@frontmcp/sdk 0.6.0 → 0.6.2

package/src/auth/flows/session.verify.flow.js

@@ -1,304 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessionVerifyOutputSchema = void 0;
-const tslib_1 = require("tslib");
-// auth/flows/session.verify.flow.ts
-const common_1 = require("../../common");
-require("reflect-metadata");
-const zod_1 = require("zod");
-const auth_token_utils_1 = require("../session/utils/auth-token.utils");
-const jwks_1 = require("../jwks");
-const session_id_utils_1 = require("../session/utils/session-id.utils");
-const authorization_1 = require("../authorization");
-const notification_service_1 = require("../../notification/notification.service");
-const inputSchema = common_1.httpRequestInputSchema;
-const stateSchema = zod_1.z.object({
-    baseUrl: zod_1.z.string().min(1),
-    authorizationHeader: zod_1.z.string().optional(),
-    token: zod_1.z.string().optional(),
-    sessionIdHeader: zod_1.z.string().optional(), // 'mcp-session-id'
-    sessionProtocol: zod_1.z.string().optional(), // 'sse/http/streamable-http'
-    userAgent: zod_1.z.string().optional(), // User-Agent header for platform detection
-    prmMetadataPath: zod_1.z.string().optional(),
-    prmMetadataHeader: zod_1.z.string().optional(),
-    jwtPayload: zod_1.z.object({}).passthrough().optional(),
-    user: common_1.userClaimSchema.optional(),
-    session: common_1.sessionIdSchema.optional(),
-});
-const UnauthorizedSchema = zod_1.z
-    .object({
-    kind: zod_1.z.literal('unauthorized'),
-    prmMetadataHeader: zod_1.z.string().describe('Path to protected resource metadata'),
-})
-    .describe("401 Unauthorized with 'WWW-Authenticate' header for requesting authentication");
-const AuthorizedSchema = zod_1.z
-    .object({
-    kind: zod_1.z.literal('authorized'),
-    authorization: common_1.authorizationSchema.describe('Session information if session id is present'),
-})
-    .describe('Authorized session information');
-exports.sessionVerifyOutputSchema = zod_1.z.union([UnauthorizedSchema, AuthorizedSchema]);
-const plan = {
-    pre: ['parseInput', 'handlePublicMode', 'requireAuthorizationHeader', 'verifyIfJwt'],
-    execute: ['deriveUser', 'parseSessionHeader', 'buildAuthorizedOutput'],
-};
-const name = 'session:verify';
-const Stage = (0, common_1.StageHookOf)(name);
-let SessionVerifyFlow = class SessionVerifyFlow extends common_1.FlowBase {
-    async parseInput() {
-        const { request } = this.rawInput;
-        const entryPath = (0, common_1.normalizeEntryPrefix)(this.scope.entryPath);
-        const routeBase = (0, common_1.normalizeScopeBase)(this.scope.routeBase);
-        const baseUrl = (0, common_1.getRequestBaseUrl)(request, entryPath);
-        const authorizationHeader = request.headers?.['authorization'] ?? undefined;
-        const httpTransportHeader = request.headers?.['http-transport'];
-        const sessionIdRawHeader = request.headers?.['mcp-session-id'];
-        const sessionIdQuery = request.query['sessionId'];
-        const sessionIdHeader = sessionIdRawHeader ?? sessionIdQuery ?? undefined;
-        // Use sessionIdRawHeader (not sessionIdHeader) to distinguish header vs query param
-        // sessionIdHeader is the merged value, but we need to know the source for protocol selection
-        const sessionProtocol = httpTransportHeader
-            ? 'http'
-            : sessionIdRawHeader
-                ? 'streamable-http'
-                : sessionIdQuery
-                    ? 'sse'
-                    : undefined;
-        const token = (0, auth_token_utils_1.extractBearerToken)(authorizationHeader);
-        const userAgent = request.headers?.['user-agent'] ?? undefined;
-        const prmMetadataPath = `/.well-known/oauth-protected-resource${entryPath}${routeBase}`;
-        const prmMetadataHeader = `Bearer resource_metadata="${baseUrl}${prmMetadataPath}"`;
-        this.state.set({
-            baseUrl,
-            authorizationHeader,
-            token,
-            sessionIdHeader,
-            sessionProtocol,
-            userAgent,
-            prmMetadataPath,
-            prmMetadataHeader,
-        });
-    }
-    /**
-     * Handle public mode - allow anonymous access without requiring authorization
-     * In public mode, we create an anonymous authorization with a stateful session
-     * but NO token. This allows public docs/CI to work without Authorization header.
-     *
-     * CRITICAL: When client sends mcp-session-id header, we MUST use that exact ID
-     * for transport registry lookup. Creating a new session ID would cause mismatch.
-     */
-    async handlePublicMode() {
-        const authOptions = this.scope.auth?.options;
-        // Skip if not public mode or if authorization header is present (authenticated public)
-        if (!authOptions || !(0, common_1.isPublicMode)(authOptions)) {
-            return;
-        }
-        // If token is present, let the normal verification flow handle it
-        if (this.state.token) {
-            return;
-        }
-        const sessionIdHeader = this.state.sessionIdHeader;
-        const machineId = (0, authorization_1.getMachineId)();
-        // CRITICAL: If client sent session ID, ALWAYS use it for transport lookup.
-        // The transport registry uses this ID as the key. Creating a different ID
-        // would cause "session not initialized" error.
-        if (sessionIdHeader) {
-            // Try to decrypt/validate for payload extraction (optional - for nodeId validation)
-            const existingPayload = (0, session_id_utils_1.decryptPublicSession)(sessionIdHeader);
-            // Determine user based on whether we could extract payload
-            const user = existingPayload
-                ? { sub: `anon:${existingPayload.iat * 1000}`, iss: 'public', name: 'Anonymous' }
-                : { sub: `anon:${crypto.randomUUID()}`, iss: 'public', name: 'Anonymous' };
-            // ALWAYS use client's session ID, regardless of validation result.
-            // If payload is valid and nodeId matches, include payload for protocol detection.
-            // If validation failed, transport layer will handle the error appropriately.
-            const finalPayload = existingPayload && existingPayload.nodeId === machineId ? existingPayload : undefined;
-            this.respond({
-                kind: 'authorized',
-                authorization: {
-                    token: '',
-                    user,
-                    session: {
-                        id: sessionIdHeader, // ← CRITICAL: Always use client's session ID
-                        payload: finalPayload,
-                    },
-                },
-            });
-            return;
-        }
-        // No session header → create new session (initialize request)
-        // For new sessions, don't pre-determine protocol. Let transport handler detect it.
