@absolutejs/auth 0.30.0-beta.4 → 0.30.0-beta.6

package/dist/index.js

@@ -2520,7 +2520,7 @@ var createOAuth2Client = async (providerName, config) => {
 };
 
 // src/index.ts
-import { Elysia as Elysia35 } from "elysia";
+import { Elysia as Elysia36 } from "elysia";
 
 // src/apikeys/routes.ts
 import { Elysia, t } from "elysia";
@@ -4623,6 +4623,12 @@ var verifyAgainstAny = async (assertion, candidates) => {
   }
   return;
 };
+var verifyJwtSignedByClientImpl = async (client, jwt) => {
+  const candidates = await resolveClientJwks(client);
+  if (candidates === undefined || candidates.length === 0)
+    return;
+  return verifyAgainstAny(jwt, candidates);
+};
 var verifyClientAssertion = async ({
   assertion,
   expectedAudience,
@@ -4677,6 +4683,10 @@ var verifyClientAssertion = async ({
   }
   return client;
 };
+var verifyJwtSignedByClient = ({
+  jwt,
+  client
+}) => verifyJwtSignedByClientImpl(client, jwt);
 
 // src/oidc/dpop.ts
 var DEFAULT_MAX_AGE_MS = 60000;
@@ -4893,6 +4903,40 @@ var fanOutBackchannelLogout = async ({
   return reachable.map(({ client }) => client.clientId);
 };
 
+// src/oidc/jar.ts
+var MS_PER_SECOND2 = 1000;
+var numberClaim = (value) => typeof value === "number" ? value : undefined;
+var stringClaim = (value) => typeof value === "string" ? value : undefined;
+var arrayClaim = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : undefined;
+var parseSignedRequestObject = async ({
+  client,
+  expectedIssuer,
+  jwt,
+  now = Date.now()
+}) => {
+  const verified = await verifyJwtSignedByClient({ client, jwt });
+  if (verified === undefined) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  const { payload } = verified;
+  const { aud } = payload;
+  const iss = stringClaim(payload.iss);
+  const exp = numberClaim(payload.exp);
+  if (iss !== client.clientId) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  const audMatches = typeof aud === "string" && aud === expectedIssuer || (arrayClaim(aud)?.includes(expectedIssuer) ?? false);
+  if (!audMatches) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  if (exp !== undefined && exp * MS_PER_SECOND2 <= now) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  const envelope = new Set(["aud", "exp", "iat", "iss", "jti", "nbf"]);
+  const params = Object.fromEntries(Object.entries(payload).filter((entry) => typeof entry[1] === "string" && !envelope.has(entry[0])));
+  return { ok: true, params };
+};
+
 // src/oidc/par.ts
 var REQUEST_URI_BYTES = 32;
 var DEFAULT_PAR_TTL_SECONDS = 90;
@@ -5467,6 +5511,9 @@ var oidcProviderRoutes = (config) => {
     introspection_endpoint: `${issuer}${introspectRoute}`,
     issuer,
     jwks_uri: `${issuer}${jwksRoute}`,
+    request_object_signing_alg_values_supported: ["ES256"],
+    request_parameter_supported: true,
+    require_signed_request_object_supported: true,
     response_types_supported: ["code"],
     revocation_endpoint: `${issuer}${revokeRoute}`,
     subject_types_supported: ["public"],
@@ -5549,6 +5596,22 @@ var oidcProviderRoutes = (config) => {
     } else if (query.request_uri !== undefined && query.request_uri.startsWith(REQUEST_URI_PREFIX)) {
       return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST2);
     }
+    const initialClientId = effectiveQuery.client_id;
+    const initialClient = initialClientId === undefined ? undefined : await clientStore.findClient(initialClientId);
+    if (effectiveQuery.request !== undefined && initialClient !== undefined) {
+      const parsed = await parseSignedRequestObject({
+        client: initialClient,
+        expectedIssuer: issuer,
+        jwt: effectiveQuery.request
+      });
+      if (!parsed.ok) {
+        return jsonResponse({ error: parsed.error }, HTTP_BAD_REQUEST2);
+      }
+      effectiveQuery = {
+        ...parsed.params,
+        client_id: initialClientId
+      };
+    }
     const {
       client_id: clientId,
       code_challenge: codeChallenge,
@@ -5559,8 +5622,8 @@ var oidcProviderRoutes = (config) => {
       scope,
       state
     } = effectiveQuery;
-    const client = clientId === undefined ? undefined : await clientStore.findClient(clientId);
