * @throws If no token store or no token available\n   */\n  async getToken(providerId?: string): Promise<string> {\n    const targetProviderId = providerId ?? this.primaryProviderId;\n\n    if (!targetProviderId) {\n      throw new Error('OrchestratedAuthorization: No provider ID specified and no primary provider set');\n    }\n\n    if (!this.#tokenStore) {\n      throw new Error(\n        'OrchestratedAuthorization: Token store not configured. ' +\n          'Orchestrated mode requires a token store for secure token retrieval.',\n      );\n    }\n\n    // Check if token exists\n    const hasToken = await this.#tokenStore.hasTokens(this.id, targetProviderId);\n    if (!hasToken) {\n      throw new Error(`OrchestratedAuthorization: No tokens available for provider \"${targetProviderId}\"`);\n    }\n\n    // Get access token\n    const accessToken = await this.#tokenStore.getAccessToken(this.id, targetProviderId);\n\n    if (accessToken) {\n      // Check if token needs refresh\n      const providerState = this.#providerStates.get(targetProviderId);\n      if (providerState?.expiresAt && providerState.expiresAt < Date.now()) {\n        return this.refreshAndGetToken(targetProviderId);\n      }\n      return accessToken;\n    }\n\n    // Try to refresh if we have a refresh token\n    return this.refreshAndGetToken(targetProviderId);\n  }\n\n  /**\n   * Refresh token and return new access token\n   */\n  private async refreshAndGetToken(providerId: string): Promise<string> {\n    if (!this.#tokenStore || !this.#onTokenRefresh) {\n      throw new Error(\n        `OrchestratedAuthorization: Token expired for provider \"${providerId}\" and refresh not available`,\n      );\n    }\n\n    const refreshToken = await this.#tokenStore.getRefreshToken(this.id, providerId);\n    if (!refreshToken) {\n      throw new Error(`OrchestratedAuthorization: No refresh token available for provider \"${providerId}\"`);\n    }\n\n    // Perform refresh\n    const result = await this.#onTokenRefresh(providerId, refreshToken);\n\n    // Store new tokens\n    await this.#tokenStore.storeTokens(this.id, providerId, {\n      accessToken: result.accessToken,\n      refreshToken: result.refreshToken,\n      expiresAt: result.expiresIn ? Date.now() + result.expiresIn * 1000 : undefined,\n    });\n\n    // Update provider state\n    const currentState = this.#providerStates.get(providerId);\n    if (currentState) {\n      currentState.expiresAt = result.expiresIn ? Date.now() + result.expiresIn * 1000 : undefined;\n    }\n\n    return result.accessToken;\n  }\n\n  /**\n   * Generate authorization ID from token\n   */\n  private static generateAuthorizationId(token: string): string {\n    const parts = token.split('.');\n    const signature = parts[2] || token;\n    return createHash('sha256').update(signature).digest('hex').substring(0, 16);\n  }\n\n  /**\n   * Check if a provider has tokens stored\n   */\n  hasProvider(providerId: string): boolean {\n    return this.#providerStates.has(providerId);\n  }\n\n  /**\n   * Get all provider IDs with tokens\n   */\n  getProviderIds(): string[] {\n    return Array.from(this.#providerStates.keys());\n  }\n\n  /**\n   * Add a new provider to this authorization\n   * Used when user authorizes additional providers after initial auth\n   */\n  async addProvider(\n    providerId: string,\n    tokens: {\n      accessToken: string;\n      refreshToken?: string;\n      expiresIn?: number;\n    },\n  ): Promise<void> {\n    if (!this.#tokenStore) {\n      throw new Error('OrchestratedAuthorization: Token store required to add providers');\n    }\n\n    const expiresAt = tokens.expiresIn ? Date.now() + tokens.expiresIn * 1000 : undefined;\n\n    // Store tokens\n    await this.#tokenStore.storeTokens(this.id, providerId, {\n      accessToken: tokens.accessToken,\n      refreshToken: tokens.refreshToken,\n      expiresAt,\n    });\n\n    // Update internal state\n    this.