-        const now = Date.now();
-        const user = { sub: `anon:${crypto.randomUUID()}`, iss: 'public', name: 'Anonymous' };
-        const uuid = crypto.randomUUID();
-        // Detect platform from User-Agent header for UI rendering support
-        const platformDetectionConfig = this.scope.metadata.transport?.platformDetection;
-        const platformType = (0, notification_service_1.detectPlatformFromUserAgent)(this.state.userAgent, platformDetectionConfig);
-        // Create a valid session payload matching the SessionIdPayload schema
-        // Include platformType if detected (non-unknown) for Tool UI support
-        const payload = {
-            uuid,
-            nodeId: machineId,
-            authSig: 'public',
-            iat: Math.floor(now / 1000),
-            isPublic: true,
-            ...(platformType !== 'unknown' && { platformType }),
-        };
-        const sessionId = (0, session_id_utils_1.encryptJson)(payload);
-        this.respond({
-            kind: 'authorized',
-            authorization: {
-                token: '',
-                user,
-                session: { id: sessionId, payload },
-            },
-        });
-    }
-    async requireAuthorizationOrChallenge() {
-        this.respond({
-            kind: 'unauthorized',
-            prmMetadataHeader: this.state.required.prmMetadataHeader,
-        });
-    }
-    /**
-     * If Authorization is a JWT:
-     *  - Attempt verification against any known / cached public keys we have (gateway/local)
-     *  - If verification fails → 401
-     *  - If verification ok → capture payload
-     * If NOT a JWT:
-     *  - we do NOT attempt verification, just pass the raw token through
-     */
-    async verifyIfJwt() {
-        const jwks = this.get(jwks_1.JwksService); // TODO: fix providers
-        const token = this.state.required.token;
-        if (!(0, auth_token_utils_1.isJwt)(token)) {
-            // Non-JWT tokens are not supported - require JWT for verification
-            this.respond({
-                kind: 'unauthorized',
-                prmMetadataHeader: this.state.required.prmMetadataHeader,
-            });
-            return;
-        }
-        // Best-effort verification using locally known keys (gateway/local provider cache).
-        // Add defensive null check for this.scope.auth (consistent with line 130)
-        const auth = this.scope.auth;
-        if (!auth) {
-            this.respond({
-                kind: 'unauthorized',
-                prmMetadataHeader: this.state.required.prmMetadataHeader,
-            });
-            return;
-        }
-        let verify;
-        const authOptions = auth.options;
-        // Transparent mode uses remote provider's keys, all other modes use local keys
-        if ((0, common_1.isTransparentMode)(authOptions)) {
-            const primary = authOptions;
-            const issuer = auth.issuer;
-            const providerRefs = [
-                {
-                    id: primary.remote.id ?? 'default',
-                    issuerUrl: issuer,
-                    jwks: primary.remote.jwks,
-                    jwksUri: primary.remote.jwksUri,
-                },
-            ];
-            verify = jwks.verifyTransparentToken(token, providerRefs);
-        }
-        else {
-            // Public or orchestrated mode - verify against local gateway keys
-            verify = jwks.verifyGatewayToken(token, this.state.required.baseUrl);
-        }
-        const result = await verify;
-        if (result.ok) {
-            this.state.set({ jwtPayload: result.payload });
-            return;
-        }
-        this.respond({
-            kind: 'unauthorized',
-            prmMetadataHeader: this.state.required.prmMetadataHeader,
-        });
-    }
-    async deriveUser() {
-        this.state.set('user', (0, auth_token_utils_1.deriveTypedUser)(this.state.required.jwtPayload ?? {}));
-    }
-    /**
-     * Parse the session header (mcp-session-id)
-     * - If session id is present, validate it
-     * - If valid, capture the session info
-     * - If NOT valid, ignore (no session)
-     */
-    async parseSessionHeader() {
-        const { sessionIdHeader, required: { token }, } = this.state;
-        const session = (0, session_id_utils_1.parseSessionHeader)(sessionIdHeader, token);
-        if (session) {
-            this.state.set('session', session);
-        }
-    }
-    async buildAuthorizedOutput() {
-        const { required: { token, user }, session, } = this.state;
-        this.respond({
-            kind: 'authorized',
-            authorization: {
-                token,
-                user,
-                session,
-            },
-        });
-    }
-};
-tslib_1.__decorate([
-    Stage('parseInput'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], SessionVerifyFlow.prototype, "parseInput", null);
-tslib_1.__decorate([
-    Stage('handlePublicMode'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], SessionVerifyFlow.prototype, "handlePublicMode", null);
-tslib_1.__decorate([
-    Stage('requireAuthorizationHeader', {
-        filter: ({ state }) => !state.authorizationHeader,
-    }),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], SessionVerifyFlow.prototype, "requireAuthorizationOrChallenge", null);
-tslib_1.__decorate([
-    Stage('verifyIfJwt'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], SessionVerifyFlow.prototype, "verifyIfJwt", null);
-tslib_1.__decorate([
-    Stage('deriveUser'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], SessionVerifyFlow.prototype, "deriveUser", null);
-tslib_1.__decorate([
-    Stage('parseSessionHeader'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], SessionVerifyFlow.prototype, "parseSessionHeader", null);
-tslib_1.__decorate([
-    Stage('buildAuthorizedOutput'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], SessionVerifyFlow.prototype, "buildAuthorizedOutput", null);
-SessionVerifyFlow = tslib_1.__decorate([
-    (0, common_1.Flow)({
-        name,
-        plan,
-        inputSchema,
-        outputSchema: exports.sessionVerifyOutputSchema,
-        access: 'authorized',
-    })
-], SessionVerifyFlow);
-exports.default = SessionVerifyFlow;
-//# sourceMappingURL=session.verify.flow.js.map

