@boxyhq/saml-jackson 1.0.2 → 1.0.5

package/dist/controller/oauth.js

@@ -50,7 +50,7 @@ const redirect = __importStar(require("./oauth/redirect"));
 const utils_1 = require("./utils");
 const deflateRawAsync = (0, util_1.promisify)(zlib_1.deflateRaw);
 const validateResponse = (rawResponse, validateOpts) => __awaiter(void 0, void 0, void 0, function* () {
-    const profile = yield saml20_1.default.validateAsync(rawResponse, validateOpts);
+    const profile = yield saml20_1.default.validate(rawResponse, validateOpts);
     if (profile && profile.claims) {
         // we map claims to our attributes id, email, firstName, lastName where possible. We also map original claims to raw
         profile.claims = claims_1.default.map(profile.claims);
@@ -61,9 +61,9 @@ const validateResponse = (rawResponse, validateOpts) => __awaiter(void 0, void 0
     }
     return profile;
 });
-function getEncodedClientId(client_id) {
+function getEncodedTenantProduct(param) {
     try {
-        const sp = new URLSearchParams(client_id);
+        const sp = new URLSearchParams(param);
         const tenant = sp.get('tenant');
         const product = sp.get('product');
         if (tenant && product) {
@@ -128,7 +128,7 @@ class OAuthController {
     }
     authorize(body) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { response_type = 'code', client_id, redirect_uri, state, tenant, product, code_challenge, code_challenge_method = '', 
+            const { response_type = 'code', client_id, redirect_uri, state, tenant, product, access_type, scope, code_challenge, code_challenge_method = '', 
             // eslint-disable-next-line @typescript-eslint/no-unused-vars
             provider = 'saml', idp_hint, } = body;
             let requestedTenant = tenant;
@@ -137,9 +137,6 @@ class OAuthController {
             if (!redirect_uri) {
                 throw new error_1.JacksonError('Please specify a redirect URL.', 400);
             }
-            if (!state) {
-                throw new error_1.JacksonError('Please specify a state to safeguard against XSRF attacks.', 400);
-            }
             let samlConfig;
             if (tenant && product) {
                 const samlConfigs = yield this.configStore.getByIndex({
@@ -171,7 +168,13 @@ class OAuthController {
             }
             else if (client_id && client_id !== '' && client_id !== 'undefined' && client_id !== 'null') {
                 // if tenant and product are encoded in the client_id then we parse it and check for the relevant config(s)
-                const sp = getEncodedClientId(client_id);
+                let sp = getEncodedTenantProduct(client_id);
+                if (!sp && access_type) {
+                    sp = getEncodedTenantProduct(access_type);
+                }
+                if (!sp && scope) {
+                    sp = getEncodedTenantProduct(scope);
+                }
                 if (sp && sp.tenant && sp.product) {
                     requestedTenant = sp.tenant;
                     requestedProduct = sp.product;
@@ -204,6 +207,10 @@ class OAuthController {
                 }
                 else {
                     samlConfig = yield this.configStore.get(client_id);
+                    if (samlConfig) {
+                        requestedTenant = samlConfig.tenant;
+                        requestedProduct = samlConfig.product;
+                    }
                 }
             }
             else {
@@ -215,6 +222,25 @@ class OAuthController {
             if (!allowed.redirect(redirect_uri, samlConfig.redirectUrl)) {
                 throw new error_1.JacksonError('Redirect URL is not allowed.', 403);
             }
+            if (!state) {
+                return {
+                    redirect_url: (0, utils_1.OAuthErrorResponse)({
+                        error: 'invalid_request',
+                        error_description: 'Please specify a state to safeguard against XSRF attacks',
+                        redirect_uri,
+                    }),
+                };
+            }
+            if (response_type !== 'code') {
+                return {
+                    redirect_url: (0, utils_1.OAuthErrorResponse)({
+                        error: 'unsupported_response_type',
+                        error_description: 'Only Authorization Code grant is supported',
+                        redirect_uri,
+                        state,
+                    }),
+                };
+            }
             let ssoUrl;
             let post = false;
             const { sso } = samlConfig.idpMetadata;
@@ -227,63 +253,86 @@ class OAuthController {
                 ssoUrl = sso.postUrl;
                 post = true;
             }
-            const samlReq = saml20_1.default.request({
-                ssoUrl,
-                entityID: this.opts.samlAudience,
-                callbackUrl: this.opts.externalUrl + this.opts.samlPath,
