codecrucible-synth/dist/core/security/oauth-resource-server.d.ts

Production-Ready AI Development Platform with Multi-Voice Synthesis, Smithery MCP Integration, Enterprise Security, and Zero-Timeout Reliability

/**
 * OAuth Resource Server for MCP Security (2024 Standards)
 * Implements RFC 6749 OAuth 2.0 and RFC 8707 Resource Indicators
 *
 * Based on 2024 MCP security research:
 * - OAuth Resource Server classification required for all MCP servers
 * - Resource Indicators (RFC 8707) provide fine-grained access control
 * - JWT validation with JWKS endpoint for scalable token verification
 * - Bearer token authentication with proper scope validation
 */
import { EventEmitter } from 'events';
export interface OAuthConfig {
    issuer: string;
    jwksUri: string;
    audience: string;
    requiredScopes: string[];
    resourceIndicators: string[];
    tokenValidation: {
        enabled: boolean;
        clockTolerance: number;
        maxAge: number;
        algorithms: string[];
    };
    caching: {
        jwksCache: boolean;
        jwksCacheTtl: number;
        tokenCache: boolean;
        tokenCacheTtl: number;
    };
}
export interface TokenClaims {
    iss: string;
    sub: string;
    aud: string | string[];
    exp: number;
    iat: number;
    nbf?: number;
    jti?: string;
    scope?: string;
    resource?: string | string[];
    client_id?: string;
    username?: string;
    roles?: string[];
}
export interface ValidationResult {
    valid: boolean;
    claims?: TokenClaims;
    scopes: string[];
    resourceIndicators: string[];
    error?: string;
    errorDescription?: string;
}
export interface JWK {
    kty: string;
    use?: string;
    alg?: string;
    kid?: string;
    n?: string;
    e?: string;
    x?: string;
    y?: string;
    crv?: string;
    k?: string;
}
export interface JWKS {
    keys: JWK[];
}
export declare class OAuthResourceServer extends EventEmitter {
    private config;
    private jwksCache;
    private tokenCache;
    private cleanupInterval;
    constructor(config: OAuthConfig);
    /**
     * Validate OAuth Bearer token according to 2024 MCP standards
     */
    validateBearerToken(authorizationHeader: string): Promise<ValidationResult>;
    /**
     * Extract Bearer token from Authorization header
     */
    private extractBearerToken;
    /**
     * Validate JWT token with comprehensive checks
     */
    private validateJWT;
    /**
     * Validate JWT signature using JWKS
     */
    private validateSignature;
    /**
     * Get signing key from JWKS endpoint
     */
    private getSigningKey;
    /**
     * Fetch JWKS from the configured endpoint
     */
    private fetchJWKS;
    /**
     * Convert JWK to Node.js crypto key
     */
    private jwkToCryptoKey;
    /**
     * Extract OAuth scopes from token claims
     */
    private extractScopes;
    /**
     * Validate required OAuth scopes
     */
    private validateScopes;
    /**
     * Extract resource indicators from token claims (RFC 8707)
     */
    private extractResourceIndicators;
    /**
     * Validate resource indicators (RFC 8707)
     */
    private validateResourceIndicators;
    /**
     * Decode base64url without padding
     */
    private decodeBase64Url;
    /**
     * Decode base64url to buffer
     */
    private decodeBase64UrlToBuffer;
    /**
     * Start cache cleanup interval
     */
    private startCacheCleanup;
    /**
     * Clean up expired cache entries
     */
    private cleanupExpiredEntries;
    /**
     * Get OAuth server metrics
     */
    getMetrics(): {
        jwksCacheSize: number;
        tokenCacheSize: number;
        cacheHitRate: number;
        validationCount: number;
        errorCount: number;
    };
    /**
     * Shutdown OAuth Resource Server
     */
    shutdown(): void;
}
export declare const defaultOAuthConfig: OAuthConfig;
//# sourceMappingURL=oauth-resource-server.d.ts.map