vesper-memory 0.5.2 → 0.5.3

package/dist/middleware 2/auth.d.ts

@@ -1,287 +0,0 @@
-/**
- * MCP Authentication Middleware
- *
- * Implements API key authentication for MCP tools with:
- * - Bearer token authentication
- * - bcrypt password hashing
- * - Key expiration
- * - IP allowlisting
- * - Scope-based authorization
- * - Audit logging
- *
- * Security Features:
- * - Constant-time comparison via bcrypt
- * - No plaintext key storage
- * - Gradual rollout support (AUTH_ENABLED env var)
- * - Rate limit tier enforcement
- */
-/** API key format prefix */
-export declare const API_KEY_PREFIX = "mem_v1_";
-/** Number of random bytes for key generation (30 bytes = 40 chars base64url) */
-export declare const API_KEY_BYTES = 30;
-/** bcrypt work factor (12 = ~250ms on modern hardware) */
-export declare const BCRYPT_ROUNDS = 12;
-/** Default key expiration in days */
-export declare const DEFAULT_KEY_EXPIRATION_DAYS = 90;
-/** Maximum allowed key expiration in days */
-export declare const MAX_KEY_EXPIRATION_DAYS = 365;
-/** Maximum grace period for key rotation in hours */
-export declare const MAX_GRACE_PERIOD_HOURS = 168;
-/** Valid scopes for API keys */
-export declare const VALID_SCOPES: readonly ["store_memory", "retrieve_memory", "list_recent", "get_stats", "*"];
-export type ValidScope = (typeof VALID_SCOPES)[number];
-/** Result of API key generation */
-export interface GeneratedApiKey {
-    fullKey: string;
-    keyPrefix: string;
-    keyHash: string;
-}
-/** API key record from database */
-export interface ApiKeyRecord {
-    id: string;
-    userId: string;
-    keyHash: string;
-    scopes: string[];
-    tier: string;
-    expiresAt: Date | null;
-    ipAllowlist: string[] | null;
-    revokedAt: Date | null;
-    lastUsedAt: Date | null;
-}
-/** Authentication result */
-export interface AuthResult {
-    authenticated: boolean;
-    userId: string;
-    keyId: string;
-    tier: string;
-    scopes: string[];
-}
-/** Audit log actions */
-export declare enum AuditAction {
-    AUTHENTICATE = "authenticate",
-    RATE_LIMITED = "rate_limited",
-    REVOKED = "revoked",
-    ROTATED = "rotated",
-    CREATED = "created",
-    SCOPE_DENIED = "scope_denied",
-    IP_DENIED = "ip_denied",
-    EXPIRED = "expired"
-}
-/** Audit log entry */
-export interface AuditEntry {
-    apiKeyId: string | null;
-    action: AuditAction;
-    success: boolean;
-    ipAddress: string | null;
-    userAgent?: string;
-    requestPath?: string;
-    failureReason?: string;
-    metadata?: Record<string, unknown>;
-    createdAt: Date;
-}
-/** Key rotation result */
-export interface RotationResult {
-    newKey: GeneratedApiKey;
-    gracePeriodHours: number;
-    oldKeyValidUntil: Date;
-}
-/** Request context for authentication */
-export interface AuthRequest {
-    apiKey: string | undefined;
-    ip: string;
-    toolName: string;
-    userAgent?: string;
-}
-/** Database interface for auth operations */
-export interface AuthDatabase {
-    getApiKey(prefix: string): Promise<ApiKeyRecord | null>;
-    updateLastUsed(keyId: string): Promise<void>;
-    createAuditEntry(entry: AuditEntry): Promise<void>;
-}
-/** Rate limits per tier */
-export interface TierRateLimits {
-    store_memory: number;
-    retrieve_memory: number;
-    list_recent: number;
-    get_stats: number;
-}
-/**
- * Generate a new API key with cryptographically secure random bytes
- *
- * @returns Generated key with full key, prefix, and hash
- */
-export declare function generateApiKey(): Promise<GeneratedApiKey>;
-/**
- * Verify an API key against its stored hash
- *
- * Uses bcrypt.compare for constant-time comparison
- *
- * @param providedKey - The API key provided by the client
- * @param storedHash - The bcrypt hash stored in the database
- * @returns true if key is valid
- */
-export declare function verifyApiKey(providedKey: string, storedHash: string): Promise<boolean>;
-/**
- * Validate API key format without database lookup
- *
- * @param key - API key to validate
- * @returns true if format is valid
- */
-export declare function validateApiKeyFormat(key: string): boolean;
-/**
- * Extract the prefix from an API key for database lookup
- *
- * @param key - Full API key
- * @returns 8-character prefix or null if invalid
- */
-export declare function extractKeyPrefix(key: string): string | null;
-/**
- * Check if an API key is expired
- *
- * @param expiresAt - Expiration date (null means never expires)
- * @returns true if key is expired
- */
-export declare function isKeyExpired(expiresAt: Date | null): boolean;
-/**
- * Calculate default expiration date (90 days from now)
- *
- * @returns Expiration date
- */
-export declare function calculateDefaultExpiration(): Date;
-/**
- * Calculate expiration date with custom days (capped at max)
- *
- * @param days - Number of days until expiration
- * @returns Expiration date
- */
-export declare function calculateExpiration(days: number): Date;
-/**
- * Get expiration days from environment or default
- *
- * @returns Number of days for key expiration
- */
-export declare function getExpirationDays(): number;
-/**
- * Check if an IP address is in the allowlist
- *
- * Supports both individual IPs and CIDR notation
- *
- * @param ip - Client IP address
- * @param allowlist - Array of allowed IPs/CIDRs (empty or null allows all)
- * @returns true if IP is allowed
- */
-export declare function isIpAllowed(ip: string, allowlist: string[] | null | undefined): boolean;
-/**
- * Check if user has required scope
- *
- * @param userScopes - Scopes granted to user
- * @param requiredScope - Scope required for operation
- * @returns true if user has scope
- */
-export declare function hasScope(userScopes: string[] | null | undefined, requiredScope: string): boolean;
-/**
- * Rotate an API key with optional grace period
- *
- * @param oldKeyHash - Hash of the old key (unused, for signature compatibility)
- * @param gracePeriodHours - Hours to allow old key (0 = immediate revocation)
- * @returns New key and grace period info
- */
-export declare function rotateApiKey(_oldKeyHash: string, gracePeriodHours: number): Promise<RotationResult>;
-/**
- * Create an audit log entry
- *
- * @param params - Audit entry parameters
- * @returns Audit entry object
- */
-export declare function createAuditEntry(params: {
-    apiKeyId: string | null;
-    action: AuditAction;
-    success: boolean;
-    ipAddress: string | null;
-    userAgent?: string;
-    requestPath?: string;
-    failureReason?: string;
-    metadata?: Record<string, unknown>;
-}): AuditEntry;
-/**
- * Hash an API key for audit logging (never log full key)
- *
- * @param key - Full API key
- * @returns Truncated SHA-256 hash for identification
- */
-export declare function hashForAudit(key: string): string;
-/**
- * Authenticate an MCP request
- *
- * @param request - Request context
- * @param db - Database interface
- * @returns Authentication result
- * @throws Error if authentication fails
- */
-export declare function authenticateRequest(request: AuthRequest, db: AuthDatabase): Promise<AuthResult>;
-/**
- * Check if authentication is enabled
- *
- * @returns true if AUTH_ENABLED=true
- */
-export declare function isAuthEnabled(): boolean;
-/**
- * Get rate limits for a tier
- *
- * @param tier - Rate limit tier
- * @returns Rate limits for the tier
- */
-export declare function getRateLimitsForTier(tier: string): TierRateLimits;
-/**
- * Create an in-memory cache for auth results
- *
- * @param options - Cache configuration
- * @returns Cache object with get/set methods
- */
-export declare function createAuthCache(options: {
-    maxSize: number;
-    ttlSeconds: number;
-}): {
-    get(keyId: string): {
-        userId: string;
-        tier: string;
-    } | null;
-    set(keyId: string, value: {
-        userId: string;
-        tier: string;
-    }): void;
-    /**
-     * Invalidate a specific key from the cache
-     * HIGH-002: Used to immediately invalidate revoked/rotated keys
-     *
-     * @param keyId - The key ID (prefix) to invalidate
-     * @returns true if key was in cache, false otherwise
-     */
-    invalidate(keyId: string): boolean;
-    clear(): void;
-    size(): number;
-};
-/**
- * Type for cache invalidation callback
- */
-export type AuthCache = ReturnType<typeof createAuthCache>;
-/**
- * Revoke an API key and invalidate it from cache
- * HIGH-002: Ensures revoked keys cannot be used even if cached
- *
- * @param keyPrefix - The key prefix to revoke
- * @param cache - The auth cache instance
- * @param reason - Reason for revocation (for audit logging)
- * @returns true if key was invalidated from cache
- */
-export declare function revokeApiKey(keyPrefix: string, cache: AuthCache, reason?: string): boolean;
-/**
- * Invalidate a rotated API key from cache
- * HIGH-002: Ensures old keys cannot be used during rotation
- *
- * @param oldKeyPrefix - The old key prefix being rotated
- * @param cache - The auth cache instance
- * @returns true if old key was invalidated from cache
- */
-export declare function invalidateRotatedKey(oldKeyPrefix: string, cache: AuthCache): boolean;
-//# sourceMappingURL=auth.d.ts.map