package/src/auth/flows/session.verify.flow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.verify.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/session.verify.flow.ts"],"names":[],"mappings":";;;;AAAA,oCAAoC;AACpC,yCAiBsB;AACtB,4BAA0B;AAC1B,6BAAwB;AACxB,wEAA+F;AAC/F,kCAAuE;AACvE,wEAA0G;AAC1G,oDAAgD;AAChD,kFAAsF;AAEtF,MAAM,WAAW,GAAG,+BAAsB,CAAC;AAE3C,MAAM,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,mBAAmB;IAC3D,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,6BAA6B;IACrE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,2CAA2C;IAC7E,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACjD,IAAI,EAAE,wBAAe,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,wBAAe,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,OAAC;KACzB,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;CAC9E,CAAC;KACD,QAAQ,CAAC,+EAA+E,CAAC,CAAC;AAE7F,MAAM,gBAAgB,GAAG,OAAC;KACvB,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,aAAa,EAAE,4BAAmB,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAC5F,CAAC;KACD,QAAQ,CAAC,gCAAgC,CAAC,CAAC;AAEjC,QAAA,yBAAyB,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEzF,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,CAAC,YAAY,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,aAAa,CAAC;IACpF,OAAO,EAAE,CAAC,YAAY,EAAE,oBAAoB,EAAE,uBAAuB,CAAC;CACnC,CAAC;AActC,MAAM,IAAI,GAAG,gBAAyB,CAAC;AACvC,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AASjB,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,iBAAqB;IAE5D,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,MAAM,SAAS,GAAG,IAAA,6BAAoB,EAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAA,2BAAkB,EAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAA,0BAAiB,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEtD,MAAM,mBAAmB,GAAI,OAAO,CAAC,OAAO,EAAE,CAAC,eAAe,CAAwB,IAAI,SAAS,CAAC;QACpG,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAuB,CAAC;QACtF,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAuB,CAAC;QACrF,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAuB,CAAC;QAExE,MAAM,eAAe,GAAG,kBAAkB,IAAI,cAAc,IAAI,SAAS,CAAC;QAC1E,oFAAoF;QACpF,6FAA6F;QAC7F,MAAM,eAAe,GAAG,mBAAmB;YACzC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,cAAc;oBAChB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,KAAK,GAAG,IAAA,qCAAkB,EAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,SAAS,GAAI,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,CAAwB,IAAI,SAAS,CAAC;QAEvF,MAAM,eAAe,GAAG,wCAAwC,SAAS,GAAG,SAAS,EAAE,CAAC;QACxF,MAAM,iBAAiB,GAAG,6BAA6B,OAAO,GAAG,eAAe,GAAG,CAAC;QAEpF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACb,OAAO;YACP,mBAAmB;YACnB,KAAK;YACL,eAAe;YACf,eAAe;YACf,SAAS;YACT,eAAe;YACf,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,gBAAgB;QACpB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;QAE7C,uFAAuF;QACvF,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,qBAAY,EAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QACnD,MAAM,SAAS,GAAG,IAAA,4BAAY,GAAE,CAAC;QAEjC,2EAA2E;QAC3E,0EAA0E;QAC1E,+CAA+C;QAC/C,IAAI,eAAe,EAAE,CAAC;YACpB,oFAAoF;YACpF,MAAM,eAAe,GAAG,IAAA,uCAAoB,EAAC,eAAe,CAAC,CAAC;YAE9D,2DAA2D;YAC3D,MAAM,IAAI,GAAG,eAAe;gBAC1B,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,eAAe,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;gBACjF,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAE7E,mEAAmE;YACnE,kFAAkF;YAClF,6EAA6E;YAC7E,MAAM,YAAY,GAAG,eAAe,IAAI,eAAe,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAE3G,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,aAAa,EAAE;oBACb,KAAK,EAAE,EAAE;oBACT,IAAI;oBACJ,OAAO,EAAE;wBACP,EAAE,EAAE,eAAe,EAAE,6CAA6C;wBAClE,OAAO,EAAE,YAAY;qBACtB;iBACF;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,8DAA8D;QAC9D,mFAAmF;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,QAAQ,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACtF,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEjC,kEAAkE;QAClE,MAAM,uBAAuB,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;QACjF,MAAM,YAAY,GAAG,IAAA,kDAA2B,EAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAEhG,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,OAAO,GAAG;YACd,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,QAAQ;YACjB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;YAC3B,QAAQ,EAAE,IAAI;YACd,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;SACpD,CAAC;QAEF,MAAM,SAAS,GAAG,IAAA,8BAAW,EAAC,OAAO,CAAC,CAAC;QAEvC,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,YAAY;YAClB,aAAa,EAAE;gBACb,KAAK,EAAE,EAAE;gBACT,IAAI;gBACJ,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE;aACpC;SACF,CAAC,CAAC;IACL,CAAC;IAKK,AAAN,KAAK,CAAC,+BAA+B;QACnC,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB;SACzD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAW,CAAC,CAAC,CAAC,sBAAsB;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAExC,IAAI,CAAC,IAAA,wBAAK,EAAC,KAAK,CAAC,EAAE,CAAC;YAClB,kEAAkE;YAClE,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB;aACzD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oFAAoF;QACpF,0EAA0E;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB;aACzD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,MAA6B,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;QAEjC,+EAA+E;QAC/E,IAAI,IAAA,0BAAiB,EAAC,WAAW,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,WAAqC,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,MAAM,YAAY,GAAwB;gBACxC;oBACE,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,SAAS;oBAClC,SAAS,EAAE,MAAM;oBACjB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;oBACzB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;iBAChC;aACF,CAAC;YACF,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,kEAAkE;YAClE,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;QAE5B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB;SACzD,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,kCAAe,EAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,kBAAkB;QACtB,MAAM,EACJ,eAAe,EACf,QAAQ,EAAE,EAAE,KAAK,EAAE,GACpB,GAAG,IAAI,CAAC,KAAK,CAAC;QAEf,MAAM,OAAO,GAAG,IAAA,qCAAkB,EAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAGK,AAAN,KAAK,CAAC,qBAAqB;QACzB,MAAM,EACJ,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EACzB,OAAO,GACR,GAAG,IAAI,CAAC,KAAK,CAAC;QAEf,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,YAAY;YAClB,aAAa,EAAE;gBACb,KAAK;gBACL,IAAI;gBACJ,OAAO;aACR;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AArPO;IADL,KAAK,CAAC,YAAY,CAAC;;;;mDAuCnB;AAWK;IADL,KAAK,CAAC,kBAAkB,CAAC;;;;yDA+EzB;AAKK;IAHL,KAAK,CAAC,4BAA4B,EAAE;QACnC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB;KAClD,CAAC;;;;wEAMD;AAWK;IADL,KAAK,CAAC,aAAa,CAAC;;;;oDAwDpB;AAGK;IADL,KAAK,CAAC,YAAY,CAAC;;;;mDAGnB;AASK;IADL,KAAK,CAAC,oBAAoB,CAAC;;;;2DAW3B;AAGK;IADL,KAAK,CAAC,uBAAuB,CAAC;;;;8DAe9B;AAtPkB,iBAAiB;IAPrC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,YAAY,EAAE,iCAAyB;QACvC,MAAM,EAAE,YAAY;KACrB,CAAC;GACmB,iBAAiB,CAuPrC;kBAvPoB,iBAAiB","sourcesContent":["// auth/flows/session.verify.flow.ts\nimport {\n  authorizationSchema,\n  Flow,\n  FlowBase,\n  FlowRunOptions,\n  StageHookOf,\n  userClaimSchema,\n  sessionIdSchema,\n  httpRequestInputSchema,\n  FlowPlan,\n  AuthOptions,\n  isTransparentMode,\n  isPublicMode,\n  TransparentAuthOptions,\n  getRequestBaseUrl,\n  normalizeEntryPrefix,\n  normalizeScopeBase,\n} from '../../common';\nimport 'reflect-metadata';\nimport { z } from 'zod';\nimport { deriveTypedUser, extractBearerToken, isJwt } from '../session/utils/auth-token.utils';\nimport { JwksService, ProviderVerifyRef, VerifyResult } from '../jwks';\nimport { parseSessionHeader, encryptJson, decryptPublicSession } from '../session/utils/session-id.utils';\nimport { getMachineId } from '../authorization';\nimport { detectPlatformFromUserAgent } from '../../notification/notification.service';\n\nconst inputSchema = httpRequestInputSchema;\n\nconst stateSchema = z.object({\n  baseUrl: z.string().min(1),\n  authorizationHeader: z.string().optional(),\n  token: z.string().optional(),\n  sessionIdHeader: z.string().optional(), // 'mcp-session-id'\n  sessionProtocol: z.string().optional(), // 'sse/http/streamable-http'\n  userAgent: z.string().optional(), // User-Agent header for platform detection\n  prmMetadataPath: z.string().optional(),\n  prmMetadataHeader: z.string().optional(),\n  jwtPayload: z.object({}).passthrough().optional(),\n  user: userClaimSchema.optional(),\n  session: sessionIdSchema.optional(),\n});\n\nconst UnauthorizedSchema = z\n  .object({\n    kind: z.literal('unauthorized'),\n    prmMetadataHeader: z.string().describe('Path to protected resource metadata'),\n  })\n  .describe(\"401 Unauthorized with 'WWW-Authenticate' header for requesting authentication\");\n\nconst AuthorizedSchema = z\n  .object({\n    kind: z.literal('authorized'),\n    authorization: authorizationSchema.describe('Session information if session id is present'),\n  })\n  .describe('Authorized session information');\n\nexport const sessionVerifyOutputSchema = z.union([UnauthorizedSchema, AuthorizedSchema]);\n\nconst plan = {\n  pre: ['parseInput', 'handlePublicMode', 'requireAuthorizationHeader', 'verifyIfJwt'],\n  execute: ['deriveUser', 'parseSessionHeader', 'buildAuthorizedOutput'],\n} as const satisfies FlowPlan<string>;\n\ndeclare global {\n  interface ExtendFlows {\n    'session:verify': FlowRunOptions<\n      SessionVerifyFlow,\n      typeof plan,\n      typeof inputSchema,\n      typeof sessionVerifyOutputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\nconst name = 'session:verify' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan,\n  inputSchema,\n  outputSchema: sessionVerifyOutputSchema,\n  access: 'authorized',\n})\nexport default class SessionVerifyFlow extends FlowBase<typeof name> {\n  @Stage('parseInput')\n  async parseInput() {\n    const { request } = this.rawInput;\n    const entryPath = normalizeEntryPrefix(this.scope.entryPath);\n    const routeBase = normalizeScopeBase(this.scope.routeBase);\n    const baseUrl = getRequestBaseUrl(request, entryPath);\n\n    const authorizationHeader = (request.headers?.['authorization'] as string | undefined) ?? undefined;\n    const httpTransportHeader = request.headers?.['http-transport'] as string | undefined;\n    const sessionIdRawHeader = request.headers?.['mcp-session-id'] as string | undefined;\n    const sessionIdQuery = request.query['sessionId'] as string | undefined;\n\n    const sessionIdHeader = sessionIdRawHeader ?? sessionIdQuery ?? undefined;\n    // Use sessionIdRawHeader (not sessionIdHeader) to distinguish header vs query param\n    // sessionIdHeader is the merged value, but we need to know the source for protocol selection\n    const sessionProtocol = httpTransportHeader\n      ? 'http'\n      : sessionIdRawHeader\n      ? 'streamable-http'\n      : sessionIdQuery\n      ? 'sse'\n      : undefined;\n\n    const token = extractBearerToken(authorizationHeader);\n    const userAgent = (request.headers?.['user-agent'] as string | undefined) ?? undefined;\n\n    const prmMetadataPath = `/.well-known/oauth-protected-resource${entryPath}${routeBase}`;\n    const prmMetadataHeader = `Bearer resource_metadata=\"${baseUrl}${prmMetadataPath}\"`;\n\n    this.state.set({\n      baseUrl,\n      authorizationHeader,\n      token,\n      sessionIdHeader,\n      sessionProtocol,\n      userAgent,\n      prmMetadataPath,\n      prmMetadataHeader,\n    });\n  }\n\n  /**\n   * Handle public mode - allow anonymous access without requiring authorization\n   * In public mode, we create an anonymous authorization with a stateful session\n   * but NO token. This allows public docs/CI to work without Authorization header.\n   *\n   * CRITICAL: When client sends mcp-session-id header, we MUST use that exact ID\n   * for transport registry lookup. Creating a new session ID would cause mismatch.\n   */\n  @Stage('handlePublicMode')\n  async handlePublicMode() {\n    const authOptions = this.scope.auth?.options;\n\n    // Skip if not public mode or if authorization header is present (authenticated public)\n    if (!authOptions || !isPublicMode(authOptions)) {\n      return;\n    }\n\n    // If token is present, let the normal verification flow handle it\n    if (this.state.token) {\n      return;\n    }\n\n    const sessionIdHeader = this.state.sessionIdHeader;\n    const machineId = getMachineId();\n\n    // CRITICAL: If client sent session ID, ALWAYS use it for transport lookup.\n    // The transport registry uses this ID as the key. Creating a different ID\n    // would cause \"session not initialized\" error.\n    if (sessionIdHeader) {\n      // Try to decrypt/validate for payload extraction (optional - for nodeId validation)\n      const existingPayload = decryptPublicSession(sessionIdHeader);\n\n      // Determine user based on whether we could extract payload\n      const user = existingPayload\n        ? { sub: `anon:${existingPayload.iat * 1000}`, iss: 'public', name: 'Anonymous' }\n        : { sub: `anon:${crypto.randomUUID()}`, iss: 'public', name: 'Anonymous' };\n\n      // ALWAYS use client's session ID, regardless of validation result.\n      // If payload is valid and nodeId matches, include payload for protocol detection.\n      // If validation failed, transport layer will handle the error appropriately.