@boxyhq/saml-jackson 1.2.1 → 1.2.2

package/dist/controller/api.js

@@ -179,6 +179,7 @@ class APIController {
     config(body) {
         return __awaiter(this, void 0, void 0, function* () {
             const { encodedRawMetadata, rawMetadata, defaultRedirectUrl, redirectUrl, tenant, product, name, description, } = body;
+            const forceAuthn = body.forceAuthn == 'true' || body.forceAuthn == true;
             metrics.increment('createConfig');
             this._validateIdPConfig(body);
             const redirectUrlList = extractRedirectUrls(redirectUrl);
@@ -205,7 +206,7 @@ class APIController {
             }
             const certs = yield x509_1.default.generate();
             if (!certs) {
-                throw new Error('Error generating x59 certs');
+                throw new Error('Error generating x509 certs');
             }
             const record = {
                 idpMetadata,
@@ -218,6 +219,7 @@ class APIController {
                 clientID,
                 clientSecret,
                 certs,
+                forceAuthn,
             };
             yield this.configStore.put(clientID, record, {
                 // secondary index on entityID
@@ -301,7 +303,7 @@ class APIController {
         return __awaiter(this, void 0, void 0, function* () {
             const { encodedRawMetadata, // could be empty
             rawMetadata, // could be empty
-            defaultRedirectUrl, redirectUrl, name, description } = body, clientInfo = __rest(body, ["encodedRawMetadata", "rawMetadata", "defaultRedirectUrl", "redirectUrl", "name", "description"]);
+            defaultRedirectUrl, redirectUrl, name, description, forceAuthn = false } = body, clientInfo = __rest(body, ["encodedRawMetadata", "rawMetadata", "defaultRedirectUrl", "redirectUrl", "name", "description", "forceAuthn"]);
             if (!(clientInfo === null || clientInfo === void 0 ? void 0 : clientInfo.clientID)) {
                 throw new error_1.JacksonError('Please provide clientID', 400);
             }
@@ -338,7 +340,7 @@ class APIController {
                     throw new error_1.JacksonError('Tenant/Product config mismatch with IdP metadata', 400);
                 }
             }
-            const record = Object.assign(Object.assign({}, _currentConfig), { name: name ? name : _currentConfig.name, description: description ? description : _currentConfig.description, idpMetadata: newMetadata ? newMetadata : _currentConfig.idpMetadata, defaultRedirectUrl: defaultRedirectUrl ? defaultRedirectUrl : _currentConfig.defaultRedirectUrl, redirectUrl: redirectUrlList ? redirectUrlList : _currentConfig.redirectUrl });
+            const record = Object.assign(Object.assign({}, _currentConfig), { name: name ? name : _currentConfig.name, description: description ? description : _currentConfig.description, idpMetadata: newMetadata ? newMetadata : _currentConfig.idpMetadata, defaultRedirectUrl: defaultRedirectUrl ? defaultRedirectUrl : _currentConfig.defaultRedirectUrl, redirectUrl: redirectUrlList ? redirectUrlList : _currentConfig.redirectUrl, forceAuthn });
             yield this.configStore.put(clientInfo === null || clientInfo === void 0 ? void 0 : clientInfo.clientID, record, {
                 // secondary index on entityID
                 name: utils_1.IndexNames.EntityID,

