mcp-from-openapi 0.0.1 → 2.0.0

package/src/security-resolver.d.ts

@@ -0,0 +1,289 @@
+import type { ParameterMapper, SecurityParameterInfo } from './types';
+/**
+ * Context for resolving security parameters
+ * Frameworks should implement this interface based on their auth system
+ */
+export interface SecurityContext {
+    /**
+     * JWT/Bearer token
+     */
+    jwt?: string;
+    /**
+     * Basic auth credentials (base64 encoded "username:password")
+     */
+    basic?: string;
+    /**
+     * Digest auth credentials
+     * Object with username, password, realm, nonce, etc.
+     */
+    digest?: DigestAuthCredentials;
+    /**
+     * API key (single key for backward compatibility)
+     */
+    apiKey?: string;
+    /**
+     * Multiple API keys by name
+     * Use this when API requires different keys for different purposes
+     * @example { 'X-API-Key': 'key1', 'X-Client-Id': 'client123' }
+     */
+    apiKeys?: Record<string, string>;
+    /**
+     * OAuth2 access token
+     */
+    oauth2Token?: string;
+    /**
+     * Client certificate for mutual TLS (mTLS)
+     */
+    clientCertificate?: ClientCertificate;
+    /**
+     * Private key for signature-based auth (HMAC, AWS Signature V4, etc.)
+     */
+    privateKey?: string;
+    /**
+     * Public key (if needed for verification)
+     */
+    publicKey?: string;
+    /**
+     * HMAC secret for HMAC-based authentication
+     */
+    hmacSecret?: string;
+    /**
+     * AWS credentials for AWS Signature V4
+     */
+    awsCredentials?: AWSCredentials;
+    /**
+     * Custom headers for proprietary authentication
+     * @example { 'X-Custom-Auth': 'custom-value' }
+     */
+    customHeaders?: Record<string, string>;
+    /**
+     * Session cookies
+     */
+    cookies?: Record<string, string>;
+    /**
+     * Custom resolver for framework-specific auth
+     * @param security - Security parameter info from mapper
+     * @returns The auth value to use, or undefined if not available
+     */
+    customResolver?: (security: SecurityParameterInfo) => string | Promise<string | undefined>;
+    /**
+     * Signature generator for signature-based auth
+     * @param data - Data to sign (typically the request)
+     * @param security - Security parameter info
+     * @returns The signature or signed value
+     */
+    signatureGenerator?: (data: SignatureData, security: SecurityParameterInfo) => string | Promise<string>;
+}
+/**
+ * Digest authentication credentials
+ */
+export interface DigestAuthCredentials {
+    username: string;
+    password: string;
+    realm?: string;
+    nonce?: string;
+    uri?: string;
+    qop?: string;
+    nc?: string;
+    cnonce?: string;
+    response?: string;
+    opaque?: string;
+}
+/**
+ * Client certificate for mTLS
+ */
+export interface ClientCertificate {
+    /**
+     * Certificate in PEM format
+     */
+    cert: string;
+    /**
+     * Private key in PEM format
+     */
+    key: string;
+    /**
+     * Passphrase for encrypted key
+     */
+    passphrase?: string;
+    /**
+     * CA certificates
+     */
+    ca?: string | string[];
+}
+/**
+ * AWS credentials for Signature V4
+ */
+export interface AWSCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    region?: string;
+    service?: string;
+}
+/**
+ * Data to be signed for signature-based auth
+ */
+export interface SignatureData {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body?: string;
+    timestamp?: number;
+}
+/**
+ * Resolved security parameters ready to be added to HTTP request
+ */
+export interface ResolvedSecurity {
+    /**
+     * Headers to add to the request
+     */
+    headers: Record<string, string>;
+    /**
+     * Query parameters to add to the request
+     */
+    query: Record<string, string>;
+    /**
+     * Cookie values to add to the request
+     */
+    cookies: Record<string, string>;
+    /**
+     * Client certificate for mTLS (if applicable)
+     */
+    clientCertificate?: ClientCertificate;
+    /**
+     * Whether signature-based auth is required
+     * If true, you need to call signRequest() before sending
+     */
+    requiresSignature?: boolean;
+    /**
+     * Signature metadata (if signature-based auth is used)
+     */
+    signatureInfo?: {
+        scheme: string;
+        algorithm?: string;
+    };
+}
+/**
+ * Security resolver that maps OpenAPI security requirements to actual auth values
+ *
+ * This helper handles security parameters from any OpenAPI spec, regardless of
+ * custom naming (BearerAuth, JWT, Authorization, etc.). It uses the mapper's
+ * security metadata to determine the auth type and format.
