@frontmcp/sdk 0.4.0 → 0.5.0

package/src/auth/flows/auth.verify.flow.js

@@ -0,0 +1,379 @@
+"use strict";
+// auth/flows/auth.verify.flow.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authVerifyOutputSchema = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("../../common");
+require("reflect-metadata");
+const zod_1 = require("zod");
+const auth_token_utils_1 = require("../session/utils/auth-token.utils");
+const jwks_1 = require("../jwks");
+const utils_1 = require("../utils");
+const authorization_1 = require("../authorization");
+const authorization_2 = require("../authorization");
+// Input schema
+const inputSchema = common_1.httpRequestInputSchema;
+// State schema for the flow
+const stateSchema = zod_1.z.object({
+    baseUrl: zod_1.z.string().min(1),
+    authorizationHeader: zod_1.z.string().optional(),
+    token: zod_1.z.string().optional(),
+    sessionIdHeader: zod_1.z.string().optional(),
+    prmUrl: zod_1.z.string(),
+    wwwAuthenticateHeader: zod_1.z.string(),
+    authMode: zod_1.z.enum(['public', 'transparent', 'orchestrated']).optional(),
+    jwtPayload: zod_1.z.object({}).passthrough().optional(),
+    user: authorization_2.authUserSchema.optional(),
+});
+// Output schemas
+const UnauthorizedSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal('unauthorized'),
+    wwwAuthenticateHeader: zod_1.z.string().describe('WWW-Authenticate header per RFC 9728'),
+    reason: zod_1.z.string().optional().describe('Human-readable reason for rejection'),
+})
+    .describe('401 Unauthorized response');
+const AuthorizedSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal('authorized'),
+    authorization: zod_1.z.custom().describe('Authorization object'),
+    llmContext: authorization_2.llmSafeAuthContextSchema.optional().describe('LLM-safe context (no tokens)'),
+})
+    .describe('Authorized response with Authorization object');
+exports.authVerifyOutputSchema = zod_1.z.union([UnauthorizedSchema, AuthorizedSchema]);
+// Flow plan
+const plan = {
+    pre: ['parseInput', 'determineAuthMode', 'handlePublicMode', 'requireAuthorizationHeader', 'verifyToken'],
+    execute: ['buildAuthorization'],
+};
+const name = 'auth:verify';
+const Stage = (0, common_1.StageHookOf)(name);
+/**
+ * Auth Verify Flow
+ *
+ * New authorization verification flow that supports the three auth modes:
+ * - public: Auto-generate anonymous authorization
+ * - transparent: Pass-through OAuth tokens from upstream provider
+ * - orchestrated: Local auth server with secure token storage
+ *
+ * This flow creates Authorization objects instead of legacy Session objects.
+ */
+let AuthVerifyFlow = class AuthVerifyFlow extends common_1.FlowBase {
+    logger = this.scope.logger.child('AuthVerifyFlow');
+    /**
+     * Parse request headers and build WWW-Authenticate header
+     */
+    async parseInput() {
+        const { request } = this.rawInput;
+        const entryPath = (0, common_1.normalizeEntryPrefix)(this.scope.entryPath);
+        const routeBase = (0, common_1.normalizeScopeBase)(this.scope.routeBase);
+        const baseUrl = (0, common_1.getRequestBaseUrl)(request, entryPath);
+        // Extract headers
+        const authorizationHeader = request.headers?.['authorization'] ?? undefined;
+        const sessionIdHeader = request.headers?.['mcp-session-id'] ??
+            request.query['sessionId'] ??
+            undefined;
+        // Build PRM URL and WWW-Authenticate header
+        const prmUrl = (0, utils_1.buildPrmUrl)(baseUrl, entryPath, routeBase);
+        const wwwAuthenticateHeader = (0, utils_1.buildUnauthorizedHeader)(prmUrl);
+        const token = (0, auth_token_utils_1.extractBearerToken)(authorizationHeader);
+        this.state.set({
+            baseUrl,
+            authorizationHeader,
+            token,
+            sessionIdHeader,
+            prmUrl,
+            wwwAuthenticateHeader,
+        });
+    }
+    /**
+     * Determine which auth mode to use based on scope configuration
+     */
+    async determineAuthMode() {
+        const authOptions = this.scope.auth?.options;
+        // Determine auth mode from options
+        let authMode = 'public'; // default
+        if (authOptions && 'mode' in authOptions) {
+            authMode = authOptions.mode;
+        }
+        this.logger.debug(`Auth mode determined: ${authMode}`);
+        this.state.set('authMode', authMode);
+    }
+    /**
+     * Handle public mode - create anonymous authorization without requiring a token
+     */
+    async handlePublicMode() {
+        const authOptions = this.scope.auth?.options;
+        // Create anonymous authorization
+        const publicAccess = authOptions?.['publicAccess'];
+        const authorization = authorization_1.PublicAuthorization.create({
+            scopes: authOptions?.['anonymousScopes'] ?? ['anonymous'],