-                signingKey: samlConfig.certs.privateKey,
-                publicKey: samlConfig.certs.publicKey,
-            });
-            const sessionId = crypto_1.default.randomBytes(16).toString('hex');
-            const requested = { client_id, state };
-            if (requestedTenant) {
-                requested.tenant = requestedTenant;
-            }
-            if (requestedProduct) {
-                requested.product = requestedProduct;
+            else {
+                return {
+                    redirect_url: (0, utils_1.OAuthErrorResponse)({
+                        error: 'invalid_request',
+                        error_description: 'SAML binding could not be retrieved',
+                        redirect_uri,
+                        state,
+                    }),
+                };
             }
-            if (idp_hint) {
-                requested.idp_hint = idp_hint;
-            }
-            yield this.sessionStore.put(sessionId, {
-                id: samlReq.id,
-                redirect_uri,
-                response_type,
-                state,
-                code_challenge,
-                code_challenge_method,
-                requested,
-            });
-            const relayState = utils_1.relayStatePrefix + sessionId;
-            let redirectUrl;
-            let authorizeForm;
-            if (!post) {
-                // HTTP Redirect binding
-                redirectUrl = redirect.success(ssoUrl, {
-                    RelayState: relayState,
-                    SAMLRequest: Buffer.from(yield deflateRawAsync(samlReq.request)).toString('base64'),
+            try {
+                const samlReq = saml20_1.default.request({
+                    ssoUrl,
+                    entityID: this.opts.samlAudience,
+                    callbackUrl: this.opts.externalUrl + this.opts.samlPath,
+                    signingKey: samlConfig.certs.privateKey,
+                    publicKey: samlConfig.certs.publicKey,
                 });
+                const sessionId = crypto_1.default.randomBytes(16).toString('hex');
+                const requested = { client_id, state };
+                if (requestedTenant) {
+                    requested.tenant = requestedTenant;
+                }
+                if (requestedProduct) {
+                    requested.product = requestedProduct;
+                }
+                if (idp_hint) {
+                    requested.idp_hint = idp_hint;
+                }
+                yield this.sessionStore.put(sessionId, {
+                    id: samlReq.id,
+                    redirect_uri,
+                    response_type,
+                    state,
+                    code_challenge,
+                    code_challenge_method,
+                    requested,
+                });
+                const relayState = utils_1.relayStatePrefix + sessionId;
+                let redirectUrl;
+                let authorizeForm;
+                if (!post) {
+                    // HTTP Redirect binding
+                    redirectUrl = redirect.success(ssoUrl, {
+                        RelayState: relayState,
+                        SAMLRequest: Buffer.from(yield deflateRawAsync(samlReq.request)).toString('base64'),
+                    });
+                }
+                else {
+                    // HTTP POST binding
+                    authorizeForm = saml20_1.default.createPostForm(ssoUrl, [
+                        {
+                            name: 'RelayState',
+                            value: relayState,
+                        },
+                        {
+                            name: 'SAMLRequest',
+                            value: Buffer.from(samlReq.request).toString('base64'),
+                        },
+                    ]);
+                }
+                return {
+                    redirect_url: redirectUrl,
+                    authorize_form: authorizeForm,
+                };
+            }
+            catch (err) {
+                return {
+                    redirect_url: (0, utils_1.OAuthErrorResponse)({
+                        error: 'server_error',
+                        error_description: (0, utils_1.getErrorMessage)(err),
+                        redirect_uri,
+                        state,
+                    }),
+                };
             }
-            else {
-                // HTTP POST binding
-                authorizeForm = saml20_1.default.createPostForm(ssoUrl, [
-                    {
-                        name: 'RelayState',
-                        value: relayState,
-                    },
-                    {
-                        name: 'SAMLRequest',
-                        value: Buffer.from(samlReq.request).toString('base64'),
-                    },
-                ]);
-            }
-            return {
-                redirect_url: redirectUrl,
