@boxyhq/saml-jackson 1.32.0 → 1.33.1-beta.1

package/dist/src/ee/identity-federation/app.js

@@ -0,0 +1,532 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import crypto from 'crypto';
+import saml from '@boxyhq/saml20';
+import { fedAppID, clientIDFederatedPrefix } from '../../controller/utils';
+import { JacksonError } from '../../controller/error';
+import { getDefaultCertificate } from '../../saml/x509';
+import { IndexNames, validateTenantAndProduct } from '../../controller/utils';
+import { throwIfInvalidLicense } from '../common/checkLicense';
+export class App {
+    /**
+     * @swagger
+     * definitions:
+     *   IdentityFederationApp:
+     *      type: object
+     *      properties:
+     *        id:
+     *          type: string
+     *          description: id
+     *        name:
+     *          type: string
+     *          description: name
+     *        tenant:
+     *          type: string
+     *          description: Tenant
+     *        product:
+     *          type: string
+     *          description: Product
+     *        acsUrl:
+     *          type: string
+     *          description: ACS URL
+     *        entityId:
+     *          type: string
+     *          description: Entity ID
+     *        logoUrl:
+     *          type: string
+     *          description: Logo URL (optional)
+     *        faviconUrl:
+     *          type: string
+     *          description: Favicon URL (optional)
+     *        primaryColor:
+     *          type: string
+     *          description: Primary color (optional)
+     */
+    constructor({ store, opts }) {
+        this.store = store;
+        this.opts = opts;
+    }
+    /**
+     * @swagger
+     * /api/v1/identity-federation:
+     *   post:
+     *     summary: Create an Identity Federation app
+     *     parameters:
+     *       - name: name
+     *         description: Name
+     *         in: formData
+     *         required: true
+     *         type: string
+     *       - name: tenant
+     *         description: Tenant
+     *         in: formData
+     *         required: true
+     *         type: string
+     *       - name: product
+     *         description: Product
+     *         in: formData
+     *         required: true
+     *         type: string
+     *       - name: acsUrl
+     *         description: ACS URL
+     *         in: formData
+     *         required: true
+     *         type: string
+     *       - name: entityId
+     *         description: Entity ID
+     *         in: formData
+     *         required: true
+     *         type: string
+     *       - name: logoUrl
+     *         description: Logo URL
+     *         in: formData
+     *         required: false
+     *         type: string
+     *       - name: faviconUrl
+     *         description: Favicon URL
+     *         in: formData
+     *         required: false
+     *         type: string
+     *       - name: primaryColor
+     *         description: Primary color
+     *         in: formData
+     *         required: false
+     *         type: string
+     *       - name: tenants
+     *         description: Mapping of tenants whose connections will be grouped under this Identity Federation app
+     *         in: formData
+     *         required: false
+     *         type: array
+     *       - name: mappings
+     *         description: Mapping of attributes from the IdP to SP
+     *         in: formData
+     *         required: false
+     *         type: array
+     *       - name: type
+     *         description: If creating an OIDC app, this should be set to 'oidc' otherwise it defaults to 'saml'
+     *         in: formData
+     *         required: false
+     *         type: array
+     *       - name: redirectUrl
+     *         description: If creating an OIDC app, provide the redirect URL
+     *         in: formData
+     *         required: false
+     *         type: array
+     *     tags: [Identity Federation]
+     *     produces:
+     *      - application/json
+     *     consumes:
+     *      - application/x-www-form-urlencoded
+     *      - application/json
+     *     responses:
+     *      200:
+     *        description: Success
+     *        schema:
+     *          type: array
+     *          items:
+     *            $ref:  '#/definitions/IdentityFederationApp'
+     */
+    create(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ name, type, redirectUrl, tenant, product, acsUrl, entityId, logoUrl, faviconUrl, primaryColor, tenants, mappings, }) {
+            yield throwIfInvalidLicense(this.opts.boxyhqLicenseKey);
+            if (type === 'oidc') {
+                if (!tenant || !product || !redirectUrl || !name) {
+                    throw new JacksonError('Missing required parameters. Required parameters are: name, tenant, product, redirectUrl', 400);