+            ttlMs: this.parseTtl(authOptions?.['sessionTtl']),
+            issuer: authOptions?.['issuer'] ?? this.state.required.baseUrl,
+            allowedTools: publicAccess?.['tools'] ?? 'all',
+            allowedPrompts: publicAccess?.['prompts'] ?? 'all',
+        });
+        this.logger.info(`Created anonymous authorization: ${authorization.id}`);
+        this.respond({
+            kind: 'authorized',
+            authorization,
+        });
+    }
+    /**
+     * Require authorization header for non-public modes
+     */
+    async requireAuthorizationHeader() {
+        this.logger.warn('No authorization header provided');
+        this.respond({
+            kind: 'unauthorized',
+            wwwAuthenticateHeader: this.state.required.wwwAuthenticateHeader,
+            reason: 'No authorization header provided',
+        });
+    }
+    /**
+     * Verify the JWT token
+     */
+    async verifyToken() {
+        const jwks = this.get(jwks_1.JwksService);
+        const token = this.state.required.token;
+        const authMode = this.state.required.authMode;
+        const { baseUrl, prmUrl } = this.state.required;
+        // Non-JWT tokens are not supported
+        if (!(0, auth_token_utils_1.isJwt)(token)) {
+            this.logger.warn('Token is not a JWT');
+            this.respond({
+                kind: 'unauthorized',
+                wwwAuthenticateHeader: (0, utils_1.buildInvalidTokenHeader)(prmUrl, 'Token is not a valid JWT'),
+                reason: 'Token is not a valid JWT',
+            });
+            return;
+        }
+        // Verify based on auth mode
+        let verifyResult;
+        if (authMode === 'orchestrated') {
+            // Orchestrated: verify against local keys
+            verifyResult = await jwks.verifyGatewayToken(token, baseUrl);
+        }
+        else {
+            // Transparent: verify against upstream provider
+            const authOptions = this.scope.auth?.options;
+            const issuerUrl = this.scope.auth?.issuer;
+            if (!issuerUrl) {
+                this.logger.warn('No issuer URL configured for transparent mode');
+                this.respond({
+                    kind: 'unauthorized',
+                    wwwAuthenticateHeader: (0, utils_1.buildInvalidTokenHeader)(prmUrl, 'Server misconfiguration'),
+                    reason: 'No issuer URL configured',
+                });
+                return;
+            }
+            const providerRefs = [
+                {
+                    id: authOptions?.['id'] ?? 'default',
+                    issuerUrl,
+                    jwks: authOptions?.['jwks'],
+                    jwksUri: authOptions?.['jwksUri'],
+                },
+            ];
+            verifyResult = await jwks.verifyTransparentToken(token, providerRefs);
+        }
+        if (!verifyResult.ok) {
+            this.logger.warn(`Token verification failed: ${verifyResult.error}`);
+            this.respond({
+                kind: 'unauthorized',
+                wwwAuthenticateHeader: (0, utils_1.buildInvalidTokenHeader)(prmUrl, verifyResult.error),
+                reason: verifyResult.error ?? 'Token verification failed',
+            });
+            return;
+        }
+        // Validate audience
+        const authOptionsForAudience = this.scope.auth?.options;
+        const expectedAudience = authOptionsForAudience?.['expectedAudience'] ??
+            (0, utils_1.deriveExpectedAudience)(baseUrl);
+        const expectedAudienceArray = Array.isArray(expectedAudience) ? expectedAudience : [expectedAudience];
+        const audResult = (0, utils_1.validateAudience)(verifyResult.payload?.aud, {
+            expectedAudiences: expectedAudienceArray,
+            allowNoAudience: true, // Some tokens may not have audience
+        });
+        if (!audResult.valid) {
+            this.logger.warn(`Audience validation failed: ${audResult.error}`);
+            this.respond({
+                kind: 'unauthorized',
+                wwwAuthenticateHeader: (0, utils_1.buildInvalidTokenHeader)(prmUrl, audResult.error),
+                reason: audResult.error,
+            });
+            return;
+        }
+        // Check required scopes
+        const requiredScopes = authOptionsForAudience?.['requiredScopes'] ?? [];
+        if (requiredScopes.length > 0) {
+            const tokenScopes = this.parseScopes(verifyResult.payload?.scope);
+            const hasAllScopes = requiredScopes.every((s) => tokenScopes.includes(s));
+            if (!hasAllScopes) {
+                this.logger.warn(`Insufficient scopes. Required: ${requiredScopes.join(', ')}`);
+                this.respond({
+                    kind: 'unauthorized',
+                    wwwAuthenticateHeader: (0, utils_1.buildInsufficientScopeHeader)(prmUrl, requiredScopes),
