@boxyhq/saml-jackson 1.32.0 → 1.33.1-beta.1

package/dist/src/controller/sso-handler.js

@@ -0,0 +1,306 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import saml from '@boxyhq/saml20';
+import crypto from 'crypto';
+import { promisify } from 'util';
+import { deflateRaw } from 'zlib';
+import { getDefaultCertificate } from '../saml/x509';
+import * as dbutils from '../db/utils';
+import { JacksonError } from './error';
+import { IndexNames } from './utils';
+import { relayStatePrefix } from './utils';
+import * as redirect from './oauth/redirect';
+import * as allowed from './oauth/allowed';
+import { oidcClientConfig } from './oauth/oidc-client';
+const deflateRawAsync = promisify(deflateRaw);
+export class SSOHandler {
+    constructor({ connection, session, opts, }) {
+        this.createSAMLResponse = (_a) => __awaiter(this, [_a], void 0, function* ({ profile, session }) {
+            const certificate = yield getDefaultCertificate();
+            const mappedClaims = profile.claims;
+            if (session.mappings) {
+                session.mappings.forEach((elem) => {
+                    const key = elem.key;
+                    const value = elem.value;
+                    if (mappedClaims.raw[value]) {
+                        mappedClaims.raw[key] = mappedClaims.raw[value];
+                    }
+                });
+                session.mappings.forEach((elem) => {
+                    const value = elem.value;
+                    delete mappedClaims.raw[value];
+                });
+            }
+            try {
+                const responseSigned = yield saml.createSAMLResponse(Object.assign(Object.assign({ audience: session.requested.entityId, acsUrl: session.requested.acsUrl, requestId: session.requested.id, issuer: `${this.opts.samlAudience}`, claims: mappedClaims }, certificate), { flattenArray: true }));
+                const params = [];
+                if (session.requested.relayState) {
+                    params.push({
+                        name: 'RelayState',
+                        value: session.requested.relayState,
+                    });
+                }
+                params.push({
+                    name: 'SAMLResponse',
+                    value: Buffer.from(responseSigned).toString('base64'),
+                });
+                const responseForm = saml.createPostForm(session.requested.acsUrl, params);
+                return { responseForm };
+            }
+            catch (err) {
+                console.error('Error creating SAML response:', err);
+                // TODO: Instead send saml response with status code
+                throw new JacksonError('Unable to validate SAML Response.', 403);
+            }
+        });
+        // Create a new session to store SP request information
+        this.createSession = (_a) => __awaiter(this, [_a], void 0, function* ({ requestId, requested, oidcCodeVerifier, oidcNonce, mappings, }) {
+            const sessionId = crypto.randomBytes(16).toString('hex');
+            const session = {
+                id: requestId,
+                requested,
+                samlFederated: true,
+                mappings,
+            };
+            if (oidcCodeVerifier) {
+                session['oidcCodeVerifier'] = oidcCodeVerifier;
+            }
+            if (oidcNonce) {
+                session['oidcNonce'] = oidcNonce;
+            }
+            yield this.session.put(sessionId, session);
+            return `${relayStatePrefix}${sessionId}`;
+        });
+        this.connection = connection;
+        this.session = session;
+        this.opts = opts;
+    }
+    // If there are multiple connections for the given tenant and product, return the url to the IdP selection page
+    // If idp_hint is provided, return the connection with the matching clientID
+    // If there is only one connection, return the connection
+    resolveConnection(params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { authFlow, originalParams, tenant, product, idp_hint, entityId, tenants, idFedAppId = '', fedType = '', thirdPartyLogin = null, ssoTraces, } = params;
+            let connections = null;
+            const noSSOConnectionErrMessage = 'No SSO connection found.';
+            // If an IdP is specified, find the connection for that IdP
+            if (idp_hint) {
+                const connection = yield this.connection.get(idp_hint);
+                if (!connection) {
+                    throw new JacksonError(noSSOConnectionErrMessage, 404);