+ *
+ * @example
+ * ```typescript
+ * // In FrontMCP
+ * const resolver = new SecurityResolver();
+ * const resolved = resolver.resolve(tool.mapper, {
+ *   jwt: context.authInfo.jwt,
+ *   apiKey: process.env.API_KEY
+ * });
+ *
+ * // Use resolved.headers in HTTP request
+ * fetch(url, { headers: { ...resolved.headers, ...otherHeaders } });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Custom resolver for framework-specific auth
+ * const resolved = resolver.resolve(tool.mapper, {
+ *   customResolver: (security) => {
+ *     if (security.type === 'http' && security.httpScheme === 'bearer') {
+ *       return myFramework.getAuthToken();
+ *     }
+ *     return undefined;
+ *   }
+ * });
+ * ```
+ */
+export declare class SecurityResolver {
+    /**
+     * Resolve security parameters from mapper entries
+     *
+     * @param mappers - Parameter mappers from the tool definition
+     * @param context - Security context with auth values or custom resolver
+     * @returns Resolved headers, query params, and cookies with auth applied
+     */
+    resolve(mappers: ParameterMapper[], context: SecurityContext): Promise<ResolvedSecurity>;
+    /**
+     * Check if security scheme requires request signing
+     */
+    private isSignatureBasedAuth;
+    /**
+     * Resolve the actual auth value based on security type
+     */
+    private resolveAuthValue;
+    /**
+     * Resolve HTTP authentication (bearer, basic, digest, etc.)
+     */
+    private resolveHttpAuth;
+    /**
+     * Resolve Bearer token authentication
+     */
+    private resolveBearerAuth;
+    /**
+     * Resolve Basic authentication
+     */
+    private resolveBasicAuth;
+    /**
+     * Resolve Digest authentication
+     */
+    private resolveDigestAuth;
+    /**
+     * Resolve custom HTTP authentication schemes
+     */
+    private resolveCustomHttpScheme;
+    /**
+     * Resolve API key authentication
+     */
+    private resolveApiKey;
+    /**
+     * Resolve OAuth2/OpenID Connect authentication
+     */
+    private resolveOAuth2;
+    /**
+     * Check if any security requirements are missing from context
+     *
+     * @param mappers - Parameter mappers from the tool definition
+     * @param context - Security context with auth values
+     * @returns Array of missing security scheme names
+     */
+    checkMissingSecurity(mappers: ParameterMapper[], context: SecurityContext): Promise<string[]>;
+    /**
+     * Sign a request for signature-based authentication
+     *
+     * Use this when resolved.requiresSignature is true.
+     * This method will call the signatureGenerator from context to sign the request.
+     *
+     * @param mappers - Parameter mappers from the tool definition
+     * @param signatureData - Request data to sign
+     * @param context - Security context with signature generator
+     * @returns Headers with signature added
+     *
+     * @example
+     * ```typescript
+     * const resolved = resolver.resolve(tool.mapper, context);
+     * if (resolved.requiresSignature) {
+     *   const signedHeaders = await resolver.signRequest(
+     *     tool.mapper,
+     *     { method: 'GET', url: 'https://api.example.com/data', headers: resolved.headers },
+     *     context
+     *   );
+     *   // Use signedHeaders in request
+     * }
+     * ```
+     */
+    signRequest(mappers: ParameterMapper[], signatureData: SignatureData, context: SecurityContext): Promise<Record<string, string>>;
+}
+/**
+ * Create a basic security context from common auth sources
+ *
+ * @example
+ * ```typescript
+ * const context = createSecurityContext({
+ *   jwt: process.env.JWT_TOKEN,
+ *   apiKey: process.env.API_KEY
+ * });
+ * ```
+ */
+export declare function createSecurityContext(auth: Partial<SecurityContext>): SecurityContext;

package/src/security-resolver.js

@@ -0,0 +1,324 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityResolver = void 0;
+exports.createSecurityContext = createSecurityContext;
+/**
+ * Security resolver that maps OpenAPI security requirements to actual auth values
+ *
+ * This helper handles security parameters from any OpenAPI spec, regardless of
+ * custom naming (BearerAuth, JWT, Authorization, etc.). It uses the mapper's
+ * security metadata to determine the auth type and format.