+                    reason: `Missing required scopes: ${requiredScopes.join(', ')}`,
+                });
+                return;
+            }
+        }
+        // Store verified payload and user
+        const user = (0, auth_token_utils_1.deriveTypedUser)(verifyResult.payload ?? {});
+        this.state.set({
+            jwtPayload: verifyResult.payload,
+            user,
+        });
+    }
+    /**
+     * Build the Authorization object based on auth mode
+     */
+    async buildAuthorization() {
+        const { token, jwtPayload, user, authMode, baseUrl } = this.state.required;
+        if (!user) {
+            this.respond({
+                kind: 'unauthorized',
+                wwwAuthenticateHeader: this.state.required.wwwAuthenticateHeader,
+                reason: 'Failed to derive user from token',
+            });
+            return;
+        }
+        let authorization;
+        if (authMode === 'transparent') {
+            // Transparent mode: pass-through token
+            const authOptions = this.scope.auth?.options;
+            // jwtPayload has been verified and should contain sub from the upstream token
+            const payload = jwtPayload;
+            authorization = authorization_1.TransparentAuthorization.fromVerifiedToken({
+                token,
+                payload,
+                providerId: this.scope.auth?.id ?? 'default',
+                providerName: authOptions?.['name'],
+            });
+        }
+        else if (authMode === 'orchestrated') {
+            // Orchestrated mode: local auth server
+            // TODO: Retrieve token store from scope configuration
+            authorization = authorization_1.OrchestratedAuthorization.create({
+                token,
+                user: {
+                    sub: user.sub ?? 'unknown',
+                    name: user.name,
+                    email: user.email,
+                    picture: user.picture,
+                },
+                scopes: this.parseScopes(jwtPayload?.['scope']),
+                claims: jwtPayload,
+                expiresAt: jwtPayload?.['exp'] ? jwtPayload['exp'] * 1000 : undefined,
+                primaryProviderId: this.scope.auth?.id ?? 'default',
+                // tokenStore will be injected by scope
+            });
+        }
+        else {
+            // Public mode with token (authenticated public)
+            authorization = authorization_1.PublicAuthorization.create({
+                scopes: this.parseScopes(jwtPayload?.['scope']) || ['anonymous'],
+                ttlMs: jwtPayload?.['exp'] ? jwtPayload['exp'] * 1000 - Date.now() : 3600000,
+                issuer: baseUrl,
+            });
+        }
+        this.logger.info(`Authorization created: ${authorization.id} (mode: ${authMode})`);
+        this.respond({
+            kind: 'authorized',
+            authorization,
+        });
+    }
+    /**
+     * Parse TTL from string or number
+     */
+    parseTtl(ttl) {
+        if (!ttl)
+            return 3600000; // 1 hour default
+        if (typeof ttl === 'number')
+            return ttl * 1000; // Assume seconds
+        // Parse duration string (e.g., '1h', '30m', '1d')
+        const match = ttl.match(/^(\d+)(s|m|h|d)$/);
+        if (!match)
+            return 3600000;
+        const [, value, unit] = match;
+        const num = parseInt(value, 10);
+        switch (unit) {
+            case 's':
+                return num * 1000;
+            case 'm':
+                return num * 60 * 1000;
+            case 'h':
+                return num * 60 * 60 * 1000;
+            case 'd':
+                return num * 24 * 60 * 60 * 1000;
+            default:
+                return 3600000;
+        }
+    }
+    /**
+     * Parse scopes from JWT claim
+     */
+    parseScopes(scope) {
+        if (!scope)
+            return [];
+        if (Array.isArray(scope))
+            return scope.map(String);
+        if (typeof scope === 'string')
+            return scope.split(/\s+/).filter(Boolean);
+        return [];
+    }
+};
+tslib_1.__decorate([
+    Stage('parseInput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuthVerifyFlow.prototype, "parseInput", null);
+tslib_1.__decorate([
+    Stage('determineAuthMode'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuthVerifyFlow.prototype, "determineAuthMode", null);
+tslib_1.__decorate([
+    Stage('handlePublicMode', {
+        filter: ({ state }) => state.authMode === 'public' && !state.token,
+    }),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuthVerifyFlow.prototype, "handlePublicMode", null);
+tslib_1.__decorate([
+    Stage('requireAuthorizationHeader', {
+        filter: ({ state }) => state.authMode !== 'public' && !state.authorizationHeader,
