@frontmcp/sdk 0.4.0 → 0.5.0

package/src/auth/flows/oauth.authorize.flow.d.ts

@@ -5,7 +5,7 @@
  *
  * When: Start of the flow.
  *
- * Purpose: Authenticate the user and obtain consent; returns an authorization code to the client’s redirect URI.
+ * Purpose: Authenticate the user and obtain consent; returns an authorization code to the client's redirect URI.
  *
  * Notes: Must support PKCE. Implicit/Hybrid are out in OAuth 2.1.
  */
@@ -16,63 +16,65 @@
  *
  * response_type=code, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method=S256, (optionally request_uri from PAR)
  */
-import { FlowBase, FlowRunOptions } from "../../common";
-import { z } from "zod";
+import { FlowBase, FlowRunOptions } from '../../common';
+import { z } from 'zod';
 /**
- * Quick checklist (security & correctness)
- * - PKCE (S256) required for public clients (and basically for all).
- * - Use authorization code grant only (no implicit/hybrid).
- * - Rotate refresh tokens and bind them to client + user + scopes.
- * - Prefer private_key_jwt or mTLS for confidential clients.
- * - PAR + JAR recommended for higher security.
- * - Consider DPoP (proof-of-possession) to reduce token replay.
- * - Keep codes very short-lived (e.g., ≤60 s) and single-use.
- * - Publish discovery and JWKS, rotate keys safely.
- * - Decide JWT vs opaque access tokens; provide introspection if opaque.
+ * Validated OAuth authorization request for orchestrated mode
  */
+declare const oauthAuthorizeRequestSchema: z.ZodObject<{
+    response_type: z.ZodLiteral<"code">;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    code_challenge: z.ZodString;
+    code_challenge_method: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"S256">>>;
+    scope: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Minimal request for anonymous/default provider mode
+ */
+declare const anonymousAuthorizeRequestSchema: z.ZodObject<{
+    redirect_uri: z.ZodString;
+    state: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type OAuthAuthorizeRequest = z.infer<typeof oauthAuthorizeRequestSchema>;
+export type AnonymousAuthorizeRequest = z.infer<typeof anonymousAuthorizeRequestSchema>;
 declare const inputSchema: z.ZodObject<{
-    request: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
-    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
-    next: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
-}, "strip", z.ZodTypeAny, {
-    request: {} & {
-        [k: string]: unknown;
-    };
-    response: {} & {
-        [k: string]: unknown;
-    };
-    next?: ((...args: unknown[]) => unknown) | undefined;
-}, {
-    request: {} & {
-        [k: string]: unknown;
-    };
-    response: {} & {
-        [k: string]: unknown;
-    };
-    next?: ((...args: unknown[]) => unknown) | undefined;
-}>;
+    request: z.ZodObject<{}, z.core.$loose>;
+    response: z.ZodObject<{}, z.core.$loose>;
+    next: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+}, z.core.$strip>;
 declare const stateSchema: z.ZodObject<{
     isDefaultAuthProvider: z.ZodBoolean;
     isOrchestrated: z.ZodBoolean;
     allowAnonymous: z.ZodBoolean;
-    redirectUri: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    allowAnonymous: boolean;
-    isOrchestrated: boolean;
-    isDefaultAuthProvider: boolean;
-    redirectUri?: string | undefined;
-}, {
-    allowAnonymous: boolean;
-    isOrchestrated: boolean;
-    isDefaultAuthProvider: boolean;
-    redirectUri?: string | undefined;
-}>;
-declare const outputSchema: z.ZodUnion<[z.ZodObject<{
+    validatedRequest: z.ZodOptional<z.ZodObject<{
+        response_type: z.ZodLiteral<"code">;
+        client_id: z.ZodString;
+        redirect_uri: z.ZodString;
+        code_challenge: z.ZodString;
+        code_challenge_method: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"S256">>>;
+        scope: z.ZodOptional<z.ZodString>;
+        state: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    rawRedirectUri: z.ZodOptional<z.ZodString>;
+    rawState: z.ZodOptional<z.ZodString>;
+    validationErrors: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    pendingAuthId: z.ZodOptional<z.ZodString>;
+    isIncrementalAuth: z.ZodDefault<z.ZodBoolean>;
+    targetAppId: z.ZodOptional<z.ZodString>;
+    targetToolId: z.ZodOptional<z.ZodString>;
+    existingSessionId: z.ZodOptional<z.ZodString>;
+    requiresFederatedLogin: z.ZodDefault<z.ZodBoolean>;
+    requiresConsent: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+declare const outputSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"redirect">;
-    status: z.ZodDefault<z.ZodType<301 | 302 | 303 | 307 | 308, z.ZodTypeDef, 301 | 302 | 303 | 307 | 308>>;
+    status: z.ZodDefault<z.ZodType<301 | 302 | 303 | 307 | 308, unknown, z.core.$ZodTypeInternals<301 | 302 | 303 | 307 | 308, unknown>>>;
