@boxyhq/saml-jackson 1.33.1-beta.1 → 1.34.0

package/dist/src/controller/sso-handler.js

@@ -1,306 +0,0 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __rest = (this && this.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
-import saml from '@boxyhq/saml20';
-import crypto from 'crypto';
-import { promisify } from 'util';
-import { deflateRaw } from 'zlib';
-import { getDefaultCertificate } from '../saml/x509';
-import * as dbutils from '../db/utils';
-import { JacksonError } from './error';
-import { IndexNames } from './utils';
-import { relayStatePrefix } from './utils';
-import * as redirect from './oauth/redirect';
-import * as allowed from './oauth/allowed';
-import { oidcClientConfig } from './oauth/oidc-client';
-const deflateRawAsync = promisify(deflateRaw);
-export class SSOHandler {
-    constructor({ connection, session, opts, }) {
-        this.createSAMLResponse = (_a) => __awaiter(this, [_a], void 0, function* ({ profile, session }) {
-            const certificate = yield getDefaultCertificate();
-            const mappedClaims = profile.claims;
-            if (session.mappings) {
-                session.mappings.forEach((elem) => {
-                    const key = elem.key;
-                    const value = elem.value;
-                    if (mappedClaims.raw[value]) {
-                        mappedClaims.raw[key] = mappedClaims.raw[value];
-                    }
-                });
-                session.mappings.forEach((elem) => {
-                    const value = elem.value;
-                    delete mappedClaims.raw[value];
-                });
-            }
-            try {
-                const responseSigned = yield saml.createSAMLResponse(Object.assign(Object.assign({ audience: session.requested.entityId, acsUrl: session.requested.acsUrl, requestId: session.requested.id, issuer: `${this.opts.samlAudience}`, claims: mappedClaims }, certificate), { flattenArray: true }));
-                const params = [];
-                if (session.requested.relayState) {
-                    params.push({
-                        name: 'RelayState',
-                        value: session.requested.relayState,
-                    });
-                }
-                params.push({
-                    name: 'SAMLResponse',
-                    value: Buffer.from(responseSigned).toString('base64'),
-                });
-                const responseForm = saml.createPostForm(session.requested.acsUrl, params);
-                return { responseForm };
-            }
-            catch (err) {
-                console.error('Error creating SAML response:', err);
-                // TODO: Instead send saml response with status code
-                throw new JacksonError('Unable to validate SAML Response.', 403);
-            }
-        });
-        // Create a new session to store SP request information
-        this.createSession = (_a) => __awaiter(this, [_a], void 0, function* ({ requestId, requested, oidcCodeVerifier, oidcNonce, mappings, }) {
-            const sessionId = crypto.randomBytes(16).toString('hex');
-            const session = {
-                id: requestId,
-                requested,
-                samlFederated: true,
-                mappings,
-            };
-            if (oidcCodeVerifier) {
-                session['oidcCodeVerifier'] = oidcCodeVerifier;
-            }
-            if (oidcNonce) {
-                session['oidcNonce'] = oidcNonce;
-            }
-            yield this.session.put(sessionId, session);
-            return `${relayStatePrefix}${sessionId}`;
-        });
-        this.connection = connection;
-        this.session = session;
-        this.opts = opts;
-    }
-    // If there are multiple connections for the given tenant and product, return the url to the IdP selection page
-    // If idp_hint is provided, return the connection with the matching clientID
-    // If there is only one connection, return the connection
-    resolveConnection(params) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { authFlow, originalParams, tenant, product, idp_hint, entityId, tenants, idFedAppId = '', fedType = '', thirdPartyLogin = null, ssoTraces, } = params;
-            let connections = null;
-            const noSSOConnectionErrMessage = 'No SSO connection found.';
-            // If an IdP is specified, find the connection for that IdP
-            if (idp_hint) {
-                const connection = yield this.connection.get(idp_hint);
-                if (!connection) {
-                    throw new JacksonError(noSSOConnectionErrMessage, 404);
-                }
-                return { connection };
-            }
-            // Find SAML connections for the app
-            if (tenants && tenants.length > 0 && product) {
-                const result = yield Promise.all(tenants.map((tenant) => this.connection.getByIndex({
-                    name: IndexNames.TenantProduct,
-                    value: dbutils.keyFromParts(tenant, product),
