Tutorial: Adding Auth0 Integration (Modular)

npm install jsonwebtoken jwks-rsa
npm install --save-dev @types/jsonwebtoken

import {
    IdentityResolver, OperationContext, UserIdentity, AuthenticationError, Logger // Import Logger
} from '@ithena-one/mcp-governance'; // Adjust path if needed
import jwt from 'jsonwebtoken';
import jwksClient, { JwksClient } from 'jwks-rsa';
 
// Interface for constructor options
interface Auth0ResolverConfig {
    auth0Domain: string;
    apiAudience: string;
    logger?: Logger; // Optional logger instance
}
 
export class Auth0IdentityResolver implements IdentityResolver {
    private readonly config: Auth0ResolverConfig;
    private readonly jwksRsaClient: JwksClient;
    private readonly logger: Logger; // Internal logger instance
 
    // Receive configuration via constructor
    constructor(config: Auth0ResolverConfig) {
        if (!config.auth0Domain || !config.apiAudience) {
            throw new Error('Auth0 domain and API audience must be provided.');
        }
        this.config = config;
        // Use provided logger or create a minimal fallback
        this.logger = config.logger || console; // Use console as basic fallback
 
        this.jwksRsaClient = jwksClient({
            jwksUri: `https://${this.config.auth0Domain}/.well-known/jwks.json`,
            cache: true, rateLimit: true,
        });
    }
 
    // Helper to get the signing key
    private getKey(header: jwt.JwtHeader, callback: jwt.SigningKeyCallback): void {
        const log = this.logger; // Use instance logger
        if (!header.kid) {
            log.warn?.('Token KID missing'); // Use optional chaining for fallback logger
            return callback(new Error('Token KID missing'));
        }
        this.jwksRsaClient.getSigningKey(header.kid, (err, key) => {
            if (err) {
                log.error?.('Error fetching signing key from JWKS', err); // Log error
                return callback(err);
            }
            const signingKey = key?.getPublicKey();
            if (!signingKey) {
                log.warn?.('Signing key not found for KID', { kid: header.kid });
                return callback(new Error('Signing key not found'));
            }
            callback(null, signingKey);
        });
    }
 
    async resolveIdentity(opCtx: OperationContext): Promise<UserIdentity | null> {
        // Use the request-scoped logger if available, otherwise use the instance logger
        const scopedLogger = opCtx.logger || this.logger;
        const authHeader = opCtx.transportContext.headers?.['authorization'] || opCtx.transportContext.headers?.['Authorization'];
        const token = Array.isArray(authHeader) ? authHeader[0]?.split(' ')[1] : authHeader?.split(' ')[1];
 
        if (!token) {
            scopedLogger.debug?.('No Bearer token found');
            return null; // Allow anonymous
        }
 
        try {
            const decoded = await new Promise<jwt.JwtPayload | undefined>((resolve, reject) => {
                jwt.verify(token, this.getKey.bind(this), { // Bind 'this' for getKey
                    audience: this.config.apiAudience,
                    issuer: `https://${this.config.auth0Domain}/`,
                    algorithms: ['RS256'],
                }, (err, decodedPayload) => {
                    if (err) { return reject(err); }
                    resolve(decodedPayload as jwt.JwtPayload | undefined);
                });
            });
 
            if (!decoded || !decoded.sub) { throw new Error('Token invalid/missing sub'); }
            scopedLogger.info?.(`Auth0 token validated: ${decoded.sub}`);
            return { id: decoded.sub, claims: decoded, source: 'auth0' };
        } catch (error: any) {
            scopedLogger.error?.('Auth0 token validation failed', { error: error.message, name: error.name });
            throw new AuthenticationError(`Auth0 validation failed: ${error.message}`, { originalError: error.name });
        }
    }
}

import {
    RoleStore, UserIdentity, OperationContext, Logger // Import Logger
} from '@ithena-one/mcp-governance'; // Adjust path if needed
 
// Interface for constructor options
interface Auth0RoleStoreConfig {
    rolesClaim: string;
    logger?: Logger; // Optional logger
}
 
export class Auth0RoleStore implements RoleStore {
    private readonly config: Auth0RoleStoreConfig;
    private readonly logger: Logger;
 
    constructor(config: Auth0RoleStoreConfig) {
        if (!config.rolesClaim) {
            throw new Error('Auth0 roles claim name must be provided.');
        }
        this.config = config;
        this.logger = config.logger || console; // Use console fallback
    }
 
    async getRoles(identity: UserIdentity, opCtx: OperationContext): Promise<string[]> {
        const scopedLogger = opCtx.logger || this.logger; // Use request or instance logger
 
        if (typeof identity === 'object' && identity !== null && identity.source === 'auth0' && identity.claims) {
            const claims = identity.claims as Record<string, any>;
            const roles = claims[this.config.rolesClaim]; // Use configured claim name
 
            if (Array.isArray(roles) && roles.every(r => typeof r === 'string')) {
                scopedLogger.debug?.(`Extracted Auth0 roles from claim '${this.config.rolesClaim}'`, { roles });
                return roles;
            } else {
                scopedLogger.debug?.(`Roles claim '${this.config.rolesClaim}' not found or not a string array`, { claims: Object.keys(claims) });
            }
        } else {
            scopedLogger.debug?.('Cannot extract Auth0 roles: Invalid identity object');
        }
        return [];
    }
}