#providerStates.set(providerId, {\n      id: providerId,\n      expiresAt,\n      secretRefId: `${this.id}:${providerId}`,\n    });\n\n    // Note: authorizedProviders/authorizedProviderIds are readonly\n    // The caller should create a new authorization if these need to be updated\n  }\n\n  // ============================================\n  // Progressive/Incremental Authorization\n  // ============================================\n\n  /**\n   * Mutable app authorization state for progressive auth.\n   * This allows expanding authorization without reissuing the session token.\n   */\n  #mutableAuthorizedApps: Map<string, { id: string; toolIds: string[] }> = new Map(\n    Object.entries(this.authorizedApps ?? {}),\n  );\n\n  /**\n   * Add app authorization after initial auth (progressive authorization).\n   * Stores app tokens server-side and updates authorized apps without JWT reissue.\n   *\n   * @param appId - App ID to authorize\n   * @param toolIds - Tool IDs accessible through this app authorization\n   * @param tokens - OAuth tokens from the app's auth provider\n   *\n   * @example\n   * ```typescript\n   * // User clicks auth link for Slack app\n   * await auth.addAppAuthorization('slack', ['slack:send_message', 'slack:list_channels'], {\n   *   accessToken: slackAccessToken,\n   *   refreshToken: slackRefreshToken,\n   *   expiresIn: 3600,\n   * });\n   *\n   * // Now slack tools will work without re-auth\n   * ```\n   */\n  async addAppAuthorization(\n    appId: string,\n    toolIds: string[],\n    tokens: {\n      accessToken: string;\n      refreshToken?: string;\n      expiresIn?: number;\n    },\n  ): Promise<void> {\n    if (!this.#tokenStore) {\n      throw new Error('OrchestratedAuthorization: Token store required for progressive authorization');\n    }\n\n    // Use app ID as provider ID for app-specific token storage\n    const providerId = `app:${appId}`;\n\n    // Store tokens server-side (SECURITY: never expose in JWT)\n    await this.addProvider(providerId, tokens);\n\n    // Track app authorization in mutable state\n    this.#mutableAuthorizedApps.set(appId, { id: appId, toolIds });\n  }\n\n  /**\n   * Get access token for a specific app (for tool execution).\n   * Retrieves the app's OAuth token from server-side storage.\n   *\n   * @param appId - App ID to get token for\n   * @returns The decrypted access token, or null if not authorized\n   */\n  async getAppToken(appId: string): Promise<string | null> {\n    if (!this.#mutableAuthorizedApps.has(appId)) {\n      return null;\n    }\n\n    const providerId = `app:${appId}`;\n\n    try {\n      return await this.getToken(providerId);\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Check if an app is authorized (includes progressively authorized apps).\n   * Overrides base class to include mutable app authorization state.\n   */\n  override isAppAuthorized(appId: string): boolean {\n    return this.#mutableAuthorizedApps.has(appId) || super.isAppAuthorized(appId);\n  }\n\n  /**\n   * Get all authorized app IDs (includes progressively authorized apps).\n   */\n  getAllAuthorizedAppIds(): string[] {\n    const baseIds = new Set(this.authorizedAppIds ?? []);\n    for (const appId of this.#mutableAuthorizedApps.keys()) {\n      baseIds.add(appId);\n    }\n    return Array.from(baseIds);\n  }\n\n  /**\n   * Get tool IDs authorized through an app.\n   */\n  getAppToolIds(appId: string): string[] | undefined {\n    return this.#mutableAuthorizedApps.get(appId)?.toolIds ?? this.authorizedApps?.[appId]?.toolIds;\n  }\n\n  /**\n   * Remove a provider from this authorization\n   */\n  async removeProvider(providerId: string): Promise<void> {\n    if (this.#tokenStore) {\n      await this.#tokenStore.deleteTokens(this.id, providerId);\n    }\n    this.#providerStates.delete(providerId);\n  }\n\n  /**\n   * Get the issuer (local orchestrator)\n   */\n  get issuer(): string | undefined {\n    return this.claims?.['iss'] as string | undefined;\n  }\n}\n"]}