+ *
+ * @example
+ * ```typescript
+ * // In FrontMCP
+ * const resolver = new SecurityResolver();
+ * const resolved = resolver.resolve(tool.mapper, {
+ *   jwt: context.authInfo.jwt,
+ *   apiKey: process.env.API_KEY
+ * });
+ *
+ * // Use resolved.headers in HTTP request
+ * fetch(url, { headers: { ...resolved.headers, ...otherHeaders } });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Custom resolver for framework-specific auth
+ * const resolved = resolver.resolve(tool.mapper, {
+ *   customResolver: (security) => {
+ *     if (security.type === 'http' && security.httpScheme === 'bearer') {
+ *       return myFramework.getAuthToken();
+ *     }
+ *     return undefined;
+ *   }
+ * });
+ * ```
+ */
+class SecurityResolver {
+    /**
+     * Resolve security parameters from mapper entries
+     *
+     * @param mappers - Parameter mappers from the tool definition
+     * @param context - Security context with auth values or custom resolver
+     * @returns Resolved headers, query params, and cookies with auth applied
+     */
+    async resolve(mappers, context) {
+        const resolved = {
+            headers: {},
+            query: {},
+            cookies: {},
+        };
+        // Add client certificate if available (for mTLS)
+        if (context.clientCertificate) {
+            resolved.clientCertificate = context.clientCertificate;
+        }
+        // Check if signature-based auth is needed
+        let requiresSignature = false;
+        let signatureScheme;
+        for (const mapper of mappers) {
+            // Skip non-security parameters
+            if (!mapper.security) {
+                continue;
+            }
+            // Check for signature-based auth
+            if (this.isSignatureBasedAuth(mapper.security)) {
+                requiresSignature = true;
+                signatureScheme = mapper.security.scheme;
+                // Signature will be added later by signRequest()
+                continue;
+            }
+            // Try to resolve the auth value
+            const authValue = await this.resolveAuthValue(mapper.security, context);
+            if (!authValue) {
+                // Auth value not available - skip this security requirement
+                // Framework may want to throw an error or log a warning
+                continue;
+            }
+            // Apply to the correct location
+            const headerName = mapper.key;
+            if (mapper.type === 'header') {
+                resolved.headers[headerName] = authValue;
+            }
+            else if (mapper.type === 'query') {
+                resolved.query[headerName] = authValue;
+            }
+            else if (mapper.type === 'cookie') {
+                resolved.cookies[headerName] = authValue;
+            }
+        }
+        // Add context cookies if available
+        if (context.cookies) {
+            resolved.cookies = { ...resolved.cookies, ...context.cookies };
+        }
+        // Add signature metadata if needed
+        if (requiresSignature) {
+            resolved.requiresSignature = true;
+            resolved.signatureInfo = {
+                scheme: signatureScheme || 'unknown',
+            };
+        }
+        return resolved;
+    }
+    /**
+     * Check if security scheme requires request signing
+     */
+    isSignatureBasedAuth(security) {
+        // Check for schemes that typically require signing
+        const signatureSchemes = ['aws4', 'hmac', 'signature', 'hawk', 'custom-signature'];
+        return signatureSchemes.some(scheme => security.scheme.toLowerCase().includes(scheme));
+    }
+    /**
+     * Resolve the actual auth value based on security type
+     */
+    async resolveAuthValue(security, context) {
+        // Try custom resolver first
+        if (context.customResolver) {
+            const customValue = await context.customResolver(security);
+            if (customValue !== undefined) {
+                return customValue;
+            }
+        }
+        // Handle standard security types
+        if (security.type === 'http') {
+            return this.resolveHttpAuth(security, context);
+        }
+        else if (security.type === 'apiKey') {
+            return this.resolveApiKey(security, context);
+        }
+        else if (security.type === 'oauth2' || security.type === 'openIdConnect') {
+            return this.resolveOAuth2(security, context);
+        }
+        return undefined;
+    }
+    /**
+     * Resolve HTTP authentication (bearer, basic, digest, etc.)
+     */
+    resolveHttpAuth(security, context) {
+        const scheme = security.httpScheme?.toLowerCase() || 'bearer';
+        switch (scheme) {
+            case 'bearer':
+                return this.resolveBearerAuth(context);
+            case 'basic':
+                return this.resolveBasicAuth(context);
+            case 'digest':
+                return this.resolveDigestAuth(context);
+            case 'hoba':
+            case 'mutual':
+            case 'negotiate':
+            case 'vapid':
+            case 'scram':
+                // These schemes typically require custom implementation
+                // Try custom headers or signature generator