+    }),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuthVerifyFlow.prototype, "requireAuthorizationHeader", null);
+tslib_1.__decorate([
+    Stage('verifyToken', {
+        filter: ({ state }) => !!state.token,
+    }),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuthVerifyFlow.prototype, "verifyToken", null);
+tslib_1.__decorate([
+    Stage('buildAuthorization'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuthVerifyFlow.prototype, "buildAuthorization", null);
+AuthVerifyFlow = tslib_1.__decorate([
+    (0, common_1.Flow)({
+        name,
+        plan,
+        inputSchema,
+        outputSchema: exports.authVerifyOutputSchema,
+        access: 'authorized',
+    })
+], AuthVerifyFlow);
+exports.default = AuthVerifyFlow;
+//# sourceMappingURL=auth.verify.flow.js.map

package/src/auth/flows/auth.verify.flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.verify.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/auth.verify.flow.ts"],"names":[],"mappings":";AAAA,iCAAiC;;;;AAEjC,yCAWsB;AACtB,4BAA0B;AAC1B,6BAAwB;AACxB,wEAA+F;AAC/F,kCAAuE;AAEvE,oCAOkB;AAClB,oDAM0B;AAC1B,oDAA4E;AAE5E,eAAe;AACf,MAAM,WAAW,GAAG,+BAAsB,CAAC;AAE3C,4BAA4B;AAC5B,MAAM,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE;IAClB,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE;IACjC,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtE,UAAU,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACjD,IAAI,EAAE,8BAAc,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,iBAAiB;AACjB,MAAM,kBAAkB,GAAG,OAAC;KACzB,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAClF,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;CAC9E,CAAC;KACD,QAAQ,CAAC,2BAA2B,CAAC,CAAC;AAEzC,MAAM,gBAAgB,GAAG,OAAC;KACvB,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAiB,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACzE,UAAU,EAAE,wCAAwB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;CACzF,CAAC;KACD,QAAQ,CAAC,+CAA+C,CAAC,CAAC;AAEhD,QAAA,sBAAsB,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAItF,YAAY;AACZ,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,CAAC,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,aAAa,CAAC;IACzG,OAAO,EAAE,CAAC,oBAAoB,CAAC;CACI,CAAC;AAetC,MAAM,IAAI,GAAG,aAAsB,CAAC;AACpC,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AAQY,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,iBAAqB;IACvD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAE3D;;OAEG;IAEG,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,MAAM,SAAS,GAAG,IAAA,6BAAoB,EAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAA,2BAAkB,EAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAA,0BAAiB,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEtD,kBAAkB;QAClB,MAAM,mBAAmB,GAAI,OAAO,CAAC,OAAO,EAAE,CAAC,eAAe,CAAwB,IAAI,SAAS,CAAC;QACpG,MAAM,eAAe,GAClB,OAAO,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAwB;YAC1D,OAAO,CAAC,KAAK,CAAC,WAAW,CAAwB;YAClD,SAAS,CAAC;QAEZ,4CAA4C;QAC5C,MAAM,MAAM,GAAG,IAAA,mBAAW,EAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC1D,MAAM,qBAAqB,GAAG,IAAA,+BAAuB,EAAC,MAAM,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAG,IAAA,qCAAkB,EAAC,mBAAmB,CAAC,CAAC;QAEtD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACb,OAAO;YACP,mBAAmB;YACnB,KAAK;YACL,eAAe;YACf,MAAM;YACN,qBAAqB;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,iBAAiB;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;QAE7C,mCAAmC;QACnC,IAAI,QAAQ,GAAa,QAAQ,CAAC,CAAC,UAAU;QAE7C,IAAI,WAAW,IAAI,MAAM,IAAI,WAAW,EAAE,CAAC;YACzC,QAAQ,GAAG,WAAW,CAAC,IAAgB,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IAIG,AAAN,KAAK,CAAC,gBAAgB;QACpB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAA8C,CAAC;QAEpF,iCAAiC;QACjC,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC,cAAc,CAAwC,CAAC;QAC1F,MAAM,aAAa,GAAG,mCAAmB,CAAC,MAAM,CAAC;YAC/C,MAAM,EAAG,WAAW,EAAE,CAAC,iBAAiB,CAA0B,IAAI,CAAC,WAAW,CAAC;YACnF,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,CAAgC,CAAC;YAChF,MAAM,EAAG,WAAW,EAAE,CAAC,QAAQ,CAAwB,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO;YACtF,YAAY,EAAG,YAAY,EAAE,CAAC,OAAO,CAAkC,IAAI,KAAK;YAChF,cAAc,EAAG,YAAY,EAAE,CAAC,SAAS,CAAkC,IAAI,KAAK;SACrF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzE,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,YAAY;YAClB,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IAIG,AAAN,KAAK,CAAC,0BAA0B;QAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB;YAChE,MAAM,EAAE,kCAAkC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IAIG,AAAN,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAW,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC9C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAEhD,mCAAmC;QACnC,IAAI,CAAC,IAAA,wBAAK,EAAC,KAAK,CAAC,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,qBAAqB,EAAE,IAAA,+BAAuB,EAAC,MAAM,EAAE,0BAA0B,CAAC;gBAClF,MAAM,EAAE,0BAA0B;aACnC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