\n      const finalPayload = existingPayload && existingPayload.nodeId === machineId ? existingPayload : undefined;\n\n      this.respond({\n        kind: 'authorized',\n        authorization: {\n          token: '',\n          user,\n          session: {\n            id: sessionIdHeader, // ← CRITICAL: Always use client's session ID\n            payload: finalPayload,\n          },\n        },\n      });\n      return;\n    }\n\n    // No session header → create new session (initialize request)\n    // For new sessions, don't pre-determine protocol. Let transport handler detect it.\n    const now = Date.now();\n    const user = { sub: `anon:${crypto.randomUUID()}`, iss: 'public', name: 'Anonymous' };\n    const uuid = crypto.randomUUID();\n\n    // Detect platform from User-Agent header for UI rendering support\n    const platformDetectionConfig = this.scope.metadata.transport?.platformDetection;\n    const platformType = detectPlatformFromUserAgent(this.state.userAgent, platformDetectionConfig);\n\n    // Create a valid session payload matching the SessionIdPayload schema\n    // Include platformType if detected (non-unknown) for Tool UI support\n    const payload = {\n      uuid,\n      nodeId: machineId,\n      authSig: 'public',\n      iat: Math.floor(now / 1000),\n      isPublic: true,\n      ...(platformType !== 'unknown' && { platformType }),\n    };\n\n    const sessionId = encryptJson(payload);\n\n    this.respond({\n      kind: 'authorized',\n      authorization: {\n        token: '',\n        user,\n        session: { id: sessionId, payload },\n      },\n    });\n  }\n\n  @Stage('requireAuthorizationHeader', {\n    filter: ({ state }) => !state.authorizationHeader,\n  })\n  async requireAuthorizationOrChallenge() {\n    this.respond({\n      kind: 'unauthorized',\n      prmMetadataHeader: this.state.required.prmMetadataHeader,\n    });\n  }\n\n  /**\n   * If Authorization is a JWT:\n   *  - Attempt verification against any known / cached public keys we have (gateway/local)\n   *  - If verification fails → 401\n   *  - If verification ok → capture payload\n   * If NOT a JWT:\n   *  - we do NOT attempt verification, just pass the raw token through\n   */\n  @Stage('verifyIfJwt')\n  async verifyIfJwt() {\n    const jwks = this.get(JwksService); // TODO: fix providers\n    const token = this.state.required.token;\n\n    if (!isJwt(token)) {\n      // Non-JWT tokens are not supported - require JWT for verification\n      this.respond({\n        kind: 'unauthorized',\n        prmMetadataHeader: this.state.required.prmMetadataHeader,\n      });\n      return;\n    }\n\n    // Best-effort verification using locally known keys (gateway/local provider cache).\n    // Add defensive null check for this.scope.auth (consistent with line 130)\n    const auth = this.scope.auth;\n    if (!auth) {\n      this.respond({\n        kind: 'unauthorized',\n        prmMetadataHeader: this.state.required.prmMetadataHeader,\n      });\n      return;\n    }\n\n    let verify: Promise<VerifyResult>;\n    const authOptions = auth.options;\n\n    // Transparent mode uses remote provider's keys, all other modes use local keys\n    if (isTransparentMode(authOptions)) {\n      const primary = authOptions as TransparentAuthOptions;\n      const issuer = auth.issuer;\n      const providerRefs: ProviderVerifyRef[] = [\n        {\n          id: primary.remote.id ?? 'default',\n          issuerUrl: issuer,\n          jwks: primary.remote.jwks,\n          jwksUri: primary.remote.jwksUri,\n        },\n      ];\n      verify = jwks.verifyTransparentToken(token, providerRefs);\n    } else {\n      // Public or orchestrated mode - verify against local gateway keys\n      verify = jwks.verifyGatewayToken(token, this.state.required.baseUrl);\n    }\n\n    const result = await verify;\n\n    if (result.ok) {\n      this.state.set({ jwtPayload: result.payload });\n      return;\n    }\n    this.respond({\n      kind: 'unauthorized',\n      prmMetadataHeader: this.state.required.prmMetadataHeader,\n    });\n  }\n\n  @Stage('deriveUser')\n  async deriveUser() {\n    this.state.set('user', deriveTypedUser(this.state.required.jwtPayload ?? {}));\n  }\n\n  /**\n   * Parse the session header (mcp-session-id)\n   * - If session id is present, validate it\n   * - If valid, capture the session info\n   * - If NOT valid, ignore (no session)\n   */\n  @Stage('parseSessionHeader')\n  async parseSessionHeader() {\n    const {\n      sessionIdHeader,\n      required: { token },\n    } = this.state;\n\n    const session = parseSessionHeader(sessionIdHeader, token);\n    if (session) {\n      this.state.set('session', session);\n    }\n  }\n\n  @Stage('buildAuthorizedOutput')\n  async buildAuthorizedOutput() {\n    const {\n      required: { token, user },\n      session,\n    } = this.state;\n\n    this.respond({\n      kind: 'authorized',\n      authorization: {\n        token,\n        user,\n        session,\n      },\n    });\n  }\n}\n"]}

package/src/auth/flows/well-known.jwks.flow.js

@@ -1,89 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const tslib_1 = require("tslib");
-// auth/flows/well-known.jwks.flow.ts
-const common_1 = require("../../common");
-require("reflect-metadata");
-const zod_1 = require("zod");
-const jwks_1 = require("../jwks");
-const inputSchema = common_1.httpInputSchema;
-const stateSchema = zod_1.z.object({
-    isOrchestrated: zod_1.z.boolean(),
-});
-const outputSchema = zod_1.z.union([common_1.HttpJsonSchema, common_1.HttpTextSchema, common_1.HttpRedirectSchema]);
-const plan = {
-    pre: ['parseInput', 'validateInput'],
-    execute: ['collectData'],
-};
-const name = 'well-known.jwks';
-const Stage = (0, common_1.StageHookOf)(name);
-let WellKnownJwksFlow = class WellKnownJwksFlow extends common_1.FlowBase {
-    static canActivate(request, scope) {
-        return (0, common_1.makeWellKnownPaths)('jwks.json', scope.entryPath, scope.routeBase).has(request.path);
-    }
-    async parseInput() {
-        this.state.set({
-            isOrchestrated: false, // scope.orchestrated, TODO: fix
-        });
-    }
-    async collectData() {
-        const { isOrchestrated } = this.state.required;
-        const jwksSvc = this.get(jwks_1.JwksService);
-        // Orchestrated gateway → serve own JWKS
-        if (isOrchestrated) {
-            const keysDoc = await jwksSvc.getPublicJwks();
-            if (!keysDoc?.keys || !Array.isArray(keysDoc.keys)) {
-                throw new Error('orchestrator jwks not available');
-            }
-            this.respond(common_1.httpRespond.json(keysDoc));
-            return;