+                return this.resolveCustomHttpScheme(scheme, security, context);
+            default:
+                // Unknown scheme - try custom resolver
+                return undefined;
+        }
+    }
+    /**
+     * Resolve Bearer token authentication
+     */
+    resolveBearerAuth(context) {
+        const token = context.jwt;
+        if (!token)
+            return undefined;
+        return `Bearer ${token}`;
+    }
+    /**
+     * Resolve Basic authentication
+     */
+    resolveBasicAuth(context) {
+        const credentials = context.basic;
+        if (!credentials)
+            return undefined;
+        return `Basic ${credentials}`;
+    }
+    /**
+     * Resolve Digest authentication
+     */
+    resolveDigestAuth(context) {
+        const digest = context.digest;
+        if (!digest)
+            return undefined;
+        // Build digest auth header
+        const parts = [
+            `username="${digest.username}"`,
+            digest.realm ? `realm="${digest.realm}"` : '',
+            digest.nonce ? `nonce="${digest.nonce}"` : '',
+            digest.uri ? `uri="${digest.uri}"` : '',
+            digest.response ? `response="${digest.response}"` : '',
+            digest.opaque ? `opaque="${digest.opaque}"` : '',
+            digest.qop ? `qop=${digest.qop}` : '',
+            digest.nc ? `nc=${digest.nc}` : '',
+            digest.cnonce ? `cnonce="${digest.cnonce}"` : '',
+        ].filter(Boolean);
+        return `Digest ${parts.join(', ')}`;
+    }
+    /**
+     * Resolve custom HTTP authentication schemes
+     */
+    resolveCustomHttpScheme(scheme, security, context) {
+        // Try custom headers first
+        const headerKey = security.apiKeyName || `X-${scheme.toUpperCase()}`;
+        if (context.customHeaders?.[headerKey]) {
+            return context.customHeaders[headerKey];
+        }
+        // Unknown scheme
+        return undefined;
+    }
+    /**
+     * Resolve API key authentication
+     */
+    resolveApiKey(security, context) {
+        // Try named API keys first (for multiple keys)
+        if (context.apiKeys && security.apiKeyName) {
+            const key = context.apiKeys[security.apiKeyName];
+            if (key)
+                return key;
+        }
+        // Try custom headers (for proprietary auth headers like X-Custom-Auth)
+        if (context.customHeaders && security.apiKeyName) {
+            const header = context.customHeaders[security.apiKeyName];
+            if (header)
+                return header;
+        }
+        // Fall back to single apiKey (backward compatibility)
+        return context.apiKey;
+    }
+    /**
+     * Resolve OAuth2/OpenID Connect authentication
+     */
+    resolveOAuth2(security, context) {
+        const token = context.oauth2Token;
+        if (!token)
+            return undefined;
+        // OAuth2 tokens are typically formatted as "Bearer {token}"
+        return `Bearer ${token}`;
+    }
+    /**
+     * Check if any security requirements are missing from context
+     *
+     * @param mappers - Parameter mappers from the tool definition
+     * @param context - Security context with auth values
+     * @returns Array of missing security scheme names
+     */
+    async checkMissingSecurity(mappers, context) {
+        const missing = [];
+        for (const mapper of mappers) {
+            if (!mapper.security)
+                continue;
+            const authValue = await this.resolveAuthValue(mapper.security, context);
+            if (!authValue) {
+                missing.push(mapper.security.scheme);
+            }
+        }
+        return missing;
+    }
+    /**
+     * Sign a request for signature-based authentication
+     *
+     * Use this when resolved.requiresSignature is true.
+     * This method will call the signatureGenerator from context to sign the request.
+     *
+     * @param mappers - Parameter mappers from the tool definition
+     * @param signatureData - Request data to sign
+     * @param context - Security context with signature generator
+     * @returns Headers with signature added
+     *
+     * @example
+     * ```typescript
+     * const resolved = resolver.resolve(tool.mapper, context);
+     * if (resolved.requiresSignature) {
+     *   const signedHeaders = await resolver.signRequest(
+     *     tool.mapper,
+     *     { method: 'GET', url: 'https://api.example.com/data', headers: resolved.headers },
+     *     context
+     *   );
+     *   // Use signedHeaders in request
+     * }
+     * ```
+     */
+    async signRequest(mappers, signatureData, context) {
+        const headers = { ...signatureData.headers };
+        if (!context.signatureGenerator) {
+            throw new Error('Signature-based auth required but no signatureGenerator provided');
+        }
+        for (const mapper of mappers) {
+            if (!mapper.security || !this.isSignatureBasedAuth(mapper.security)) {
+                continue;
+            }
+            // Call signature generator
+            const signature = await context.signatureGenerator(signatureData, mapper.security);
+            // Add signature to appropriate location
