1+ /**
2+ * OAuth provider extensions for specialized authentication flows.
3+ *
4+ * This module provides ready-to-use OAuthClientProvider implementations
5+ * for common machine-to-machine authentication scenarios.
6+ */
7+ import { OAuthClientInformation , OAuthClientMetadata , OAuthTokens } from '../shared/auth.js' ;
8+ import { AddClientAuthentication , OAuthClientProvider } from './auth.js' ;
9+ /**
10+ * Helper to produce a private_key_jwt client authentication function.
11+ *
12+ * Usage:
13+ * const addClientAuth = createPrivateKeyJwtAuth({ issuer, subject, privateKey, alg, audience? });
14+ * // pass addClientAuth as provider.addClientAuthentication implementation
15+ */
16+ export declare function createPrivateKeyJwtAuth ( options : {
17+ issuer : string ;
18+ subject : string ;
19+ privateKey : string | Uint8Array | Record < string , unknown > ;
20+ alg : string ;
21+ audience ?: string | URL ;
22+ lifetimeSeconds ?: number ;
23+ claims ?: Record < string , unknown > ;
24+ } ) : AddClientAuthentication ;
25+ /**
26+ * Options for creating a ClientCredentialsProvider.
27+ */
28+ export interface ClientCredentialsProviderOptions {
29+ /**
30+ * The client_id for this OAuth client.
31+ */
32+ clientId : string ;
33+ /**
34+ * The client_secret for client_secret_basic authentication.
35+ */
36+ clientSecret : string ;
37+ /**
38+ * Optional client name for metadata.
39+ */
40+ clientName ?: string ;
41+ }
42+ /**
43+ * OAuth provider for client_credentials grant with client_secret_basic authentication.
44+ *
45+ * This provider is designed for machine-to-machine authentication where
46+ * the client authenticates using a client_id and client_secret.
47+ *
48+ * @example
49+ * const provider = new ClientCredentialsProvider({
50+ * clientId: 'my-client',
51+ * clientSecret: 'my-secret'
52+ * });
53+ *
54+ * const transport = new StreamableHTTPClientTransport(serverUrl, {
55+ * authProvider: provider
56+ * });
57+ */
58+ export declare class ClientCredentialsProvider implements OAuthClientProvider {
59+ private _tokens ?;
60+ private _clientInfo ;
61+ private _clientMetadata ;
62+ constructor ( options : ClientCredentialsProviderOptions ) ;
63+ get redirectUrl ( ) : undefined ;
64+ get clientMetadata ( ) : OAuthClientMetadata ;
65+ clientInformation ( ) : OAuthClientInformation ;
66+ saveClientInformation ( info : OAuthClientInformation ) : void ;
67+ tokens ( ) : OAuthTokens | undefined ;
68+ saveTokens ( tokens : OAuthTokens ) : void ;
69+ redirectToAuthorization ( ) : void ;
70+ saveCodeVerifier ( ) : void ;
71+ codeVerifier ( ) : string ;
72+ prepareTokenRequest ( scope ?: string ) : URLSearchParams ;
73+ }
74+ /**
75+ * Options for creating a PrivateKeyJwtProvider.
76+ */
77+ export interface PrivateKeyJwtProviderOptions {
78+ /**
79+ * The client_id for this OAuth client.
80+ */
81+ clientId : string ;
82+ /**
83+ * The private key for signing JWT assertions.
84+ * Can be a PEM string, Uint8Array, or JWK object.
85+ */
86+ privateKey : string | Uint8Array | Record < string , unknown > ;
87+ /**
88+ * The algorithm to use for signing (e.g., 'RS256', 'ES256').
89+ */
90+ algorithm : string ;
91+ /**
92+ * Optional client name for metadata.
93+ */
94+ clientName ?: string ;
95+ /**
96+ * Optional JWT lifetime in seconds (default: 300).
97+ */
98+ jwtLifetimeSeconds ?: number ;
99+ }
100+ /**
101+ * OAuth provider for client_credentials grant with private_key_jwt authentication.
102+ *
103+ * This provider is designed for machine-to-machine authentication where
104+ * the client authenticates using a signed JWT assertion (RFC 7523 Section 2.2).
105+ *
106+ * @example
107+ * const provider = new PrivateKeyJwtProvider({
108+ * clientId: 'my-client',
109+ * privateKey: pemEncodedPrivateKey,
110+ * algorithm: 'RS256'
111+ * });
112+ *
113+ * const transport = new StreamableHTTPClientTransport(serverUrl, {
114+ * authProvider: provider
115+ * });
116+ */
117+ export declare class PrivateKeyJwtProvider implements OAuthClientProvider {
118+ private _tokens ?;
119+ private _clientInfo ;
120+ private _clientMetadata ;
121+ addClientAuthentication : AddClientAuthentication ;
122+ constructor ( options : PrivateKeyJwtProviderOptions ) ;
123+ get redirectUrl ( ) : undefined ;
124+ get clientMetadata ( ) : OAuthClientMetadata ;
125+ clientInformation ( ) : OAuthClientInformation ;
126+ saveClientInformation ( info : OAuthClientInformation ) : void ;
127+ tokens ( ) : OAuthTokens | undefined ;
128+ saveTokens ( tokens : OAuthTokens ) : void ;
129+ redirectToAuthorization ( ) : void ;
130+ saveCodeVerifier ( ) : void ;
131+ codeVerifier ( ) : string ;
132+ prepareTokenRequest ( scope ?: string ) : URLSearchParams ;
133+ }
134+ /**
135+ * Options for creating a StaticPrivateKeyJwtProvider.
136+ */
137+ export interface StaticPrivateKeyJwtProviderOptions {
138+ /**
139+ * The client_id for this OAuth client.
140+ */
141+ clientId : string ;
142+ /**
143+ * A pre-built JWT client assertion to use for authentication.
144+ *
145+ * This token should already contain the appropriate claims
146+ * (iss, sub, aud, exp, etc.) and be signed by the client's key.
147+ */
148+ jwtBearerAssertion : string ;
149+ /**
150+ * Optional client name for metadata.
151+ */
152+ clientName ?: string ;
153+ }
154+ /**
155+ * OAuth provider for client_credentials grant with a static private_key_jwt assertion.
156+ *
157+ * This provider mirrors {@link PrivateKeyJwtProvider} but instead of constructing and
158+ * signing a JWT on each request, it accepts a pre-built JWT assertion string and
159+ * uses it directly for authentication.
160+ */
161+ export declare class StaticPrivateKeyJwtProvider implements OAuthClientProvider {
162+ private _tokens ?;
163+ private _clientInfo ;
164+ private _clientMetadata ;
165+ addClientAuthentication : AddClientAuthentication ;
166+ constructor ( options : StaticPrivateKeyJwtProviderOptions ) ;
167+ get redirectUrl ( ) : undefined ;
168+ get clientMetadata ( ) : OAuthClientMetadata ;
169+ clientInformation ( ) : OAuthClientInformation ;
170+ saveClientInformation ( info : OAuthClientInformation ) : void ;
171+ tokens ( ) : OAuthTokens | undefined ;
172+ saveTokens ( tokens : OAuthTokens ) : void ;
173+ redirectToAuthorization ( ) : void ;
174+ saveCodeVerifier ( ) : void ;
175+ codeVerifier ( ) : string ;
176+ prepareTokenRequest ( scope ?: string ) : URLSearchParams ;
177+ }
178+ //# sourceMappingURL=auth-extensions.d.ts.map
0 commit comments