@memberjunction/auth-providers 6.1.0-edge.5 → 6.1.0-edge.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.turbo/turbo-build.log +1 -1
- package/CHANGELOG.md +36 -0
- package/dist/BaseAuthProvider.d.ts +2 -0
- package/dist/BaseAuthProvider.d.ts.map +1 -1
- package/dist/BaseAuthProvider.js +1 -0
- package/dist/BaseAuthProvider.js.map +1 -1
- package/dist/IAuthProvider.d.ts +6 -0
- package/dist/IAuthProvider.d.ts.map +1 -1
- package/dist/providers/CognitoProvider.d.ts +4 -1
- package/dist/providers/CognitoProvider.d.ts.map +1 -1
- package/dist/providers/CognitoProvider.js +5 -1
- package/dist/providers/CognitoProvider.js.map +1 -1
- package/package.json +3 -3
- package/src/BaseAuthProvider.ts +3 -0
- package/src/IAuthProvider.ts +7 -0
- package/src/__tests__/EnvironmentDiscovery.test.ts +13 -0
- package/src/providers/CognitoProvider.ts +5 -1
package/.turbo/turbo-build.log
CHANGED
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,41 @@
|
|
|
1
1
|
# @memberjunction/auth-providers
|
|
2
2
|
|
|
3
|
+
## 6.1.0-edge.6
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- c679e8d: Fix the MCP OAuth proxy against Amazon Cognito: use the hosted-UI domain for the upstream endpoints.
|
|
8
|
+
|
|
9
|
+
The proxy derived its upstream `/authorize` and `/token` URLs with an Azure AD branch and an Auth0-shaped fallback, so a Cognito provider got `https://cognito-idp.<region>.amazonaws.com/<poolId>/authorize` — the user-pool API host, which answers HTTP 400. Cognito serves OAuth only on the hosted-UI domain (`https://<domain>.auth.<region>.amazoncognito.com/oauth2/authorize` and `/oauth2/token`); the issuer stays on `cognito-idp` and is still what validates tokens. The same fallback also appended `offline_access`, which Cognito rejects as `invalid_scope`.
|
|
10
|
+
|
|
11
|
+
Endpoint derivation now lives in `resolveUpstreamOAuthEndpoints()` (`@memberjunction/ai-mcp-server/auth/UpstreamEndpoints`) with an explicit Cognito branch. Azure AD and generic-OIDC (Auth0/Okta) URLs are unchanged and pinned by tests. The hosted-UI domain comes from the provider's existing optional `domain` field, which `CognitoProvider.ConfigFromEnvironment` now populates from `COGNITO_DOMAIN` — the same variable and host-only form MJExplorer already reads. `BaseAuthProvider` exposes `domain` alongside `clientId` for the proxy to read. A Cognito upstream configured without a domain now throws a message naming what to set, instead of silently building a URL that 400s.
|
|
12
|
+
|
|
13
|
+
The provider is also classified from the issuer's **hostname** rather than by substring-matching the whole issuer URL, which is how the Azure AD check worked before. An issuer is caller-supplied configuration, and the flavor decides which host a user's browser is sent to for login, so `https://evil.example/?microsoftonline.com` must not classify as Azure AD. Matching is exact-or-subdomain, so `notmicrosoftonline.com` does not match either. Legitimate issuers — including provider subdomains such as `login.partner.microsoftonline.com` — classify exactly as before.
|
|
14
|
+
|
|
15
|
+
Token validation is untouched: `domain` is optional and unused outside the OAuth proxy, so an existing Cognito deployment that never sets `COGNITO_DOMAIN` behaves exactly as before.