+                }
+            }
+            else {
+                if (!tenant || !product || !acsUrl || !entityId || !name) {
+                    throw new JacksonError('Missing required parameters. Required parameters are: name, tenant, product, acsUrl, entityId', 400);
+                }
+            }
+            validateTenantAndProduct(tenant, product);
+            const id = fedAppID(tenant, product, type);
+            // Check if an app already exists for the same tenant and product
+            const foundApp = yield this.store.get(id);
+            if (foundApp) {
+                throw new JacksonError('Cannot create another app for the same tenant and product. An app already exists.', 400);
+            }
+            if (type === 'saml') {
+                // Check if an app already exists with the same entityId
+                const result = yield this.store.getByIndex({
+                    name: IndexNames.EntityID,
+                    value: entityId,
+                });
+                const apps = result.data;
+                if (apps && apps.length > 0) {
+                    throw new JacksonError(`An app already exists with the same Entity ID. Provide a unique Entity ID and try again.`, 400);
+                }
+            }
+            let _tenants = [];
+            if (tenants && tenants.length > 0) {
+                _tenants = tenants.filter((t) => t !== tenant);
+                _tenants.unshift(tenant);
+            }
+            else {
+                _tenants.push(tenant);
+            }
+            const app = {
+                id,
+                type,
+                redirectUrl,
+                name,
+                tenant,
+                product,
+                acsUrl,
+                entityId,
+                logoUrl: logoUrl || null,
+                faviconUrl: faviconUrl || null,
+                primaryColor: primaryColor || null,
+                tenants: _tenants,
+                mappings: mappings || [],
+            };
+            if (type === 'oidc') {
+                app.clientID = `${clientIDFederatedPrefix}${id}`;
+                app.clientSecret = crypto.randomBytes(24).toString('hex');
+            }
+            const indexes = [
+                {
+                    name: IndexNames.Product,
+                    value: product,
+                },
+            ];
+            if (type !== 'oidc') {
+                indexes.push({
+                    name: IndexNames.EntityID,
+                    value: entityId,
+                });
+            }
+            yield this.store.put(id, app, ...indexes);
+            return app;
+        });
+    }
+    /**
+     * @swagger
+     * /api/v1/identity-federation:
+     *   get:
+     *     summary: Get an Identity Federation app
+     *     parameters:
+     *       - name: id
+     *         description: App ID
+     *         in: query
+     *         required: true
+     *         type: string
+     *       - name: tenant
+     *         description: Tenant
+     *         in: query
+     *         required: false
+     *         type: string
+     *       - name: product
+     *         description: Product
+     *         in: query
+     *         required: false
+     *         type: string
+     *     tags:
+     *       - Identity Federation
+     *     produces:
+     *       - application/json
+     *     responses:
+     *       '200':
+     *         description: Success
+     *         schema:
+     *           $ref: '#/definitions/IdentityFederationApp'
+     */
+    get(params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield throwIfInvalidLicense(this.opts.boxyhqLicenseKey);
+            if ('id' in params) {
+                const app = yield this.store.get(params.id);
+                if (!app) {
+                    throw new JacksonError('Identity Federation app not found', 404);
+                }
+                return app;
+            }
+            if ('tenant' in params && 'product' in params) {
+                const app = yield this.store.get(fedAppID(params.tenant, params.product, params.type));
+                if (!app) {
+                    throw new JacksonError('Identity Federation app not found', 404);
+                }
+                return app;
+            }
+            throw new JacksonError('Provide either the `id` or `tenant` and `product` to get the app', 400);
+        });
+    }
+    /**
+     * @swagger
+     * /api/v1/identity-federation/product:
+     *   get:
+     *     summary: Get Identity Federation apps by product
+     *     parameters:
+     *       - name: product
+     *         description: Product
+     *         in: query
+     *         required: true
+     *         type: string
+     *       - $ref: '#/parameters/pageOffset'
+     *       - $ref: '#/parameters/pageLimit'