+            if (mapper.type === 'header') {
+                headers[mapper.key] = signature;
+            }
+            // Note: Query/cookie signatures would be handled differently
+        }
+        return headers;
+    }
+}
+exports.SecurityResolver = SecurityResolver;
+/**
+ * Create a basic security context from common auth sources
+ *
+ * @example
+ * ```typescript
+ * const context = createSecurityContext({
+ *   jwt: process.env.JWT_TOKEN,
+ *   apiKey: process.env.API_KEY
+ * });
+ * ```
+ */
+function createSecurityContext(auth) {
+    return {
+        ...auth,
+        jwt: auth.jwt,
+        basic: auth.basic,
+        apiKey: auth.apiKey,
+        oauth2Token: auth.oauth2Token,
+        customResolver: auth.customResolver,
+    };
+}
+//# sourceMappingURL=security-resolver.js.map

package/src/security-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-resolver.js","sourceRoot":"","sources":["../../src/security-resolver.ts"],"names":[],"mappings":";;;AA+iBA,sDAWC;AAxXD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAa,gBAAgB;IAC3B;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,OAA0B,EAAE,OAAwB;QAChE,MAAM,QAAQ,GAAqB;YACjC,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,EAAE;SACZ,CAAC;QAEF,iDAAiD;QACjD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,QAAQ,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACzD,CAAC;QAED,0CAA0C;QAC1C,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,eAAmC,CAAC;QAExC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,+BAA+B;YAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YAED,iCAAiC;YACjC,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/C,iBAAiB,GAAG,IAAI,CAAC;gBACzB,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACzC,iDAAiD;gBACjD,SAAS;YACX,CAAC;YAED,gCAAgC;YAChC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,4DAA4D;gBAC5D,wDAAwD;gBACxD,SAAS;YACX,CAAC;YAED,gCAAgC;YAChC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC;YAE9B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;YAC3C,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;YACzC,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QACjE,CAAC;QAED,mCAAmC;QACnC,IAAI,iBAAiB,EAAE,CAAC;YACtB,QAAQ,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAClC,QAAQ,CAAC,aAAa,GAAG;gBACvB,MAAM,EAAE,eAAe,IAAI,SAAS;aACrC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,QAA+B;QAC1D,mDAAmD;QACnD,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;QACnF,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CACpC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,QAA+B,EAC/B,OAAwB;QAExB,4BAA4B;QAC5B,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,WAAW,CAAC;YACrB,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,QAA+B,EAC/B,OAAwB;QAExB,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,QAAQ,CAAC;QAE9D,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAEzC,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAExC,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAEzC,KAAK,MAAM,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,WAAW,CAAC;YACjB,KAAK,OAAO,CAAC;YACb,KAAK,OAAO;gBACV,wDAAwD;gBACxD,4CAA4C;gBAC5C,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAEjE;gBACE,uCAAuC;gBACvC,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,OAAwB;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,OAAwB;QAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACnC,OAAO,SAAS,WAAW,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,OAAwB;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,2BAA2B;QAC3B,MAAM,KAAK,GAAa;YACtB,aAAa,MAAM,CAAC,QAAQ,GAAG;YAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE;YAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE;YACvC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE;YACtD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE;YAChD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE;YACrC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;YAClC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE;SACjD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElB,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,MAAc,EACd,QAA+B,EAC/B,OAAwB;QAExB,2BAA2B;QAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACrE,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,iBAAiB;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,QAA+B,EAC/B,OAAwB;QAExB,+CAA+C;QAC/C,IAAI,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QAED,uEAAuE;QACvE,IAAI,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC1D,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,sDAAsD;QACtD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,QAA+B,EAC/B,OAAwB;QAExB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAE7B,4DAA4D;QAC5D,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0B,EAC1B,OAAwB;QAExB,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,SAAS;YAE/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,WAAW,CACf,OAA0B,EAC1B,aAA4B,EAC5B,OAAwB;QAExB,MAAM,OAAO,GAA2B,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,CAAC;QAErE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpE,SAAS;YACX,CAAC;YAED,2BAA2B;YAC3B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEnF,wCAAwC;YACxC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;YAClC,CAAC;YACD,6DAA6D;QAC/D,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA/TD,4CA+TC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CACnC,IAA8B;IAE9B,OAAO;QACL,GAAG,IAAI;QACP,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { ParameterMapper, SecurityParameterInfo } from './types';\n\n/**\n * Context for resolving security parameters\n * Frameworks should implement this interface based on their auth system\n */\nexport interface SecurityContext {\n  /**\n   * JWT/Bearer token\n   */\n  jwt?: string;\n\n  /**\n   * Basic auth credentials (base64 encoded \"username:password\")\n   */\n  basic?: string;\n\n  /**\n   * Digest auth credentials\n   * Object with username, password, realm, nonce, etc.