|
|
16
|
+
|
|
17
|
+
- Updated dependencies [197fdf8]
|
|
18
|
+
- Updated dependencies [67e4c9e]
|
|
19
|
+
- Updated dependencies [0ec1980]
|
|
20
|
+
- Updated dependencies [2d14c62]
|
|
21
|
+
- Updated dependencies [38d4482]
|
|
22
|
+
- Updated dependencies [8d880cc]
|
|
23
|
+
- Updated dependencies [6485ef0]
|
|
24
|
+
- Updated dependencies [b954812]
|
|
25
|
+
- Updated dependencies [9b9e5a4]
|
|
26
|
+
- Updated dependencies [f544a93]
|
|
27
|
+
- Updated dependencies [9f73528]
|
|
28
|
+
- Updated dependencies [63bc733]
|
|
29
|
+
- Updated dependencies [92f2ac9]
|
|
30
|
+
- Updated dependencies [98841bb]
|
|
31
|
+
- Updated dependencies [2be2960]
|
|
32
|
+
- Updated dependencies [7f3c60c]
|
|
33
|
+
- Updated dependencies [1748491]
|
|
34
|
+
- Updated dependencies [b00a985]
|
|
35
|
+
- Updated dependencies [041865c]
|
|
36
|
+
- @memberjunction/core@6.1.0-edge.6
|
|
37
|
+
- @memberjunction/global@6.1.0-edge.6
|
|
38
|
+
|
|
3
39
|
## 6.1.0-edge.5
|
|
4
40
|
|
|
5
41
|
### Patch Changes
|
|
@@ -14,6 +14,8 @@ export declare abstract class BaseAuthProvider implements IAuthProvider {
|
|
|
14
14
|
jwksUri: string;
|
|
15
15
|
/** OAuth client ID for this provider (used by OAuth proxy for upstream auth) */
|
|
16
16
|
clientId?: string;
|
|
17
|
+
/** Provider domain hosting the OAuth endpoints when they aren't on the issuer (used by OAuth proxy) */
|
|
18
|
+
domain?: string;
|
|
17
19
|
protected config: AuthProviderConfig;
|
|
18
20
|
protected jwksClient: jwksClient.JwksClient;
|
|
19
21
|
constructor(config: AuthProviderConfig);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"BaseAuthProvider.d.ts","sourceRoot":"","sources":["../src/BaseAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,UAAU,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAInD;;;;GAIG;AACH,8BAAsB,gBAAiB,YAAW,aAAa;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACrC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;gBAEhC,MAAM,EAAE,kBAAkB;
|
|
1
|
+
{"version":3,"file":"BaseAuthProvider.d.ts","sourceRoot":"","sources":["../src/BaseAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,UAAU,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAInD;;;;GAIG;AACH,8BAAsB,gBAAiB,YAAW,aAAa;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACrC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;gBAEhC,MAAM,EAAE,kBAAkB;IAqCtC;;OAEG;IACH,cAAc,IAAI,OAAO;IAIzB;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAYpE;;OAEG;YACW,sBAAsB;IAuCpC;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAOtC;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;CAC5D"}
|
package/dist/BaseAuthProvider.js
CHANGED
|
@@ -14,6 +14,7 @@ export class BaseAuthProvider {
|
|
|
14
14
|
this.audience = config.audience;
|
|
15
15
|
this.jwksUri = config.jwksUri;
|
|
16
16
|
this.clientId = config.clientId;
|
|
17
|
+
this.domain = config.domain;
|
|
17
18
|
// Create HTTP agent with keep-alive to prevent socket hangups
|
|
18
19
|
const agent = this.jwksUri.startsWith('https')
|
|
19
20
|
? new https.Agent({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"BaseAuthProvider.js","sourceRoot":"","sources":["../src/BaseAuthProvider.ts"],"names":[],"mappings":"AACA,OAAO,UAAU,MAAM,UAAU,CAAC;AAGlC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;GAIG;AACH,MAAM,OAAgB,gBAAgB;
|
|
1
|
+
{"version":3,"file":"BaseAuthProvider.js","sourceRoot":"","sources":["../src/BaseAuthProvider.ts"],"names":[],"mappings":"AACA,OAAO,UAAU,MAAM,UAAU,CAAC;AAGlC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;GAIG;AACH,MAAM,OAAgB,gBAAgB;IAYpC,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,8DAA8D;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5C,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC;gBACd,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,EAAE;gBACd,cAAc,EAAE,EAAE;gBAClB,OAAO,EAAE,KAAK;aACf,CAAC;YACJ,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;gBACb,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,EAAE;gBACd,cAAc,EAAE,EAAE;gBAClB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QAEP,sEAAsE;QACtE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI;YACX,eAAe,EAAE,CAAC;YAClB,WAAW,EAAE,MAAM,EAAE,aAAa;YAClC,OAAO,EAAE,KAAK,EAAE,0CAA0C;YAC1D,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAiB,EAAE,QAA4B;QAC3D,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC;aACzC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,MAAM,UAAU,GAAG,WAAW,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YACzE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7B,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,OAAO,CAAC,KAAK,CAAC,0CAA0C,IAAI,CAAC,IAAI,iBAAiB,EAAE,GAAG,CAAC,CAAC;YACzF,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAClC,MAAiB,EACjB,UAAkB,EAClB,cAAsB;QAEtB,IAAI,SAA4B,CAAC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAEhE,4DAA4D;gBAC5D,MAAM,gBAAgB,GACpB,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBAC5C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;oBACxC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACvC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACvC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAE1C,IAAI,CAAC,gBAAgB,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAChD,MAAM,SAAS,CAAC;gBAClB,CAAC;gBAED,sDAAsD;gBACtD,MAAM,OAAO,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACtD,OAAO,CAAC,IAAI,CACV,WAAW,OAAO,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,wBAAwB,IAAI,CAAC,IAAI,IAAI;oBAC7E,eAAe,OAAO,gBAAgB,SAAS,CAAC,OAAO,EAAE,CAC1D,CAAC;gBAEF,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAc;QAC1B,+CAA+C;QAC/C,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,wBAAwB,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9E,OAAO,gBAAgB,KAAK,wBAAwB,CAAC;IACvD,CAAC;CAMF"}
|
package/dist/IAuthProvider.d.ts
CHANGED
|
@@ -25,6 +25,12 @@ export interface IAuthProvider {
|
|
|
25
25
|
* OAuth client ID for this provider (optional, used by OAuth proxy for upstream authentication)
|
|
26
26
|
*/
|
|
27
27
|
clientId?: string;
|
|
28
|
+
/**
|
|
29
|
+
* Provider domain, where the provider hosts its OAuth endpoints somewhere other than its
|
|
30
|
+
* issuer (optional, used by the OAuth proxy). Cognito is the case that needs it: its issuer
|
|
31
|
+
* is the user-pool URL, but /authorize and /token live on the hosted-UI domain.
|
|
32
|
+
*/
|
|
33
|
+
domain?: string;
|
|
28
34
|
/**
|
|
29
35
|
* Validates that the provider configuration is complete and valid
|
|
30
36
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"IAuthProvider.d.ts","sourceRoot":"","sources":["../src/IAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAsB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAExE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,cAAc,IAAI,OAAO,CAAC;IAE1B;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAErE;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY,CAAC;IAEnD;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CACxC"}
|
|
1
|
+
{"version":3,"file":"IAuthProvider.d.ts","sourceRoot":"","sources":["../src/IAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAsB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAExE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,cAAc,IAAI,OAAO,CAAC;IAE1B;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAErE;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY,CAAC;IAEnD;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CACxC"}
|
|
@@ -9,7 +9,10 @@ export declare class CognitoProvider extends BaseAuthProvider {
|
|
|
9
9
|
/**
|
|
10
10
|
* Configures Amazon Cognito from COGNITO_USER_POOL_ID + COGNITO_CLIENT_ID + AWS_REGION.
|
|
11
11
|
*
|
|
12
|
-
* Mapping preserved byte-for-byte from the env block that previously lived in MJServer's config
|
|
12
|
+
* Mapping preserved byte-for-byte from the env block that previously lived in MJServer's config,
|
|
13
|
+
* plus the optional COGNITO_DOMAIN — the hosted-UI domain, which is the only place Cognito serves
|
|
14
|
+
* /oauth2/authorize and /oauth2/token. Token validation doesn't need it; anything that *initiates*
|
|
15
|
+
* a Cognito login does. Same env var name and host-only form MJExplorer already uses.
|
|
13
16
|
*/
|
|
14
17
|
static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null;
|
|
15
18
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"CognitoProvider.d.ts","sourceRoot":"","sources":["../../src/providers/CognitoProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AACH,qBACa,eAAgB,SAAQ,gBAAgB;gBACvC,MAAM,EAAE,kBAAkB;IAItC
|
|
1
|
+
{"version":3,"file":"CognitoProvider.d.ts","sourceRoot":"","sources":["../../src/providers/CognitoProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AACH,qBACa,eAAgB,SAAQ,gBAAgB;gBACvC,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,GAAG,IAAI;IAiB/E;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAoBlD;;OAEG;IACH,cAAc,IAAI,OAAO;CAQ1B"}
|
|
@@ -19,7 +19,10 @@ let CognitoProvider = class CognitoProvider extends BaseAuthProvider {
|
|
|
19
19
|
/**
|
|
20
20
|
* Configures Amazon Cognito from COGNITO_USER_POOL_ID + COGNITO_CLIENT_ID + AWS_REGION.
|
|
21
21
|
*
|
|
22
|
-
* Mapping preserved byte-for-byte from the env block that previously lived in MJServer's config
|
|
22
|
+
* Mapping preserved byte-for-byte from the env block that previously lived in MJServer's config,
|
|
23
|
+
* plus the optional COGNITO_DOMAIN — the hosted-UI domain, which is the only place Cognito serves
|
|
24
|
+
* /oauth2/authorize and /oauth2/token. Token validation doesn't need it; anything that *initiates*
|
|
25
|
+
* a Cognito login does. Same env var name and host-only form MJExplorer already uses.