+                }
+                return { connection };
+            }
+            // Find SAML connections for the app
+            if (tenants && tenants.length > 0 && product) {
+                const result = yield Promise.all(tenants.map((tenant) => this.connection.getByIndex({
+                    name: IndexNames.TenantProduct,
+                    value: dbutils.keyFromParts(tenant, product),
+                })));
+                connections = result.flatMap((r) => r.data);
+            }
+            else if (tenant && product) {
+                const result = yield this.connection.getByIndex({
+                    name: IndexNames.TenantProduct,
+                    value: dbutils.keyFromParts(tenant, product),
+                });
+                connections = result.data;
+            }
+            else if (entityId) {
+                const result = yield this.connection.getByIndex({
+                    name: IndexNames.EntityID,
+                    value: entityId,
+                });
+                connections = result.data;
+            }
+            if (!connections || connections.length === 0) {
+                throw new JacksonError(noSSOConnectionErrMessage, 404);
+            }
+            // Third party login from an oidcProvider, here we match the connection from the iss param
+            if ((thirdPartyLogin === null || thirdPartyLogin === void 0 ? void 0 : thirdPartyLogin.idpInitiatorType) === 'oidc') {
+                const oidcConnections = connections.filter((connection) => 'oidcProvider' in connection);
+                for (let _a of oidcConnections) {
+                    const { oidcProvider } = _a, rest = __rest(_a, ["oidcProvider"]);
+                    const connection = Object.assign({ oidcProvider }, rest);
+                    const { discoveryUrl, metadata, clientId, clientSecret } = oidcProvider;
+                    const oidcConfig = yield oidcClientConfig({
+                        discoveryUrl,
+                        metadata,
+                        clientId,
+                        clientSecret,
+                        ssoTraces: ssoTraces,
+                    });
+                    if (oidcConfig.serverMetadata().issuer === thirdPartyLogin.iss) {
+                        if (thirdPartyLogin.target_link_uri) {
+                            if (!allowed.redirect(thirdPartyLogin.target_link_uri, connection.redirectUrl)) {
+                                throw new JacksonError('target_link_uri is not allowed');
+                            }
+                        }
+                        return { connection };
+                    }
+                }
+                // No match found for iss
+                throw new JacksonError(noSSOConnectionErrMessage, 404);
+            }
+            // If more than one, redirect to the connection selection page
+            if (connections.length > 1) {
+                const url = new URL(`${this.opts.externalUrl}${this.opts.idpDiscoveryPath}`);
+                // SP initiated flow
+                if (['oauth', 'saml'].includes(authFlow)) {
+                    const qps = Object.assign({ authFlow: 'sp-initiated', idFedAppId,
+                        fedType }, originalParams);
+                    if (tenant && product && fedType !== 'oidc') {
+                        qps['tenant'] = tenant;
+                        qps['product'] = product;
+                    }
+                    const params = new URLSearchParams(qps);
+                    return { redirectUrl: `${url}?${params}` };
+                }
+                // IdP initiated flow
+                if (authFlow === 'idp-initiated') {
+                    if (entityId) {
+                        const params = new URLSearchParams({
+                            entityId,
+                            authFlow,
+                        });
+                        const postForm = saml.createPostForm(`${this.opts.idpDiscoveryPath}?${params}`, [
+                            {
+                                name: 'SAMLResponse',
+                                value: originalParams.SAMLResponse,
+                            },
+                        ]);
+                        return { postForm };
+                    }
+                }
+            }
+            // If only one, use that connection
+            return { connection: connections[0] };
+        });
+    }
+    createSAMLRequest(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ connection, requestParams, mappings, }) {