\n   */\n  digest?: DigestAuthCredentials;\n\n  /**\n   * API key (single key for backward compatibility)\n   */\n  apiKey?: string;\n\n  /**\n   * Multiple API keys by name\n   * Use this when API requires different keys for different purposes\n   * @example { 'X-API-Key': 'key1', 'X-Client-Id': 'client123' }\n   */\n  apiKeys?: Record<string, string>;\n\n  /**\n   * OAuth2 access token\n   */\n  oauth2Token?: string;\n\n  /**\n   * Client certificate for mutual TLS (mTLS)\n   */\n  clientCertificate?: ClientCertificate;\n\n  /**\n   * Private key for signature-based auth (HMAC, AWS Signature V4, etc.)\n   */\n  privateKey?: string;\n\n  /**\n   * Public key (if needed for verification)\n   */\n  publicKey?: string;\n\n  /**\n   * HMAC secret for HMAC-based authentication\n   */\n  hmacSecret?: string;\n\n  /**\n   * AWS credentials for AWS Signature V4\n   */\n  awsCredentials?: AWSCredentials;\n\n  /**\n   * Custom headers for proprietary authentication\n   * @example { 'X-Custom-Auth': 'custom-value' }\n   */\n  customHeaders?: Record<string, string>;\n\n  /**\n   * Session cookies\n   */\n  cookies?: Record<string, string>;\n\n  /**\n   * Custom resolver for framework-specific auth\n   * @param security - Security parameter info from mapper\n   * @returns The auth value to use, or undefined if not available\n   */\n  customResolver?: (security: SecurityParameterInfo) => string | Promise<string | undefined>;\n\n  /**\n   * Signature generator for signature-based auth\n   * @param data - Data to sign (typically the request)\n   * @param security - Security parameter info\n   * @returns The signature or signed value\n   */\n  signatureGenerator?: (data: SignatureData, security: SecurityParameterInfo) => string | Promise<string>;\n}\n\n/**\n * Digest authentication credentials\n */\nexport interface DigestAuthCredentials {\n  username: string;\n  password: string;\n  realm?: string;\n  nonce?: string;\n  uri?: string;\n  qop?: string;\n  nc?: string;\n  cnonce?: string;\n  response?: string;\n  opaque?: string;\n}\n\n/**\n * Client certificate for mTLS\n */\nexport interface ClientCertificate {\n  /**\n   * Certificate in PEM format\n   */\n  cert: string;\n\n  /**\n   * Private key in PEM format\n   */\n  key: string;\n\n  /**\n   * Passphrase for encrypted key\n   */\n  passphrase?: string;\n\n  /**\n   * CA certificates\n   */\n  ca?: string | string[];\n}\n\n/**\n * AWS credentials for Signature V4\n */\nexport interface AWSCredentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string;\n  region?: string;\n  service?: string;\n}\n\n/**\n * Data to be signed for signature-based auth\n */\nexport interface SignatureData {\n  method: string;\n  url: string;\n  headers: Record<string, string>;\n  body?: string;\n  timestamp?: number;\n}\n\n/**\n * Resolved security parameters ready to be added to HTTP request\n */\nexport interface ResolvedSecurity {\n  /**\n   * Headers to add to the request\n   */\n  headers: Record<string, string>;\n\n  /**\n   * Query parameters to add to the request\n   */\n  query: Record<string, string>;\n\n  /**\n   * Cookie values to add to the request\n   */\n  cookies: Record<string, string>;\n\n  /**\n   * Client certificate for mTLS (if applicable)\n   */\n  clientCertificate?: ClientCertificate;\n\n  /**\n   * Whether signature-based auth is required\n   * If true, you need to call signRequest() before sending\n   */\n  requiresSignature?: boolean;\n\n  /**\n   * Signature metadata (if signature-based auth is used)\n   */\n  signatureInfo?: {\n    scheme: string;\n    algorithm?: string;\n  };\n}\n\n/**\n * Security resolver that maps OpenAPI security requirements to actual auth values\n *\n * This helper handles security parameters from any OpenAPI spec, regardless of\n * custom naming (BearerAuth, JWT, Authorization, etc.). It uses the mapper's\n * security metadata to determine the auth type and format.