@absolutejs/auth 0.45.6 → 0.45.8

package/dist/index.d.ts

@@ -15266,6 +15266,7 @@ export { ssoDiscoveryRoute } from './sso/discoveryRoute';
 export { oidcSsoRoutes } from './sso/oidcRoutes';
 export { samlIdpRoutes } from './sso/samlIdpRoutes';
 export { samlSsoRoutes } from './sso/samlRoutes';
+export { createNodeSamlAdapter } from './sso/nodeSamlAdapter';
 export { createInMemorySamlServiceProviderStore } from './sso/inMemorySamlServiceProviderStore';
 export { createInMemorySsoConnectionStore } from './sso/inMemorySsoConnectionStore';
 export { createNeonSamlServiceProviderStore, createPostgresSamlServiceProviderStore, samlServiceProvidersTable } from './sso/postgresSamlServiceProviderStore';
@@ -15274,6 +15275,7 @@ export * from './webauthn/adapter';
 export * from './webauthn/config';
 export * from './webauthn/types';
 export { webauthnRoutes } from './webauthn/routes';
+export { createSimpleWebAuthnAdapter } from './webauthn/simpleWebAuthnAdapter';
 export { createInMemoryWebAuthnCredentialStore } from './webauthn/inMemoryWebAuthnCredentialStore';
 export { createNeonWebAuthnCredentialStore, createPostgresWebAuthnCredentialStore, webauthnCredentialsTable } from './webauthn/postgresWebAuthnCredentialStore';
 export * from './organizations/config';