-    if (client === undefined || redirectUri === undefined || !client.redirectUris.includes(redirectUri)) {
+    const client = initialClient;
+    if (client === undefined || clientId !== client.clientId || redirectUri === undefined || !client.redirectUris.includes(redirectUri)) {
       return jsonResponse({ error: "invalid_client" }, HTTP_BAD_REQUEST2);
     }
     const errorRedirect = (error) => {
@@ -5572,6 +5635,9 @@ var oidcProviderRoutes = (config) => {
     if (client.requirePushedAuthorizationRequests === true && query.request_uri === undefined) {
       return errorRedirect("invalid_request");
     }
+    if (client.requireSignedRequestObject === true && query.request === undefined && query.request_uri === undefined) {
+      return errorRedirect("invalid_request_object");
+    }
     if (responseType !== "code") {
       return errorRedirect("unsupported_response_type");
     }
@@ -5652,6 +5718,7 @@ var oidcProviderRoutes = (config) => {
       nonce: t12.Optional(t12.String()),
       prompt: t12.Optional(t12.String()),
       redirect_uri: t12.Optional(t12.String()),
+      request: t12.Optional(t12.String()),
       request_uri: t12.Optional(t12.String()),
       response_type: t12.Optional(t12.String()),
       scope: t12.Optional(t12.String()),
@@ -21415,6 +21482,8 @@ var oauthClientsTable = pgTable("auth_oauth_clients", {
   name: varchar("name", { length: ID_LENGTH7 }).notNull(),
   post_logout_redirect_uris: text("post_logout_redirect_uris").array(),
   redirect_uris: text("redirect_uris").array().notNull(),
+  require_pushed_authorization_requests: boolean("require_pushed_authorization_requests"),
+  require_signed_request_object: boolean("require_signed_request_object"),
   scopes: text("scopes").array().notNull()
 });
 var oauthCodesTable = pgTable("auth_oauth_codes", {
@@ -21487,6 +21556,8 @@ var toClient2 = (row) => ({
   name: row.name,
   postLogoutRedirectUris: row.post_logout_redirect_uris ?? undefined,
   redirectUris: row.redirect_uris,
+  requirePushedAuthorizationRequests: row.require_pushed_authorization_requests ?? undefined,
+  requireSignedRequestObject: row.require_signed_request_object ?? undefined,
   scopes: row.scopes
 });
 var toLogoutDelivery = (row) => ({
@@ -21686,6 +21757,8 @@ var toClientValues2 = (client) => ({
   name: client.name,
   post_logout_redirect_uris: client.postLogoutRedirectUris ?? null,
   redirect_uris: client.redirectUris,
+  require_pushed_authorization_requests: client.requirePushedAuthorizationRequests ?? null,
+  require_signed_request_object: client.requireSignedRequestObject ?? null,
   scopes: client.scopes
 });
 var createPostgresOAuthClientStore = (db) => ({
@@ -22317,6 +22390,220 @@ var createPostgresWarrantStore = (db) => ({
     }).onConflictDoNothing({ target: warrantsTable.id });
   }
 });
+// src/sso/samlIdpRoutes.ts
+import { Elysia as Elysia35, t as t31 } from "elysia";
+var HTTP_BAD_REQUEST3 = 400;
+var HTTP_UNAUTHORIZED3 = 401;
+var HTTP_FOUND2 = 302;
+var HTTP_OK3 = 200;
+var xmlResponse = (body) => new Response(body, {
+  headers: { "content-type": "application/samlmetadata+xml" },
+  status: HTTP_OK3
+});
+var htmlResponse = (body) => new Response(body, {
+  headers: { "content-type": "text/html; charset=utf-8" },
+  status: HTTP_OK3
+});
+var redirectTo2 = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND2 });
+var errorJson = (status, error) => new Response(JSON.stringify({ error }), {
+  headers: { "content-type": "application/json" },
+  status
+});
+var samlIdpRoutes = ({
+  authSessionStore,
+  getNameId,
+  getSamlAttributes,
+  idpAdapter,
+  idpEntityId,
+  loginUrl,
+  samlServiceProviderStore,
+  ssoRoute = DEFAULT_SSO_ROUTE
+}) => {
+  const ssoIdpRoute = `${ssoRoute}/saml/idp/sso`;
+  const idpInitiateRoute = `${ssoRoute}/saml/idp/sso/initiate`;
+  const idpMetadataRoute = `${ssoRoute}/saml/idp/metadata`;
+  const ssoUrlFor = (requestUrl) => `${new URL(requestUrl).origin}${ssoIdpRoute}`;
+  const renderResponse = async ({
+    acsUrl,
+    inResponseTo,
+    relayState,
+    serviceProviderEntityId,
+    user
+  }) => {
+    const samlResponse = await idpAdapter.createSamlResponse({