-                })));
-                connections = result.flatMap((r) => r.data);
-            }
-            else if (tenant && product) {
-                const result = yield this.connection.getByIndex({
-                    name: IndexNames.TenantProduct,
-                    value: dbutils.keyFromParts(tenant, product),
-                });
-                connections = result.data;
-            }
-            else if (entityId) {
-                const result = yield this.connection.getByIndex({
-                    name: IndexNames.EntityID,
-                    value: entityId,
-                });
-                connections = result.data;
-            }
-            if (!connections || connections.length === 0) {
-                throw new JacksonError(noSSOConnectionErrMessage, 404);
-            }
-            // Third party login from an oidcProvider, here we match the connection from the iss param
-            if ((thirdPartyLogin === null || thirdPartyLogin === void 0 ? void 0 : thirdPartyLogin.idpInitiatorType) === 'oidc') {
-                const oidcConnections = connections.filter((connection) => 'oidcProvider' in connection);
-                for (let _a of oidcConnections) {
-                    const { oidcProvider } = _a, rest = __rest(_a, ["oidcProvider"]);
-                    const connection = Object.assign({ oidcProvider }, rest);
-                    const { discoveryUrl, metadata, clientId, clientSecret } = oidcProvider;
-                    const oidcConfig = yield oidcClientConfig({
-                        discoveryUrl,
-                        metadata,
-                        clientId,
-                        clientSecret,
-                        ssoTraces: ssoTraces,
-                    });
-                    if (oidcConfig.serverMetadata().issuer === thirdPartyLogin.iss) {
-                        if (thirdPartyLogin.target_link_uri) {
-                            if (!allowed.redirect(thirdPartyLogin.target_link_uri, connection.redirectUrl)) {
-                                throw new JacksonError('target_link_uri is not allowed');
-                            }
-                        }
-                        return { connection };
-                    }
-                }
-                // No match found for iss
-                throw new JacksonError(noSSOConnectionErrMessage, 404);
-            }
-            // If more than one, redirect to the connection selection page
-            if (connections.length > 1) {
-                const url = new URL(`${this.opts.externalUrl}${this.opts.idpDiscoveryPath}`);
-                // SP initiated flow
-                if (['oauth', 'saml'].includes(authFlow)) {
-                    const qps = Object.assign({ authFlow: 'sp-initiated', idFedAppId,
-                        fedType }, originalParams);
-                    if (tenant && product && fedType !== 'oidc') {
-                        qps['tenant'] = tenant;
-                        qps['product'] = product;
-                    }
-                    const params = new URLSearchParams(qps);
-                    return { redirectUrl: `${url}?${params}` };
-                }
-                // IdP initiated flow
-                if (authFlow === 'idp-initiated') {
-                    if (entityId) {
-                        const params = new URLSearchParams({
-                            entityId,
-                            authFlow,
-                        });
-                        const postForm = saml.createPostForm(`${this.opts.idpDiscoveryPath}?${params}`, [
-                            {
-                                name: 'SAMLResponse',
-                                value: originalParams.SAMLResponse,
-                            },
-                        ]);
-                        return { postForm };
-                    }
-                }
-            }
-            // If only one, use that connection
-            return { connection: connections[0] };
-        });
-    }
-    createSAMLRequest(_a) {
-        return __awaiter(this, arguments, void 0, function* ({ connection, requestParams, mappings, }) {
-            // We have a connection now, so we can create the SAML request
-            const certificate = yield getDefaultCertificate();
-            const { sso } = connection.idpMetadata;
-            let ssoUrl;
-            let post = false;
-            if ('redirectUrl' in sso) {
-                ssoUrl = sso.redirectUrl;
-            }
-            else if ('postUrl' in sso) {
-                ssoUrl = sso.postUrl;
-                post = true;
-            }
-            const samlRequest = saml.request({
-                ssoUrl,
-                entityID: `${this.opts.samlAudience}`,
-                callbackUrl: this.opts.externalUrl + this.opts.samlPath,
-                signingKey: certificate.privateKey,
-                publicKey: certificate.publicKey,