,4BAA4B;QAC5B,IAAI,YAA0B,CAAC;QAE/B,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChC,0CAA0C;YAC1C,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,gDAAgD;YAChD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAA8C,CAAC;YACpF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;YAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;gBAClE,IAAI,CAAC,OAAO,CAAC;oBACX,IAAI,EAAE,cAAc;oBACpB,qBAAqB,EAAE,IAAA,+BAAuB,EAAC,MAAM,EAAE,yBAAyB,CAAC;oBACjF,MAAM,EAAE,0BAA0B;iBACnC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,YAAY,GAAwB;gBACxC;oBACE,EAAE,EAAG,WAAW,EAAE,CAAC,IAAI,CAAwB,IAAI,SAAS;oBAC5D,SAAS;oBACT,IAAI,EAAE,WAAW,EAAE,CAAC,MAAM,CAA8B;oBACxD,OAAO,EAAE,WAAW,EAAE,CAAC,SAAS,CAAuB;iBACxD;aACF,CAAC;YACF,YAAY,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,qBAAqB,EAAE,IAAA,+BAAuB,EAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC;gBAC1E,MAAM,EAAE,YAAY,CAAC,KAAK,IAAI,2BAA2B;aAC1D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oBAAoB;QACpB,MAAM,sBAAsB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAA8C,CAAC;QAC/F,MAAM,gBAAgB,GACnB,sBAAsB,EAAE,CAAC,kBAAkB,CAAmC;YAC/E,IAAA,8BAAsB,EAAC,OAAO,CAAC,CAAC;QAClC,MAAM,qBAAqB,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAEtG,MAAM,SAAS,GAAG,IAAA,wBAAgB,EAAC,YAAY,CAAC,OAAO,EAAE,GAAoC,EAAE;YAC7F,iBAAiB,EAAE,qBAAqB;YACxC,eAAe,EAAE,IAAI,EAAE,oCAAoC;SAC5D,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,qBAAqB,EAAE,IAAA,+BAAuB,EAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC;gBACvE,MAAM,EAAE,SAAS,CAAC,KAAK;aACxB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,wBAAwB;QACxB,MAAM,cAAc,GAAI,sBAAsB,EAAE,CAAC,gBAAgB,CAA0B,IAAI,EAAE,CAAC;QAClG,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAElF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChF,IAAI,CAAC,OAAO,CAAC;oBACX,IAAI,EAAE,cAAc;oBACpB,qBAAqB,EAAE,IAAA,oCAA4B,EAAC,MAAM,EAAE,cAAc,CAAC;oBAC3E,MAAM,EAAE,4BAA4B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAChE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,GAAG,IAAA,kCAAe,EAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACb,UAAU,EAAE,YAAY,CAAC,OAAO;YAChC,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,kBAAkB;QACtB,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAE3E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB;gBAChE,MAAM,EAAE,kCAAkC;aAC3C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,aAA4B,CAAC;QAEjC,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC/B,uCAAuC;YACvC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAA8C,CAAC;YACpF,8EAA8E;YAC9E,MAAM,OAAO,GAAG,UAAwC,CAAC;YACzD,aAAa,GAAG,wCAAwB,CAAC,iBAAiB,CAAC;gBACzD,KAAK;gBACL,OAAO;gBACP,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,SAAS;gBAC5C,YAAY,EAAE,WAAW,EAAE,CAAC,MAAM,CAAuB;aAC1D,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACvC,uCAAuC;YACvC,sDAAsD;YACtD,aAAa,GAAG,yCAAyB,CAAC,MAAM,CAAC;gBAC/C,KAAK;gBACL,IAAI,EAAE;oBACJ,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS;oBAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB;gBACD,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC/C,MAAM,EAAE,UAAU;gBAClB,SAAS,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,UAAU,CAAC,KAAK,CAAY,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;gBACjF,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,SAAS;gBACnD,uCAAuC;aACxC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,gDAAgD;YAChD,aAAa,GAAG,mCAAmB,CAAC,MAAM,CAAC;gBACzC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;gBAChE,KAAK,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,UAAU,CAAC,KAAK,CAAY,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO;gBACxF,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,EAAE,WAAW,QAAQ,GAAG,CAAC,CAAC;QAEnF,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,YAAY;YAClB,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,QAAQ,CAAC,GAAqB;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO,OAAO,CAAC,CAAC,iBAAiB;QAE3C,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,GAAG,IAAI,CAAC,CAAC,iBAAiB;QAEjE,kDAAkD;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAE3B,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;QAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEhC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,GAAG,GAAG,IAAI,CAAC;YACpB,KAAK,GAAG;gBACN,OAAO,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;YACzB,KAAK,GAAG;gBACN,OAAO,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAC9B,KAAK,GAAG;gBACN,OAAO,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACnC;gBACE,OAAO,OAAO,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,KAAc;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzE,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAA;AA5SO;IADL,KAAK,CAAC,YAAY,CAAC;;;;gDA4BnB;AAMK;IADL,KAAK,CAAC,mBAAmB,CAAC;;;;uDAa1B;AAQK;IAHL,KAAK,CAAC,kBAAkB,EAAE;QACzB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK;KACnE,CAAC;;;;sDAoBD;AAQK;IAHL,KAAK,CAAC,4BAA4B,EAAE;QACnC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,mBAAmB;KACjF,CAAC;;;;gEAQD;AAQK;IAHL,KAAK,CAAC,aAAa,EAAE;QACpB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;KACrC,CAAC;;;;iDAuGD;AAMK;IADL,KAAK,CAAC,oBAAoB,CAAC;;;;wDA0D3B;AA3QkB,cAAc;IAPlC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,YAAY,EAAE,8BAAsB;QACpC,MAAM,EAAE,YAAY;KACrB,CAAC;GACmB,cAAc,CAmTlC;kBAnToB,cAAc","sourcesContent":["// auth/flows/auth.verify.flow.ts\n\nimport {\n  Flow,\n  FlowBase,\n  FlowRunOptions,\n  StageHookOf,\n  httpRequestInputSchema,\n  getRequestBaseUrl,\n  normalizeEntryPrefix,\n  normalizeScopeBase,\n  FlowPlan,\n  AuthMode,\n} from '../../common';\nimport 'reflect-metadata';\nimport { z } from 'zod';\nimport { deriveTypedUser, extractBearerToken, isJwt } from '../session/utils/auth-token.utils';\nimport { JwksService, ProviderVerifyRef, VerifyResult } from '../jwks';\nimport type { JSONWebKeySet } from 'jose';\nimport {\n  buildPrmUrl,\n  buildUnauthorizedHeader,\n  buildInvalidTokenHeader,\n  buildInsufficientScopeHeader,\n  validateAudience,\n  deriveExpectedAudience,\n} from '../utils';\nimport {\n  PublicAuthorization,\n  TransparentAuthorization,\n  OrchestratedAuthorization,\n  Authorization,\n  TransparentVerifiedPayload,\n} from '../authorization';\nimport { authUserSchema, llmSafeAuthContextSchema } from '../authorization';\n\n// Input schema\nconst inputSchema = httpRequestInputSchema;\n\n// State schema for the flow\nconst stateSchema = z.object({\n  baseUrl: z.string().min(1),\n  authorizationHeader: z.string().optional(),\n  token: z.string().optional(),\n  sessionIdHeader: z.string().optional(),\n  prmUrl: z.string(),\n  wwwAuthenticateHeader: z.string(),\n  authMode: z.enum(['public', 'transparent', 'orchestrated']).optional(),\n  jwtPayload: z.object({}).passthrough().optional(),\n  user: authUserSchema.optional(),\n});\n\n// Output schemas\nconst UnauthorizedSchema = z\n  .object({\n    kind: z.literal('unauthorized'),\n    wwwAuthenticateHeader: z.string().describe('WWW-Authenticate header per RFC 9728'),\n    reason: z.string().optional().describe('Human-readable reason for rejection'),\n  })\n  .describe('401 Unauthorized response');\n\nconst AuthorizedSchema = z\n  .object({\n    kind: z.literal('authorized'),\n    authorization: z.custom<Authorization>().describe('Authorization object'),\n    llmContext: llmSafeAuthContextSchema.optional().describe('LLM-safe context (no tokens)'),\n  })\n  .describe('Authorized response with Authorization object');\n\nexport const authVerifyOutputSchema = z.union([UnauthorizedSchema, AuthorizedSchema]);\n\nexport type AuthVerifyOutput = z.infer<typeof authVerifyOutputSchema>;\n\n// Flow plan\nconst plan = {\n  pre: ['parseInput', 'determineAuthMode', 'handlePublicMode', 'requireAuthorizationHeader', 'verifyToken'],\n  execute: ['buildAuthorization'],\n} as const satisfies FlowPlan<string>;\n\n// Declare flow types\ndeclare global {\n  interface ExtendFlows {\n    'auth:verify': FlowRunOptions<\n      AuthVerifyFlow,\n      typeof plan,\n      typeof inputSchema,\n      typeof authVerifyOutputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\nconst name = 'auth:verify' as const;\nconst Stage = StageHookOf(name);\n\n/**\n * Auth Verify Flow\n *\n * New authorization verification flow that supports the three auth modes:\n * - public: Auto-generate anonymous authorization\n * - transparent: Pass-through OAuth tokens from upstream provider\n * - orchestrated: Local auth server with secure token storage\n *\n * This flow creates Authorization objects instead of legacy Session objects.\n */\n@Flow({\n  name,\n  plan,\n  inputSchema,\n  outputSchema: authVerifyOutputSchema,\n  access: 'authorized',\n})\nexport default class AuthVerifyFlow extends FlowBase<typeof name> {\n  private logger = this.scope.logger.child('AuthVerifyFlow');\n\n  /**\n   * Parse request headers and build WWW-Authenticate header\n   */\n  @Stage('parseInput')\n  async parseInput() {\n    const { request } = this.rawInput;\n    const entryPath = normalizeEntryPrefix(this.scope.entryPath);\n    const routeBase = normalizeScopeBase(this.scope.routeBase);\n    const baseUrl = getRequestBaseUrl(request, entryPath);\n\n    // Extract headers\n    const authorizationHeader = (request.headers?.['authorization'] as string | undefined) ?? undefined;\n    const sessionIdHeader =\n      (request.headers?.['mcp-session-id'] as string | undefined) ??\n      (request.query['sessionId'] as string | undefined) ??