     location: z.ZodString;
-} & {
-    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>]>>>>;
     cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         value: z.ZodString;
@@ -80,69 +82,39 @@ declare const outputSchema: z.ZodUnion<[z.ZodObject<{
         domain: z.ZodOptional<z.ZodString>;
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
-        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        sameSite: z.ZodOptional<z.ZodEnum<{
+            lax: "lax";
+            strict: "strict";
+            none: "none";
+        }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;
         expires: z.ZodOptional<z.ZodDate>;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }, {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }>, "many">>>;
-}, "strip", z.ZodTypeAny, {
-    status: 301 | 302 | 303 | 307 | 308;
-    kind: "redirect";
-    location: string;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-}, {
-    kind: "redirect";
-    location: string;
-    status?: 301 | 302 | 303 | 307 | 308 | undefined;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-}>, z.ZodObject<{
+    }, z.core.$strip>>>>;
+}, z.core.$strip>, z.ZodObject<{
     kind: z.ZodLiteral<"text">;
-    status: z.ZodEffects<z.ZodNumber, number, number>;
+    status: z.ZodNumber;
     body: z.ZodString;
     contentType: z.ZodDefault<z.ZodString>;
-} & {
-    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>]>>>>;
+    cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        path: z.ZodDefault<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        httpOnly: z.ZodDefault<z.ZodBoolean>;
+        secure: z.ZodOptional<z.ZodBoolean>;
+        sameSite: z.ZodOptional<z.ZodEnum<{
+            lax: "lax";
+            strict: "strict";
+            none: "none";
+        }>>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        expires: z.ZodOptional<z.ZodDate>;
+    }, z.core.$strip>>>>;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodNumber;
+    body: z.ZodString;
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>]>>>>;
     cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         value: z.ZodString;
@@ -150,65 +122,17 @@ declare const outputSchema: z.ZodUnion<[z.ZodObject<{
         domain: z.ZodOptional<z.ZodString>;
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
-        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        sameSite: z.ZodOptional<z.ZodEnum<{
+            lax: "lax";
+            strict: "strict";
+            none: "none";
+        }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;
         expires: z.ZodOptional<z.ZodDate>;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }, {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }>, "many">>>;
-}, "strip", z.ZodTypeAny, {
-    status: number;
-    kind: "text";
-    body: string;
-    contentType: string;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-}, {
-    status: number;
-    kind: "text";
-    body: string;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-    contentType?: string | undefined;
-}>]>;
+    }, z.core.$strip>>>>;
+    kind: z.ZodLiteral<"html">;
+    contentType: z.ZodDefault<z.ZodLiteral<"text/html; charset=utf-8">>;
+}, z.core.$strip>]>;
 declare const plan: {
     readonly pre: ["parseInput", "validateInput", "checkIfAuthorized"];
     readonly execute: ["prepareAuthorizationRequest", "buildAuthorizeOutput"];
@@ -221,11 +145,41 @@ declare global {
 }
 declare const name: "oauth:authorize";
 export default class OauthAuthorizeFlow extends FlowBase<typeof name> {
+    private logger;
     parseInput(): Promise<void>;
     validateInput(): Promise<void>;
     checkIfAuthorized(): Promise<void>;
     prepareAuthorizationRequest(): Promise<void>;
     buildAuthorizeOutput(): Promise<void>;
     validateOutput(): Promise<void>;
+    /**
+     * Format Zod errors into human-readable strings
+     */
+    private formatZodErrors;
+    /**
+     * Respond with OAuth error - redirect if possible, otherwise show error page
+     */
+    private respondWithError;
+    /**
+     * Render a simple login page using HTMX templates
+     */
+    private renderLoginPage;
+    /**
+     * Render incremental authorization page for a single app using HTMX templates
+     */
+    private renderIncrementalAuthPage;
+    /**
+     * Render federated login page for multiple auth providers using HTMX templates
+     */
+    private renderFederatedLoginPage;
+    /**
+     * Render consent page for tool selection
+     * This is a placeholder - in production, use Juris/Svelte for the UI
+     */
+    private renderConsentPage;
+    /**
+     * Render an error page
+     */
+    private renderErrorPage;
 }
 export {};