|
|
23
26
|
*/
|
|
24
27
|
static ConfigFromEnvironment(env) {
|
|
25
28
|
if (!env.COGNITO_USER_POOL_ID || !env.COGNITO_CLIENT_ID || !env.AWS_REGION) {
|
|
@@ -32,6 +35,7 @@ let CognitoProvider = class CognitoProvider extends BaseAuthProvider {
|
|
|
32
35
|
audience: env.COGNITO_CLIENT_ID,
|
|
33
36
|
jwksUri: `https://cognito-idp.${env.AWS_REGION}.amazonaws.com/${env.COGNITO_USER_POOL_ID}/.well-known/jwks.json`,
|
|
34
37
|
clientId: env.COGNITO_CLIENT_ID,
|
|
38
|
+
domain: env.COGNITO_DOMAIN,
|
|
35
39
|
region: env.AWS_REGION,
|
|
36
40
|
userPoolId: env.COGNITO_USER_POOL_ID
|
|
37
41
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"CognitoProvider.js","sourceRoot":"","sources":["../../src/providers/CognitoProvider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,gBAAgB;IACnD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED
|
|
1
|
+
{"version":3,"file":"CognitoProvider.js","sourceRoot":"","sources":["../../src/providers/CognitoProvider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;GAEG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,gBAAgB;IACnD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAsB;QACjD,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,uBAAuB,GAAG,CAAC,UAAU,kBAAkB,GAAG,CAAC,oBAAoB,EAAE;YACzF,QAAQ,EAAE,GAAG,CAAC,iBAAiB;YAC/B,OAAO,EAAE,uBAAuB,GAAG,CAAC,UAAU,kBAAkB,GAAG,CAAC,oBAAoB,wBAAwB;YAChH,QAAQ,EAAE,GAAG,CAAC,iBAAiB;YAC/B,MAAM,EAAE,GAAG,CAAC,cAAc;YAC1B,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,UAAU,EAAE,GAAG,CAAC,oBAAoB;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAmB;QACjC,oEAAoE;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B;YACnC,OAAO,CAAC,kBAAkB,CAAuB,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAuB;YAClD,OAAO,CAAC,kBAAwC;YAChD,KAAK,CAAC;QAE/B,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACvC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAE/C,OAAO,SAAS,IAAI,WAAW,IAAI,SAAS,IAAI,aAAa,CAAC;IAChE,CAAC;CACF,CAAA;AAhEY,eAAe;IAD3B,aAAa,CAAC,gBAAgB,EAAE,SAAS,CAAC;;GAC9B,eAAe,CAgE3B"}
|
package/package.json
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@memberjunction/auth-providers",
|
|
3
3
|
"license": "BUSL-1.1",
|
|
4
|
-
"version": "6.1.0-edge.
|
|
4
|
+
"version": "6.1.0-edge.6",
|
|
5
5
|
"description": "Authentication provider interfaces, base classes, and implementations for MemberJunction",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"main": "./dist/index.js",
|
|
8
8
|
"types": "./dist/index.d.ts",
|
|
9
9
|
"dependencies": {
|
|
10
|
-
"@memberjunction/core": "6.1.0-edge.
|
|
11
|
-
"@memberjunction/global": "6.1.0-edge.
|
|
10
|
+
"@memberjunction/core": "6.1.0-edge.6",
|
|
11
|
+
"@memberjunction/global": "6.1.0-edge.6",
|
|
12
12
|
"graphql": "^16.12.0",
|
|
13
13
|
"jsonwebtoken": "9.0.3",
|
|
14
14
|
"jwks-rsa": "^3.2.2"
|
package/src/BaseAuthProvider.ts
CHANGED
|
@@ -17,6 +17,8 @@ export abstract class BaseAuthProvider implements IAuthProvider {
|
|
|
17
17
|
jwksUri: string;
|
|
18
18
|
/** OAuth client ID for this provider (used by OAuth proxy for upstream auth) */
|
|
19
19
|
clientId?: string;
|
|
20
|
+
/** Provider domain hosting the OAuth endpoints when they aren't on the issuer (used by OAuth proxy) */
|
|
21
|
+
domain?: string;
|
|
20
22
|
protected config: AuthProviderConfig;
|
|
21
23
|
protected jwksClient: jwksClient.JwksClient;
|
|
22
24
|
|
|
@@ -27,6 +29,7 @@ export abstract class BaseAuthProvider implements IAuthProvider {
|
|
|
27
29
|
this.audience = config.audience;
|
|
28
30
|
this.jwksUri = config.jwksUri;
|
|
29
31
|
this.clientId = config.clientId;
|
|
32
|
+
this.domain = config.domain;
|
|
30
33
|
|
|
31
34
|
// Create HTTP agent with keep-alive to prevent socket hangups
|
|
32
35
|
const agent = this.jwksUri.startsWith('https')
|
package/src/IAuthProvider.ts
CHANGED
|
@@ -31,6 +31,13 @@ export interface IAuthProvider {
|
|
|
31
31
|
*/
|
|
32
32
|
clientId?: string;
|
|
33
33
|
|
|
34
|
+
/**
|
|
35
|
+
* Provider domain, where the provider hosts its OAuth endpoints somewhere other than its
|
|
36
|
+
* issuer (optional, used by the OAuth proxy). Cognito is the case that needs it: its issuer
|
|
37
|
+
* is the user-pool URL, but /authorize and /token live on the hosted-UI domain.