+            // We have a connection now, so we can create the SAML request
+            const certificate = yield getDefaultCertificate();
+            const { sso } = connection.idpMetadata;
+            let ssoUrl;
+            let post = false;
+            if ('redirectUrl' in sso) {
+                ssoUrl = sso.redirectUrl;
+            }
+            else if ('postUrl' in sso) {
+                ssoUrl = sso.postUrl;
+                post = true;
+            }
+            const samlRequest = saml.request({
+                ssoUrl,
+                entityID: `${this.opts.samlAudience}`,
+                callbackUrl: this.opts.externalUrl + this.opts.samlPath,
+                signingKey: certificate.privateKey,
+                publicKey: certificate.publicKey,
+                forceAuthn: !!connection.forceAuthn,
+                identifierFormat: connection.identifierFormat
+                    ? connection.identifierFormat
+                    : 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
+            });
+            const relayState = yield this.createSession({
+                requestId: samlRequest.id,
+                requested: Object.assign(Object.assign({}, requestParams), { client_id: connection.clientID }),
+                mappings,
+            });
+            let redirectUrl;
+            let authorizeForm;
+            // Decide whether to use HTTP Redirect or HTTP POST binding
+            if (!post) {
+                redirectUrl = redirect.success(ssoUrl, {
+                    RelayState: relayState,
+                    SAMLRequest: Buffer.from(yield deflateRawAsync(samlRequest.request)).toString('base64'),
+                });
+            }
+            else {
+                authorizeForm = saml.createPostForm(ssoUrl, [
+                    {
+                        name: 'RelayState',
+                        value: relayState,
+                    },
+                    {
+                        name: 'SAMLRequest',
+                        value: Buffer.from(samlRequest.request).toString('base64'),
+                    },
+                ]);
+            }
+            return {
+                redirect_url: redirectUrl,
+                authorize_form: authorizeForm,
+            };
+        });
+    }
+    createOIDCRequest(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ connection, requestParams, mappings, ssoTraces, }) {
+            var _b;
+            if (!this.opts.oidcPath) {
+                throw new JacksonError('OpenID response handler path (oidcPath) is not set', 400);
+            }
+            const { discoveryUrl, metadata, clientId, clientSecret } = connection.oidcProvider;
+            try {
+                const client = yield import('openid-client');
+                const oidcConfig = yield oidcClientConfig({
+                    discoveryUrl,
+                    metadata,
+                    clientId,
+                    clientSecret,
+                    ssoTraces,
+                });
+                const oidcCodeVerifier = client.randomPKCECodeVerifier();
+                const code_challenge = yield client.calculatePKCECodeChallenge(oidcCodeVerifier);
+                const oidcNonce = client.randomNonce();
+                const standardScopes = ((_b = this.opts.openid) === null || _b === void 0 ? void 0 : _b.requestProfileScope)
+                    ? ['openid', 'email', 'profile']
+                    : ['openid', 'email'];
+                const relayState = yield this.createSession({
+                    requestId: connection.clientID,
+                    requested: requestParams,
+                    oidcCodeVerifier,
+                    oidcNonce,
+                    mappings,
+                });
+                const ssoUrl = client.buildAuthorizationUrl(oidcConfig, {
+                    scope: standardScopes
+                        .filter((value, index, self) => self.indexOf(value) === index) // filter out duplicates
+                        .join(' '),
+                    code_challenge,
+                    code_challenge_method: 'S256',
+                    state: relayState,
+                    nonce: oidcNonce,
+                    redirect_uri: this.opts.externalUrl + this.opts.oidcPath,
+                }).href;
+                return {
+                    redirect_url: ssoUrl,
+                    authorize_form: null,
+                };
+            }
