@memberjunction/auth-providers 6.1.0-edge.6 → 6.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.turbo/turbo-build.log +1 -1
- package/CHANGELOG.md +139 -0
- package/package.json +3 -3
package/.turbo/turbo-build.log
CHANGED
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,144 @@
|
|
|
1
1
|
# @memberjunction/auth-providers
|
|
2
2
|
|
|
3
|
+
## 6.1.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 048c5ce: feat(auth): metadata-driven pluggable authentication providers
|
|
8
|
+
|
|
9
|
+
Authentication providers are now discovered the MJ way — a `@RegisterClass(BaseAuthProvider, 'x')`
|
|
10
|
+
subclass plus a row in the new `MJ: Authentication Providers` entity, resolved at runtime through
|
|
11
|
+
`ClassFactory` by `DriverClass`. Adding a provider requires no core edits.
|
|
12
|
+
- **New entity** `__mj.AuthenticationProvider`, with the OIDC connection fields as columns, an
|
|
13
|
+
optional `CredentialID` for the rare provider needing server-side secrets, and login-picker
|
|
14
|
+
presentation fields. Driver configuration is split by trust boundary: `AdditionalConfiguration`
|
|
15
|
+
is server-only, `ClientConfiguration` is published to the browser.
|
|
16
|
+
- **`AuthProviderEngine`** loads the catalog at startup and registers it with `AuthProviderFactory`.
|
|
17
|
+
- **Layered resolution** — `mj.config.cjs` `authProviders[]` remains fully supported as the baseline
|
|
18
|
+
and fallback, so existing deployments are unaffected and need no changes.
|
|
19
|
+
- **`GET /auth/providers`** publishes the non-secret catalog to the pre-auth browser (rate-limited,
|
|
20
|
+
mounted ahead of the auth middleware, allow-list projection).
|
|
21
|
+
- **`<mj-login-picker>`** — a reusable, app-agnostic multi-IdP picker built on `mjButton`, rendered
|
|
22
|
+
only when 2+ client-visible providers exist. Single-provider deployments look exactly as before.
|
|
23
|
+
- `AuthProviderFactory` no longer carries a hard-wired list of built-in provider imports; the
|
|
24
|
+
package entry point and the class-registration manifests already covered registration.
|
|
25
|
+
- **Environment-variable configuration is now pluggable too.** The hard-coded block in MJServer's
|
|
26
|
+
config that enumerated Entra / Auth0 / Cognito inline is replaced by an optional
|
|
27
|
+
`configFromEnvironment` static on each provider class (`IEnvironmentConfigurableProvider`),
|
|
28
|
+
collected through the ClassFactory registry by `AuthProviderFactory.discoverFromEnvironment()`.
|
|
29
|
+
A third-party provider can now offer the same "set two variables and you're done" experience
|
|
30
|
+
with no change to MJ core. The three existing mappings are preserved byte-for-byte; **Okta**
|
|
31
|
+
(`OKTA_DOMAIN` + `OKTA_CLIENT_ID`) and **WorkOS** (`WORKOS_CLIENT_ID`) gain env-var support they
|
|
32
|
+
did not previously have.
|
|
33
|
+
|
|
34
|
+
### Patch Changes
|
|
35
|
+
|
|
36
|
+
- c679e8d: Fix the MCP OAuth proxy against Amazon Cognito: use the hosted-UI domain for the upstream endpoints.
|
|
37
|
+
|
|
38
|
+
The proxy derived its upstream `/authorize` and `/token` URLs with an Azure AD branch and an Auth0-shaped fallback, so a Cognito provider got `https://cognito-idp.<region>.amazonaws.com/<poolId>/authorize` — the user-pool API host, which answers HTTP 400. Cognito serves OAuth only on the hosted-UI domain (`https://<domain>.auth.<region>.amazoncognito.com/oauth2/authorize` and `/oauth2/token`); the issuer stays on `cognito-idp` and is still what validates tokens. The same fallback also appended `offline_access`, which Cognito rejects as `invalid_scope`.