\n      undefined;\n\n    // Build PRM URL and WWW-Authenticate header\n    const prmUrl = buildPrmUrl(baseUrl, entryPath, routeBase);\n    const wwwAuthenticateHeader = buildUnauthorizedHeader(prmUrl);\n\n    const token = extractBearerToken(authorizationHeader);\n\n    this.state.set({\n      baseUrl,\n      authorizationHeader,\n      token,\n      sessionIdHeader,\n      prmUrl,\n      wwwAuthenticateHeader,\n    });\n  }\n\n  /**\n   * Determine which auth mode to use based on scope configuration\n   */\n  @Stage('determineAuthMode')\n  async determineAuthMode() {\n    const authOptions = this.scope.auth?.options;\n\n    // Determine auth mode from options\n    let authMode: AuthMode = 'public'; // default\n\n    if (authOptions && 'mode' in authOptions) {\n      authMode = authOptions.mode as AuthMode;\n    }\n\n    this.logger.debug(`Auth mode determined: ${authMode}`);\n    this.state.set('authMode', authMode);\n  }\n\n  /**\n   * Handle public mode - create anonymous authorization without requiring a token\n   */\n  @Stage('handlePublicMode', {\n    filter: ({ state }) => state.authMode === 'public' && !state.token,\n  })\n  async handlePublicMode() {\n    const authOptions = this.scope.auth?.options as Record<string, unknown> | undefined;\n\n    // Create anonymous authorization\n    const publicAccess = authOptions?.['publicAccess'] as Record<string, unknown> | undefined;\n    const authorization = PublicAuthorization.create({\n      scopes: (authOptions?.['anonymousScopes'] as string[] | undefined) ?? ['anonymous'],\n      ttlMs: this.parseTtl(authOptions?.['sessionTtl'] as string | number | undefined),\n      issuer: (authOptions?.['issuer'] as string | undefined) ?? this.state.required.baseUrl,\n      allowedTools: (publicAccess?.['tools'] as string[] | 'all' | undefined) ?? 'all',\n      allowedPrompts: (publicAccess?.['prompts'] as string[] | 'all' | undefined) ?? 'all',\n    });\n\n    this.logger.info(`Created anonymous authorization: ${authorization.id}`);\n\n    this.respond({\n      kind: 'authorized',\n      authorization,\n    });\n  }\n\n  /**\n   * Require authorization header for non-public modes\n   */\n  @Stage('requireAuthorizationHeader', {\n    filter: ({ state }) => state.authMode !== 'public' && !state.authorizationHeader,\n  })\n  async requireAuthorizationHeader() {\n    this.logger.warn('No authorization header provided');\n    this.respond({\n      kind: 'unauthorized',\n      wwwAuthenticateHeader: this.state.required.wwwAuthenticateHeader,\n      reason: 'No authorization header provided',\n    });\n  }\n\n  /**\n   * Verify the JWT token\n   */\n  @Stage('verifyToken', {\n    filter: ({ state }) => !!state.token,\n  })\n  async verifyToken() {\n    const jwks = this.get(JwksService);\n    const token = this.state.required.token;\n    const authMode = this.state.required.authMode;\n    const { baseUrl, prmUrl } = this.state.required;\n\n    // Non-JWT tokens are not supported\n    if (!isJwt(token)) {\n      this.logger.warn('Token is not a JWT');\n      this.respond({\n        kind: 'unauthorized',\n        wwwAuthenticateHeader: buildInvalidTokenHeader(prmUrl, 'Token is not a valid JWT'),\n        reason: 'Token is not a valid JWT',\n      });\n      return;\n    }\n\n    // Verify based on auth mode\n    let verifyResult: VerifyResult;\n\n    if (authMode === 'orchestrated') {\n      // Orchestrated: verify against local keys\n      verifyResult = await jwks.verifyGatewayToken(token, baseUrl);\n    } else {\n      // Transparent: verify against upstream provider\n      const authOptions = this.scope.auth?.options as Record<string, unknown> | undefined;\n      const issuerUrl = this.scope.auth?.issuer;\n      if (!issuerUrl) {\n        this.logger.warn('No issuer URL configured for transparent mode');\n        this.respond({\n          kind: 'unauthorized',\n          wwwAuthenticateHeader: buildInvalidTokenHeader(prmUrl, 'Server misconfiguration'),\n          reason: 'No issuer URL configured',\n        });\n        return;\n      }\n      const providerRefs: ProviderVerifyRef[] = [\n        {\n          id: (authOptions?.['id'] as string | undefined) ?? 'default',\n          issuerUrl,\n          jwks: authOptions?.['jwks'] as JSONWebKeySet | undefined,\n          jwksUri: authOptions?.['jwksUri'] as string | undefined,\n        },\n      ];\n      verifyResult = await jwks.verifyTransparentToken(token, providerRefs);\n    }\n\n    if (!verifyResult.ok) {\n      this.logger.warn(`Token verification failed: ${verifyResult.error}`);\n      this.respond({\n        kind: 'unauthorized',\n        wwwAuthenticateHeader: buildInvalidTokenHeader(prmUrl, verifyResult.error),\n        reason: verifyResult.error ?? 'Token verification failed',\n      });\n      return;\n    }\n\n    // Validate audience\n    const authOptionsForAudience = this.scope.auth?.options as Record<string, unknown> | undefined;\n    const expectedAudience =\n      (authOptionsForAudience?.['expectedAudience'] as string | string[] | undefined) ??