@_mustachio/openauth 0.10.0 → 0.12.0

package/dist/esm/methods/saml-sp/factory.js

@@ -0,0 +1,70 @@
+// src/methods/saml-sp/factory.ts
+import { z } from "zod";
+import { buildSamlSpMethod } from "./method";
+var attributeRefSchema = z.union([
+  z.object({ source: z.literal("nameId") }),
+  z.object({
+    source: z.literal("attribute"),
+    name: z.string().min(1),
+    format: z.string().optional()
+  })
+]);
+var attributeMappingSchema = z.object({
+  subject: attributeRefSchema.optional(),
+  email: attributeRefSchema.optional(),
+  emailVerified: z.object({ source: z.literal("literal"), value: z.boolean() }).optional(),
+  name: attributeRefSchema.optional(),
+  groups: attributeRefSchema.optional(),
+  custom: z.record(attributeRefSchema).optional()
+});
+var signingCertSchema = z.object({
+  pem: z.string().min(1),
+  notBefore: z.number().optional(),
+  notAfter: z.number().optional()
+});
+var idpSchema = z.object({
+  entityId: z.string().min(1),
+  ssoUrl: z.string().url(),
+  sloUrl: z.string().url().optional(),
+  nameIdFormat: z.enum(["persistent", "transient", "emailAddress", "unspecified"]).optional(),
+  signingCerts: z.array(signingCertSchema).min(1)
+});
+var idpInitiatedSchema = z.object({
+  defaultClientId: z.string().min(1),
+  defaultRedirectUri: z.string().url(),
+  defaultScopes: z.array(z.string()).optional()
+});
+var samlSpConfigSchema = z.object({
+  idp: idpSchema,
+  attributeMapping: attributeMappingSchema,
+  signAuthnRequest: z.boolean().optional(),
+  signingKey: z.object({
+    privateKeyPem: z.string().min(1),
+    certPem: z.string().min(1)
+  }).optional(),
+  allowEncryptedAssertions: z.boolean().optional(),
+  decryptionKey: z.object({
+    privateKeyPem: z.string().min(1),
+    certPem: z.string().min(1)
+  }).optional(),
+  idpInitiated: idpInitiatedSchema.optional(),
+  clockSkewSeconds: z.number().int().nonnegative().optional()
+}).refine((c) => !c.signAuthnRequest || c.signingKey !== undefined, {
+  message: "signingKey is required when signAuthnRequest is true",
+  path: ["signingKey"]
+}).refine((c) => !c.allowEncryptedAssertions || c.decryptionKey !== undefined, {
+  message: "decryptionKey is required when allowEncryptedAssertions is true",
+  path: ["decryptionKey"]
+});
+var samlSpFactory = {
+  kind: "saml-sp",
+  configSchema: samlSpConfigSchema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildSamlSpMethod(id, kind, config)
+};
+export {
+  samlSpFactory
+};

package/dist/esm/methods/saml-sp/index.js

@@ -0,0 +1,7 @@
+// src/methods/saml-sp/index.ts
+import { samlSpFactory } from "./factory";
+import { parseSamlIdpMetadata } from "./parse-idp-metadata";
+export {
+  parseSamlIdpMetadata,
+  samlSpFactory
+};