+      acsUrl,
+      attributes: getSamlAttributes?.(user),
+      audience: serviceProviderEntityId,
+      idpEntityId,
+      inResponseTo,
+      nameId: getNameId(user),
+      sessionIndex: crypto.randomUUID()
+    });
+    const html2 = idpAdapter.buildAutoPostForm({
+      acsUrl,
+      relayState,
+      samlResponse
+    });
+    return htmlResponse(html2);
+  };
+  const handleSpInitiated = async ({
+    binding,
+    body,
+    inMemorySession,
+    request,
+    userSessionIdValue
+  }) => {
+    if (body.SAMLRequest === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "missing_saml_request");
+    }
+    let firstPass;
+    try {
+      firstPass = await idpAdapter.parseAuthnRequest({
+        binding,
+        samlRequest: body.SAMLRequest
+      });
+    } catch {
+      return errorJson(HTTP_BAD_REQUEST3, "invalid_authn_request");
+    }
+    const serviceProvider = await samlServiceProviderStore.findServiceProvider(firstPass.issuer);
+    if (serviceProvider === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "unknown_service_provider");
+    }
+    let parsed;
+    try {
+      parsed = await idpAdapter.parseAuthnRequest({
+        binding,
+        samlRequest: body.SAMLRequest,
+        serviceProvider,
+        signature: body.Signature,
+        signatureAlgorithm: body.SigAlg,
+        signedQueryString: binding === "Redirect" ? new URL(request.url).search.slice(1) : undefined
+      });
+    } catch {
+      return errorJson(HTTP_BAD_REQUEST3, "invalid_authn_request");
+    }
+    const userSession = await loadSessionFromSource({
+      authSessionStore,
+      session: inMemorySession,
+      userSessionId: userSessionIdValue
+    });
+    if (userSession === undefined || parsed.forceAuthn === true) {
+      if (loginUrl === undefined) {
+        return errorJson(HTTP_UNAUTHORIZED3, "login_required");
+      }
+      return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
+    }
+    return renderResponse({
+      acsUrl: parsed.acsUrl ?? serviceProvider.acsUrl,
+      inResponseTo: parsed.id,
+      relayState: parsed.relayState ?? body.RelayState,
+      serviceProviderEntityId: serviceProvider.entityId,
+      user: userSession.user
+    });
+  };
+  return new Elysia35().use(sessionStore()).post(ssoIdpRoute, async ({
+    body,
+    cookie: { user_session_id },
+    request,
+    store
+  }) => handleSpInitiated({
+    binding: "POST",
+    body,
+    inMemorySession: store.session,
+    request,
+    userSessionIdValue: user_session_id.value
+  }), {
+    body: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      SAMLRequest: t31.Optional(t31.String())
+    }),
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    })
+  }).get(ssoIdpRoute, async ({
+    cookie: { user_session_id },
+    query,
+    request,
+    store
+  }) => handleSpInitiated({
+    binding: "Redirect",
+    body: query,
+    inMemorySession: store.session,
+    request,
+    userSessionIdValue: user_session_id.value
+  }), {
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    }),
+    query: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      SAMLRequest: t31.Optional(t31.String()),
+      SigAlg: t31.Optional(t31.String()),
+      Signature: t31.Optional(t31.String())
+    })
+  }).get(idpInitiateRoute, async ({
+    cookie: { user_session_id },
+    query: { sp: serviceProviderEntityId, RelayState: relayState },
+    request,
+    store
+  }) => {
+    if (serviceProviderEntityId === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "missing_sp");
+    }
+    const serviceProvider = await samlServiceProviderStore.findServiceProvider(serviceProviderEntityId);
+    if (serviceProvider === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "unknown_service_provider");
+    }
+    const userSession = authSessionStore === undefined ? await loadSessionFromSource({
+      session: store.session,
+      userSessionId: user_session_id.value
+    }) : await loadSessionFromSource({
+      authSessionStore,
+      session: store.session,
+      userSessionId: user_session_id.value
+    });
+    if (userSession === undefined) {
+      if (loginUrl === undefined) {