|
|
39
|
+
|
|
40
|
+
Endpoint derivation now lives in `resolveUpstreamOAuthEndpoints()` (`@memberjunction/ai-mcp-server/auth/UpstreamEndpoints`) with an explicit Cognito branch. Azure AD and generic-OIDC (Auth0/Okta) URLs are unchanged and pinned by tests. The hosted-UI domain comes from the provider's existing optional `domain` field, which `CognitoProvider.ConfigFromEnvironment` now populates from `COGNITO_DOMAIN` — the same variable and host-only form MJExplorer already reads. `BaseAuthProvider` exposes `domain` alongside `clientId` for the proxy to read. A Cognito upstream configured without a domain now throws a message naming what to set, instead of silently building a URL that 400s.
|
|
41
|
+
|
|
42
|
+
The provider is also classified from the issuer's **hostname** rather than by substring-matching the whole issuer URL, which is how the Azure AD check worked before. An issuer is caller-supplied configuration, and the flavor decides which host a user's browser is sent to for login, so `https://evil.example/?microsoftonline.com` must not classify as Azure AD. Matching is exact-or-subdomain, so `notmicrosoftonline.com` does not match either. Legitimate issuers — including provider subdomains such as `login.partner.microsoftonline.com` — classify exactly as before.
|
|
43
|
+
|
|
44
|
+
Token validation is untouched: `domain` is optional and unused outside the OAuth proxy, so an existing Cognito deployment that never sets `COGNITO_DOMAIN` behaves exactly as before.
|
|
45
|
+
|
|
46
|
+
- Updated dependencies [834f8d7]
|
|
47
|
+
- Updated dependencies [394d276]
|
|
48
|
+
- Updated dependencies [c42c0e8]
|
|
49
|
+
- Updated dependencies [4586215]
|
|
50
|
+
- Updated dependencies [197fdf8]
|
|
51
|
+
- Updated dependencies [67e4c9e]
|
|
52
|
+
- Updated dependencies [0ec1980]
|
|
53
|
+
- Updated dependencies [1940a4d]
|
|
54
|
+
- Updated dependencies [07cb22e]
|
|
55
|
+
- Updated dependencies [1d2ffd4]
|
|
56
|
+
- Updated dependencies [e2ad3c0]
|
|
57
|
+
- Updated dependencies [c581b4f]
|
|
58
|
+
- Updated dependencies [d79fe39]
|
|
59
|
+
- Updated dependencies [9699d0e]
|
|
60
|
+
- Updated dependencies [394d276]
|
|
61
|
+
- Updated dependencies [08829f5]
|
|
62
|
+
- Updated dependencies [815b9bc]
|
|
63
|
+
- Updated dependencies [a5f92d2]
|
|
64
|
+
- Updated dependencies [2d14c62]
|
|
65
|
+
- Updated dependencies [c996a56]
|
|
66
|
+
- Updated dependencies [38d4482]
|
|
67
|
+
- Updated dependencies [052b4c7]
|
|
68
|
+
- Updated dependencies [f5ec13b]
|
|
69
|
+
- Updated dependencies [50987c4]
|
|
70
|
+
- Updated dependencies [c996a56]
|
|
71
|
+
- Updated dependencies [7b4abe7]
|
|
72
|
+
- Updated dependencies [051e0ff]
|
|
73
|
+
- Updated dependencies [95fc3e6]
|
|
74
|
+
- Updated dependencies [8d880cc]
|
|
75
|
+
- Updated dependencies [cefc302]
|
|
76
|
+
- Updated dependencies [841e6ea]
|
|
77
|
+
- Updated dependencies [6485ef0]
|
|
78
|
+
- Updated dependencies [b954812]
|
|
79
|
+
- Updated dependencies [080f4cd]
|
|
80
|
+
- Updated dependencies [bbb7fcc]
|
|
81
|
+
- Updated dependencies [b8130f3]
|
|
82
|
+
- Updated dependencies [d66a26a]
|
|
83
|
+
- Updated dependencies [1d88e00]
|
|
84
|
+
- Updated dependencies [647bd71]