package/src/auth/authorization/public.authorization.d.ts

@@ -0,0 +1,91 @@
+import { AuthorizationBase } from './authorization.class';
+import { AuthMode } from '../../common';
+/**
+ * Context for creating a PublicAuthorization
+ */
+export interface PublicAuthorizationCreateCtx {
+    /**
+     * Anonymous user's identifier prefix
+     * @default 'anon'
+     */
+    prefix?: string;
+    /**
+     * Anonymous scopes granted to the user
+     * @default ['anonymous']
+     */
+    scopes?: string[];
+    /**
+     * Session TTL in milliseconds
+     * @default 3600000 (1 hour)
+     */
+    ttlMs?: number;
+    /**
+     * Issuer identifier for the anonymous JWT
+     */
+    issuer?: string;
+    /**
+     * Allowed tools for anonymous access
+     * If 'all', all tools are allowed
+     */
+    allowedTools?: 'all' | string[];
+    /**
+     * Allowed prompts for anonymous access
+     * If 'all', all prompts are allowed
+     */
+    allowedPrompts?: 'all' | string[];
+}
+/**
+ * PublicAuthorization - Authorization for public/anonymous access mode
+ *
+ * In public mode:
+ * - No authentication is required
+ * - Anonymous sessions are auto-generated
+ * - getToken() throws - anonymous users cannot access provider tokens
+ * - Ideal for development, docs, public wikis, and read-only resources
+ */
+export declare class PublicAuthorization extends AuthorizationBase {
+    readonly mode: AuthMode;
+    /**
+     * Issuer identifier for the anonymous authorization
+     */
+    readonly issuer?: string;
+    private constructor();
+    /**
+     * Create a new PublicAuthorization for anonymous access
+     *
+     * @param ctx - Creation context with optional configuration
+     * @returns A new PublicAuthorization instance
+     *
+     * @example
+     * ```typescript
+     * const auth = PublicAuthorization.create({
+     *   scopes: ['read', 'anonymous'],
+     *   ttlMs: 3600000,
+     *   allowedTools: ['search', 'get-docs'],
+     * });
+     * ```
+     */
+    static create(ctx?: PublicAuthorizationCreateCtx): PublicAuthorization;
+    /**
+     * Anonymous users cannot access provider tokens
+     *
+     * @throws Error always - anonymous users do not have provider tokens
+     */
+    getToken(_providerId?: string): Promise<string>;
+    /**
+     * Check if all tools are allowed (public access)
+     */
+    get allowsAllTools(): boolean;
+    /**
+     * Check if all prompts are allowed (public access)
+     */
+    get allowsAllPrompts(): boolean;
+    /**
+     * Override canAccessTool to support 'all' mode
+     */
+    canAccessTool(toolId: string): boolean;
+    /**
+     * Override canAccessPrompt to support 'all' mode
+     */
+    canAccessPrompt(promptId: string): boolean;
+}

package/src/auth/authorization/public.authorization.js

@@ -0,0 +1,132 @@
+"use strict";
+// auth/authorization/public.authorization.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicAuthorization = void 0;
+const crypto_1 = require("crypto");
+const authorization_class_1 = require("./authorization.class");
+/**
+ * PublicAuthorization - Authorization for public/anonymous access mode
+ *
+ * In public mode:
+ * - No authentication is required
+ * - Anonymous sessions are auto-generated
+ * - getToken() throws - anonymous users cannot access provider tokens
+ * - Ideal for development, docs, public wikis, and read-only resources
+ */
+class PublicAuthorization extends authorization_class_1.AuthorizationBase {
+    mode = 'public';
+    /**
+     * Issuer identifier for the anonymous authorization
+     */
+    issuer;
+    constructor(ctx) {
+        super(ctx);
+        this.issuer = ctx.issuer;
+    }
+    /**
+     * Create a new PublicAuthorization for anonymous access
+     *