-                forceAuthn: !!connection.forceAuthn,
-                identifierFormat: connection.identifierFormat
-                    ? connection.identifierFormat
-                    : 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
-            });
-            const relayState = yield this.createSession({
-                requestId: samlRequest.id,
-                requested: Object.assign(Object.assign({}, requestParams), { client_id: connection.clientID }),
-                mappings,
-            });
-            let redirectUrl;
-            let authorizeForm;
-            // Decide whether to use HTTP Redirect or HTTP POST binding
-            if (!post) {
-                redirectUrl = redirect.success(ssoUrl, {
-                    RelayState: relayState,
-                    SAMLRequest: Buffer.from(yield deflateRawAsync(samlRequest.request)).toString('base64'),
-                });
-            }
-            else {
-                authorizeForm = saml.createPostForm(ssoUrl, [
-                    {
-                        name: 'RelayState',
-                        value: relayState,
-                    },
-                    {
-                        name: 'SAMLRequest',
-                        value: Buffer.from(samlRequest.request).toString('base64'),
-                    },
-                ]);
-            }
-            return {
-                redirect_url: redirectUrl,
-                authorize_form: authorizeForm,
-            };
-        });
-    }
-    createOIDCRequest(_a) {
-        return __awaiter(this, arguments, void 0, function* ({ connection, requestParams, mappings, ssoTraces, }) {
-            var _b;
-            if (!this.opts.oidcPath) {
-                throw new JacksonError('OpenID response handler path (oidcPath) is not set', 400);
-            }
-            const { discoveryUrl, metadata, clientId, clientSecret } = connection.oidcProvider;
-            try {
-                const client = yield import('openid-client');
-                const oidcConfig = yield oidcClientConfig({
-                    discoveryUrl,
-                    metadata,
-                    clientId,
-                    clientSecret,
-                    ssoTraces,
-                });
-                const oidcCodeVerifier = client.randomPKCECodeVerifier();
-                const code_challenge = yield client.calculatePKCECodeChallenge(oidcCodeVerifier);
-                const oidcNonce = client.randomNonce();
-                const standardScopes = ((_b = this.opts.openid) === null || _b === void 0 ? void 0 : _b.requestProfileScope)
-                    ? ['openid', 'email', 'profile']
-                    : ['openid', 'email'];
-                const relayState = yield this.createSession({
-                    requestId: connection.clientID,
-                    requested: requestParams,
-                    oidcCodeVerifier,
-                    oidcNonce,
-                    mappings,
-                });
-                const ssoUrl = client.buildAuthorizationUrl(oidcConfig, {
-                    scope: standardScopes
-                        .filter((value, index, self) => self.indexOf(value) === index) // filter out duplicates
-                        .join(' '),
-                    code_challenge,
-                    code_challenge_method: 'S256',
-                    state: relayState,
-                    nonce: oidcNonce,
-                    redirect_uri: this.opts.externalUrl + this.opts.oidcPath,
-                }).href;
-                return {
-                    redirect_url: ssoUrl,
-                    authorize_form: null,
-                };
-            }
-            catch (err) {
-                console.error(err);
-                throw new JacksonError(`Unable to complete OIDC request. - ${err.message}`, 400);
-            }
-        });
-    }
-}
-//# sourceMappingURL=sso-handler.js.map

package/dist/src/controller/sso-handler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso-handler.js","sourceRoot":"","sources":["../../../src/controller/sso-handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,OAAO,IAAI,MAAM,gBAAgB,CAAC;AAClC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAYlC,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,OAAO,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,eAAe,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AAE9C,MAAM,OAAO,UAAU;IAKrB,YAAY,EACV,UAAU,EACV,OAAO,EACP,IAAI,GAKL;QA+SD,uBAAkB,GAAG,KAAqE,EAAE,0CAAhE,EAAE,OAAO,EAAE,OAAO,EAA0C;YACtF,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAElD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;YACpC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;oBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;oBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;oBACzB,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC5B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;oBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;oBACzB,