+            catch (err) {
+                console.error(err);
+                throw new JacksonError(`Unable to complete OIDC request. - ${err.message}`, 400);
+            }
+        });
+    }
+}
+//# sourceMappingURL=sso-handler.js.map

package/dist/src/controller/sso-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-handler.js","sourceRoot":"","sources":["../../../src/controller/sso-handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,OAAO,IAAI,MAAM,gBAAgB,CAAC;AAClC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAYlC,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,OAAO,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,eAAe,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AAE9C,MAAM,OAAO,UAAU;IAKrB,YAAY,EACV,UAAU,EACV,OAAO,EACP,IAAI,GAKL;QA+SD,uBAAkB,GAAG,KAAqE,EAAE,0CAAhE,EAAE,OAAO,EAAE,OAAO,EAA0C;YACtF,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAElD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;YACpC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;oBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;oBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;oBACzB,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC5B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;oBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;oBACzB,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,+BAClD,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,EACpC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAChC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EACnC,MAAM,EAAE,YAAY,IACjB,WAAW,KACd,YAAY,EAAE,IAAI,IAClB,CAAC;gBAEH,MAAM,MAAM,GAAsC,EAAE,CAAC;gBAErD,IAAI,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,YAAY;wBAClB,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU;qBACpC,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,cAAc;oBACpB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBACtD,CAAC,CAAC;gBAEH,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAE3E,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;gBACpD,oDAAoD;gBACpD,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;YACnE,CAAC;QACH,CAAC,CAAA,CAAC;QAEF,uDAAuD;QAC/C,kBAAa,GAAG,KAYrB,EAAE,0CAZ0B,EAC7B,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,QAAQ,GAOT;YACC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAEzD,MAAM,OAAO,GAAG;gBACd,EAAE,EAAE,SAAS;gBACb,SAAS;gBACT,aAAa,EAAE,IAAI;gBACnB,QAAQ;aACT,CAAC;YAEF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,CAAC,kBAAkB,CAAC,GAAG,gBAAgB,CAAC;YACjD,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;YACnC,CAAC;YAED,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAE3C,OAAO,GAAG,gBAAgB,GAAG,SAAS,EAAE,CAAC;QAC3C,CAAC,CAAA,CAAC;QArYA,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,+GAA+G;IAC/G,4EAA4E;IAC5E,yDAAyD;IACnD,iBAAiB,CAAC,MAavB;;YAWC,MAAM,EACJ,QAAQ,EACR,cAAc,EACd,MAAM,EACN,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,UAAU,GAAG,EAAE,EACf,OAAO,GAAG,EAAE,EACZ,eAAe,GAAG,IAAI,EACtB,SAAS,GACV,GAAG,MAAM,CAAC;YAEX,IAAI,WAAW,GAA6C,IAAI,CAAC;YACjE,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;YAE7D,2DAA2D;YAC3D,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAEvD,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;gBACzD,CAAC;gBAED,OAAO,EAAE,UAAU,EAAE,CAAC;YACxB,CAAC;YAED,oCAAoC;YACpC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;oBACzB,IAAI,EAAE,UAAU,CAAC,aAAa;oBAC9B,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC7C,CAAC,CACH,CACF,CAAC;gBAEF,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9C,IAAI,EAAE,UAAU,CAAC,aAAa;oBAC9B,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC7C,CAAC,CAAC;gBAEH,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;YAC5B,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9C,IAAI,EAAE,UAAU,CAAC,QAAQ;oBACzB,KAAK,EAAE,QAAQ;iBAChB,CAAC,CAAC;gBAEH,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;YAC5B,CAAC;YAED,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;YAED,0FAA0F;YAC1F,IAAI,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,gBAAgB,MAAK,MAAM,EAAE,CAAC;gBACjD,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CACxC,CAAC,UAAU,EAAE,EAAE,CAAC,cAAc,IAAI,UAAU,CAC1B,CAAC;gBAErB,KAAK,IAAA,EAA+B,IAAI,eAAe,EAAE,CAAC;oBAArD,MAAM,EAAE,YAAY,OAAW,EAAN,IAAI,cAAvB,gBAAyB,CAAA,CAAA;oBAClC,MAAM,UAAU,mBAAK,YAAY,IAAK,IAAI,CAAE,CAAC;oBAC7C,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,YAAY,CAAC;oBACxE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;wBACxC,YAAY;wBACZ,QAAQ;wBACR,QAAQ;wBACR,YAAY;wBACZ,SAAS,EAAE,SAAU;qBACtB,CAAC,CAAC;oBAEH,