package/dist/esm/methods/saml-sp/metadata.js

@@ -0,0 +1,69 @@
+// src/methods/saml-sp/metadata.ts
+import { authError } from "../../types/error";
+import { deriveSpEntityId } from "./saml-instance";
+var NAME_ID_FORMAT_URN = {
+  persistent: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
+  transient: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+  emailAddress: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+  unspecified: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
+};
+var HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+var HTTP_REDIRECT = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
+function xmlEscape(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function certBody(pem) {
+  return pem.replace(/-----BEGIN CERTIFICATE-----/g, "").replace(/-----END CERTIFICATE-----/g, "").replace(/\s+/g, "");
+}
+function buildSpMetadataXml(input) {
+  const entityId = xmlEscape(input.spEntityId);
+  const acs = xmlEscape(input.acsUrl);
+  const signed = input.signingCertPem !== undefined;
+  const nameIdLine = input.nameIdFormat !== undefined ? `
+    <md:NameIDFormat>${NAME_ID_FORMAT_URN[input.nameIdFormat]}</md:NameIDFormat>` : "";
+  const x509 = (cert) => `<ds:KeyInfo><ds:X509Data><ds:X509Certificate>` + certBody(cert) + `</ds:X509Certificate></ds:X509Data></ds:KeyInfo>`;
+  const keyDescriptor = (signed ? `
+    <md:KeyDescriptor use="signing">` + x509(input.signingCertPem) + `</md:KeyDescriptor>` : "") + (input.encryptionCertPem !== undefined ? `
+    <md:KeyDescriptor use="encryption">` + x509(input.encryptionCertPem) + `</md:KeyDescriptor>` : "");
+  const sls = input.slsUrl !== undefined ? `
+    <md:SingleLogoutService ` + `Binding="${HTTP_REDIRECT}" Location="${xmlEscape(input.slsUrl)}"/>` + `
+    <md:SingleLogoutService ` + `Binding="${HTTP_POST}" Location="${xmlEscape(input.slsUrl)}"/>` : "";
+  return `<?xml version="1.0" encoding="UTF-8"?>
+` + `<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ` + `xmlns:ds="http://www.w3.org/2000/09/xmldsig#" ` + `entityID="${entityId}">
+` + `  <md:SPSSODescriptor AuthnRequestsSigned="${signed}" ` + `WantAssertionsSigned="true" ` + `protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">` + keyDescriptor + sls + nameIdLine + `
+    <md:AssertionConsumerService ` + `Binding="${HTTP_POST}" Location="${acs}" index="0" isDefault="true"/>` + `
+  </md:SPSSODescriptor>
+` + `</md:EntityDescriptor>
+`;
+}
+async function buildSpMetadata(ctx, methodId, config) {
+  if (!ctx.dispatch) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: metadata route dispatched without issuer context " + "(ctx.dispatch is null)")
+    };
+  }
+  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  const cb = new URL(ctx.dispatch.callbackUrl);
+  const slsUrl = `${cb.protocol}//${cb.host}/m/${methodId}/sls`;
+  const xml = buildSpMetadataXml({
+    spEntityId,
+    acsUrl: ctx.dispatch.callbackUrl,
+    ...config.idp.sloUrl ? { slsUrl } : {},
+    ...config.idp.nameIdFormat !== undefined ? { nameIdFormat: config.idp.nameIdFormat } : {},
+    ...config.signAuthnRequest && config.signingKey ? { signingCertPem: config.signingKey.certPem } : {},
+    ...config.allowEncryptedAssertions && config.decryptionKey ? { encryptionCertPem: config.decryptionKey.certPem } : {}
+  });
+  return {
+    kind: "challenge",
+    response: new Response(xml, {
+      status: 200,
+      headers: { "content-type": "application/samlmetadata+xml" }
+    }),
+    cache: { sMaxAge: 300 }
+  };
+}
+export {
+  buildSpMetadata,
+  buildSpMetadataXml
+};