package/dist/index.js

@@ -25462,6 +25462,57 @@ var samlIdpRoutes = ({
     ssoUrl: ssoUrlFor(request.url)
   })));
 };
+// src/sso/nodeSamlAdapter.ts
+var STANDARD_PROFILE_KEYS = new Set([
+  "ID",
+  "getAssertion",
+  "getAssertionXml",
+  "getSamlResponseXml",
+  "issuer",
+  "mainAttributes",
+  "nameID",
+  "nameIDFormat",
+  "sessionIndex",
+  "spNameQualifier"
+]);
+var createNodeSamlAdapter = async () => {
+  const { SAML } = await import("@node-saml/node-saml");
+  const build = (acsUrl, connection) => {
+    const spEntityId = new URL(acsUrl).origin;
+    return new SAML({
+      audience: spEntityId,
+      callbackUrl: acsUrl,
+      entryPoint: connection.config.idpSsoUrl,
+      idpCert: connection.config.idpX509Cert,
+      issuer: spEntityId,
+      logoutUrl: connection.config.idpSloUrl,
+      wantAssertionsSigned: true
+    });
+  };
+  return {
+    createAuthorizationUrl: ({ acsUrl, connection, relayState }) => build(acsUrl, connection).getAuthorizeUrlAsync(relayState ?? "", undefined, {}),
+    getServiceProviderMetadata: ({ acsUrl, connection }) => build(acsUrl, connection).generateServiceProviderMetadata(null),
+    validateAssertion: async ({ acsUrl, connection, samlResponse }) => {
+      const { profile: profile2 } = await build(acsUrl, connection).validatePostResponseAsync({ SAMLResponse: samlResponse });
+      if (!profile2) {
+        throw new Error("SAML response contained no assertion profile");
+      }
+      const attributes = {};
+      for (const [key, value] of Object.entries(profile2)) {
+        if (!STANDARD_PROFILE_KEYS.has(key))
+          attributes[key] = value;
+      }
+      const email = profile2.email ?? (profile2.nameID.includes("@") ? profile2.nameID : undefined);
+      const result = {
+        attributes,
+        email,
+        nameId: profile2.nameID,
+        sessionIndex: profile2.sessionIndex
+      };
+      return result;
+    }
+  };
+};
 // src/sso/inMemorySamlServiceProviderStore.ts
 var createInMemorySamlServiceProviderStore = () => {
   const providers2 = new Map;
@@ -25506,6 +25557,105 @@ var createInMemorySsoConnectionStore = () => {
     }
   };
 };
+// src/webauthn/simpleWebAuthnAdapter.ts
+var createSimpleWebAuthnAdapter = async () => {
+  const {
+    generateAuthenticationOptions,
+    generateRegistrationOptions,
+    verifyAuthenticationResponse,
+    verifyRegistrationResponse
+  } = await import("@simplewebauthn/server");
+  const toBase64Url3 = (bytes) => Buffer.from(bytes).toString("base64url");
+  const fromBase64Url3 = (value) => new Uint8Array(Buffer.from(value, "base64url"));
+  return {
+    createAuthenticationOptions: async ({ allowCredentials, rpId }) => {
+      const options = await generateAuthenticationOptions({
+        allowCredentials: allowCredentials.map(({ id }) => ({
+          id
+        })),
+        rpID: rpId
+      });
+      return {
+        challenge: options.challenge,
+        options: { ...options }
+      };
+    },
+    createRegistrationOptions: async ({
+      excludeCredentials,
+      rpId,
+      rpName,
+      userDisplayName,
+      userId,
+      userName
+    }) => {
+      const options = await generateRegistrationOptions({
+        excludeCredentials: excludeCredentials.map(({ id }) => ({
+          id
+        })),
+        rpID: rpId,
+        rpName,
+        userDisplayName,
+        userID: Uint8Array.from(new TextEncoder().encode(userId)),
+        userName
+      });
+      return {
+        challenge: options.challenge,
+        options: { ...options }
+      };
+    },
+    verifyAuthentication: async ({
+      credential,
+      expectedChallenge,
+      expectedOrigin,
+      expectedRPID,
+      response
+    }) => {
+      const result = await verifyAuthenticationResponse({
+        credential: {
+          counter: credential.counter,
+          id: credential.credentialId,
+          publicKey: fromBase64Url3(credential.publicKey)
+        },
+        expectedChallenge,
+        expectedOrigin,
+        expectedRPID,
+        response
+      });
+      return {
+        newCounter: result.authenticationInfo?.newCounter,
+        verified: result.verified
+      };
+    },
+    verifyRegistration: async ({
+      expectedChallenge,
+      expectedOrigin,
+      expectedRPID,
+      response
+    }) => {
+      const result = await verifyRegistrationResponse({
+        expectedChallenge,
+        expectedOrigin,
+        expectedRPID,
+        response
+      });
+      if (!result.verified || !result.registrationInfo) {
+        return { verified: false };
+      }
+      const { credential, credentialBackedUp, credentialDeviceType } = result.registrationInfo;
+      return {
+        credential: {
+          backedUp: credentialBackedUp,
+          counter: credential.counter,
+          credentialId: credential.id,
+          deviceType: credentialDeviceType,
+          publicKey: toBase64Url3(credential.publicKey),
+          transports: credential.transports
+        },
+        verified: true
+      };
+    }
+  };
+};
 // src/webauthn/inMemoryWebAuthnCredentialStore.ts
 var cloneCredential2 = (value) => ({
   ...value,
@@ -26081,6 +26231,7 @@ export {
   createTotpKeyUri,
   createTamperEvidentSink,
   createStatusList,
+  createSimpleWebAuthnAdapter,
   createSiemLogStream,
   createSetupSession,
   createSecretCipher,
@@ -26125,6 +26276,7 @@ export {
   createPostgresAccessTokenStore,
   createOrganization,
   createOAuthLinkedProviderCredentialResolver,
+  createNodeSamlAdapter,
   createNeonWebhookDeliveryStore,
   createNeonWebAuthnCredentialStore,
   createNeonWarrantStore,
@@ -26282,5 +26434,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=E03238E021BE190464756E2164756E21
+//# debugId=CF175090287D988A64756E2164756E21
 //# sourceMappingURL=index.js.map