+        return errorJson(HTTP_UNAUTHORIZED3, "login_required");
+      }
+      return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
+    }
+    return renderResponse({
+      acsUrl: serviceProvider.acsUrl,
+      relayState,
+      serviceProviderEntityId: serviceProvider.entityId,
+      user: userSession.user
+    });
+  }, {
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    }),
+    query: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      sp: t31.Optional(t31.String())
+    })
+  }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
+    entityId: idpEntityId,
+    ssoUrl: ssoUrlFor(request.url)
+  })));
+};
+// src/sso/inMemorySamlServiceProviderStore.ts
+var createInMemorySamlServiceProviderStore = () => {
+  const providers2 = new Map;
+  return {
+    deleteServiceProvider: async (entityId) => {
+      providers2.delete(entityId);
+    },
+    findServiceProvider: async (entityId) => {
+      const found = providers2.get(entityId);
+      return found ? { ...found } : undefined;
+    },
+    listServiceProviders: async () => Array.from(providers2.values()).map((serviceProvider) => ({ ...serviceProvider })),
+    saveServiceProvider: async (serviceProvider) => {
+      providers2.set(serviceProvider.entityId, { ...serviceProvider });
+    }
+  };
+};
 // src/sso/inMemorySsoConnectionStore.ts
 var cloneConnection = (value) => value.type === "oidc" ? {
   ...value,
@@ -22342,16 +22629,63 @@ var createInMemorySsoConnectionStore = () => {
     }
   };
 };
-// src/sso/postgresSsoConnectionStore.ts
+// src/sso/postgresSamlServiceProviderStore.ts
 var ID_LENGTH10 = 255;
+var URL_LENGTH2 = 2048;
+var samlServiceProvidersTable = pgTable("auth_saml_service_providers", {
+  acs_url: varchar("acs_url", { length: URL_LENGTH2 }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  entity_id: varchar("entity_id", { length: URL_LENGTH2 }).primaryKey(),
+  name_id_format: varchar("name_id_format", { length: ID_LENGTH10 }),
+  signing_cert: text("signing_cert"),
+  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
+});
+var toServiceProvider = (row) => ({
+  acsUrl: row.acs_url,
+  createdAt: row.created_at_ms,
+  entityId: row.entity_id,
+  nameIdFormat: row.name_id_format ?? undefined,
+  signingCert: row.signing_cert ?? undefined,
+  updatedAt: row.updated_at_ms
+});
+var toValues2 = (serviceProvider) => ({
+  acs_url: serviceProvider.acsUrl,
+  created_at_ms: serviceProvider.createdAt,
+  entity_id: serviceProvider.entityId,
+  name_id_format: serviceProvider.nameIdFormat ?? null,
+  signing_cert: serviceProvider.signingCert ?? null,
+  updated_at_ms: serviceProvider.updatedAt
+});
+var createNeonSamlServiceProviderStore = (databaseUrl) => createPostgresSamlServiceProviderStore(createNeonDatabase(databaseUrl));
+var createPostgresSamlServiceProviderStore = (db) => ({
+  deleteServiceProvider: async (entityId) => {
+    await db.delete(samlServiceProvidersTable).where(eq(samlServiceProvidersTable.entity_id, entityId));
+  },
+  findServiceProvider: async (entityId) => {
+    const [row] = await db.select().from(samlServiceProvidersTable).where(eq(samlServiceProvidersTable.entity_id, entityId)).limit(1);
+    return row === undefined ? undefined : toServiceProvider(row);
+  },
+  listServiceProviders: async () => {
+    const rows = await db.select().from(samlServiceProvidersTable);
+    return rows.map(toServiceProvider);
+  },
+  saveServiceProvider: async (serviceProvider) => {
+    await db.insert(samlServiceProvidersTable).values(toValues2(serviceProvider)).onConflictDoUpdate({
+      set: toValues2(serviceProvider),
+      target: samlServiceProvidersTable.entity_id
+    });
+  }
+});
+// src/sso/postgresSsoConnectionStore.ts
+var ID_LENGTH11 = 255;
 var TYPE_LENGTH2 = 16;
 var ssoConnectionsTable = pgTable("auth_sso_connections", {
   config: jsonb("config").$type().notNull(),
-  connection_id: varchar("connection_id", { length: ID_LENGTH10 }).primaryKey(),
+  connection_id: varchar("connection_id", { length: ID_LENGTH11 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   enabled: boolean("enabled").notNull().default(true),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH10