-        }
-        const options = this.scope.auth.options;
-        if (options && (0, common_1.isTransparentMode)(options)) {
-            // Transparent mode - use remote provider's JWKS
-            if (options.remote.jwks && options.remote.jwks.keys.length) {
-                this.respond(common_1.httpRespond.json(options.remote.jwks));
-            }
-            else {
-                const location = options.remote.jwksUri ?? `${options.remote.provider}/.well-known/jwks.json`;
-                this.respond(common_1.httpRespond.redirect(location));
-            }
-        }
-        else {
-            // Public or orchestrated mode - serve local JWKS
-            const keysDoc = await jwksSvc.getPublicJwks();
-            if (keysDoc?.keys && Array.isArray(keysDoc.keys)) {
-                this.respond(common_1.httpRespond.json(keysDoc));
-            }
-            else {
-                this.respond(common_1.httpRespond.notFound());
-            }
-        }
-    }
-};
-tslib_1.__decorate([
-    Stage('parseInput'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], WellKnownJwksFlow.prototype, "parseInput", null);
-tslib_1.__decorate([
-    Stage('collectData'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], WellKnownJwksFlow.prototype, "collectData", null);
-WellKnownJwksFlow = tslib_1.__decorate([
-    (0, common_1.Flow)({
-        name,
-        plan,
-        inputSchema,
-        outputSchema,
-        access: 'public',
-        middleware: {
-            method: 'GET',
-        },
-    })
-], WellKnownJwksFlow);
-exports.default = WellKnownJwksFlow;
-//# sourceMappingURL=well-known.jwks.flow.js.map

package/src/auth/flows/well-known.jwks.flow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"well-known.jwks.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/well-known.jwks.flow.ts"],"names":[],"mappings":";;;AAAA,qCAAqC;AACrC,yCAesB;AACtB,4BAA0B;AAC1B,6BAAwB;AACxB,kCAAsC;AAEtC,MAAM,WAAW,GAAG,wBAAe,CAAC;AAEpC,MAAM,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3B,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,uBAAc,EAAE,uBAAc,EAAE,2BAAkB,CAAC,CAAC,CAAC;AAEnF,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC;IACpC,OAAO,EAAE,CAAC,aAAa,CAAC;CACW,CAAC;AActC,MAAM,IAAI,GAAG,iBAA0B,CAAC;AACxC,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAYjB,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,iBAAqB;IAClE,MAAM,CAAC,WAAW,CAAC,OAAsB,EAAE,KAAiB;QAC1D,OAAO,IAAA,2BAAkB,EAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACb,cAAc,EAAE,KAAK,EAAE,gCAAgC;SACxD,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAW,CAAC,CAAC;QAEtC,wCAAwC;QACxC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,IAAI,OAAO,IAAI,IAAA,0BAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,gDAAgD;YAChD,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC3D,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,wBAAwB,CAAC;gBAC9F,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iDAAiD;YACjD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YAC9C,IAAI,OAAO,EAAE,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAA;AAxCO;IADL,KAAK,CAAC,YAAY,CAAC;;;;mDAKnB;AAGK;IADL,KAAK,CAAC,aAAa,CAAC;;;;oDAiCpB;AA7CkB,iBAAiB;IAVrC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,KAAK;SACd;KACF,CAAC;GACmB,iBAAiB,CA8CrC;kBA9CoB,iBAAiB","sourcesContent":["// auth/flows/well-known.jwks.flow.ts\nimport {\n  Flow,\n  FlowBase,\n  FlowPlan,\n  FlowRunOptions,\n  httpInputSchema,\n  HttpJsonSchema,\n  HttpRedirectSchema,\n  httpRespond,\n  HttpTextSchema,\n  ScopeEntry,\n  ServerRequest,\n  StageHookOf,\n  isTransparentMode,\n  makeWellKnownPaths,\n} from '../../common';\nimport 'reflect-metadata';\nimport { z } from 'zod';\nimport { JwksService } from '../jwks';\n\nconst inputSchema = httpInputSchema;\n\nconst stateSchema = z.object({\n  isOrchestrated: z.boolean(),\n});\n\nconst outputSchema = z.union([HttpJsonSchema, HttpTextSchema, HttpRedirectSchema]);\n\nconst plan = {\n  pre: ['parseInput', 'validateInput'],\n  execute: ['collectData'],\n} as const satisfies FlowPlan<string>;\n\ndeclare global {\n  interface ExtendFlows {\n    'well-known.jwks': FlowRunOptions<\n      WellKnownJwksFlow,\n      typeof plan,\n      typeof inputSchema,\n      typeof outputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\nconst name = 'well-known.jwks' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'GET',\n  },\n})\nexport default class WellKnownJwksFlow extends FlowBase<typeof name> {\n  static canActivate(request: ServerRequest, scope: ScopeEntry) {\n    return makeWellKnownPaths('jwks.json', scope.entryPath, scope.routeBase).has(request.path);\n  }\n\n  @Stage('parseInput')\n  async parseInput() {\n    this.state.set({\n      isOrchestrated: false, // scope.orchestrated, TODO: fix\n    });\n  }\n\n  @Stage('collectData')\n  async collectData() {\n    const { isOrchestrated } = this.state.required;\n    const jwksSvc = this.get(JwksService);\n\n    // Orchestrated gateway → serve own JWKS\n    if (isOrchestrated) {\n      const keysDoc = await jwksSvc.getPublicJwks();\n      if (!keysDoc?.keys || !Array.isArray(keysDoc.keys)) {\n        throw new Error('orchestrator jwks not available');\n      }\n      this.respond(httpRespond.json(keysDoc));\n      return;\n    }\n\n    const options = this.scope.auth.options;\n    if (options && isTransparentMode(options)) {\n      // Transparent mode - use remote provider's JWKS\n      if (options.remote.jwks && options.remote.jwks.keys.length) {\n        this.respond(httpRespond.json(options.remote.jwks));\n      } else {\n        const location = options.remote.jwksUri ?? `${options.remote.provider}/.well-known/jwks.json`;\n        this.respond(httpRespond.redirect(location));\n      }\n    } else {\n      // Public or orchestrated mode - serve local JWKS\n      const keysDoc = await jwksSvc.getPublicJwks();\n      if (keysDoc?.keys && Array.isArray(keysDoc.keys)) {\n        this.respond(httpRespond.json(keysDoc));\n      } else {\n        this.respond(httpRespond.notFound());\n      }\n    }\n  }\n}\n"]}

package/src/auth/flows/well-known.oauth-authorization-server.flow.js

@@ -1,122 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.wellKnownAsStateSchema = exports.outputSchema = void 0;
-const tslib_1 = require("tslib");
-// auth/flows/well-known.oauth-authorization-server.flow.ts
-require("reflect-metadata");
-const zod_1 = require("zod");
-const common_1 = require("../../common");
-const inputSchema = common_1.httpInputSchema;
-// ===== Result =====