|
|
38
|
+
*/
|
|
39
|
+
domain?: string;
|
|
40
|
+
|
|
34
41
|
/**
|
|
35
42
|
* Validates that the provider configuration is complete and valid
|
|
36
43
|
*/
|
|
@@ -67,6 +67,19 @@ describe('ConfigFromEnvironment — parity with the previous hard-coded block',
|
|
|
67
67
|
userPoolId: 'pool'
|
|
68
68
|
});
|
|
69
69
|
});
|
|
70
|
+
|
|
71
|
+
it('Cognito carries COGNITO_DOMAIN through as the provider domain', () => {
|
|
72
|
+
// The hosted-UI domain is the only host serving /oauth2/authorize and /oauth2/token —
|
|
73
|
+
// anything initiating a Cognito login (the MCP OAuth proxy) reads it off the provider.
|
|
74
|
+
const config = CognitoProvider.ConfigFromEnvironment({
|
|
75
|
+
COGNITO_USER_POOL_ID: 'pool',
|
|
76
|
+
COGNITO_CLIENT_ID: 'ccid',
|
|
77
|
+
AWS_REGION: 'us-east-1',
|
|
78
|
+
COGNITO_DOMAIN: 'my-pool.auth.us-east-1.amazoncognito.com'
|
|
79
|
+
});
|
|
80
|
+
expect(config?.domain).toBe('my-pool.auth.us-east-1.amazoncognito.com');
|
|
81
|
+
expect(new CognitoProvider(config!).domain).toBe('my-pool.auth.us-east-1.amazoncognito.com');
|
|
82
|
+
});
|
|
70
83
|
});
|
|
71
84
|
|
|
72
85
|
describe('ConfigFromEnvironment — incomplete configuration', () => {
|
|
@@ -16,7 +16,10 @@ export class CognitoProvider extends BaseAuthProvider {
|
|
|
16
16
|
/**
|
|
17
17
|
* Configures Amazon Cognito from COGNITO_USER_POOL_ID + COGNITO_CLIENT_ID + AWS_REGION.
|
|
18
18
|
*
|
|
19
|
-
* Mapping preserved byte-for-byte from the env block that previously lived in MJServer's config
|
|
19
|
+
* Mapping preserved byte-for-byte from the env block that previously lived in MJServer's config,
|
|
20
|
+
* plus the optional COGNITO_DOMAIN — the hosted-UI domain, which is the only place Cognito serves
|
|
21
|
+
* /oauth2/authorize and /oauth2/token. Token validation doesn't need it; anything that *initiates*
|
|
22
|
+
* a Cognito login does. Same env var name and host-only form MJExplorer already uses.
|
|
20
23
|
*/
|
|
21
24
|
static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null {
|
|
22
25
|
if (!env.COGNITO_USER_POOL_ID || !env.COGNITO_CLIENT_ID || !env.AWS_REGION) {
|
|
@@ -29,6 +32,7 @@ export class CognitoProvider extends BaseAuthProvider {
|
|
|
29
32
|
audience: env.COGNITO_CLIENT_ID,
|
|
30
33
|
jwksUri: `https://cognito-idp.${env.AWS_REGION}.amazonaws.com/${env.COGNITO_USER_POOL_ID}/.well-known/jwks.json`,
|
|
31
34
|
clientId: env.COGNITO_CLIENT_ID,
|
|
35
|
+
domain: env.COGNITO_DOMAIN,
|
|
32
36
|
region: env.AWS_REGION,
|
|
33
37
|
userPoolId: env.COGNITO_USER_POOL_ID
|
|
34
38
|
};
|