+     *       - $ref: '#/parameters/pageToken'
+     *     tags:
+     *       - Identity Federation
+     *     produces:
+     *       - application/json
+     *     responses:
+     *        200:
+     *          description: Success
+     *          content:
+     *            application/json:
+     *               schema:
+     *                 type: object
+     *                 properties:
+     *                   data:
+     *                     type: array
+     *                     items:
+     *                       $ref: '#/definitions/IdentityFederationApp'
+     *                   pageToken:
+     *                     type: string
+     *                     description: token for pagination
+     */
+    getByProduct(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ product, pageOffset, pageLimit, pageToken }) {
+            yield throwIfInvalidLicense(this.opts.boxyhqLicenseKey);
+            if (!product) {
+                throw new JacksonError('Please provide a `product`.', 400);
+            }
+            const apps = yield this.store.getByIndex({
+                name: IndexNames.Product,
+                value: product,
+            }, pageOffset, pageLimit, pageToken);
+            return apps;
+        });
+    }
+    // Get the app by SP EntityId
+    getByEntityId(entityId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield throwIfInvalidLicense(this.opts.boxyhqLicenseKey);
+            if (!entityId) {
+                throw new JacksonError('Missing required parameters. Required parameters are: entityId', 400);
+            }
+            const apps = (yield this.store.getByIndex({
+                name: IndexNames.EntityID,
+                value: entityId,
+            })).data;
+            if (!apps || apps.length === 0) {
+                throw new JacksonError('Identity Federation app not found', 404);
+            }
+            return apps[0];
+        });
+    }
+    /**
+     * @swagger
+     * /api/v1/identity-federation:
+     *   patch:
+     *     summary: Update an Identity Federation app
+     *     parameters:
+     *       - name: id
+     *         description: App ID
+     *         in: formData
+     *         required: true
+     *         type: string
+     *       - name: tenant
+     *         description: Tenant
+     *         in: formData
+     *         required: false
+     *         type: string
+     *       - name: product
+     *         description: Product
+     *         in: formData
+     *         required: false
+     *         type: string
+     *       - name: name
+     *         description: Name
+     *         in: formData
+     *         required: false
+     *         type: string
+     *       - name: acsUrl
+     *         description: ACS URL
+     *         in: formData
+     *         required: false
+     *         type: string
+     *       - name: logoUrl
+     *         description: Logo URL
+     *         in: formData
+     *         required: false
+     *         type: string
+     *       - name: faviconUrl
+     *         description: Favicon URL
+     *         in: formData
+     *         required: false
+     *         type: string
+     *       - name: primaryColor
+     *         description: Primary color
+     *         in: formData
+     *         required: false
+     *         type: string
+     *       - name: tenants
+     *         description: Mapping of tenants whose connections will be grouped under this Identity Federation app
+     *         in: formData
+     *         required: false
+     *         type: array
+     *       - name: mappings
+     *         description: Mapping of attributes from the IdP to SP
+     *         in: formData
+     *         required: false
+     *         type: array
+     *     tags:
+     *       - Identity Federation
+     *     produces:
+     *       - application/json
+     *     consumes:
+     *      - application/x-www-form-urlencoded
+     *      - application/json
+     *     responses:
+     *       '200':
+     *         description: Success
+     *         schema:
+     *           $ref: '#/definitions/IdentityFederationApp'
+     */
+    update(params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield throwIfInvalidLicense(this.opts.boxyhqLicenseKey);
+            const { id, tenant, product, type } = params;
+            if (!id && (!tenant || !product)) {
+                throw new JacksonError('Provide either the `id` or `tenant` and `product` to update the app', 400);
+            }
+            let app = null;
+            if (id) {
+                app = yield this.get({ id });
+            }
+            else if (tenant && product) {
+                app = yield this.get({ tenant, product, type });
+            }
+            if (!app) {
+                throw new JacksonError('Identity Federation app not found', 404);