package/dist/esm/methods/saml-sp/method.js

@@ -0,0 +1,29 @@
+// src/methods/saml-sp/method.ts
+import { consumeAssertion } from "./acs";
+import { buildAuthnRequestRedirect } from "./authnrequest";
+import { buildSpMetadata } from "./metadata";
+import { consumeSls } from "./sls";
+import { initiateSpLogout } from "./slo-initiate";
+function buildSamlSpMethod(id, kind, config) {
+  return {
+    id,
+    kind,
+    type: "custom",
+    routes: {
+      "GET /authorize": (ctx) => buildAuthnRequestRedirect(ctx, id, config),
+      "GET /callback": (ctx) => consumeAssertion(ctx, id, config),
+      "GET /metadata": (ctx) => buildSpMetadata(ctx, id, config),
+      "GET /sls": (ctx) => consumeSls(ctx, id, config),
+      "POST /sls": (ctx) => consumeSls(ctx, id, config),
+      "POST /logout": (ctx) => initiateSpLogout(ctx, id, config)
+    },
+    publicRoutes: [
+      "GET /metadata",
+      ...config.idp.sloUrl ? ["GET /sls", "POST /sls", "POST /logout"] : []
+    ],
+    unsolicitedCallback: config.idpInitiated !== undefined
+  };
+}
+export {
+  buildSamlSpMethod
+};

package/dist/esm/methods/saml-sp/parse-idp-metadata.js

@@ -0,0 +1,102 @@
+// src/methods/saml-sp/parse-idp-metadata.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+import xmldom from "@xmldom/xmldom";
+var { DOMParser } = xmldom;
+var HTTP_REDIRECT = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
+var HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+var NAME_ID_FORMAT_BY_URN = {
+  "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent": "persistent",
+  "urn:oasis:names:tc:SAML:2.0:nameid-format:transient": "transient",
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress": "emailAddress",
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified": "unspecified"
+};
+function els(root, localName) {
+  const list = root.getElementsByTagNameNS("*", localName);
+  const out = [];
+  for (let i = 0;i < list.length; i++) {
+    const n = list[i];
+    if (n)
+      out.push(n);
+  }
+  return out;
+}
+function pickEndpoint(endpoints) {
+  if (endpoints.length === 0)
+    return;
+  const byBinding = (b) => endpoints.find((e) => e.getAttribute("Binding") === b);
+  const chosen = byBinding(HTTP_REDIRECT) ?? byBinding(HTTP_POST) ?? endpoints[0];
+  const loc = chosen?.getAttribute("Location");
+  return loc && loc.length > 0 ? loc : undefined;
+}
+function toPem(rawX509) {
+  const b64 = rawX509.replace(/\s+/g, "");
+  const lines = b64.match(/.{1,64}/g) ?? [b64];
+  return `-----BEGIN CERTIFICATE-----
+` + lines.join(`
+`) + `
+-----END CERTIFICATE-----`;
+}
+function parseSamlIdpMetadata(xml) {
+  if (typeof xml !== "string" || xml.trim().length === 0) {
+    return err(authError.invalidRequest("metadata XML is empty"));
+  }
+  let doc;
+  try {
+    doc = new DOMParser().parseFromString(xml, "text/xml");
+  } catch (e) {
+    return err(authError.invalidRequest(`metadata XML is not well-formed: ${e instanceof Error ? e.message : String(e)}`));
+  }
+  if (!doc?.documentElement) {
+    return err(authError.invalidRequest("metadata XML has no root element"));
+  }
+  const entityDescriptor = els(doc, "EntityDescriptor")[0];
+  if (!entityDescriptor) {
+    return err(authError.invalidRequest("metadata has no <EntityDescriptor>"));
+  }
+  const entityId = entityDescriptor.getAttribute("entityID");
+  if (!entityId) {
+    return err(authError.invalidRequest("EntityDescriptor has no entityID"));
+  }
+  const idp = els(entityDescriptor, "IDPSSODescriptor")[0];
+  if (!idp) {
+    return err(authError.invalidRequest("not an IdP metadata document (no <IDPSSODescriptor>) — this looks " + "like SP metadata"));
+  }
+  const ssoUrl = pickEndpoint(els(idp, "SingleSignOnService"));
+  if (!ssoUrl) {
+    return err(authError.invalidRequest("IDPSSODescriptor has no usable <SingleSignOnService> Location"));
+  }
+  const sloUrl = pickEndpoint(els(idp, "SingleLogoutService"));
+  let nameIdFormat;
+  for (const f of els(idp, "NameIDFormat")) {
+    const mapped = NAME_ID_FORMAT_BY_URN[(f.textContent ?? "").trim()];
+    if (mapped) {
+      nameIdFormat = mapped;
+      break;
+    }
+  }
+  const signingCerts = [];
+  for (const kd of els(idp, "KeyDescriptor")) {
+    const use = kd.getAttribute("use");
+    if (use && use !== "signing")
+      continue;
+    for (const cert of els(kd, "X509Certificate")) {
+      const body = (cert.textContent ?? "").trim();
+      if (body.length > 0)
+        signingCerts.push({ pem: toPem(body) });
+    }
+  }
+  if (signingCerts.length === 0) {
+    return err(authError.invalidRequest("IDPSSODescriptor has no signing <X509Certificate>"));
+  }
+  return ok({
+    entityId,
+    ssoUrl,
+    ...sloUrl !== undefined ? { sloUrl } : {},
+    ...nameIdFormat !== undefined ? { nameIdFormat } : {},
+    signingCerts
+  });
+}
+export {
+  parseSamlIdpMetadata
+};

