@boxyhq/saml-jackson 1.0.4 → 1.0.5

package/dist/controller/oauth.js

@@ -50,7 +50,7 @@ const redirect = __importStar(require("./oauth/redirect"));
 const utils_1 = require("./utils");
 const deflateRawAsync = (0, util_1.promisify)(zlib_1.deflateRaw);
 const validateResponse = (rawResponse, validateOpts) => __awaiter(void 0, void 0, void 0, function* () {
-    const profile = yield saml20_1.default.validateAsync(rawResponse, validateOpts);
+    const profile = yield saml20_1.default.validate(rawResponse, validateOpts);
     if (profile && profile.claims) {
         // we map claims to our attributes id, email, firstName, lastName where possible. We also map original claims to raw
         profile.claims = claims_1.default.map(profile.claims);
@@ -237,6 +237,7 @@ class OAuthController {
                         error: 'unsupported_response_type',
                         error_description: 'Only Authorization Code grant is supported',
                         redirect_uri,
+                        state,
                     }),
                 };
             }
@@ -258,6 +259,7 @@ class OAuthController {
                         error: 'invalid_request',
                         error_description: 'SAML binding could not be retrieved',
                         redirect_uri,
+                        state,
                     }),
                 };
             }
@@ -323,12 +325,14 @@ class OAuthController {
                         error: 'server_error',
                         error_description: (0, utils_1.getErrorMessage)(err),
                         redirect_uri,
+                        state,
                     }),
                 };
             }
         });
     }
     samlResponse(body) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
             const { SAMLResponse, idp_hint } = body;
             let RelayState = body.RelayState || ''; // RelayState will contain the sessionId from earlier quasi-oauth flow
@@ -339,10 +343,13 @@ class OAuthController {
             }
             RelayState = RelayState.replace(utils_1.relayStatePrefix, '');
             const rawResponse = Buffer.from(SAMLResponse, 'base64').toString();
-            const parsedResp = yield saml20_1.default.parseAsync(rawResponse);
+            const issuer = saml20_1.default.parseIssuer(rawResponse);
+            if (!issuer) {
+                throw new error_1.JacksonError('Issuer not found.', 403);
+            }
             const samlConfigs = yield this.configStore.getByIndex({
                 name: utils_1.IndexNames.EntityID,
-                value: parsedResp === null || parsedResp === void 0 ? void 0 : parsedResp.issuer,
+                value: issuer,
             });
             if (!samlConfigs || samlConfigs.length === 0) {
                 throw new error_1.JacksonError('SAML configuration not found.', 403);
@@ -382,6 +389,7 @@ class OAuthController {
             const validateOpts = {
                 thumbprint: samlConfig.idpMetadata.thumbprint,
                 audience: this.opts.samlAudience,
+                privateKey: samlConfig.certs.privateKey,
             };
             if (session && session.redirect_uri && !allowed.redirect(session.redirect_uri, samlConfig.redirectUrl)) {
                 throw new error_1.JacksonError('Redirect URL is not allowed.', 403);
@@ -401,6 +409,7 @@ class OAuthController {
                         error: 'access_denied',
                         error_description: (0, utils_1.getErrorMessage)(err),
                         redirect_uri,
+                        state: (_a = session === null || session === void 0 ? void 0 : session.requested) === null || _a === void 0 ? void 0 : _a.state,
                     }),
                 };
             }
@@ -425,6 +434,7 @@ class OAuthController {
                         error: 'server_error',
                         error_description: (0, utils_1.getErrorMessage)(err),
                         redirect_uri,
+                        state: (_b = session === null || session === void 0 ? void 0 : session.requested) === null || _b === void 0 ? void 0 : _b.state,
                     }),
                 };
             }

package/dist/controller/utils.d.ts

@@ -5,5 +5,5 @@ export declare enum IndexNames {
 }
 export declare const relayStatePrefix = "boxyhq_jackson_";
 export declare const validateAbsoluteUrl: (url: any, message: any) => void;
-export declare const OAuthErrorResponse: ({ error, error_description, redirect_uri }: OAuthErrorHandlerParams) => string;
+export declare const OAuthErrorResponse: ({ error, error_description, redirect_uri, state, }: OAuthErrorHandlerParams) => string;
 export declare function getErrorMessage(error: unknown): string;

package/dist/controller/utils.js

@@ -41,8 +41,8 @@ const validateAbsoluteUrl = (url, message) => {
     }
 };
 exports.validateAbsoluteUrl = validateAbsoluteUrl;
-const OAuthErrorResponse = ({ error, error_description, redirect_uri }) => {
-    return redirect.success(redirect_uri, { error, error_description });
+const OAuthErrorResponse = ({ error, error_description, redirect_uri, state, }) => {
+    return redirect.success(redirect_uri, { error, error_description, state });
 };
 exports.OAuthErrorResponse = OAuthErrorResponse;
 // https://kentcdodds.com/blog/get-a-catch-block-error-message-with-typescript

package/dist/typings.d.ts

@@ -144,7 +144,7 @@ interface Metadata {
     };
     entityID: string;
     thumbprint: string;
-    loginType: 'idp';
+    loginType: 'idp' | 'sp';
     provider: string;
 }
 export interface SAMLConfig {
@@ -166,5 +166,6 @@ export interface OAuthErrorHandlerParams {
     error: 'invalid_request' | 'access_denied' | 'unauthorized_client' | 'unsupported_response_type' | 'invalid_scope' | 'server_error' | 'temporarily_unavailable';
     error_description: string;
     redirect_uri: string;
+    state?: string;
 }
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxyhq/saml-jackson",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "SAML Jackson library",
   "keywords": [
     "SAML 2.0"
@@ -36,35 +36,36 @@
     "statements": 70
   },
   "dependencies": {
-    "@boxyhq/saml20": "1.0.2",
+    "@boxyhq/saml20": "1.0.3",
     "@opentelemetry/api-metrics": "0.27.0",
+    "@opentelemetry/api": "1.0.4",
     "@peculiar/webcrypto": "1.4.0",
-    "@peculiar/x509": "1.6.3",
-    "mongodb": "4.6.0",
+    "@peculiar/x509": "1.7.2",
+    "mongodb": "4.7.0",
     "mysql2": "2.3.3",
     "pg": "8.7.3",
     "redis": "4.0.6",
     "reflect-metadata": "0.1.13",
     "ripemd160": "2.0.2",
-    "typeorm": "0.3.6",
+    "typeorm": "0.3.7",
     "xml2js": "0.4.23",
     "xmlbuilder": "15.1.1"
   },
   "devDependencies": {
-    "@types/node": "17.0.34",
-    "@types/sinon": "10.0.11",
+    "@types/node": "18.0.1",
+    "@types/sinon": "10.0.12",
     "@types/tap": "15.0.7",
-    "@typescript-eslint/eslint-plugin": "5.25.0",
-    "@typescript-eslint/parser": "5.25.0",
+    "@typescript-eslint/eslint-plugin": "5.30.5",
+    "@typescript-eslint/parser": "5.30.5",
     "cross-env": "7.0.3",
-    "eslint": "8.15.0",
+    "eslint": "8.19.0",
     "eslint-config-prettier": "8.5.0",
-    "prettier": "2.6.2",
+    "prettier": "2.7.1",
     "sinon": "14.0.0",
-    "tap": "16.2.0",
-    "ts-node": "10.7.0",
+    "tap": "16.3.0",
+    "ts-node": "10.8.2",
     "tsconfig-paths": "4.0.0",
-    "typescript": "4.6.4"
+    "typescript": "4.7.4"
   },
   "engines": {
     "node": ">=14.18.1 <=16.x"