+     * @param ctx - Creation context with optional configuration
+     * @returns A new PublicAuthorization instance
+     *
+     * @example
+     * ```typescript
+     * const auth = PublicAuthorization.create({
+     *   scopes: ['read', 'anonymous'],
+     *   ttlMs: 3600000,
+     *   allowedTools: ['search', 'get-docs'],
+     * });
+     * ```
+     */
+    static create(ctx = {}) {
+        const { prefix = 'anon', scopes = ['anonymous'], ttlMs = 3600000, // 1 hour default
+        issuer, allowedTools = 'all', allowedPrompts = 'all', } = ctx;
+        // Generate anonymous user identity
+        const uuid = (0, crypto_1.randomUUID)();
+        const sub = `${prefix}:${uuid}`;
+        const user = {
+            sub,
+            name: 'Anonymous',
+            anonymous: true,
+        };
+        // Calculate expiration
+        const expiresAt = ttlMs ? Date.now() + ttlMs : undefined;
+        // Build authorized tools map
+        const authorizedTools = {};
+        const authorizedToolIds = [];
+        if (allowedTools !== 'all' && Array.isArray(allowedTools)) {
+            for (const toolId of allowedTools) {
+                authorizedTools[toolId] = {
+                    executionPath: ['public', toolId],
+                };
+                authorizedToolIds.push(toolId);
+            }
+        }
+        // Build authorized prompts map
+        const authorizedPrompts = {};
+        const authorizedPromptIds = [];
+        if (allowedPrompts !== 'all' && Array.isArray(allowedPrompts)) {
+            for (const promptId of allowedPrompts) {
+                authorizedPrompts[promptId] = {
+                    executionPath: ['public', promptId],
+                };
+                authorizedPromptIds.push(promptId);
+            }
+        }
+        return new PublicAuthorization({
+            id: sub,
+            isAnonymous: true,
+            user,
+            scopes,
+            expiresAt,
+            issuer,
+            authorizedTools: allowedTools === 'all' ? undefined : authorizedTools,
+            authorizedToolIds: allowedTools === 'all' ? undefined : authorizedToolIds,
+            authorizedPrompts: allowedPrompts === 'all' ? undefined : authorizedPrompts,
+            authorizedPromptIds: allowedPrompts === 'all' ? undefined : authorizedPromptIds,
+        });
+    }
+    /**
+     * Anonymous users cannot access provider tokens
+     *
+     * @throws Error always - anonymous users do not have provider tokens
+     */
+    async getToken(_providerId) {
+        throw new Error('PublicAuthorization: Anonymous users cannot access provider tokens. ' +
+            'Use transparent or orchestrated mode for token access.');
+    }
+    /**
+     * Check if all tools are allowed (public access)
+     */
+    get allowsAllTools() {
+        return this.authorizedToolIds.length === 0 && Object.keys(this.authorizedTools).length === 0;
+    }
+    /**
+     * Check if all prompts are allowed (public access)
+     */
+    get allowsAllPrompts() {
+        return this.authorizedPromptIds.length === 0 && Object.keys(this.authorizedPrompts).length === 0;
+    }
+    /**
+     * Override canAccessTool to support 'all' mode
+     */
+    canAccessTool(toolId) {
+        // If no specific tools defined, all are allowed
+        if (this.allowsAllTools) {
+            return true;
+        }
+        return super.canAccessTool(toolId);
+    }
+    /**
+     * Override canAccessPrompt to support 'all' mode
+     */
+    canAccessPrompt(promptId) {
+        // If no specific prompts defined, all are allowed
+        if (this.allowsAllPrompts) {
+            return true;
+        }
+        return super.canAccessPrompt(promptId);
+    }
+}
+exports.PublicAuthorization = PublicAuthorization;
+//# sourceMappingURL=public.authorization.js.map