+            }
+            const toUpdate = {};
+            // Support partial updates
+            if ('name' in params) {
+                toUpdate['name'] = params.name;
+            }
+            if ('redirectUrl' in params) {
+                toUpdate['redirectUrl'] = params.redirectUrl;
+            }
+            if ('acsUrl' in params) {
+                toUpdate['acsUrl'] = params.acsUrl;
+            }
+            if ('logoUrl' in params) {
+                toUpdate['logoUrl'] = params.logoUrl || null;
+            }
+            if ('faviconUrl' in params) {
+                toUpdate['faviconUrl'] = params.faviconUrl || null;
+            }
+            if ('primaryColor' in params) {
+                toUpdate['primaryColor'] = params.primaryColor || null;
+            }
+            if ('tenants' in params) {
+                let _tenants = [];
+                if (params.tenants && params.tenants.length > 0) {
+                    _tenants = params.tenants.filter((t) => t !== (app === null || app === void 0 ? void 0 : app.tenant));
+                    _tenants.unshift(app.tenant);
+                }
+                else {
+                    _tenants.push(app.tenant);
+                }
+                toUpdate['tenants'] = _tenants;
+            }
+            if ('mappings' in params) {
+                toUpdate['mappings'] = params.mappings;
+            }
+            if (Object.keys(toUpdate).length === 0) {
+                throw new JacksonError('Please provide at least one of the following parameters: acsUrl, name, logoUrl, faviconUrl, primaryColor', 400);
+            }
+            const updatedApp = Object.assign(Object.assign({}, app), toUpdate);
+            yield this.store.put(app.id, updatedApp);
+            return updatedApp;
+        });
+    }
+    // Get all apps
+    getAll(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ pageOffset, pageLimit, pageToken, }) {
+            yield throwIfInvalidLicense(this.opts.boxyhqLicenseKey);
+            const apps = (yield this.store.getAll(pageOffset, pageLimit, pageToken));
+            return apps;
+        });
+    }
+    /**
+     * @swagger
+     * /api/v1/identity-federation:
+     *   delete:
+     *     summary: Delete an Identity Federation app
+     *     parameters:
+     *       - name: id
+     *         description: App ID
+     *         in: query
+     *         required: true
+     *         type: string
+     *       - name: tenant
+     *         description: Tenant
+     *         in: query
+     *         required: false
+     *         type: string
+     *       - name: product
+     *         description: Product
+     *         in: query
+     *         required: false
+     *         type: string
+     *     tags:
+     *       - Identity Federation
+     *     produces:
+     *       - application/json
+     *     responses:
+     *       '200':
+     *         description: Success
+     *         schema:
+     *           $ref: '#/definitions/IdentityFederationApp'
+     */
+    delete(params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield throwIfInvalidLicense(this.opts.boxyhqLicenseKey);
+            if ('id' in params) {
+                return yield this.store.delete(params.id);
+            }
+            if ('tenant' in params && 'product' in params) {
+                const id = fedAppID(params.tenant, params.product, params.type);
+                return yield this.store.delete(id);
+            }
+            throw new JacksonError('Provide either the `id` or `tenant` and `product` to delete the app', 400);
+        });
+    }
+    // Get the metadata for the app
+    getMetadata() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield throwIfInvalidLicense(this.opts.boxyhqLicenseKey);
+            const { publicKey } = yield getDefaultCertificate();
+            const ssoUrl = `${this.opts.externalUrl}/api/identity-federation/sso`;
+            const entityId = `${this.opts.samlAudience}`;
+            const xml = saml.createIdPMetadataXML({
+                entityId,
+                ssoUrl,
+                x509cert: publicKey,
+                wantAuthnRequestsSigned: false,
+            });
+            return {
+                xml,
+                entityId,
+                ssoUrl,
+                x509cert: publicKey,
+            };
+        });
+    }
+    getCount(idx) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.store.getCount(idx);
+        });
+    }
+}
+//# sourceMappingURL=app.js.map