package/dist/controller/oauth.js

@@ -49,6 +49,7 @@ const allowed = __importStar(require("./oauth/allowed"));
 const codeVerifier = __importStar(require("./oauth/code-verifier"));
 const redirect = __importStar(require("./oauth/redirect"));
 const utils_1 = require("./utils");
+const x509_1 = __importDefault(require("../saml/x509"));
 const deflateRawAsync = (0, util_1.promisify)(zlib_1.deflateRaw);
 const validateResponse = (rawResponse, validateOpts) => __awaiter(void 0, void 0, void 0, function* () {
     const profile = yield saml20_1.default.validate(rawResponse, validateOpts);
@@ -134,7 +135,7 @@ class OAuthController {
         return __awaiter(this, void 0, void 0, function* () {
             const { response_type = 'code', client_id, redirect_uri, state, tenant, product, access_type, resource, scope, nonce, code_challenge, code_challenge_method = '', 
             // eslint-disable-next-line @typescript-eslint/no-unused-vars
-            provider = 'saml', idp_hint, } = body;
+            provider = 'saml', idp_hint, prompt, } = body;
             let requestedTenant = tenant;
             let requestedProduct = product;
             metrics.increment('oauthAuthorize');
@@ -294,12 +295,37 @@ class OAuthController {
                 };
             }
             try {
+                const { validTo } = new crypto_1.default.X509Certificate(samlConfig.certs.publicKey);
+                const isValidExpiry = validTo != 'Bad time value' && new Date(validTo) > new Date();
+                if (!isValidExpiry) {
+                    const certs = yield x509_1.default.generate();
+                    samlConfig.certs = certs;
+                    if (certs) {
+                        yield this.configStore.put(samlConfig.clientID, samlConfig, {
+                            // secondary index on entityID
+                            name: utils_1.IndexNames.EntityID,
+                            value: samlConfig.idpMetadata.entityID,
+                        }, {
+                            // secondary index on tenant + product
+                            name: utils_1.IndexNames.TenantProduct,
+                            value: dbutils.keyFromParts(samlConfig.tenant, samlConfig.product),
+                        });
+                    }
+                    else {
+                        throw new Error('Error generating x509 certs');
+                    }
+                }
+                // We will get undefined or Space delimited, case sensitive list of ASCII string values in prompt
+                // If login is one of the value in prompt we want to enable forceAuthn
+                // Else use the saml config forceAuthn value
+                const promptOptions = prompt ? prompt.split(' ').filter((p) => p === 'login') : [];
                 const samlReq = saml20_1.default.request({
                     ssoUrl,
                     entityID: this.opts.samlAudience,
                     callbackUrl: this.opts.externalUrl + this.opts.samlPath,
                     signingKey: samlConfig.certs.privateKey,
                     publicKey: samlConfig.certs.publicKey,
+                    forceAuthn: promptOptions.length > 0 ? true : !!samlConfig.forceAuthn,
                 });
                 const sessionId = crypto_1.default.randomBytes(16).toString('hex');
                 const requested = { client_id, state, redirect_uri };
@@ -550,7 +576,7 @@ class OAuthController {
      *             expires_in: 300
      */
     token(body) {
-        var _a, _b, _c;
+        var _a, _b, _c, _d, _e;
         return __awaiter(this, void 0, void 0, function* () {
             const { client_id, client_secret, code_verifier, code, grant_type = 'authorization_code', redirect_uri, } = body;
             metrics.increment('oauthToken');
@@ -590,6 +616,9 @@ class OAuthController {
                         }
                     }
                     else {
+                        if (sp.tenant !== ((_b = codeVal.requested) === null || _b === void 0 ? void 0 : _b.tenant) || sp.product !== ((_c = codeVal.requested) === null || _c === void 0 ? void 0 : _c.product)) {
+                            throw new error_1.JacksonError('Invalid tenant or product', 401);
+                        }
                         // encoded client_id, verify client_secret
                         if (client_secret !== this.opts.clientSecretVerifier) {
                             throw new error_1.JacksonError('Invalid client_secret', 401);
@@ -608,8 +637,8 @@ class OAuthController {
             // store details against a token
             const token = crypto_1.default.randomBytes(20).toString('hex');
             const tokenVal = Object.assign(Object.assign({}, codeVal.profile), { requested: codeVal.requested });
-            const requestedOIDCFlow = !!((_b = codeVal.requested) === null || _b === void 0 ? void 0 : _b.oidc);
-            const requestHasNonce = !!((_c = codeVal.requested) === null || _c === void 0 ? void 0 : _c.nonce);
+            const requestedOIDCFlow = !!((_d = codeVal.requested) === null || _d === void 0 ? void 0 : _d.oidc);
+            const requestHasNonce = !!((_e = codeVal.requested) === null || _e === void 0 ? void 0 : _e.nonce);
             if (requestedOIDCFlow) {
                 const { jwtSigningKeys, jwsAlg } = this.opts.openid;
                 if (!jwtSigningKeys || !(0, utils_1.isJWSKeyPairLoaded)(jwtSigningKeys)) {

package/dist/directory-sync/DirectoryUsers.js

@@ -143,6 +143,10 @@ class DirectoryUsers {
             this.users.setTenantAndProduct(directory.tenant, directory.product);
             // Get the user
             const { data: user } = userId ? yield this.users.get(userId) : { data: null };
+            // Delete password if exists in the body
+            if (body && 'password' in body) {
+                delete body['password'];
+            }
             if (user) {
                 switch (method) {
                     case 'GET':

package/dist/saml/x509.d.ts

@@ -1,7 +1,7 @@
 declare const _default: {
-    generate: () => Promise<{
-        publicKey: string;
-        privateKey: string;
-    } | undefined>;
+    generate: () => {
+        publicKey: any;
+        privateKey: any;
+    };
 };
 export default _default;