package/dist/middleware 2/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,4BAA4B;AAC5B,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC,gFAAgF;AAChF,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,0DAA0D;AAC1D,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,qCAAqC;AACrC,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,6CAA6C;AAC7C,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,gCAAgC;AAChC,eAAO,MAAM,YAAY,+EAMf,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAMvD,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,4BAA4B;AAC5B,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAwB;AACxB,oBAAY,WAAW;IACrB,YAAY,iBAAiB;IAC7B,YAAY,iBAAiB;IAC7B,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED,sBAAsB;AACtB,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,0BAA0B;AAC1B,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,IAAI,CAAC;CACxB;AAED,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACxD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED,2BAA2B;AAC3B,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAaD;;;;GAIG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,CAgB/D;AAMD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAkBzD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM3D;AAMD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAM5D;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAIjD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAS1C;AAMD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GACrC,OAAO,CAgBT;AA+FD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CACtB,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EACvC,aAAa,EAAE,MAAM,GACpB,OAAO,CAWT;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,cAAc,CAAC,CAkBzB;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GAAG,UAAU,CAKb;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAMD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,EAAE,EAAE,YAAY,GACf,OAAO,CAAC,UAAU,CAAC,CAwIrB;AAMD;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AA4BD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAEjE;AAMD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;eAKjE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;eAehD,MAAM,SAAS;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAgBjE;;;;;;OAMG;sBACe,MAAM,GAAG,OAAO;aAIzB,IAAI;YAIL,MAAM;EAIjB;AAMD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,EAChB,MAAM,GAAE,MAA4B,GACnC,OAAO,CAcT;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,SAAS,GACf,OAAO,CAWT"}