+    length: ID_LENGTH11
   }).notNull(),
   type: varchar("type", { length: TYPE_LENGTH2 }).$type().notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
@@ -22418,7 +22752,7 @@ var toConnection = (row) => {
   };
   return connection;
 };
-var toValues2 = (connection) => ({
+var toValues3 = (connection) => ({
   config: connection.config,
   connection_id: connection.connectionId,
   created_at_ms: connection.createdAt,
@@ -22448,7 +22782,7 @@ var createPostgresSsoConnectionStore = (db) => ({
     });
   },
   saveConnection: async (connection) => {
-    const values = toValues2(connection);
+    const values = toValues3(connection);
     await db.insert(ssoConnectionsTable).values(values).onConflictDoUpdate({
       set: values,
       target: ssoConnectionsTable.connection_id
@@ -22477,18 +22811,18 @@ var createInMemoryWebAuthnCredentialStore = () => {
   };
 };
 // src/webauthn/postgresWebAuthnCredentialStore.ts
-var ID_LENGTH11 = 255;
+var ID_LENGTH12 = 255;
 var DEVICE_TYPE_LENGTH = 32;
 var webauthnCredentialsTable = pgTable("auth_webauthn_credentials", {
   backed_up: boolean("backed_up"),
   counter: bigint("counter", { mode: "number" }).notNull().default(0),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  credential_id: varchar("credential_id", { length: ID_LENGTH11 }).primaryKey(),
+  credential_id: varchar("credential_id", { length: ID_LENGTH12 }).primaryKey(),
   device_type: varchar("device_type", { length: DEVICE_TYPE_LENGTH }),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
   public_key: text("public_key").notNull(),
   transports: jsonb("transports").$type(),
-  user_id: varchar("user_id", { length: ID_LENGTH11 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH12 }).notNull()
 });
 var toCredential = (row) => ({
   backedUp: row.backed_up ?? undefined,
@@ -22501,7 +22835,7 @@ var toCredential = (row) => ({
   transports: row.transports ?? undefined,
   userId: row.user_id
 });
-var toValues3 = (credential) => ({
+var toValues4 = (credential) => ({
   backed_up: credential.backedUp ?? null,
   counter: credential.counter,
   created_at_ms: credential.createdAt,
@@ -22526,7 +22860,7 @@ var createPostgresWebAuthnCredentialStore = (db) => ({
     await db.delete(webauthnCredentialsTable).where(eq(webauthnCredentialsTable.credential_id, credentialId));
   },
   saveCredential: async (credential) => {
-    const values = toValues3(credential);
+    const values = toValues4(credential);
     await db.insert(webauthnCredentialsTable).values(values).onConflictDoUpdate({
       set: values,
       target: webauthnCredentialsTable.credential_id
@@ -22581,41 +22915,41 @@ var createInMemoryOrganizationStore = () => {
   };
 };
 // src/organizations/postgresOrganizationStore.ts
-var ID_LENGTH12 = 255;
+var ID_LENGTH13 = 255;
 var NAME_LENGTH = 255;
 var STATE_LENGTH = 16;
 var organizationInvitationsTable = pgTable("auth_organization_invitations", {
   accepted_at_ms: bigint("accepted_at_ms", { mode: "number" }),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  email: varchar("email", { length: ID_LENGTH12 }).notNull(),
+  email: varchar("email", { length: ID_LENGTH13 }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   invitation_id: varchar("invitation_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).primaryKey(),
-  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH12 }),
+  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH13 }),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).notNull(),
   roles: jsonb("roles").$type().notNull().default([]),
   state: varchar("state", { length: STATE_LENGTH }).$type().notNull().default("pending"),
-  token_hash: varchar("token_hash", { length: ID_LENGTH12 }).notNull().unique()
+  token_hash: varchar("token_hash", { length: ID_LENGTH13 }).notNull().unique()
 });
 var organizationMembershipsTable = pgTable("auth_organization_memberships", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).notNull(),
   roles: jsonb("roles").$type().notNull().default([]),
   status: varchar("status", { length: STATE_LENGTH }).$type().notNull().default("active"),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH12 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH13 }).notNull()
 }, (table) => [primaryKey({ columns: [table.organization_id, table.user_id] })]);
 var organizationsTable = pgTable("auth_organizations", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   metadata: jsonb("metadata").$type(),
   name: varchar("name", { length: NAME_LENGTH }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).primaryKey(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
 });
@@ -22789,12 +23123,12 @@ var createInMemoryRoleStore = () => {
   };
 };
 // src/roles/postgresRoleStore.ts
-var ID_LENGTH13 = 255;
+var ID_LENGTH14 = 255;
 var SLUG_LENGTH = 128;
 var GLOBAL_SCOPE = "";
 var rolesTable = pgTable("auth_roles", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  organization_id: varchar("organization_id", { length: ID_LENGTH13 }).notNull().default(GLOBAL_SCOPE),
+  organization_id: varchar("organization_id", { length: ID_LENGTH14 }).notNull().default(GLOBAL_SCOPE),
   permissions: jsonb("permissions").$type().notNull().default([]),
   slug: varchar("slug", { length: SLUG_LENGTH }).notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
@@ -22849,11 +23183,11 @@ var createInMemoryPasswordlessTokenStore = () => {
   };
 };
 // src/passwordless/postgresPasswordlessTokenStore.ts
-var ID_LENGTH14 = 255;
+var ID_LENGTH15 = 255;
 var passwordlessTokensTable = pgTable("auth_passwordless_tokens", {
-  email: varchar("email", { length: ID_LENGTH14 }).notNull(),
+  email: varchar("email", { length: ID_LENGTH15 }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH14 }).primaryKey()
+  token_hash: varchar("token_hash", { length: ID_LENGTH15 }).primaryKey()
 });
 var toToken3 = (row) => ({
   email: row.email,
@@ -22893,14 +23227,14 @@ var createInMemoryWebhookDeliveryStore = () => {
   };
 };
 // src/webhooks/postgresStore.ts
-var ID_LENGTH15 = 255;
-var URL_LENGTH2 = 2048;
+var ID_LENGTH16 = 255;
+var URL_LENGTH3 = 2048;
 var DEFAULT_LIST_LIMIT4 = 100;
 var webhookDeliveriesTable = pgTable("auth_webhook_deliveries", {
   attempts: bigint("attempts", { mode: "number" }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  endpoint_url: varchar("endpoint_url", { length: URL_LENGTH2 }).notNull(),
-  envelope_id: varchar("envelope_id", { length: ID_LENGTH15 }).primaryKey(),
+  endpoint_url: varchar("endpoint_url", { length: URL_LENGTH3 }).notNull(),
+  envelope_id: varchar("envelope_id", { length: ID_LENGTH16 }).primaryKey(),
   envelope_json: jsonb("envelope_json").$type().notNull(),
   last_error: text("last_error"),
   last_status: bigint("last_status", { mode: "number" })
@@ -22955,19 +23289,19 @@ var createInMemorySetupSessionStore = () => {
   };
 };
 // src/portal/postgresSetupSessionStore.ts
-var ID_LENGTH16 = 255;
+var ID_LENGTH17 = 255;
 var setupSessionsTable = pgTable("auth_setup_sessions", {
   capabilities: jsonb("capabilities").$type().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  created_by: varchar("created_by", { length: ID_LENGTH16 }),
+  created_by: varchar("created_by", { length: ID_LENGTH17 }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH16
+    length: ID_LENGTH17
   }).notNull(),
   setup_session_id: varchar("setup_session_id", {
-    length: ID_LENGTH16
+    length: ID_LENGTH17
   }).primaryKey(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH16 }).notNull().unique()
+  token_hash: varchar("token_hash", { length: ID_LENGTH17 }).notNull().unique()
 });
 var toSession = (row) => ({
   capabilities: row.capabilities,
@@ -23073,7 +23407,7 @@ var auth = async ({
   const auditedOnCallbackSuccess = auditEmit ? composeCallbackAudit(onCallbackSuccess, auditEmit) : onCallbackSuccess;
   const auditedOnRevocationSuccess = auditEmit ? composeRevocationAudit(onRevocationSuccess, auditEmit) : onRevocationSuccess;
   const auditedOnSignOut = auditEmit ? composeSignOutAudit(onSignOut, auditEmit) : onSignOut;
-  return new Elysia35().use(sessionCleanup({
+  return new Elysia36().use(sessionCleanup({
     authSessionStore,
     cleanupIntervalMs,
     maxSessions,
@@ -23119,42 +23453,42 @@ var auth = async ({