package/src/auth/authorization/public.authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.authorization.js","sourceRoot":"","sources":["../../../../src/auth/authorization/public.authorization.ts"],"names":[],"mappings":";AAAA,6CAA6C;;;AAE7C,mCAAoC;AACpC,+DAA0D;AA4C1D;;;;;;;;GAQG;AACH,MAAa,mBAAoB,SAAQ,uCAAiB;IAC/C,IAAI,GAAa,QAAQ,CAAC;IAEnC;;OAEG;IACM,MAAM,CAAU;IAEzB,YAAoB,GAAiD;QACnE,KAAK,CAAC,GAAG,CAAC,CAAC;QACX,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,MAAM,CAAC,MAAoC,EAAE;QAClD,MAAM,EACJ,MAAM,GAAG,MAAM,EACf,MAAM,GAAG,CAAC,WAAW,CAAC,EACtB,KAAK,GAAG,OAAO,EAAE,iBAAiB;QAClC,MAAM,EACN,YAAY,GAAG,KAAK,EACpB,cAAc,GAAG,KAAK,GACvB,GAAG,GAAG,CAAC;QAER,mCAAmC;QACnC,MAAM,IAAI,GAAG,IAAA,mBAAU,GAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;QAEhC,MAAM,IAAI,GAAa;YACrB,GAAG;YACH,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,IAAI;SAChB,CAAC;QAEF,uBAAuB;QACvB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzD,6BAA6B;QAC7B,MAAM,eAAe,GAA8C,EAAE,CAAC;QACtE,MAAM,iBAAiB,GAAa,EAAE,CAAC;QACvC,IAAI,YAAY,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1D,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;gBAClC,eAAe,CAAC,MAAM,CAAC,GAAG;oBACxB,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;iBAClC,CAAC;gBACF,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,MAAM,iBAAiB,GAAgD,EAAE,CAAC;QAC1E,MAAM,mBAAmB,GAAa,EAAE,CAAC;QACzC,IAAI,cAAc,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9D,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;gBACtC,iBAAiB,CAAC,QAAQ,CAAC,GAAG;oBAC5B,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;iBACpC,CAAC;gBACF,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC;YAC7B,EAAE,EAAE,GAAG;YACP,WAAW,EAAE,IAAI;YACjB,IAAI;YACJ,MAAM;YACN,SAAS;YACT,MAAM;YACN,eAAe,EAAE,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;YACrE,iBAAiB,EAAE,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB;YACzE,iBAAiB,EAAE,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB;YAC3E,mBAAmB,EAAE,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB;SAChF,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,WAAoB;QACjC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/F,CAAC;IAED;;OAEG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACnG,CAAC;IAED;;OAEG;IACM,aAAa,CAAC,MAAc;QACnC,gDAAgD;QAChD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACM,eAAe,CAAC,QAAgB;QACvC,kDAAkD;QAClD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;CACF;AAxID,kDAwIC","sourcesContent":["// auth/authorization/public.authorization.ts\n\nimport { randomUUID } from 'crypto';\nimport { AuthorizationBase } from './authorization.class';\nimport { AuthorizationCreateCtx, AuthUser } from './authorization.types';\nimport { AuthMode } from '../../common';\n\n/**\n * Context for creating a PublicAuthorization\n */\nexport interface PublicAuthorizationCreateCtx {\n  /**\n   * Anonymous user's identifier prefix\n   * @default 'anon'\n   */\n  prefix?: string;\n\n  /**\n   * Anonymous scopes granted to the user\n   * @default ['anonymous']\n   */\n  scopes?: string[];\n\n  /**\n   * Session TTL in milliseconds\n   * @default 3600000 (1 hour)\n   */\n  ttlMs?: number;\n\n  /**\n   * Issuer identifier for the anonymous JWT\n   */\n  issuer?: string;\n\n  /**\n   * Allowed tools for anonymous access\n   * If 'all', all tools are allowed\n   */\n  allowedTools?: 'all' | string[];\n\n  /**\n   * Allowed prompts for anonymous access\n   * If 'all', all prompts are allowed\n   */\n  allowedPrompts?: 'all' | string[];\n}\n\n/**\n * PublicAuthorization - Authorization for public/anonymous access mode\n *\n * In public mode:\n * - No authentication is required\n * - Anonymous sessions are auto-generated\n * - getToken() throws - anonymous users cannot access provider tokens\n * - Ideal for development, docs, public wikis, and read-only resources\n */\nexport class PublicAuthorization extends AuthorizationBase {\n  readonly mode: AuthMode = 'public';\n\n  /**\n   * Issuer identifier for the anonymous authorization\n   */\n  