package/dist/src/ee/identity-federation/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../../../src/ee/identity-federation/app.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,gBAAgB,CAAC;AAWlC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAW/D,MAAM,OAAO,GAAG;IAId;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IAEH,YAAY,EAAE,KAAK,EAAE,IAAI,EAA4C;QACnE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+EG;IACU,MAAM;6DAAC,EAClB,IAAI,EACJ,IAAI,EACJ,WAAW,EACX,MAAM,EACN,OAAO,EACP,MAAM,EACN,QAAQ,EACR,OAAO,EACP,UAAU,EACV,YAAY,EACZ,OAAO,EACP,QAAQ,GACK;YACb,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAExD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC;oBACjD,MAAM,IAAI,YAAY,CACpB,0FAA0F,EAC1F,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;oBACzD,MAAM,IAAI,YAAY,CACpB,+FAA+F,EAC/F,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAE1C,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAE3C,iEAAiE;YACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAE1C,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,YAAY,CACpB,mFAAmF,EACnF,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,wDAAwD;gBACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;oBACzC,IAAI,EAAE,UAAU,CAAC,QAAQ;oBACzB,KAAK,EAAE,QAAQ;iBAChB,CAAC,CAAC;gBAEH,MAAM,IAAI,GAA4B,MAAM,CAAC,IAAI,CAAC;gBAElD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,YAAY,CACpB,0FAA0F,EAC1F,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,GAAa,EAAE,CAAC;YAE5B,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;gBAC/C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;YAED,MAAM,GAAG,GAA0B;gBACjC,EAAE;gBACF,IAAI;gBACJ,WAAW;gBACX,IAAI;gBACJ,MAAM;gBACN,OAAO;gBACP,MAAM;gBACN,QAAQ;gBACR,OAAO,EAAE,OAAO,IAAI,IAAI;gBACxB,UAAU,EAAE,UAAU,IAAI,IAAI;gBAC9B,YAAY,EAAE,YAAY,IAAI,IAAI;gBAClC,OAAO,EAAE,QAAQ;gBACjB,QAAQ,EAAE,QAAQ,IAAI,EAAE;aACzB,CAAC;YAEF,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,GAAG,CAAC,QAAQ,GAAG,GAAG,uBAAuB,GAAG,EAAE,EAAE,CAAC;gBACjD,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,OAAO,GAAG;gBACd;oBACE,IAAI,EAAE,UAAU,CAAC,OAAO;oBACxB,KAAK,EAAE,OAAO;iBACf;aACF,CAAC;YAEF,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,UAAU,CAAC,QAAQ;oBACzB,KAAK,EAAE,QAAQ;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;YAE1C,OAAO,GAAG,CAAC;QACb,CAAC;KAAA;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACU,GAAG,CAAC,MAAwB;;YACvC,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAExD,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAE5C,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;gBACnE,CAAC;gBAED,OAAO,GAA4B,CAAC;YACtC,CAAC;YAED,IAAI,QAAQ,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;gBAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAEvF,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;gBACnE,CAAC;gBAED,OAAO,GAA4B,CAAC;YACtC,CAAC;YAED,MAAM,IAAI,YAAY,CAAC,kEAAkE,EAAE,GAAG,CAAC,CAAC;QAClG,CAAC;KAAA;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACU,YAAY;6DAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAsB;YACzF,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAExD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,YAAY,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CACtC;gBACE,IAAI,EAAE,UAAU,CAAC,OAAO;gBACxB,KAAK,EAAE,OAAO;aACf,EACD,UAAU,EACV,SAAS,EACT,SAAS,CACV,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAED,6BAA6B;IAChB,aAAa,CAAC,QAAgB;;YACzC,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAExD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,YAAY,CAAC,gEAAgE,EAAE,GAAG,CAAC,CAAC;YAChG,CAAC;YAED,MAAM,IAAI,GAA4B,CACpC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,EAAE,UAAU,CAAC,QAAQ;gBACzB,KAAK,EAAE,QAAQ;aAChB,CAAC,CACH,CAAC,IAAI,CAAC;YAEP,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;YACnE,CAAC;YAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;KAAA;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoEG;IACU,MAAM,CAAC,MAAsC;;YACxD,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAExD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;YAE7C,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,YAAY,CAAC,qEAAqE,EAAE,GAAG,CAAC,CAAC;YACrG,CAAC;YAED,IAAI,GAAG,GAAiC,IAAI,CAAC;YAE7C,IAAI,EAAE,EAAE,CAAC;gBACP,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/B,CAAC;iBAAM,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,QAAQ,GAAmC,EAAE,CAAC;YAEpD,0BAA0B;YAE1B,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;gBACrB,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;YACjC,CAAC;YAED,IAAI,aAAa,IAAI,MAAM,EAAE,CAAC;gBAC5B,QAAQ,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;YAC/C,CAAC;YAED,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;gBACvB,QAAQ,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;YACrC,CAAC;YAED,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;gBACxB,QAAQ,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;YAC/C,CAAC;YAED,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;gBAC3B,QAAQ,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;YACrD,CAAC;YAED,IAAI,cAAc,IAAI,MAAM,EAAE,CAAC;gBAC7B,QAAQ,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;YACzD,CAAC;YAED,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;gBACxB,IAAI,QAAQ,GAAa,EAAE,CAAC;gBAE5B,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChD,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAK,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAA,CAAC,CAAC;oBAC3D,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC5B,CAAC;gBAED,QAAQ,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC;YACjC,CAAC;YAED,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;gBACzB,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;YACzC,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,YAAY,CACpB,0GAA0G,EAC1G,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,mCACX,GAAG,GACH,QAAQ,CACZ,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YAEzC,OAAO,UAAU,CAAC;QACpB,CAAC;KAAA;IAED,eAAe;IACF,MAAM;6DAAC,EAClB,UAAU,EACV,SAAS,EACT,SAAS,GAKV;YACC,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAExD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CACnC,UAAU,EACV,SAAS,EACT,SAAS,CACV,CAAmC,CAAC;YAErC,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACU,MAAM,CAAC,MAAwB;;YAC1C,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAExD,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;gBACnB,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5C,CAAC;YAED,IAAI,QAAQ,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;gBAC9C,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAChE,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,MAAM,IAAI,YAAY,CAAC,qEAAqE,EAAE,GAAG,CAAC,CAAC;QACrG,CAAC;KAAA;IAED,+BAA+B;IAClB,WAAW;;YACtB,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAExD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAEpD,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,8BAA8B,CAAC;YACtE,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,CAAC;gBACpC,QAAQ;gBACR,MAAM;gBACN,QAAQ,EAAE,SAAS;gBACnB,uBAAuB,EAAE,KAAK;aAC/B,CAAC,CAAC;YAEH,OAAO;gBACL,GAAG;gBACH,QAAQ;gBACR,MAAM;gBACN,QAAQ,EAAE,SAAS;aACpB,CAAC;QACJ,CAAC;KAAA;IAEY,QAAQ,CAAC,GAAW;;YAC/B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;KAAA;CACF"}

package/dist/src/ee/identity-federation/idp-login.d.ts

@@ -0,0 +1,18 @@
+import { OIDCIdPInitiatedReq } from '../../typings';
+export declare class IdPLogin {
+    private ssoHandler;
+    private ssoTraces;
+    private app;
+    private opts;
+    constructor({ app, ssoHandler, ssoTraces, opts }: {
+        app: any;
+        ssoHandler: any;
+        ssoTraces: any;
+        opts: any;
+    });
+    oidcInitiateLogin(body: OIDCIdPInitiatedReq & {
+        fedAppId: string;
+    }): Promise<{
+        redirect_url: string;
+    }>;
+}

package/dist/src/ee/identity-federation/idp-login.js

@@ -0,0 +1,98 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { JacksonError } from '../../controller/error';
+import { getErrorMessage, isConnectionActive } from '../../controller/utils';
+import { throwIfInvalidLicense } from '../common/checkLicense';
+export class IdPLogin {
+    constructor({ app, ssoHandler, ssoTraces, opts }) {
+        this.app = app;
+        this.ssoHandler = ssoHandler;
+        this.ssoTraces = ssoTraces;
+        this.opts = opts;
+    }
+    // Supported for SAML Federation only
+    oidcInitiateLogin(body) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield throwIfInvalidLicense(this.opts.boxyhqLicenseKey);
+            let connection;
+            let fedApp;
+            const { iss, target_link_uri, fedAppId } = body;
+            const context = {
+                isSAMLFederated: true,
+                relayState: target_link_uri,
+                isIdPFlow: true,
+                oidcIdPRequest: body,
+            };
+            try {
+                // get federated connection
+                fedApp = yield this.app.get({
+                    id: fedAppId,
+                });
+                const requestedTenant = fedApp.tenant;
+                const requestedProduct = fedApp.product;
+                context.tenant = requestedTenant;
+                context.product = requestedProduct;
+                if (fedApp.type !== 'saml') {
+                    throw new JacksonError('Third party login from an OIDC provider is only supported with SAML Federation', 400);
+                }
+                const response = yield this.ssoHandler.resolveConnection({
+                    tenant: requestedTenant,
+                    product: requestedProduct,
+                    authFlow: 'idp-initiated',
+                    originalParams: Object.assign({}, body),
+                    tenants: fedApp.tenants,
+                    idFedAppId: fedApp.id,
+                    fedType: fedApp.type, // will be saml
+                    thirdPartyLogin: { idpInitiatorType: 'oidc', iss, target_link_uri },
+                    ssoTraces: { instance: this.ssoTraces, context },
+                });
+                if ('connection' in response) {
+                    connection = response.connection;
+                }
+                if (!connection) {