package/dist/esm/methods/saml-sp/saml-instance.js

@@ -0,0 +1,49 @@
+// src/methods/saml-sp/saml-instance.ts
+import nodeSaml from "@node-saml/node-saml";
+import { methodScratchCacheProvider } from "./cache-provider";
+import { selectActiveCertPems } from "./cert-rotation";
+var { SAML, ValidateInResponseTo } = nodeSaml;
+var NAME_ID_FORMAT_URN = {
+  persistent: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
+  transient: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+  emailAddress: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+  unspecified: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
+};
+var IN_RESPONSE_TO_TTL_MS = 60 * 60 * 1000;
+function deriveSpEntityId(issuerUrl, tenantId, methodId) {
+  const base = issuerUrl.endsWith("/") ? issuerUrl.slice(0, -1) : issuerUrl;
+  return `${base}/${tenantId}/${methodId}`;
+}
+function buildSamlInstance(config, binding, nowMs) {
+  const activeCerts = selectActiveCertPems(config.idp.signingCerts, nowMs);
+  if (activeCerts.length === 0) {
+    throw new Error("saml-sp: no IdP signing certificate is currently within its " + "validity window — check SamlSpConfig.idp.signingCerts notBefore/notAfter.");
+  }
+  const identifierFormat = config.idp.nameIdFormat !== undefined ? NAME_ID_FORMAT_URN[config.idp.nameIdFormat] : null;
+  return new SAML({
+    idpCert: activeCerts,
+    issuer: binding.spEntityId,
+    callbackUrl: binding.acsUrl,
+    entryPoint: config.idp.ssoUrl,
+    idpIssuer: config.idp.entityId,
+    audience: binding.spEntityId,
+    identifierFormat,
+    validateInResponseTo: binding.logout ? ValidateInResponseTo.never : binding.idpInitiated ? ValidateInResponseTo.ifPresent : ValidateInResponseTo.always,
+    wantAssertionsSigned: true,
+    wantAuthnResponseSigned: false,
+    acceptedClockSkewMs: (config.clockSkewSeconds ?? 60) * 1000,
+    cacheProvider: methodScratchCacheProvider(binding.scratch, IN_RESPONSE_TO_TTL_MS),
+    ...binding.signing ? {
+      privateKey: binding.signing.privateKeyPem,
+      publicCert: binding.signing.certPem,
+      signatureAlgorithm: "sha256"
+    } : {},
+    ...binding.logoutUrl ? { logoutUrl: binding.logoutUrl } : {},
+    ...binding.decryptionPvk ? { decryptionPvk: binding.decryptionPvk } : {}
+  });
+}
+export {
+  NAME_ID_FORMAT_URN,
+  buildSamlInstance,
+  deriveSpEntityId
+};