-const AuthServerMetadataSchema = zod_1.z.object({
-    kind: zod_1.z.literal('json'),
-    status: zod_1.z.literal(200),
-    contentType: zod_1.z.literal('application/json; charset=utf-8'),
-    body: zod_1.z
-        .object({
-        issuer: zod_1.z.string().min(1),
-        authorization_endpoint: zod_1.z.string().min(1),
-        token_endpoint: zod_1.z.string().min(1),
-        userinfo_endpoint: zod_1.z.string().min(1).optional(),
-        jwks_uri: zod_1.z.string().min(1),
-        registration_endpoint: zod_1.z.string().min(1).optional(),
-        token_endpoint_auth_methods_supported: zod_1.z
-            .array(zod_1.z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))
-            .optional(),
-        response_types_supported: zod_1.z.array(zod_1.z.enum(['code'])).default(['code']),
-        grant_types_supported: zod_1.z
-            .array(zod_1.z.enum(['authorization_code', 'refresh_token']))
-            .default(['authorization_code', 'refresh_token']),
-        scopes_supported: zod_1.z.array(zod_1.z.string()).default(['openid', 'profile', 'email']),
-        code_challenge_methods_supported: zod_1.z.array(zod_1.z.enum(['S256'])).default(['S256']),
-    })
-        .passthrough(),
-});
-exports.outputSchema = zod_1.z.union([AuthServerMetadataSchema, common_1.HttpRedirectSchema, common_1.HttpTextSchema]);
-exports.wellKnownAsStateSchema = zod_1.z.object({
-    baseUrl: zod_1.z.string().min(1), // baseUrl + entryPrefix (unsuffixed)
-    scopesSupported: zod_1.z.array(zod_1.z.string()).default(['openid', 'profile', 'email']),
-    tokenEndpointAuthMethods: zod_1.z
-        .array(zod_1.z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))
-        .default(['client_secret_basic', 'client_secret_post']),
-    dcrEnabled: zod_1.z.boolean().default(true),
-    isOrchestrated: zod_1.z.boolean(),
-});
-const wellKnownAsPlan = {
-    pre: ['parseInput'],
-    execute: ['collectData'],
-};
-const name = 'well-known.oauth-authorization-server';
-const Stage = (0, common_1.StageHookOf)(name);
-let WellKnownAsFlow = class WellKnownAsFlow extends common_1.FlowBase {
-    static canActivate(request, scope) {
-        return (0, common_1.makeWellKnownPaths)('oauth-authorization-server', scope.entryPath, scope.routeBase).has(request.path);
-    }
-    async parseInput() {
-        const { request } = this.rawInput;
-        if (!request)
-            throw new Error('Request is undefined');
-        const baseUrl = (0, common_1.getRequestBaseUrl)(request, this.scope.entryPath);
-        this.state.set(exports.wellKnownAsStateSchema.parse({
-            baseUrl,
-            scopesSupported: [],
-            tokenEndpointAuthMethods: [],
-            dcrEnabled: false, //scope.oauth.dcrEnabled,
-            isOrchestrated: !this.scope.metadata.auth, // scope.orchestrated,
-        }));
-    }
-    async collectData() {
-        const { baseUrl, scopesSupported, tokenEndpointAuthMethods, dcrEnabled, isOrchestrated } = this.state.required;
-        // Orchestrated => gateway is the AS
-        if (isOrchestrated) {
-            const baseIssuer = `${baseUrl}`;
-            this.respond({
-                kind: 'json',
-                contentType: 'application/json; charset=utf-8',
-                status: 200,
-                body: {
-                    issuer: baseIssuer,
-                    authorization_endpoint: `${baseIssuer}/oauth/authorize`,
-                    token_endpoint: `${baseIssuer}/oauth/token`,
-                    userinfo_endpoint: `${baseIssuer}/oauth/userinfo`,
-                    jwks_uri: `${baseIssuer}/.well-known/jwks.json`,
-                    registration_endpoint: `${baseIssuer}/oauth/register`,
-                    token_endpoint_auth_methods_supported: tokenEndpointAuthMethods,
-                    response_types_supported: ['code'],
-                    grant_types_supported: ['authorization_code', 'refresh_token'],
-                    scopes_supported: scopesSupported,
-                    code_challenge_methods_supported: ['S256'],
-                },
-            });
-            return;
-        }
-        const primary = this.scope.auth;
-        this.respond(common_1.httpRespond.redirect(`${primary.issuer}/.well-known/oauth-authorization-server`));
-    }
-};
-tslib_1.__decorate([
-    Stage('parseInput'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], WellKnownAsFlow.prototype, "parseInput", null);
-tslib_1.__decorate([
-    Stage('collectData'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], WellKnownAsFlow.prototype, "collectData", null);
-WellKnownAsFlow = tslib_1.__decorate([
-    (0, common_1.Flow)({
-        name,
-        plan: wellKnownAsPlan,
-        inputSchema,
-        outputSchema: exports.outputSchema,
-        access: 'public',
-        middleware: {
-            method: 'GET',
-        },
-    })
-], WellKnownAsFlow);
-exports.default = WellKnownAsFlow;
-//# sourceMappingURL=well-known.oauth-authorization-server.flow.js.map

package/src/auth/flows/well-known.oauth-authorization-server.flow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"well-known.oauth-authorization-server.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/well-known.oauth-authorization-server.flow.ts"],"names":[],"mappings":";;;;AAAA,2DAA2D;AAC3D,4BAA0B;AAC1B,6BAAwB;AACxB,yCAcsB;AAEtB,MAAM,WAAW,GAAG,wBAAe,CAAC;AAEpC,qBAAqB;AACrB,MAAM,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,OAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACtB,WAAW,EAAE,OAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;IACzD,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,sBAAsB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC/C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACnD,qCAAqC,EAAE,OAAC;aACrC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC;aAC/E,QAAQ,EAAE;QACb,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;QACrE,qBAAqB,EAAE,OAAC;aACrB,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC;aACtD,OAAO,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;QACnD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,gCAAgC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;KAC9E,CAAC;SACD,WAAW,EAAE;CACjB,CAAC,CAAC;AAEU,QAAA,YAAY,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,2BAAkB,EAAE,uBAAc,CAAC,CAAC,CAAC;AAEvF,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qCAAqC;IACjE,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,wBAAwB,EAAE,OAAC;SACxB,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC;SAC/E,OAAO,