|
|
85
|
+
- Updated dependencies [8288711]
|
|
86
|
+
- Updated dependencies [be0bdb2]
|
|
87
|
+
- Updated dependencies [9b9e5a4]
|
|
88
|
+
- Updated dependencies [f544a93]
|
|
89
|
+
- Updated dependencies [48ff99f]
|
|
90
|
+
- Updated dependencies [9f73528]
|
|
91
|
+
- Updated dependencies [68b9cf0]
|
|
92
|
+
- Updated dependencies [27e4d09]
|
|
93
|
+
- Updated dependencies [d90a3ea]
|
|
94
|
+
- Updated dependencies [23c2521]
|
|
95
|
+
- Updated dependencies [048c5ce]
|
|
96
|
+
- Updated dependencies [63bc733]
|
|
97
|
+
- Updated dependencies [92f2ac9]
|
|
98
|
+
- Updated dependencies [8ad04e8]
|
|
99
|
+
- Updated dependencies [7300953]
|
|
100
|
+
- Updated dependencies [7300953]
|
|
101
|
+
- Updated dependencies [98841bb]
|
|
102
|
+
- Updated dependencies [53c341c]
|
|
103
|
+
- Updated dependencies [b46330e]
|
|
104
|
+
- Updated dependencies [fccd0b2]
|
|
105
|
+
- Updated dependencies [84f276e]
|
|
106
|
+
- Updated dependencies [6ecfaa0]
|
|
107
|
+
- Updated dependencies [2be2960]
|
|
108
|
+
- Updated dependencies [cf2484c]
|
|
109
|
+
- Updated dependencies [7f3c60c]
|
|
110
|
+
- Updated dependencies [97aefcc]
|
|
111
|
+
- Updated dependencies [0967ba7]
|
|
112
|
+
- Updated dependencies [f5ec13b]
|
|
113
|
+
- Updated dependencies [de343b5]
|
|
114
|
+
- Updated dependencies [5fc861f]
|
|
115
|
+
- Updated dependencies [1748491]
|
|
116
|
+
- Updated dependencies [a1a8989]
|
|
117
|
+
- Updated dependencies [b00a985]
|
|
118
|
+
- Updated dependencies [041865c]
|
|
119
|
+
- Updated dependencies [905820a]
|
|
120
|
+
- Updated dependencies [1bd9674]
|
|
121
|
+
- Updated dependencies [394d276]
|
|
122
|
+
- Updated dependencies [394d276]
|
|
123
|
+
- Updated dependencies [394d276]
|
|
124
|
+
- Updated dependencies [7fcdc2d]
|
|
125
|
+
- Updated dependencies [15319b4]
|
|
126
|
+
- Updated dependencies [d0a2a55]
|
|
127
|
+
- @memberjunction/global@6.1.0
|
|
128
|
+
- @memberjunction/core@6.1.0
|
|
129
|
+
|
|
130
|
+
## 6.1.0-edge.7
|
|
131
|
+
|
|
132
|
+
### Patch Changes
|
|
133
|
+
|
|
134
|
+
- Updated dependencies [c996a56]
|
|
135
|
+
- Updated dependencies [c996a56]
|
|
136
|
+
- Updated dependencies [cf2484c]
|
|
137
|
+
- Updated dependencies [97aefcc]
|
|
138
|
+
- Updated dependencies [7fcdc2d]
|
|
139
|
+
- @memberjunction/core@6.1.0-edge.7
|
|
140
|
+
- @memberjunction/global@6.1.0-edge.7
|
|
141
|
+
|
|
3
142
|
## 6.1.0-edge.6
|
|
4
143
|
|
|
5
144
|
### Patch Changes
|
package/package.json
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@memberjunction/auth-providers",
|
|
3
3
|
"license": "BUSL-1.1",
|
|
4
|
-
"version": "6.1.0
|
|
4
|
+
"version": "6.1.0",
|
|
5
5
|
"description": "Authentication provider interfaces, base classes, and implementations for MemberJunction",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"main": "./dist/index.js",
|
|
8
8
|
"types": "./dist/index.d.ts",
|
|
9
9
|
"dependencies": {
|
|
10
|
-
"@memberjunction/core": "6.1.0
|
|
11
|
-
"@memberjunction/global": "6.1.0
|
|
10
|
+
"@memberjunction/core": "6.1.0",
|
|
11
|
+
"@memberjunction/global": "6.1.0",
|
|
12
12
|
"graphql": "^16.12.0",
|
|
13
13
|
"jsonwebtoken": "9.0.3",
|
|
14
14
|
"jwks-rsa": "^3.2.2"
|