package/dist/esm/methods/saml-sp/slo-initiate.js

@@ -0,0 +1,84 @@
+// src/methods/saml-sp/slo-initiate.ts
+import { authError } from "../../types/error";
+import {
+  buildSamlInstance,
+  deriveSpEntityId,
+  NAME_ID_FORMAT_URN
+} from "./saml-instance";
+async function initiateSpLogout(ctx, methodId, config) {
+  if (!ctx.dispatch) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /logout dispatched without issuer context (ctx.dispatch is null)")
+    };
+  }
+  if (!config.idp.sloUrl) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /logout reached with no idp.sloUrl configured")
+    };
+  }
+  let nameId;
+  let sessionIndex;
+  let relayState;
+  let nameIdFormatParam;
+  try {
+    const form = new URLSearchParams(await ctx.request.text());
+    nameId = form.get("nameId");
+    sessionIndex = form.get("sessionIndex");
+    relayState = form.get("relayState");
+    nameIdFormatParam = form.get("nameIdFormat");
+  } catch {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /logout could not read POST body")
+    };
+  }
+  if (!nameId) {
+    return { kind: "denied", reason: "missing nameId" };
+  }
+  if (nameIdFormatParam !== null && !(nameIdFormatParam in NAME_ID_FORMAT_URN)) {
+    return {
+      kind: "denied",
+      reason: `unrecognized nameIdFormat "${nameIdFormatParam}" — expected one ` + `of: ${Object.keys(NAME_ID_FORMAT_URN).join(", ")}`
+    };
+  }
+  const nameIDFormat = nameIdFormatParam !== null ? NAME_ID_FORMAT_URN[nameIdFormatParam] : config.idp.nameIdFormat !== undefined ? NAME_ID_FORMAT_URN[config.idp.nameIdFormat] : NAME_ID_FORMAT_URN.persistent;
+  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  let redirectUrl;
+  try {
+    const saml = buildSamlInstance(config, {
+      spEntityId,
+      acsUrl: ctx.dispatch.callbackUrl,
+      scratch: ctx.methodScratch,
+      logoutUrl: config.idp.sloUrl,
+      logout: true,
+      ...config.signingKey ? {
+        signing: {
+          privateKeyPem: config.signingKey.privateKeyPem,
+          certPem: config.signingKey.certPem
+        }
+      } : {}
+    }, Date.now());
+    redirectUrl = await saml.getLogoutUrlAsync({
+      nameID: nameId,
+      nameIDFormat,
+      ...sessionIndex !== null ? { sessionIndex } : {}
+    }, relayState ?? "", {});
+  } catch (e) {
+    return {
+      kind: "error",
+      error: authError.internalError(`saml-sp: failed to build LogoutRequest: ${e instanceof Error ? e.message : String(e)}`, e)
+    };
+  }
+  return {
+    kind: "challenge",
+    response: new Response(null, {
+      status: 302,
+      headers: { location: redirectUrl }
+    })
+  };
+}
+export {
+  initiateSpLogout
+};