\n      deriveExpectedAudience(baseUrl);\n    const expectedAudienceArray = Array.isArray(expectedAudience) ? expectedAudience : [expectedAudience];\n\n    const audResult = validateAudience(verifyResult.payload?.aud as string | string[] | undefined, {\n      expectedAudiences: expectedAudienceArray,\n      allowNoAudience: true, // Some tokens may not have audience\n    });\n\n    if (!audResult.valid) {\n      this.logger.warn(`Audience validation failed: ${audResult.error}`);\n      this.respond({\n        kind: 'unauthorized',\n        wwwAuthenticateHeader: buildInvalidTokenHeader(prmUrl, audResult.error),\n        reason: audResult.error,\n      });\n      return;\n    }\n\n    // Check required scopes\n    const requiredScopes = (authOptionsForAudience?.['requiredScopes'] as string[] | undefined) ?? [];\n    if (requiredScopes.length > 0) {\n      const tokenScopes = this.parseScopes(verifyResult.payload?.scope);\n      const hasAllScopes = requiredScopes.every((s: string) => tokenScopes.includes(s));\n\n      if (!hasAllScopes) {\n        this.logger.warn(`Insufficient scopes. Required: ${requiredScopes.join(', ')}`);\n        this.respond({\n          kind: 'unauthorized',\n          wwwAuthenticateHeader: buildInsufficientScopeHeader(prmUrl, requiredScopes),\n          reason: `Missing required scopes: ${requiredScopes.join(', ')}`,\n        });\n        return;\n      }\n    }\n\n    // Store verified payload and user\n    const user = deriveTypedUser(verifyResult.payload ?? {});\n    this.state.set({\n      jwtPayload: verifyResult.payload,\n      user,\n    });\n  }\n\n  /**\n   * Build the Authorization object based on auth mode\n   */\n  @Stage('buildAuthorization')\n  async buildAuthorization() {\n    const { token, jwtPayload, user, authMode, baseUrl } = this.state.required;\n\n    if (!user) {\n      this.respond({\n        kind: 'unauthorized',\n        wwwAuthenticateHeader: this.state.required.wwwAuthenticateHeader,\n        reason: 'Failed to derive user from token',\n      });\n      return;\n    }\n\n    let authorization: Authorization;\n\n    if (authMode === 'transparent') {\n      // Transparent mode: pass-through token\n      const authOptions = this.scope.auth?.options as Record<string, unknown> | undefined;\n      // jwtPayload has been verified and should contain sub from the upstream token\n      const payload = jwtPayload as TransparentVerifiedPayload;\n      authorization = TransparentAuthorization.fromVerifiedToken({\n        token,\n        payload,\n        providerId: this.scope.auth?.id ?? 'default',\n        providerName: authOptions?.['name'] as string | undefined,\n      });\n    } else if (authMode === 'orchestrated') {\n      // Orchestrated mode: local auth server\n      // TODO: Retrieve token store from scope configuration\n      authorization = OrchestratedAuthorization.create({\n        token,\n        user: {\n          sub: user.sub ?? 'unknown',\n          name: user.name,\n          email: user.email,\n          picture: user.picture,\n        },\n        scopes: this.parseScopes(jwtPayload?.['scope']),\n        claims: jwtPayload,\n        expiresAt: jwtPayload?.['exp'] ? (jwtPayload['exp'] as number) * 1000 : undefined,\n        primaryProviderId: this.scope.auth?.id ?? 'default',\n        // tokenStore will be injected by scope\n      });\n    } else {\n      // Public mode with token (authenticated public)\n      authorization = PublicAuthorization.create({\n        scopes: this.parseScopes(jwtPayload?.['scope']) || ['anonymous'],\n        ttlMs: jwtPayload?.['exp'] ? (jwtPayload['exp'] as number) * 1000 - Date.now() : 3600000,\n        issuer: baseUrl,\n      });\n    }\n\n    this.logger.info(`Authorization created: ${authorization.id} (mode: ${authMode})`);\n\n    this.respond({\n      kind: 'authorized',\n      authorization,\n    });\n  }\n\n  /**\n   * Parse TTL from string or number\n   */\n  private parseTtl(ttl?: string | number): number {\n    if (!ttl) return 3600000; // 1 hour default\n\n    if (typeof ttl === 'number') return ttl * 1000; // Assume seconds\n\n    // Parse duration string (e.g., '1h', '30m', '1d')\n    const match = ttl.match(/^(\\d+)(s|m|h|d)$/);\n    if (!match) return 3600000;\n\n    const [, value, unit] = match;\n    const num = parseInt(value, 10);\n\n    switch (unit) {\n      case 's':\n        return num * 1000;\n      case 'm':\n        return num * 60 * 1000;\n      case 'h':\n        return num * 60 * 60 * 1000;\n      case 'd':\n        return num * 24 * 60 * 60 * 1000;\n      default:\n        return 3600000;\n    }\n  }\n\n  /**\n   * Parse scopes from JWT claim\n   */\n  private parseScopes(scope: unknown): string[] {\n    if (!scope) return [];\n    if (Array.isArray(scope)) return scope.map(String);\n    if (typeof scope === 'string') return scope.split(/\\s+/).filter(Boolean);\n    return [];\n  }\n}\n"]}