readonly issuer?: string;\n\n  private constructor(ctx: AuthorizationCreateCtx & { issuer?: string }) {\n    super(ctx);\n    this.issuer = ctx.issuer;\n  }\n\n  /**\n   * Create a new PublicAuthorization for anonymous access\n   *\n   * @param ctx - Creation context with optional configuration\n   * @returns A new PublicAuthorization instance\n   *\n   * @example\n   * ```typescript\n   * const auth = PublicAuthorization.create({\n   *   scopes: ['read', 'anonymous'],\n   *   ttlMs: 3600000,\n   *   allowedTools: ['search', 'get-docs'],\n   * });\n   * ```\n   */\n  static create(ctx: PublicAuthorizationCreateCtx = {}): PublicAuthorization {\n    const {\n      prefix = 'anon',\n      scopes = ['anonymous'],\n      ttlMs = 3600000, // 1 hour default\n      issuer,\n      allowedTools = 'all',\n      allowedPrompts = 'all',\n    } = ctx;\n\n    // Generate anonymous user identity\n    const uuid = randomUUID();\n    const sub = `${prefix}:${uuid}`;\n\n    const user: AuthUser = {\n      sub,\n      name: 'Anonymous',\n      anonymous: true,\n    };\n\n    // Calculate expiration\n    const expiresAt = ttlMs ? Date.now() + ttlMs : undefined;\n\n    // Build authorized tools map\n    const authorizedTools: AuthorizationCreateCtx['authorizedTools'] = {};\n    const authorizedToolIds: string[] = [];\n    if (allowedTools !== 'all' && Array.isArray(allowedTools)) {\n      for (const toolId of allowedTools) {\n        authorizedTools[toolId] = {\n          executionPath: ['public', toolId],\n        };\n        authorizedToolIds.push(toolId);\n      }\n    }\n\n    // Build authorized prompts map\n    const authorizedPrompts: AuthorizationCreateCtx['authorizedPrompts'] = {};\n    const authorizedPromptIds: string[] = [];\n    if (allowedPrompts !== 'all' && Array.isArray(allowedPrompts)) {\n      for (const promptId of allowedPrompts) {\n        authorizedPrompts[promptId] = {\n          executionPath: ['public', promptId],\n        };\n        authorizedPromptIds.push(promptId);\n      }\n    }\n\n    return new PublicAuthorization({\n      id: sub,\n      isAnonymous: true,\n      user,\n      scopes,\n      expiresAt,\n      issuer,\n      authorizedTools: allowedTools === 'all' ? undefined : authorizedTools,\n      authorizedToolIds: allowedTools === 'all' ? undefined : authorizedToolIds,\n      authorizedPrompts: allowedPrompts === 'all' ? undefined : authorizedPrompts,\n      authorizedPromptIds: allowedPrompts === 'all' ? undefined : authorizedPromptIds,\n    });\n  }\n\n  /**\n   * Anonymous users cannot access provider tokens\n   *\n   * @throws Error always - anonymous users do not have provider tokens\n   */\n  async getToken(_providerId?: string): Promise<string> {\n    throw new Error(\n      'PublicAuthorization: Anonymous users cannot access provider tokens. ' +\n        'Use transparent or orchestrated mode for token access.',\n    );\n  }\n\n  /**\n   * Check if all tools are allowed (public access)\n   */\n  get allowsAllTools(): boolean {\n    return this.authorizedToolIds.length === 0 && Object.keys(this.authorizedTools).length === 0;\n  }\n\n  /**\n   * Check if all prompts are allowed (public access)\n   */\n  get allowsAllPrompts(): boolean {\n    return this.authorizedPromptIds.length === 0 && Object.keys(this.authorizedPrompts).length === 0;\n  }\n\n  /**\n   * Override canAccessTool to support 'all' mode\n   */\n  override canAccessTool(toolId: string): boolean {\n    // If no specific tools defined, all are allowed\n    if (this.allowsAllTools) {\n      return true;\n    }\n    return super.canAccessTool(toolId);\n  }\n\n  /**\n   * Override canAccessPrompt to support 'all' mode\n   */\n  override canAccessPrompt(promptId: string): boolean {\n    // If no specific prompts defined, all are allowed\n    if (this.allowsAllPrompts) {\n      return true;\n    }\n    return super.canAccessPrompt(promptId);\n  }\n}\n"]}