-                authorize_form: authorizeForm,
-            };
         });
     }
     samlResponse(body) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
             const { SAMLResponse, idp_hint } = body;
             let RelayState = body.RelayState || ''; // RelayState will contain the sessionId from earlier quasi-oauth flow
@@ -294,10 +343,13 @@ class OAuthController {
             }
             RelayState = RelayState.replace(utils_1.relayStatePrefix, '');
             const rawResponse = Buffer.from(SAMLResponse, 'base64').toString();
-            const parsedResp = yield saml20_1.default.parseAsync(rawResponse);
+            const issuer = saml20_1.default.parseIssuer(rawResponse);
+            if (!issuer) {
+                throw new error_1.JacksonError('Issuer not found.', 403);
+            }
             const samlConfigs = yield this.configStore.getByIndex({
                 name: utils_1.IndexNames.EntityID,
-                value: parsedResp === null || parsedResp === void 0 ? void 0 : parsedResp.issuer,
+                value: issuer,
             });
             if (!samlConfigs || samlConfigs.length === 0) {
                 throw new error_1.JacksonError('SAML configuration not found.', 403);
@@ -337,11 +389,30 @@ class OAuthController {
             const validateOpts = {
                 thumbprint: samlConfig.idpMetadata.thumbprint,
                 audience: this.opts.samlAudience,
+                privateKey: samlConfig.certs.privateKey,
             };
+            if (session && session.redirect_uri && !allowed.redirect(session.redirect_uri, samlConfig.redirectUrl)) {
+                throw new error_1.JacksonError('Redirect URL is not allowed.', 403);
+            }
             if (session && session.id) {
                 validateOpts.inResponseTo = session.id;
             }
-            const profile = yield validateResponse(rawResponse, validateOpts);
+            let profile;
+            const redirect_uri = (session && session.redirect_uri) || samlConfig.defaultRedirectUrl;
+            try {
+                profile = yield validateResponse(rawResponse, validateOpts);
+            }
+            catch (err) {
+                // return error to redirect_uri
+                return {
+                    redirect_url: (0, utils_1.OAuthErrorResponse)({
+                        error: 'access_denied',
+                        error_description: (0, utils_1.getErrorMessage)(err),
+                        redirect_uri,
+                        state: (_a = session === null || session === void 0 ? void 0 : session.requested) === null || _a === void 0 ? void 0 : _a.state,
+                    }),
+                };
+            }
             // store details against a code
             const code = crypto_1.default.randomBytes(20).toString('hex');
             const codeVal = {
@@ -353,9 +424,19 @@ class OAuthController {
             if (session) {
                 codeVal.session = session;
             }
-            yield this.codeStore.put(code, codeVal);
-            if (session && session.redirect_uri && !allowed.redirect(session.redirect_uri, samlConfig.redirectUrl)) {
-                throw new error_1.JacksonError('Redirect URL is not allowed.', 403);
+            try {
+                yield this.codeStore.put(code, codeVal);
+            }
+            catch (err) {
+                // return error to redirect_uri
+                return {
+                    redirect_url: (0, utils_1.OAuthErrorResponse)({
+                        error: 'server_error',
+                        error_description: (0, utils_1.getErrorMessage)(err),
+                        redirect_uri,
+                        state: (_b = session === null || session === void 0 ? void 0 : session.requested) === null || _b === void 0 ? void 0 : _b.state,
+                    }),
+                };
             }
             const params = {
                 code,
@@ -363,7 +444,7 @@ class OAuthController {
             if (session && session.state) {
                 params.state = session.state;
             }
-            const redirectUrl = redirect.success((session && session.redirect_uri) || samlConfig.defaultRedirectUrl, params);
+            const redirectUrl = redirect.success(redirect_uri, params);
             // delete the session
             try {
                 yield this.sessionStore.delete(RelayState);
@@ -456,7 +537,7 @@ class OAuthController {
             else if (client_id && client_secret) {
                 // check if we have an encoded client_id
                 if (client_id !== 'dummy') {
-                    const sp = getEncodedClientId(client_id);
+                    const sp = getEncodedTenantProduct(client_id);
                     if (!sp) {
                         // OAuth flow
                         if (client_id !== codeVal.clientID || client_secret !== codeVal.clientSecret) {