     ...auditedCredentials,
     authSessionStore,
     lockoutGuard
-  }) : new Elysia35).use(auditedMfa ? mfaRoutes({ ...auditedMfa, authSessionStore }) : new Elysia35).use(passwordless ? passwordlessRoutes({
+  }) : new Elysia36).use(auditedMfa ? mfaRoutes({ ...auditedMfa, authSessionStore }) : new Elysia36).use(passwordless ? passwordlessRoutes({
     ...passwordless,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia35).use(sso ? oidcSsoRoutes({ ...sso, authSessionStore }) : new Elysia35).use(sso && sso.samlAdapter ? samlSsoRoutes({
+  }) : new Elysia36).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia36).use(sso ? oidcSsoRoutes({ ...sso, authSessionStore }) : new Elysia36).use(sso && sso.samlAdapter ? samlSsoRoutes({
     ...sso,
     authSessionStore,
     samlAdapter: sso.samlAdapter
-  }) : new Elysia35).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
+  }) : new Elysia36).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
     getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
     ssoConnectionStore: sso.ssoConnectionStore,
     ssoRoute: sso.ssoRoute
-  }) : new Elysia35).use(scim ? scimRoutes(scim) : new Elysia35).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia35).use(oidc ? oidcProviderRoutes({ ...oidc, authSessionStore }) : new Elysia35).use(organizations ? organizationRoutes({
+  }) : new Elysia36).use(scim ? scimRoutes(scim) : new Elysia36).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia36).use(oidc ? oidcProviderRoutes({ ...oidc, authSessionStore }) : new Elysia36).use(organizations ? organizationRoutes({
     ...organizations,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(roles ? roleRoutes({
+  }) : new Elysia36).use(roles ? roleRoutes({
     ...roles,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia35).use(webauthn ? webauthnRoutes({
+  }) : new Elysia36).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia36).use(webauthn ? webauthnRoutes({
     ...webauthn,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(compliance ? complianceRoutes({
+  }) : new Elysia36).use(compliance ? complianceRoutes({
     ...compliance,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
+  }) : new Elysia36).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
     ...authorization,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(htmx ? createAuthHtmxRoutes({
+  }) : new Elysia36).use(htmx ? createAuthHtmxRoutes({
     ...htmx,
     authSessionStore
-  }) : new Elysia35);
+  }) : new Elysia36);
 };
 export {
   writeWarrant,
@@ -23169,6 +23503,7 @@ export {
   verifyRecaptcha,
   verifyPkce,
   verifyPassword,
+  verifyJwtSignedByClient,
   verifyJwt,
   verifyIdTokenHint,
   verifyHcaptcha,
@@ -23205,6 +23540,8 @@ export {
   scimTokensTable,
   scimRoutes,
   samlSsoRoutes,
+  samlServiceProvidersTable,
+  samlIdpRoutes,
   rotateVaultKey,
   rotateMfaEncryptionKey,
   rolesTable,
@@ -23238,6 +23575,7 @@ export {
   pkceProviderOptions,
   passwordlessTokensTable,
   passwordlessRoutes,
+  parseSignedRequestObject,
   parseSchema,
   organizationsTable,
   organizationRoutes,
@@ -23359,6 +23697,7 @@ export {
   createPostgresSsoConnectionStore,
   createPostgresSetupSessionStore,
   createPostgresScimTokenStore,
+  createPostgresSamlServiceProviderStore,
   createPostgresRoleStore,
   createPostgresPushedAuthorizationRequestStore,
   createPostgresPasswordlessTokenStore,
@@ -23389,6 +23728,7 @@ export {
   createNeonSsoConnectionStore,
   createNeonSetupSessionStore,
   createNeonScimTokenStore,
+  createNeonSamlServiceProviderStore,
   createNeonRoleStore,
   createNeonPushedAuthorizationRequestStore,
   createNeonPasswordlessTokenStore,
@@ -23425,6 +23765,7 @@ export {
   createInMemorySsoConnectionStore,
   createInMemorySetupSessionStore,
   createInMemoryScimTokenStore,
+  createInMemorySamlServiceProviderStore,
   createInMemoryRoleStore,
   createInMemoryPushedAuthorizationRequestStore,
   createInMemoryPasswordlessTokenStore,
@@ -23515,5 +23856,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=2099933871462CB064756E2164756E21
+//# debugId=B31AA1D09BAE440964756E2164756E21
 //# sourceMappingURL=index.js.map