+                    throw new JacksonError('IdP connection not found.', 404);
+                }
+                context.clientID = connection.clientID;
+                context.providerName = (connection === null || connection === void 0 ? void 0 : connection.oidcProvider.friendlyProviderName) || '';
+                context.acsUrl = fedApp.acsUrl;
+                context.entityId = fedApp.entityId;
+                if (!isConnectionActive(connection)) {
+                    throw new JacksonError('OIDC connection is deactivated. Please contact your administrator.', 403);
+                }
+                const requestParams = {
+                    acsUrl: fedApp.acsUrl,
+                    entityId: fedApp.entityId,
+                    tenant: fedApp.tenant,
+                    product: fedApp.product,
+                    relayState: target_link_uri,
+                    oidcIdPRequest: body,
+                };
+                return yield this.ssoHandler.createOIDCRequest({
+                    connection,
+                    requestParams,
+                    mappings: fedApp.mappings,
+                    ssoTraces: {
+                        instance: this.ssoTraces,
+                        context,
+                    },
+                });
+            }
+            catch (err) {
+                const error_description = getErrorMessage(err);
+                this.ssoTraces.saveTrace({
+                    error: error_description,
+                    context,
+                });
+                throw err;
+            }
+        });
+    }
+}
+//# sourceMappingURL=idp-login.js.map

package/dist/src/ee/identity-federation/idp-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp-login.js","sourceRoot":"","sources":["../../../../src/ee/identity-federation/idp-login.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAS7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,MAAM,OAAO,QAAQ;IAMnB,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE;QAC9C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,qCAAqC;IACxB,iBAAiB,CAC5B,IAAgD;;YAEhD,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAExD,IAAI,UAAqC,CAAC;YAC1C,IAAI,MAAyC,CAAC;YAC9C,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;YAChD,MAAM,OAAO,GAAG;gBACd,eAAe,EAAE,IAAI;gBACrB,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,IAAI;aACa,CAAC;YAEpC,IAAI,CAAC;gBACH,2BAA2B;gBAC3B,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC1B,EAAE,EAAE,QAAQ;iBACb,CAAC,CAAC;gBAEH,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;gBACtC,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC;gBAExC,OAAO,CAAC,MAAM,GAAG,eAAe,CAAC;gBACjC,OAAO,CAAC,OAAO,GAAG,gBAAgB,CAAC;gBAEnC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC3B,MAAM,IAAI,YAAY,CACpB,gFAAgF,EAChF,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;oBACvD,MAAM,EAAE,eAAe;oBACvB,OAAO,EAAE,gBAAgB;oBACzB,QAAQ,EAAE,eAAe;oBACzB,cAAc,oBAAO,IAAI,CAAE;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,UAAU,EAAE,MAAM,CAAC,EAAE;oBACrB,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,eAAe;oBACrC,eAAe,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE;oBACnE,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE;iBACjD,CAAC,CAAC;gBAEH,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;oBAC7B,UAAU,GAAG,QAAQ,CAAC,UAA2B,CAAC;gBACpD,CAAC;gBAED,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;gBAED,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;gBACvC,OAAO,CAAC,YAAY,GAAG,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,YAAY,CAAC,oBAAoB,KAAI,EAAE,CAAC;gBAC3E,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC/B,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAEnC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,YAAY,CAAC,oEAAoE,EAAE,GAAG,CAAC,CAAC;gBACpG,CAAC;gBAED,MAAM,aAAa,GAAG;oBACpB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,UAAU,EAAE,eAAe;oBAC3B,cAAc,EAAE,IAAI;iBACrB,CAAC;gBAEF,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;oBAC7C,UAAU;oBACV,aAAa;oBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,SAAS,EAAE;wBACT,QAAQ,EAAE,IAAI,CAAC,SAAS;wBACxB,OAAO;qBACR;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;gBAE/C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;oBACvB,KAAK,EAAE,iBAAiB;oBACxB,OAAO;iBACR,CAAC,CAAC;gBAEH,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;KAAA;CACF"}

package/dist/src/ee/identity-federation/index.d.ts

@@ -0,0 +1,15 @@
+import { SSO } from './sso';
+import { App } from './app';
+import type { JacksonOption, SSOTracesInstance } from '../../typings';
+import { IdPLogin } from './idp-login';
+declare const IdentityFederation: ({ db, opts, ssoTraces, }: {
+    db: any;
+    opts: JacksonOption;
+    ssoTraces: SSOTracesInstance;
+}) => Promise<{
+    app: App;
+    sso: SSO;
+    idpLogin: IdPLogin;
+}>;
+export default IdentityFederation;
+export * from './types';