package/dist/controller/utils.d.ts

@@ -1,6 +1,9 @@
+import type { OAuthErrorHandlerParams } from '../typings';
 export declare enum IndexNames {
     EntityID = "entityID",
     TenantProduct = "tenantProduct"
 }
 export declare const relayStatePrefix = "boxyhq_jackson_";
 export declare const validateAbsoluteUrl: (url: any, message: any) => void;
+export declare const OAuthErrorResponse: ({ error, error_description, redirect_uri, state, }: OAuthErrorHandlerParams) => string;
+export declare function getErrorMessage(error: unknown): string;

package/dist/controller/utils.js

@@ -1,7 +1,31 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateAbsoluteUrl = exports.relayStatePrefix = exports.IndexNames = void 0;
+exports.getErrorMessage = exports.OAuthErrorResponse = exports.validateAbsoluteUrl = exports.relayStatePrefix = exports.IndexNames = void 0;
 const error_1 = require("./error");
+const redirect = __importStar(require("./oauth/redirect"));
 var IndexNames;
 (function (IndexNames) {
     IndexNames["EntityID"] = "entityID";
@@ -17,3 +41,14 @@ const validateAbsoluteUrl = (url, message) => {
     }
 };
 exports.validateAbsoluteUrl = validateAbsoluteUrl;
+const OAuthErrorResponse = ({ error, error_description, redirect_uri, state, }) => {
+    return redirect.success(redirect_uri, { error, error_description, state });
+};
+exports.OAuthErrorResponse = OAuthErrorResponse;
+// https://kentcdodds.com/blog/get-a-catch-block-error-message-with-typescript
+function getErrorMessage(error) {
+    if (error instanceof Error)
+        return error.message;
+    return String(error);
+}
+exports.getErrorMessage = getErrorMessage;

package/dist/typings.d.ts

@@ -51,6 +51,8 @@ export interface OAuthReqBody {
     state: string;
     tenant?: string;
     product?: string;
+    access_type?: string;
+    scope?: string;
     code_challenge: string;
     code_challenge_method: 'plain' | 'S256' | '';
     provider: 'saml';
@@ -78,6 +80,7 @@ export interface Profile {
     email: string;
     firstName: string;
     lastName: string;
+    requested: Record<string, string>;
 }
 export interface Index {
     name: string;
@@ -141,7 +144,7 @@ interface Metadata {
     };
     entityID: string;
     thumbprint: string;
-    loginType: 'idp';
+    loginType: 'idp' | 'sp';
     provider: string;
 }
 export interface SAMLConfig {
@@ -159,4 +162,10 @@ export interface ILogoutController {
     }>;
     handleResponse(body: SAMLResponsePayload): Promise<any>;
 }
+export interface OAuthErrorHandlerParams {
+    error: 'invalid_request' | 'access_denied' | 'unauthorized_client' | 'unsupported_response_type' | 'invalid_scope' | 'server_error' | 'temporarily_unavailable';
+    error_description: string;
+    redirect_uri: string;
+    state?: string;
+}
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxyhq/saml-jackson",
-  "version": "1.0.2",
+  "version": "1.0.5",
   "description": "SAML Jackson library",
   "keywords": [
     "SAML 2.0"
@@ -36,35 +36,36 @@
     "statements": 70
   },
   "dependencies": {
-    "@boxyhq/saml20": "1.0.2",
+    "@boxyhq/saml20": "1.0.3",
     "@opentelemetry/api-metrics": "0.27.0",
-    "@peculiar/webcrypto": "1.3.3",
-    "@peculiar/x509": "1.6.1",
-    "mongodb": "4.5.0",
+    "@opentelemetry/api": "1.0.4",
+    "@peculiar/webcrypto": "1.4.0",
+    "@peculiar/x509": "1.7.2",
+    "mongodb": "4.7.0",
     "mysql2": "2.3.3",
     "pg": "8.7.3",
     "redis": "4.0.6",
     "reflect-metadata": "0.1.13",
     "ripemd160": "2.0.2",
-    "typeorm": "0.3.6",
+    "typeorm": "0.3.7",
     "xml2js": "0.4.23",
     "xmlbuilder": "15.1.1"
   },
   "devDependencies": {
-    "@types/node": "17.0.30",
-    "@types/sinon": "10.0.11",
+    "@types/node": "18.0.1",
+    "@types/sinon": "10.0.12",
     "@types/tap": "15.0.7",
-    "@typescript-eslint/eslint-plugin": "5.21.0",
-    "@typescript-eslint/parser": "5.21.0",
+    "@typescript-eslint/eslint-plugin": "5.30.5",
+    "@typescript-eslint/parser": "5.30.5",
     "cross-env": "7.0.3",
-    "eslint": "8.14.0",
+    "eslint": "8.19.0",
     "eslint-config-prettier": "8.5.0",
-    "prettier": "2.6.2",
-    "sinon": "13.0.2",
-    "tap": "16.1.0",
-    "ts-node": "10.7.0",
-    "tsconfig-paths": "3.14.1",
-    "typescript": "4.6.4"
+    "prettier": "2.7.1",
+    "sinon": "14.0.0",
+    "tap": "16.3.0",
+    "ts-node": "10.8.2",
+    "tsconfig-paths": "4.0.0",
+    "typescript": "4.7.4"
   },
   "engines": {
     "node": ">=14.18.1 <=16.x"