package/dist/esm/methods/saml-sp/sls.js

@@ -0,0 +1,154 @@
+// src/methods/saml-sp/sls.ts
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { buildSamlInstance, deriveSpEntityId } from "./saml-instance";
+var SLO_REPLAY_HORIZON_MS = 10 * 60000;
+async function consumeSls(ctx, methodId, config) {
+  if (!ctx.dispatch) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /sls dispatched without issuer context (ctx.dispatch is null)")
+    };
+  }
+  if (!config.idp.sloUrl) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /sls reached with no idp.sloUrl configured")
+    };
+  }
+  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  const url = new URL(ctx.request.url);
+  const originalQuery = url.search.replace(/^\?/, "");
+  let samlRequest;
+  let samlResponse;
+  let relayState;
+  const isPost = ctx.request.method.toUpperCase() === "POST";
+  let postForm = null;
+  try {
+    if (isPost) {
+      postForm = new URLSearchParams(await ctx.request.text());
+      samlRequest = postForm.get("SAMLRequest");
+      samlResponse = postForm.get("SAMLResponse");
+      relayState = postForm.get("RelayState");
+    } else {
+      samlRequest = url.searchParams.get("SAMLRequest");
+      samlResponse = url.searchParams.get("SAMLResponse");
+      relayState = url.searchParams.get("RelayState");
+    }
+  } catch {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /sls could not read request")
+    };
+  }
+  if (!samlRequest && !samlResponse) {
+    return { kind: "denied", reason: "missing SAMLRequest / SAMLResponse" };
+  }
+  let saml;
+  try {
+    saml = buildSamlInstance(config, {
+      spEntityId,
+      acsUrl: ctx.dispatch.callbackUrl,
+      scratch: ctx.methodScratch,
+      logoutUrl: config.idp.sloUrl,
+      logout: true,
+      ...config.signingKey ? {
+        signing: {
+          privateKeyPem: config.signingKey.privateKeyPem,
+          certPem: config.signingKey.certPem
+        }
+      } : {}
+    }, Date.now());
+  } catch (e) {
+    return {
+      kind: "error",
+      error: authError.internalError(`saml-sp: cannot construct logout verifier: ${e instanceof Error ? e.message : String(e)}`, e)
+    };
+  }
+  if (samlRequest) {
+    let profile;
+    try {
+      const res = isPost ? await saml.validatePostRequestAsync({
+        SAMLRequest: samlRequest,
+        ...relayState !== null ? { RelayState: relayState } : {}
+      }) : await saml.validateRedirectAsync(Object.fromEntries(url.searchParams), originalQuery);
+      profile = res.profile;
+    } catch (e) {
+      return {
+        kind: "denied",
+        reason: `logout request rejected: ${e instanceof Error ? e.message : String(e)}`
+      };
+    }
+    if (!profile) {
+      return { kind: "denied", reason: "logout request produced no profile" };
+    }
+    if (!profile.ID) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: LogoutRequest carries no @ID — front-channel replay " + "protection cannot be established. Refusing to process.")
+      };
+    }
+    {
+      const key = `slo-replay:${profile.ID}`;
+      const seen = await ctx.methodScratch.get(key);
+      if (seen.ok) {
+        return {
+          kind: "denied",
+          reason: "logout request replay detected (request ID already seen)"
+        };
+      }
+      const recorded = await ctx.methodScratch.put(key, "1", SLO_REPLAY_HORIZON_MS);
+      if (isErr(recorded)) {
+        return {
+          kind: "error",
+          error: authError.internalError("saml-sp: could not record LogoutRequest ID for replay protection")
+        };
+      }
+    }
+    let logoutResponseUrl;
+    try {
+      logoutResponseUrl = await saml.getLogoutResponseUrlAsync(profile, relayState ?? "", {}, true);
+    } catch (e) {
+      return {
+        kind: "error",
+        error: authError.internalError(`saml-sp: failed to build LogoutResponse: ${e instanceof Error ? e.message : String(e)}`, e)
+      };
+    }
+    return {
+      kind: "challenge",
+      response: new Response(null, {
+        status: 302,
+        headers: { location: logoutResponseUrl }
+      }),
+      logout: {
+        ...profile.nameID !== undefined ? { nameId: profile.nameID } : {},
+        ...profile.sessionIndex !== undefined ? { sessionIndex: profile.sessionIndex } : {}
+      }
+    };
+  }
+  try {
+    if (isPost) {
+      await saml.validatePostResponseAsync({
+        SAMLResponse: samlResponse,
+        ...relayState !== null ? { RelayState: relayState } : {}
+      });
+    } else {
+      await saml.validateRedirectAsync(Object.fromEntries(url.searchParams), originalQuery);
+    }
+  } catch (e) {
+    return {
+      kind: "denied",
+      reason: `logout response rejected: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  return {
+    kind: "challenge",
+    response: new Response("Logged out.", {
+      status: 200,
+      headers: { "content-type": "text/plain" }
+    })
+  };
+}
+export {
+  consumeSls
+};