\n *\n * @example\n * ```typescript\n * // In FrontMCP\n * const resolver = new SecurityResolver();\n * const resolved = resolver.resolve(tool.mapper, {\n *   jwt: context.authInfo.jwt,\n *   apiKey: process.env.API_KEY\n * });\n *\n * // Use resolved.headers in HTTP request\n * fetch(url, { headers: { ...resolved.headers, ...otherHeaders } });\n * ```\n *\n * @example\n * ```typescript\n * // Custom resolver for framework-specific auth\n * const resolved = resolver.resolve(tool.mapper, {\n *   customResolver: (security) => {\n *     if (security.type === 'http' && security.httpScheme === 'bearer') {\n *       return myFramework.getAuthToken();\n *     }\n *     return undefined;\n *   }\n * });\n * ```\n */\nexport class SecurityResolver {\n  /**\n   * Resolve security parameters from mapper entries\n   *\n   * @param mappers - Parameter mappers from the tool definition\n   * @param context - Security context with auth values or custom resolver\n   * @returns Resolved headers, query params, and cookies with auth applied\n   */\n  async resolve(mappers: ParameterMapper[], context: SecurityContext): Promise<ResolvedSecurity> {\n    const resolved: ResolvedSecurity = {\n      headers: {},\n      query: {},\n      cookies: {},\n    };\n\n    // Add client certificate if available (for mTLS)\n    if (context.clientCertificate) {\n      resolved.clientCertificate = context.clientCertificate;\n    }\n\n    // Check if signature-based auth is needed\n    let requiresSignature = false;\n    let signatureScheme: string | undefined;\n\n    for (const mapper of mappers) {\n      // Skip non-security parameters\n      if (!mapper.security) {\n        continue;\n      }\n\n      // Check for signature-based auth\n      if (this.isSignatureBasedAuth(mapper.security)) {\n        requiresSignature = true;\n        signatureScheme = mapper.security.scheme;\n        // Signature will be added later by signRequest()\n        continue;\n      }\n\n      // Try to resolve the auth value\n      const authValue = await this.resolveAuthValue(mapper.security, context);\n      if (!authValue) {\n        // Auth value not available - skip this security requirement\n        // Framework may want to throw an error or log a warning\n        continue;\n      }\n\n      // Apply to the correct location\n      const headerName = mapper.key;\n\n      if (mapper.type === 'header') {\n        resolved.headers[headerName] = authValue;\n      } else if (mapper.type === 'query') {\n        resolved.query[headerName] = authValue;\n      } else if (mapper.type === 'cookie') {\n        resolved.cookies[headerName] = authValue;\n      }\n    }\n\n    // Add context cookies if available\n    if (context.cookies) {\n      resolved.cookies = { ...resolved.cookies, ...context.cookies };\n    }\n\n    // Add signature metadata if needed\n    if (requiresSignature) {\n      resolved.requiresSignature = true;\n      resolved.signatureInfo = {\n        scheme: signatureScheme || 'unknown',\n      };\n    }\n\n    return resolved;\n  }\n\n  /**\n   * Check if security scheme requires request signing\n   */\n  private isSignatureBasedAuth(security: SecurityParameterInfo): boolean {\n    // Check for schemes that typically require signing\n    const signatureSchemes = ['aws4', 'hmac', 'signature', 'hawk', 'custom-signature'];\n    return signatureSchemes.some(scheme =>\n      security.scheme.toLowerCase().includes(scheme)\n    );\n  }\n\n  /**\n   * Resolve the actual auth value based on security type\n   */\n  private async resolveAuthValue(\n    security: SecurityParameterInfo,\n    context: SecurityContext\n  ): Promise<string | undefined> {\n    // Try custom resolver first\n    if (context.customResolver) {\n      const customValue = await context.customResolver(security);\n      if (customValue !== undefined) {\n        return customValue;\n      }\n    }\n\n    // Handle standard security types\n    if (security.type === 'http') {\n      return this.resolveHttpAuth(security, context);\n    } else if (security.type === 'apiKey') {\n      return this.resolveApiKey(security, context);\n    } else if (security.type === 'oauth2' || security.type === 'openIdConnect') {\n      return this.resolveOAuth2(security, context);\n    }\n\n    return undefined;\n  }\n\n  /**\n   * Resolve HTTP authentication (bearer, basic, digest, etc.)\n   */\n  private resolveHttpAuth(\n    security: SecurityParameterInfo,\n    context: SecurityContext\n  ): string | undefined {\n    const scheme = security.httpScheme?.toLowerCase() || 'bearer';\n\n    switch (scheme) {\n      case 'bearer':\n        return this.resolveBearerAuth(context);\n\n      case 'basic':\n        return this.resolveBasicAuth(context);\n\n      case 'digest':\n        return this.resolveDigestAuth(context);\n\n      case 'hoba':\n      case 'mutual':\n      case 'negotiate':\n      case 'vapid':\n      case 'scram':\n        // These schemes typically require custom implementation\n        // Try custom headers or signature generator\n        return this.resolveCustomHttpScheme(scheme, security, context);\n\n      default:\n        // Unknown scheme - try custom resolver\n        return undefined;\n    }\n  }\n\n  /**\n   * Resolve Bearer token authentication\n   */\n  private resolveBearerAuth(context: SecurityContext): string | undefined {\n    const token = context.jwt;\n    if (!token) return undefined;\n    return `Bearer ${token}`;\n  }\n\n  /**\n   * Resolve Basic authentication\n   */\n  private resolveBasicAuth(context: SecurityContext): string | undefined {\n    const credentials = context.basic;\n    if (!credentials) return undefined;\n    return `Basic ${credentials}`;\n  }\n\n  /**\n   * Resolve Digest authentication\n   */\n  private resolveDigestAuth(context: SecurityContext): string | undefined {\n    const digest = context.digest;\n    if (!digest) return undefined;\n\n    // Build digest auth header\n    const parts: string[] = [\n      `username=\"${digest.username}\"`,\n      digest.realm ? `realm=\"${digest.realm}\"` : '',\n      digest.nonce ? `nonce=\"${digest.nonce}\"` : '',\n      digest.uri ? `uri=\"${digest.uri}\"` : '',\n      digest.response ? `response=\"${digest.response}\"` : '',\n      digest.opaque ? `opaque=\"${digest.opaque}\"` : '',\n      digest.qop ? `qop=${digest.qop}` : '',\n      digest.nc ? `nc=${digest.nc}` : '',\n      digest.cnonce ? `cnonce=\"${digest.cnonce}\"` : '',\n    ].filter(Boolean);\n\n    return `Digest ${parts.join(', ')}`;\n  }\n\n  /**\n   * Resolve custom HTTP authentication schemes\n   */\n  private resolveCustomHttpScheme(\n    scheme: string,\n    security: SecurityParameterInfo,\n    context: SecurityContext\n  ): string | undefined {\n    // Try custom headers first\n    const headerKey = security.apiKeyName || `X-${scheme.toUpperCase()}`;\n    if (context.customHeaders?.[headerKey]) {\n      return context.customHeaders[headerKey];\n    }\n\n    // Unknown scheme\n    return undefined;\n  }\n\n  /**\n   * Resolve API key authentication\n   */\n  private resolveApiKey(\n    security: SecurityParameterInfo,\n    context: SecurityContext\n  ): string | undefined {\n    // Try named API keys first (for multiple keys)\n    if (context.apiKeys && security.apiKeyName) {\n      const key = context.apiKeys[security.apiKeyName];\n      if (key) return key;\n    }\n\n    // Try custom headers (for proprietary auth headers like X-Custom-Auth)\n    if (context.customHeaders && security.apiKeyName) {\n      const header = context.customHeaders[security.apiKeyName];\n      if (header) return header;\n    }\n\n    // Fall back to single apiKey (backward compatibility)\n    return context.apiKey;\n  }\n\n  /**\n   * Resolve OAuth2/OpenID Connect authentication\n   */\n  private resolveOAuth2(\n    security: SecurityParameterInfo,\n    context: SecurityContext\n  ): string | undefined {\n    const token = context.oauth2Token;\n    if (!token) return undefined;\n\n    // OAuth2 tokens are typically formatted as \"Bearer {token}\"\n    return `Bearer ${token}`;\n  }\n\n  /**\n   * Check if any security requirements are missing from context\n   *\n   * @param mappers - Parameter mappers from the tool definition\n   * @param context - Security context with auth values\n   * @returns Array of missing security scheme names\n   */\n  async checkMissingSecurity(\n    mappers: ParameterMapper[],\n    context: SecurityContext\n  ): Promise<string[]> {\n    const missing: string[] = [];\n\n    for (const mapper of mappers) {\n      if (!mapper.security) continue;\n\n      const authValue = await this.resolveAuthValue(mapper.security, context);\n      if (!authValue) {\n        missing.push(mapper.security.scheme);\n      }\n    }\n\n    return missing;\n  }\n\n  /**\n   * Sign a request for signature-based authentication\n   *\n   * Use this when resolved.requiresSignature is true.\n   * This method will call the signatureGenerator from context to sign the request.\n   *\n   * @param mappers - Parameter mappers from the tool definition\n   * @param signatureData - Request data to sign\n   * @param context - Security context with signature generator\n   * @returns Headers with signature added\n   *\n   * @example\n   * ```typescript\n   * const resolved = resolver.resolve(tool.mapper, context);\n   * if (resolved.requiresSignature) {\n   *   const signedHeaders = await resolver.signRequest(\n   *     tool.mapper,\n   *     { method: 'GET', url: 'https://api.example.com/data', headers: resolved.headers },\n   *     context\n   *   );\n   *   // Use signedHeaders in request\n   * }\n   * ```\n   */\n  async signRequest(\n    mappers: ParameterMapper[],\n    signatureData: SignatureData,\n    context: SecurityContext\n  ): Promise<Record<string, string>> {\n    const headers: Record<string, string> = { ...signatureData.headers };\n\n    if (!context.signatureGenerator) {\n      throw new Error('Signature-based auth required but no signatureGenerator provided');\n    }\n\n    for (const mapper of mappers) {\n      if (!mapper.security || !this.isSignatureBasedAuth(mapper.security)) {\n        continue;\n      }\n\n      // Call signature generator\n      const signature = await context.signatureGenerator(signatureData, mapper.security);\n\n      // Add signature to appropriate location\n      if (mapper.type === 'header') {\n        headers[mapper.key] = signature;\n      }\n      // Note: Query/cookie signatures would be handled differently\n    }\n\n    return headers;\n  }\n}\n\n/**\n * Create a basic security context from common auth sources\n *\n * @example\n * ```typescript\n * const context = createSecurityContext({\n *   jwt: process.env.JWT_TOKEN,\n *   apiKey: process.env.API_KEY\n * });\n * ```\n */\nexport function createSecurityContext(\n  auth: Partial<SecurityContext>\n): SecurityContext {\n  return {\n    ...auth,\n    jwt: auth.jwt,\n    basic: auth.basic,\n    apiKey: auth.apiKey,\n    oauth2Token: auth.oauth2Token,\n    customResolver: auth.customResolver,\n  };\n}\n"]}