package/dist/saml/x509.js

@@ -22,50 +22,46 @@ var __importStar = (this && this.__importStar) || function (mod) {
     __setModuleDefault(result, mod);
     return result;
 };
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const x509 = __importStar(require("@peculiar/x509"));
-const webcrypto_1 = require("@peculiar/webcrypto");
-const crypto = new webcrypto_1.Crypto();
-x509.cryptoProvider.set(crypto);
-const alg = {
-    name: 'RSASSA-PKCS1-v1_5',
-    hash: 'SHA-256',
-    publicExponent: new Uint8Array([1, 0, 1]),
-    modulusLength: 2048,
+const forge = __importStar(require("node-forge"));
+const pki = forge.pki;
+const generate = () => {
+    const today = new Date();
+    const keys = pki.rsa.generateKeyPair(2048);
+    const cert = pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = '01';
+    cert.validity.notBefore = new Date();
+    cert.validity.notAfter = new Date(today.setFullYear(today.getFullYear() + 10));
+    const attrs = [
+        {
+            name: 'commonName',
+            value: 'BoxyHQ Jackson',
+        },
+    ];
+    cert.setSubject(attrs);
+    cert.setIssuer(attrs);
+    cert.setExtensions([
+        {
+            name: 'basicConstraints',
+            cA: false,
+        },
+        {
+            name: 'keyUsage',
+            keyCertSign: false,
+            digitalSignature: true,
+            nonRepudiation: false,
+            keyEncipherment: false,
+            dataEncipherment: false,
+        },
+    ]);
+    // self-sign certificate
+    cert.sign(keys.privateKey, forge.md.sha256.create());
+    return {
+        publicKey: pki.certificateToPem(cert),
+        privateKey: pki.privateKeyToPem(keys.privateKey),
+    };
 };
-const generate = () => __awaiter(void 0, void 0, void 0, function* () {
-    const keys = yield crypto.subtle.generateKey(alg, true, ['sign', 'verify']);
-    const extensions = [new x509.BasicConstraintsExtension(false, undefined, true)];
-    extensions.push(new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature, true));
-    if (keys.publicKey) {
-        extensions.push(yield x509.SubjectKeyIdentifierExtension.create(keys.publicKey));
-    }
-    const cert = yield x509.X509CertificateGenerator.createSelfSigned({
-        serialNumber: '01',
-        name: 'CN=BoxyHQ Jackson',
-        notBefore: new Date(),
-        notAfter: new Date('3021/01/01'),
-        signingAlgorithm: alg,
-        keys: keys,
-        extensions,
-    });
-    if (keys.privateKey) {
-        const pkcs8 = yield crypto.subtle.exportKey('pkcs8', keys.privateKey);
-        return {
-            publicKey: cert.toString('pem'),
-            privateKey: x509.PemConverter.encode(pkcs8, 'private key'),
-        };
-    }
-});
 exports.default = {
     generate,
 };

package/dist/typings.d.ts

@@ -8,6 +8,7 @@ export declare type IdPConfig = {
     description?: string;
     rawMetadata?: string;
     encodedRawMetadata?: string;
+    forceAuthn: boolean | string;
 };
 export interface IAPIController {
     config(body: IdPConfig): Promise<any>;
@@ -84,6 +85,7 @@ export interface OAuthReqBody {
     code_challenge_method: 'plain' | 'S256' | '';
     provider: 'saml';
     idp_hint?: string;
+    prompt?: string;
 }
 export interface SAMLResponsePayload {
     SAMLResponse: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxyhq/saml-jackson",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "SAML Jackson library",
   "keywords": [
     "SAML 2.0"
@@ -38,40 +38,39 @@
     "statements": 70
   },
   "dependencies": {
-    "@boxyhq/saml20": "1.0.6",
+    "@boxyhq/saml20": "1.0.7",
     "@opentelemetry/api": "1.0.4",
     "@opentelemetry/api-metrics": "0.27.0",
-    "@peculiar/webcrypto": "1.4.0",
     "axios": "^0.27.2",
-    "@peculiar/x509": "1.8.3",
-    "jose": "4.9.2",
+    "jose": "4.9.3",
     "marked": "4.1.0",
-    "mongodb": "4.9.1",
+    "mongodb": "4.10.0",
     "mysql2": "2.3.3",
+    "node-forge": "1.3.1",
     "pg": "8.8.0",
     "redis": "4.3.1",
     "reflect-metadata": "0.1.13",
     "ripemd160": "2.0.2",
-    "typeorm": "0.3.9",
+    "typeorm": "0.3.10",
     "xml2js": "0.4.23",
     "xmlbuilder": "15.1.1"
   },
   "devDependencies": {
-    "@faker-js/faker": "7.2.0",
-    "@types/node": "18.7.16",
+    "@faker-js/faker": "7.5.0",
+    "@types/node": "18.7.23",
     "@types/sinon": "10.0.13",
     "@types/tap": "15.0.7",
-    "@typescript-eslint/eslint-plugin": "5.36.2",
-    "@typescript-eslint/parser": "5.36.2",
+    "@typescript-eslint/eslint-plugin": "5.38.1",
+    "@typescript-eslint/parser": "5.38.1",
     "cross-env": "7.0.3",
-    "eslint": "8.23.0",
+    "eslint": "8.24.0",
     "eslint-config-prettier": "8.5.0",
     "prettier": "2.7.1",
     "sinon": "14.0.0",
     "tap": "16.3.0",
     "ts-node": "10.9.1",
     "tsconfig-paths": "4.1.0",
-    "typescript": "4.8.2"
+    "typescript": "4.8.3"
   },
   "engines": {
     "node": ">=14.18.1 <=16.x"