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IACzD,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG;IACtB,GAAG,EAAE,CAAC,YAAY,CAAC;IACnB,OAAO,EAAE,CAAC,aAAa,CAAC;CACW,CAAC;AAiBtC,MAAM,IAAI,GAAG,uCAAgD,CAAC;AAC9D,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAYjB,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,iBAAqB;IAChE,MAAM,CAAC,WAAW,CAAC,OAAsB,EAAE,KAAiB;QAC1D,OAAO,IAAA,2BAAkB,EAAC,4BAA4B,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9G,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,IAAA,0BAAiB,EAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,8BAAsB,CAAC,KAAK,CAAC;YAC3B,OAAO;YACP,eAAe,EAAE,EAAE;YACnB,wBAAwB,EAAE,EAAE;YAC5B,UAAU,EAAE,KAAK,EAAE,yBAAyB;YAC5C,cAAc,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;SAClE,CAAC,CACH,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/G,oCAAoC;QACpC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,GAAG,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,iCAAiC;gBAC9C,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,MAAM,EAAE,UAAU;oBAClB,sBAAsB,EAAE,GAAG,UAAU,kBAAkB;oBACvD,cAAc,EAAE,GAAG,UAAU,cAAc;oBAC3C,iBAAiB,EAAE,GAAG,UAAU,iBAAiB;oBACjD,QAAQ,EAAE,GAAG,UAAU,wBAAwB;oBAC/C,qBAAqB,EAAE,GAAG,UAAU,iBAAiB;oBACrD,qCAAqC,EAAE,wBAAwB;oBAC/D,wBAAwB,EAAE,CAAC,MAAM,CAAC;oBAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;oBAC9D,gBAAgB,EAAE,eAAe;oBACjC,gCAAgC,EAAE,CAAC,MAAM,CAAC;iBAC3C;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,yCAAyC,CAAC,CAAC,CAAC;IACjG,CAAC;CACF,CAAA;AA7CO;IADL,KAAK,CAAC,YAAY,CAAC;;;;iDAenB;AAGK;IADL,KAAK,CAAC,aAAa,CAAC;;;;kDA4BpB;AAlDkB,eAAe;IAVnC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI,EAAE,eAAe;QACrB,WAAW;QACX,YAAY,EAAZ,oBAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,KAAK;SACd;KACF,CAAC;GACmB,eAAe,CAmDnC;kBAnDoB,eAAe","sourcesContent":["// auth/flows/well-known.oauth-authorization-server.flow.ts\nimport 'reflect-metadata';\nimport { z } from 'zod';\nimport {\n  HttpRedirectSchema,\n  httpRespond,\n  HttpTextSchema,\n  Flow,\n  FlowBase,\n  FlowRunOptions,\n  ScopeEntry,\n  ServerRequest,\n  StageHookOf,\n  httpInputSchema,\n  FlowPlan,\n  getRequestBaseUrl,\n  makeWellKnownPaths,\n} from '../../common';\n\nconst inputSchema = httpInputSchema;\n\n// ===== Result =====\nconst AuthServerMetadataSchema = z.object({\n  kind: z.literal('json'),\n  status: z.literal(200),\n  contentType: z.literal('application/json; charset=utf-8'),\n  body: z\n    .object({\n      issuer: z.string().min(1),\n      authorization_endpoint: z.string().min(1),\n      token_endpoint: z.string().min(1),\n      userinfo_endpoint: z.string().min(1).optional(),\n      jwks_uri: z.string().min(1),\n      registration_endpoint: z.string().min(1).optional(),\n      token_endpoint_auth_methods_supported: z\n        .array(z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))\n        .optional(),\n      response_types_supported: z.array(z.enum(['code'])).default(['code']),\n      grant_types_supported: z\n        .array(z.enum(['authorization_code', 'refresh_token']))\n        .default(['authorization_code', 'refresh_token']),\n      scopes_supported: z.array(z.string()).default(['openid', 'profile', 'email']),\n      code_challenge_methods_supported: z.array(z.enum(['S256'])).default(['S256']),\n    })\n    .passthrough(),\n});\n\nexport const outputSchema = z.union([AuthServerMetadataSchema, HttpRedirectSchema, HttpTextSchema]);\n\nexport const wellKnownAsStateSchema = z.object({\n  baseUrl: z.string().min(1), // baseUrl + entryPrefix (unsuffixed)\n  scopesSupported: z.array(z.string()).default(['openid', 'profile', 'email']),\n  tokenEndpointAuthMethods: z\n    .array(z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))\n    .default(['client_secret_basic', 'client_secret_post']),\n  dcrEnabled: z.boolean().default(true),\n  isOrchestrated: z.boolean(),\n});\n\nconst wellKnownAsPlan = {\n  pre: ['parseInput'],\n  execute: ['collectData'],\n} as const satisfies FlowPlan<string>;\n\ntype WellKnownAsPlan = typeof wellKnownAsPlan;\ntype WellKnownAsFlowOptions = FlowRunOptions<\n  WellKnownAsFlow,\n  WellKnownAsPlan,\n  typeof inputSchema,\n  typeof outputSchema,\n  typeof wellKnownAsStateSchema\n>;\n\ndeclare global {\n  interface ExtendFlows {\n    'well-known.oauth-authorization-server': WellKnownAsFlowOptions;\n  }\n}\n\nconst name = 'well-known.oauth-authorization-server' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan: wellKnownAsPlan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'GET',\n  },\n})\nexport default class WellKnownAsFlow extends FlowBase<typeof name> {\n  static canActivate(request: ServerRequest, scope: ScopeEntry) {\n    return makeWellKnownPaths('oauth-authorization-server', scope.entryPath, scope.routeBase).has(request.path);\n  }\n\n  @Stage('parseInput')\n  async parseInput() {\n    const { request } = this.rawInput;\n    if (!request) throw new Error('Request is undefined');\n\n    const baseUrl = getRequestBaseUrl(request, this.scope.entryPath);\n    this.state.set(\n      wellKnownAsStateSchema.parse({\n        baseUrl,\n        scopesSupported: [],\n        tokenEndpointAuthMethods: [],\n        dcrEnabled: false, //scope.oauth.dcrEnabled,\n        isOrchestrated: !this.scope.metadata.auth, // scope.orchestrated,\n      }),\n    );\n  }\n\n  @Stage('collectData')\n  async collectData() {\n    const { baseUrl, scopesSupported, tokenEndpointAuthMethods, dcrEnabled, isOrchestrated } = this.state.required;\n    // Orchestrated => gateway is the AS\n    if (isOrchestrated) {\n      const baseIssuer = `${baseUrl}`;\n      this.respond({\n        kind: 'json',\n        contentType: 'application/json; charset=utf-8',\n        status: 200,\n        body: {\n          issuer: baseIssuer,\n          authorization_endpoint: `${baseIssuer}/oauth/authorize`,\n          token_endpoint: `${baseIssuer}/oauth/token`,\n          userinfo_endpoint: `${baseIssuer}/oauth/userinfo`,\n          jwks_uri: `${baseIssuer}/.well-known/jwks.json`,\n          registration_endpoint: `${baseIssuer}/oauth/register`,\n          token_endpoint_auth_methods_supported: tokenEndpointAuthMethods,\n          response_types_supported: ['code'],\n          grant_types_supported: ['authorization_code', 'refresh_token'],\n          scopes_supported: scopesSupported,\n          code_challenge_methods_supported: ['S256'],\n        },\n      });\n      return;\n    }\n    const primary = this.scope.auth;\n    this.respond(httpRespond.redirect(`${primary.issuer}/.well-known/oauth-authorization-server`));\n  }\n}\n"]}