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC,MAAM,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;wBAC/D,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;4BACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,eAAe,EAAE,UAAU,CAAC,WAAuB,CAAC,EAAE,CAAC;gCAC3F,MAAM,IAAI,YAAY,CAAC,gCAAgC,CAAC,CAAC;4BAC3D,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,UAAU,EAAE,CAAC;oBACxB,CAAC;gBACH,CAAC;gBACD,yBAAyB;gBACzB,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;YAED,8DAA8D;YAC9D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBAE7E,oBAAoB;gBACpB,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzC,MAAM,GAAG,mBACP,QAAQ,EAAE,cAAc,EACxB,UAAU;wBACV,OAAO,IACJ,cAAc,CAClB,CAAC;oBACF,IAAI,MAAM,IAAI,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;wBAC5C,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;wBACvB,GAAG,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;oBAC3B,CAAC;oBACD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;oBAExC,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,IAAI,MAAM,EAAE,EAAE,CAAC;gBAC7C,CAAC;gBAED,qBAAqB;gBACrB,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;oBACjC,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;4BACjC,QAAQ;4BACR,QAAQ;yBACT,CAAC,CAAC;wBAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,MAAM,EAAE,EAAE;4BAC9E;gCACE,IAAI,EAAE,cAAc;gCACpB,KAAK,EAAE,cAAc,CAAC,YAAY;6BACnC;yBACF,CAAC,CAAC;wBAEH,OAAO,EAAE,QAAQ,EAAE,CAAC;oBACtB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,mCAAmC;YACnC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC;KAAA;IAEK,iBAAiB;6DAAC,EACtB,UAAU,EACV,aAAa,EACb,QAAQ,GAKT;YACC,8DAA8D;YAC9D,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAElD,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC;YAEvC,IAAI,MAAM,CAAC;YACX,IAAI,IAAI,GAAG,KAAK,CAAC;YAEjB,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC;YAC3B,CAAC;iBAAM,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;gBACrB,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC/B,MAAM;gBACN,QAAQ,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;gBACrC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ;gBACvD,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU;gBACnC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;oBAC3C,CAAC,CAAC,UAAU,CAAC,gBAAgB;oBAC7B,CAAC,CAAC,wDAAwD;aAC7D,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;gBAC1C,SAAS,EAAE,WAAW,CAAC,EAAE;gBACzB,SAAS,kCACJ,aAAa,KAChB,SAAS,EAAE,UAAU,CAAC,QAAQ,GAC/B;gBACD,QAAQ;aACT,CAAC,CAAC;YAEH,IAAI,WAAW,CAAC;YAChB,IAAI,aAAa,CAAC;YAElB,2DAA2D;YAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE;oBACrC,UAAU,EAAE,UAAU;oBACtB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBACxF,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE;oBAC1C;wBACE,IAAI,EAAE,YAAY;wBAClB,KAAK,EAAE,UAAU;qBAClB;oBACD;wBACE,IAAI,EAAE,aAAa;wBACnB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;qBAC3D;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,YAAY,EAAE,WAAW;gBACzB,cAAc,EAAE,aAAa;aAC9B,CAAC;QACJ,CAAC;KAAA;IAEK,iBAAiB;6DAAC,EACtB,UAAU,EACV,aAAa,EACb,QAAQ,EACR,SAAS,GAMV;;YACC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,YAAY,CAAC,oDAAoD,EAAE,GAAG,CAAC,CAAC;YACpF,CAAC;YAED,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,UAAU,CAAC,YAAY,CAAC;YAEnF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;gBAC7C,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;oBACxC,YAAY;oBACZ,QAAQ;oBACR,QAAQ;oBACR,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC;gBACzD,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;gBACjF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvC,MAAM,cAAc,GAAG,CAAA,MAAA,IAAI,CAAC,IAAI,CAAC,MAAM,0CAAE,mBAAmB;oBAC1D,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;oBAChC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAExB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;oBAC1C,SAAS,EAAE,UAAU,CAAC,QAAQ;oBAC9B,SAAS,EAAE,aAAa;oBACxB,gBAAgB;oBAChB,SAAS;oBACT,QAAQ;iBACT,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,CAAC,UAAU,EAAE;oBACtD,KAAK,EAAE,cAAc;yBAClB,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,wBAAwB;yBACtF,IAAI,CAAC,GAAG,CAAC;oBACZ,cAAc;oBACd,qBAAqB,EAAE,MAAM;oBAC7B,KAAK,EAAE,UAAU;oBACjB,KAAK,EAAE,SAAS;oBAChB,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ;iBACzD,CAAC,CAAC,IAAI,CAAC;gBAER,OAAO;oBACL,YAAY,EAAE,MAAM;oBACpB,cAAc,EAAE,IAAI;iBACrB,CAAC;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnB,MAAM,IAAI,YAAY,CAAC,sCAAsC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;KAAA;CA0FF"}

package/dist/src/controller/utils.d.ts

