@_mustachio/openauth 0.11.0 → 0.13.0

package/dist/types/methods/saml-sp/attributes.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Attribute mapping — translate a node-saml `Profile` (already
+ * cryptographically verified by the time it reaches here) into our
+ * `SamlSpProperties`.
+ *
+ * node-saml flattens the assertion's `AttributeStatement` onto the
+ * `Profile` object as arbitrary top-level keys (single value → string,
+ * multi-valued → array), plus the structural `nameID` /
+ * `nameIDFormat` / `sessionIndex`. The host's `success` callback owns
+ * the final `SubjectClaim`; this layer just normalises the SAML side
+ * per the tenant's configured `SamlAttributeMapping`.
+ *
+ * Pure: no node-saml import, no I/O. `Profile` is modelled here as the
+ * minimal structural shape we read, so this file stays free of the
+ * third-party type (the public-API leak guard depends on that).
+ */
+import type { SamlAttributeMapping, SamlSpProperties } from "./types";
+/** The slice of node-saml's `Profile` we actually consume. */
+export type VerifiedProfile = {
+    nameID: string;
+    nameIDFormat: string;
+    sessionIndex?: string;
+    attributes: Record<string, unknown>;
+    /** `AuthnStatement/@AuthnInstant`, raw XSD dateTime. */
+    authnInstant?: string;
+    /** `AuthnStatement/@SessionNotOnOrAfter`, already parsed to Unix ms. */
+    sessionNotOnOrAfter?: number;
+    /** `AuthnContext/AuthnContextClassRef` — what the IdP actually asserted. */
+    authnContextClassRef?: string;
+    responseXml: string;
+};
+export type MappedSubject = {
+    providerSubject: string;
+    properties: SamlSpProperties;
+};
+/**
+ * Build `(providerSubject, properties)` from a verified profile.
+ * Returns a string describing the failure when the configured subject
+ * source resolves to nothing — the caller turns that into a `denied`
+ * result rather than minting a subject-less success.
+ */
+export declare function mapProfile(profile: VerifiedProfile, mapping: SamlAttributeMapping): MappedSubject | {
+    error: string;
+};
+//# sourceMappingURL=attributes.d.ts.map

package/dist/types/methods/saml-sp/attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attributes.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EACV,oBAAoB,EAGpB,gBAAgB,EACjB,MAAM,SAAS,CAAA;AAEhB,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wEAAwE;IACxE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAwCD,MAAM,MAAM,aAAa,GAAG;IAC1B,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,gBAAgB,CAAA;CAC7B,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,oBAAoB,GAC5B,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAuDnC"}

package/dist/types/methods/saml-sp/authnrequest.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function buildAuthnRequestRedirect(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=authnrequest.d.ts.map

package/dist/types/methods/saml-sp/authnrequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authnrequest.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/authnrequest.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1E,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CA0GtD"}

package/dist/types/methods/saml-sp/cache-provider.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `@node-saml/node-saml` `CacheProvider` backed by `methodScratch`.
+ *
+ * node-saml tracks outstanding `AuthnRequest` IDs through a
+ * `CacheProvider`: `saveAsync(requestId, marker)` when the request is
+ * generated, then `getAsync` + `removeAsync` during response
+ * validation to enforce `InResponseTo` (defeats unsolicited /
+ * replayed Responses on the SP-initiated path).
+ *
+ * The default in-memory provider is single-process only. We back it
+ * with `MethodContext.methodScratch`, which is already scoped per
+ * `(tenantId, methodId)` and shared across instances via the
+ * `SessionStore` adapter — so an AuthnRequest minted on one node
+ * validates on another.
+ *
+ * `methodScratch.get` returning `unknown_state` (missing / expired)
+ * maps to `null`, which is exactly node-saml's "unknown request id"
+ * signal.
+ */
+import type { MethodScratch } from "../../types/method";
+type CacheItem = {
+    value: string;
+    createdAt: number;
+};
+type NodeSamlCacheProvider = {
+    saveAsync(key: string, value: string): Promise<CacheItem | null>;
+    getAsync(key: string): Promise<string | null>;
+    removeAsync(key: string | null): Promise<string | null>;
+};
+/**
+ * @param scratch  Per-request `MethodContext.methodScratch`.
+ * @param ttlMs    How long an outstanding request id stays valid. Should
+ *                  comfortably exceed the slowest realistic IdP login
+ *                  (the flow record itself expires independently).
+ */
+export declare function methodScratchCacheProvider(scratch: MethodScratch, ttlMs: number): NodeSamlCacheProvider;
+export {};
+//# sourceMappingURL=cache-provider.d.ts.map

package/dist/types/methods/saml-sp/cache-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-provider.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/cache-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD,KAAK,SAAS,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AACrD,KAAK,qBAAqB,GAAG;IAC3B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC7C,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACxD,CAAA;AAKD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,MAAM,GACZ,qBAAqB,CAiCvB"}

package/dist/types/methods/saml-sp/cert-rotation.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Cert-rotation shim.
+ *
+ * `@node-saml/node-saml`'s `idpCert` accepts a single PEM, an array of
+ * PEMs, or a callback. Our config models hot rotation as an array of
+ * `{ pem, notBefore?, notAfter? }`. This pure function filters that
+ * array to the certs whose validity window covers `now`, producing the
+ * PEM list node-saml verifies against.
+ *
+ * A cert with no `notBefore` has no lower bound; no `notAfter` has no
+ * upper bound. `notBefore` is inclusive, `notAfter` is exclusive — a
+ * cert is active while `notBefore <= now < notAfter`. Overlapping
+ * windows are the whole point: during rotation both the outgoing and
+ * incoming cert are active so in-flight assertions from either key
+ * still verify.
+ *
+ * Returns `[]` when nothing is in window — the caller surfaces a
+ * configuration error rather than handing node-saml an empty cert set
+ * (which it would treat as "accept nothing").
+ */
+import type { SamlIdpSigningCert } from "./types";
+export declare function selectActiveCertPems(certs: ReadonlyArray<SamlIdpSigningCert>, nowMs: number): string[];
+//# sourceMappingURL=cert-rotation.d.ts.map

package/dist/types/methods/saml-sp/cert-rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-rotation.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/cert-rotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAEjD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,aAAa,CAAC,kBAAkB,CAAC,EACxC,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAQV"}