@softtechai/quickmcp 1.0.14 → 1.1.0

package/dist/auth/auth-utils.d.ts

@@ -0,0 +1,130 @@
+import express from 'express';
+import { IDataStore } from '../database/datastore';
+import { AuthMode, LiteAdminUser } from '../config/auth-config';
+export type AppUserRole = 'admin' | 'user';
+export type AuthContext = {
+    username: string;
+    workspaceId: string;
+    role: AppUserRole;
+};
+export interface CreateMcpTokenResult {
+    token: string;
+    expiresAt: string | null;
+    tokenHash: string;
+    tokenId: string;
+}
+export interface AuthUtilsConfig {
+    authMode: AuthMode;
+    authDefaultUsername: string;
+    authCookieSecret: string;
+    authAccessTtlSec: number;
+    authRefreshTtlSec: number;
+    accessCookieName: string;
+    refreshCookieName: string;
+    authAdminUsers: LiteAdminUser[];
+    cookieSecure: boolean;
+    ensureDataStore: () => IDataStore;
+}
+export type McpIdentity = {
+    tokenId: string;
+    username: string;
+    workspace: string;
+    role: string;
+};
+export type McpTokenAuthRecord = {
+    id: string;
+    tokenName: string;
+    workspaceId: string;
+    subjectUsername: string;
+    allowAllServers: boolean;
+    allowAllTools: boolean;
+    allowAllResources: boolean;
+    serverIds: string[];
+    allowedTools: string[];
+    allowedResources: string[];
+    serverRules: Record<string, boolean | null>;
+    toolRules: Record<string, boolean | null>;
+    resourceRules: Record<string, boolean | null>;
+    neverExpires: boolean;
+    expiresAt: string | null;
+    revokedAt: string | null;
+};
+export declare class AuthUtils {
+    private readonly authMode;
+    private readonly authDefaultUsername;
+    private readonly authCookieSecret;
+    private readonly authAccessTtlSec;
+    private readonly authRefreshTtlSec;
+    private readonly accessCookieName;
+    private readonly refreshCookieName;
+    private readonly authAdminUsers;
+    private readonly cookieSecure;
+    private readonly ensureDataStore;
+    constructor(config: AuthUtilsConfig);
+    normalizeUsername(value: unknown): string;
+    isNoneMode(): boolean;
+    hashPassword(password: string): string;
+    verifyPassword(password: string, expectedHash: string): boolean;
+    createMcpToken(username: string, workspaceId: string, role: AppUserRole, ttlSec?: number, audience?: string, issuer?: string, scope?: string): CreateMcpTokenResult;
+    getUserRole(username: string, workspaceId?: string): AppUserRole;
+    isAdminUser(username: string, workspaceId?: string): boolean;
+    parseCookies(req: express.Request): Record<string, string>;
+    setCookie(res: express.Response, name: string, value: string, maxAgeSec: number): void;
+    clearCookie(res: express.Response, name: string): void;
+    getEffectiveUsername(req: {
+        authWorkspace?: string;
+        authUser?: string;
+    }): string;
+    getNoneModeAuthContext(): AuthContext;
+    applyNoneModeAuth(req: {
+        authUser?: string;
+        authWorkspace?: string;
+        authRole?: AppUserRole;
+    }): void;
+    resolvePublicDir(currentDir: string): string;
+    buildServerId(ownerUsername: string, serverName: string): string;
+    isPublicPath(pathname: string): boolean;
+    getAuthenticatedUser(req: express.Request): string | null;
+    getUserRoleAsync(username: string, workspaceId?: string): Promise<AppUserRole>;
+    seedLiteAdminsAsync(): Promise<void>;
+    tryRefreshAuthAsync(req: express.Request, res: express.Response): Promise<string | null>;
+    resolveAuthContextAsync(req: express.Request & {
+        authUser?: string;
+    }, res?: express.Response): Promise<AuthContext | null>;
+    requireAdminApiAsync(req: express.Request & {
+        authUser?: string;
+    }, res: express.Response): Promise<AuthContext | null>;
+    applyAuthenticatedRequestContextAsync(req: express.Request & {
+        authUser?: string;
+        authWorkspace?: string;
+        authRole?: AppUserRole;
+    }, res: express.Response): Promise<boolean>;
+    private base64UrlEncode;
+    private signMcpToken;
+}
+export declare function normalizeStringArray(value: unknown): string[];
+export declare function resolveLiteAdminUsernames(): Set<string>;
+export declare function normalizeRuleMap(value: unknown): Record<string, boolean | null>;
+export declare function getMcpTokenRecord(dataStore: {
+    getMcpTokenByHash?: (tokenHash: string) => any;
+}, mcpAuthMode: AuthMode, mcpTokenHash: string): McpTokenAuthRecord | null;
+export declare function isMcpAuthorizedGlobally(mcpAuthMode: AuthMode, mcpIdentity: McpIdentity | null, mcpTokenRecord: McpTokenAuthRecord | null): boolean;
+export declare function parseServerOwner(serverId: string): string;
+export declare function isServerOwnedByCurrentIdentity(mcpAuthMode: AuthMode, mcpIdentity: McpIdentity | null, mcpTokenRecord: McpTokenAuthRecord | null, serverId: string): boolean;
+export declare function getServerRequireMcpToken(mcpAuthMode: AuthMode, dataStore: {
+    getServerAuthConfig?: (serverId: string) => any;
+    getMcpTokenPolicy?: (scopeType: 'global' | 'user' | 'server' | 'tool', scopeId: string) => any;
+}, serverId: string): boolean;
+export declare function isServerAuthorized(mcpAuthMode: AuthMode, dataStore: {
+    getServerAuthConfig?: (serverId: string) => any;
+    getMcpTokenPolicy?: (scopeType: 'global' | 'user' | 'server' | 'tool', scopeId: string) => any;
+}, mcpIdentity: McpIdentity | null, mcpTokenRecord: McpTokenAuthRecord | null, serverId: string): boolean;
+export declare function isToolAuthorized(mcpAuthMode: AuthMode, dataStore: {
+    getServerAuthConfig?: (serverId: string) => any;
+    getMcpTokenPolicy?: (scopeType: 'global' | 'user' | 'server' | 'tool', scopeId: string) => any;
+}, mcpIdentity: McpIdentity | null, mcpTokenRecord: McpTokenAuthRecord | null, serverId: string, toolName: string): boolean;
+export declare function isResourceAuthorized(mcpAuthMode: AuthMode, dataStore: {
+    getServerAuthConfig?: (serverId: string) => any;
+    getMcpTokenPolicy?: (scopeType: 'global' | 'user' | 'server' | 'tool', scopeId: string) => any;
+}, mcpIdentity: McpIdentity | null, mcpTokenRecord: McpTokenAuthRecord | null, serverId: string, resourceName: string): boolean;
+//# sourceMappingURL=auth-utils.d.ts.map