@@ -0,0 +1,84 @@
+import * as jose from 'jose';
+import type { Configuration, authorizationCodeGrant } from 'openid-client' with { 'resolution-mode': 'import' };
+import type { ConnectionType, OAuthErrorHandlerParams, SAMLSSOConnectionWithEncodedMetadata, SAMLSSOConnectionWithRawMetadata, OIDCSSOConnectionWithDiscoveryUrl, OIDCSSOConnectionWithMetadata, Profile, SAMLSSORecord, OIDCSSORecord, Directory } from '../typings';
+export declare enum IndexNames {
+    EntityID = "entityID",
+    TenantProduct = "tenantProduct",
+    OIDCProviderClientID = "OIDCProviderClientID",
+    SSOClientID = "SSOClientID",
+    Product = "product",
+    Service = "service",
+    SetupToken = "token",
+    ProductService = "productService",
+    TenantProductService = "tenantProductService"
+}
+export declare const storeNamespacePrefix: {
+    dsync: {
+        config: string;
+        logs: string;
+        users: string;
+        groups: string;
+        members: string;
+        providers: string;
+        events: string;
+        lock: string;
+    };
+    saml: {
+        config: string;
+    };
+};
+export declare const relayStatePrefix = "boxyhq_jackson_";
+export declare const clientIDFederatedPrefix = "fed_";
+export declare const clientIDOIDCPrefix = "oidc_";
+export declare const validateAbsoluteUrl: (url: any, message: any) => void;
+export declare const OAuthErrorResponse: ({ error, error_description, redirect_uri, state, }: OAuthErrorHandlerParams) => string;
+export declare function getErrorMessage(error: unknown): string;
+export declare const createRandomSecret: (length: number) => Promise<string>;
+export declare function loadJWSPrivateKey(key: string, alg: string): Promise<jose.KeyLike>;
+export declare function isJWSKeyPairLoaded(jwsKeyPair: {
+    private: string;
+    public: string;
+}): boolean;
+export declare const importJWTPublicKey: (key: string, jwsAlg: string) => Promise<jose.KeyLike>;
+export declare const exportPublicKeyJWK: (key: jose.KeyLike) => Promise<jose.JWK>;
+export declare const generateJwkThumbprint: (jwk: jose.JWK) => Promise<string>;
+export declare const computeKid: (key: string, jwsAlg: string) => Promise<string>;
+export declare const validateSSOConnection: (body: SAMLSSOConnectionWithRawMetadata | SAMLSSOConnectionWithEncodedMetadata | OIDCSSOConnectionWithDiscoveryUrl | OIDCSSOConnectionWithMetadata, strategy: ConnectionType) => void;
+export declare const validateRedirectUrl: ({ redirectUrlList, defaultRedirectUrl }: {
+    redirectUrlList: any;
+    defaultRedirectUrl: any;
+}) => void;
+export declare const extractRedirectUrls: (urls: string[] | string) => string[];
+export declare const extractHostName: (url: string) => string | null;
+export type AuthorizationCodeGrantResult = Awaited<ReturnType<typeof authorizationCodeGrant>>;
+export declare const extractOIDCUserProfile: (tokens: AuthorizationCodeGrantResult, oidcConfig: Configuration) => Promise<{
+    claims: Partial<Profile & {
+        raw: Record<string, unknown>;
+    }>;
+}>;
+export declare const getScopeValues: (scope?: string) => string[];
+export declare const getEncodedTenantProduct: (param: string) => {
+    tenant: string | null;
+    product: string | null;
+} | null;
+export declare const validateTenantAndProduct: (tenant: string, product: string) => void;
+export declare const appID: (tenant: string, product: string) => string;
+export declare const fedAppID: (tenant: string, product: string, type?: string) => string;
+declare const wellKnownProviders: {
+    readonly 'okta.com': "Okta";
+    readonly 'sts.windows.net': "Entra ID";
+    readonly 'mocksaml.com': "MockSAML";
+    readonly 'onelogin.com': "OneLogin";
+    readonly 'keycloak.com': "Keycloak";
+    readonly 'jumpcloud.com': "JumpCloud";
+    readonly 'google.com': "Google";
+    readonly 'auth0.com': "Auth0";
+    readonly 'pingone.com': "PingOne";
+};
+export declare const findFriendlyProviderName: (providerName: string) => keyof typeof wellKnownProviders | "null";
+export declare const transformConnections: (connections: Array<SAMLSSORecord | OIDCSSORecord>) => (SAMLSSORecord | OIDCSSORecord)[];
+export declare const transformConnection: (connection: SAMLSSORecord | OIDCSSORecord) => SAMLSSORecord | OIDCSSORecord;
+export declare const isLocalhost: (url: string) => boolean;
+export declare const isConnectionActive: (connection: SAMLSSORecord | OIDCSSORecord | Directory) => boolean;
+export declare const validateSortOrder: (sortOrder: unknown) => void;
+export {};