package/dist/esm/types/error.js

@@ -58,6 +58,11 @@ var authError = {
     code: "internal_error",
     description,
     ...cause !== undefined ? { cause } : {}
+  }),
+  invalidDpopProof: (description, replaySignal) => ({
+    code: "invalid_dpop_proof",
+    description,
+    ...replaySignal !== undefined ? { replaySignal } : {}
   })
 };
 export {

package/dist/esm/types/result.js

@@ -4,8 +4,8 @@ var err = (error) => ({ ok: false, error });
 var isOk = (r) => r.ok === true;
 var isErr = (r) => r.ok === false;
 export {
-  ok,
-  isOk,
+  err,
   isErr,
-  err
+  isOk,
+  ok
 };

package/dist/esm/ui/forms.js

@@ -246,8 +246,8 @@ function renderForm(opts) {
   });
 }
 export {
-  renderForm,
-  htmlPage,
+  BASE_STYLES,
   escapeHtml,
-  BASE_STYLES
+  htmlPage,
+  renderForm
 };

package/dist/esm/ui/index.js

@@ -1,8 +1,11 @@
+// src/ui/index.ts
+import { renderForm, escapeHtml, htmlPage, BASE_STYLES } from "./forms";
+import { renderPicker, buildMethodLink } from "./picker";
 export {
-  renderPicker,
-  renderForm,
-  htmlPage,
-  escapeHtml,
+  BASE_STYLES,
   buildMethodLink,
-  BASE_STYLES
+  escapeHtml,
+  htmlPage,
+  renderForm,
+  renderPicker
 };

package/dist/esm/ui/picker.js

@@ -44,6 +44,6 @@ function prettyKind(kind) {
   return kind.split(/[-_]/).map((p) => p.length === 0 ? p : p[0].toUpperCase() + p.slice(1)).join(" ");
 }
 export {
-  renderPicker,
-  buildMethodLink
+  buildMethodLink,
+  renderPicker
 };

package/dist/types/adapters/d1/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,eAAO,MAAM,kBAAkB,UAkE9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9D"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,eAAO,MAAM,kBAAkB,UAuE9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9D"}

package/dist/types/adapters/d1/session-store.d.ts

@@ -16,5 +16,8 @@ export declare class D1SessionStore implements SessionStore {
     createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
     readSession(sessionId: string): Promise<Result<SessionRecord>>;
     revokeSession(sessionId: string): Promise<Result<void>>;
+    saveScratch(key: string, value: string, ttlMs: number): Promise<Result<void>>;
+    readScratch(key: string): Promise<Result<string>>;
+    deleteScratch(key: string): Promise<Result<void>>;
 }
 //# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/d1/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAIhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,YAAW,YAAY;;gBAIrC,IAAI,EAAE,qBAAqB;IAKjC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwDlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA2BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAuBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA2B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAW9D"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAIhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,YAAW,YAAY;;gBAIrC,IAAI,EAAE,qBAAqB;IAKjC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwDlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA2BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAuBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA2B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYvD,WAAW,CACf,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAyBlB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IA2BjD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAWxD"}

package/dist/types/adapters/durable-object/session-store.d.ts

@@ -16,6 +16,9 @@ export declare class DurableObjectSessionStore implements SessionStore {
     createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
     readSession(sessionId: string): Promise<Result<SessionRecord>>;
     revokeSession(sessionId: string): Promise<Result<void>>;
+    saveScratch(key: string, value: string, ttlMs: number): Promise<Result<void>>;
+    readScratch(key: string): Promise<Result<string>>;
+    deleteScratch(key: string): Promise<Result<void>>;
 }
 export type { DurableObjectStorageLike, DurableObjectTransactionLike };
 //# sourceMappingURL=session-store.d.ts.map