package/dist/auth/auth-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-utils.d.ts","sourceRoot":"","sources":["../../src/auth/auth-utils.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAIhE,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;AAC3C,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAEvF,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,QAAQ,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,UAAU,CAAC;CACnC;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IAC1C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9C,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;gBAEvC,MAAM,EAAE,eAAe;IAanC,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAIzC,UAAU,IAAI,OAAO;IAIrB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAItC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IAI/D,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACb,oBAAoB;IA8BvB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,WAAW;IAOhE,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO;IAI5D,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAW1D,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IActF,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAQtD,oBAAoB,CAAC,GAAG,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAKhF,sBAAsB,IAAI,WAAW;IAQrC,iBAAiB,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI;IAOnG,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAkB5C,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAIhE,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAmCvC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,IAAI;IASnD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAc9E,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAYpC,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA0DxF,uBAAuB,CAC3B,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5C,GAAG,CAAC,EAAE,OAAO,CAAC,QAAQ,GACrB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA8BxB,oBAAoB,CACxB,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5C,GAAG,EAAE,OAAO,CAAC,QAAQ,GACpB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAaxB,qCAAqC,CACzC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,WAAW,CAAA;KAAE,EAC5F,GAAG,EAAE,OAAO,CAAC,QAAQ,GACpB,OAAO,CAAC,OAAO,CAAC;IA2BnB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,YAAY;CAIrB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAW7D;AAED,wBAAgB,yBAAyB,IAAI,GAAG,CAAC,MAAM,CAAC,CAcvD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,CAqB/E;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE;IAAE,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,GAAG,CAAA;CAAE,EAC7D,WAAW,EAAE,QAAQ,EACrB,YAAY,EAAE,MAAM,GACnB,kBAAkB,GAAG,IAAI,CA2B3B;AAED,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,QAAQ,EACrB,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,cAAc,EAAE,kBAAkB,GAAG,IAAI,GACxC,OAAO,CAYT;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIzD;AAED,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,QAAQ,EACrB,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,cAAc,EAAE,kBAAkB,GAAG,IAAI,EACzC,QAAQ,EAAE,MAAM,GACf,OAAO,CAKT;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,QAAQ,EACrB,SAAS,EAAE;IACT,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAC;IAChD,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,GAAG,CAAC;CAChG,EACD,QAAQ,EAAE,MAAM,GACf,OAAO,CA+BT;AAuBD,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,QAAQ,EACrB,SAAS,EAAE;IACT,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAC;IAChD,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,GAAG,CAAC;CAChG,EACD,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,cAAc,EAAE,kBAAkB,GAAG,IAAI,EACzC,QAAQ,EAAE,MAAM,GACf,OAAO,CAgBT;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,QAAQ,EACrB,SAAS,EAAE;IACT,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAC;IAChD,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,GAAG,CAAC;CAChG,EACD,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,cAAc,EAAE,kBAAkB,GAAG,IAAI,EACzC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAkBT;AAED,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,QAAQ,EACrB,SAAS,EAAE;IACT,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAC;IAChD,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,GAAG,CAAC;CAChG,EACD,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,cAAc,EAAE,kBAAkB,GAAG,IAAI,EACzC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAeT"}