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,+BAClD,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,EACpC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAChC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EACnC,MAAM,EAAE,YAAY,IACjB,WAAW,KACd,YAAY,EAAE,IAAI,IAClB,CAAC;gBAEH,MAAM,MAAM,GAAsC,EAAE,CAAC;gBAErD,IAAI,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,YAAY;wBAClB,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU;qBACpC,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,cAAc;oBACpB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBACtD,CAAC,CAAC;gBAEH,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAE3E,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;gBACpD,oDAAoD;gBACpD,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;YACnE,CAAC;QACH,CAAC,CAAA,CAAC;QAEF,uDAAuD;QAC/C,kBAAa,GAAG,KAYrB,EAAE,0CAZ0B,EAC7B,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,QAAQ,GAOT;YACC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAEzD,MAAM,OAAO,GAAG;gBACd,EAAE,EAAE,SAAS;gBACb,SAAS;gBACT,aAAa,EAAE,IAAI;gBACnB,QAAQ;aACT,CAAC;YAEF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,CAAC,kBAAkB,CAAC,GAAG,gBAAgB,CAAC;YACjD,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;YACnC,CAAC;YAED,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAE3C,OAAO,GAAG,gBAAgB,GAAG,SAAS,EAAE,CAAC;QAC3C,CAAC,CAAA,CAAC;QArYA,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,+GAA+G;IAC/G,4EAA4E;IAC5E,yDAAyD;IACnD,iBAAiB,CAAC,MAavB;;YAWC,MAAM,EACJ,QAAQ,EACR,cAAc,EACd,MAAM,EACN,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,UAAU,GAAG,EAAE,EACf,OAAO,GAAG,EAAE,EACZ,eAAe,GAAG,IAAI,EACtB,SAAS,GACV,GAAG,MAAM,CAAC;YAEX,IAAI,WAAW,GAA6C,IAAI,CAAC;YACjE,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;YAE7D,2DAA2D;YAC3D,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAEvD,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;gBACzD,CAAC;gBAED,OAAO,EAAE,UAAU,EAAE,CAAC;YACxB,CAAC;YAED,oCAAoC;YACpC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;oBACzB,IAAI,EAAE,UAAU,CAAC,aAAa;oBAC9B,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC7C,CAAC,CACH,CACF,CAAC;gBAEF,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9C,IAAI,EAAE,UAAU,CAAC,aAAa;oBAC9B,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC7C,CAAC,CAAC;gBAEH,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;YAC5B,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9C,IAAI,EAAE,UAAU,CAAC,QAAQ;oBACzB,KAAK,EAAE,QAAQ;iBAChB,CAAC,CAAC;gBAEH,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;YAC5B,CAAC;YAED,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;YAED,0FAA0F;YAC1F,IAAI,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,gBAAgB,MAAK,MAAM,EAAE,CAAC;gBACjD,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CACxC,CAAC,UAAU,EAAE,EAAE,CAAC,cAAc,IAAI,UAAU,CAC1B,CAAC;gBAErB,KAAK,IAAA,EAA+B,IAAI,eAAe,EAAE,CAAC;oBAArD,MAAM,EAAE,YAAY,OAAW,EAAN,IAAI,cAAvB,gBAAyB,CAAA,CAAA;oBAClC,MAAM,UAAU,mBAAK,YAAY,IAAK,IAAI,CAAE,CAAC;oBAC7C,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,YAAY,CAAC;oBACxE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;wBACxC,YAAY;wBACZ,QAAQ;wBACR,QAAQ;wBACR,YAAY;wBACZ,SAAS,EAAE,SAAU;qBACtB,CAAC,CAAC;oBAEH,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC,MAAM,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;wBAC/D,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;4BACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,eAAe,EAAE,UAAU,CAAC,WAAuB,CAAC,EAAE,CAAC;gCAC3F,MAAM,IAAI,YAAY,CAAC,gCAAgC,CAAC,CAAC;4BAC3D,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,UAAU,EAAE,CAAC;oBACxB,CAAC;gBACH,CAAC;gBACD,yBAAyB;gBACzB,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;YAED,8DAA8D;YAC9D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBAE7E,oBAAoB;gBACpB,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzC,MAAM,GAAG,mBACP,QAAQ,EAAE,cAAc,EACxB,UAAU;wBACV,OAAO,IACJ,cAAc,CAClB,CAAC;oBACF,IAAI,MAAM,IAAI,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;wBAC5C,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;wBACvB,GAAG,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;oBAC3B,CAAC;oBACD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;oBAExC,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,IAAI,MAAM,EAAE,EAAE,CAAC;gBAC7C,CAAC;gBAED,qBAAqB;gBACrB,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;oBACjC,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;4BACjC,QAAQ;4BACR,QAAQ;yBACT,CAAC,CAAC;wBAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,MAAM,EAAE,EAAE;4BAC9E;gCACE,IAAI,EAAE,cAAc;gCACpB,KAAK,EAAE,cAAc,CAAC,YAAY;6BACnC;yBACF,CAAC,CAAC;wBAEH,OAAO,EAAE,QAAQ,EAAE,CAAC;oBACtB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,mCAAmC;YACnC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC;KAAA;IAEK,iBAAiB;6DAAC,EACtB,UAAU,EACV,aAAa,EACb,QAAQ,GAKT;YACC,8DAA8D;YAC9D,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAElD,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC;YAEvC,IAAI,MAAM,CAAC;YACX,IAAI,IAAI,GAAG,KAAK,CAAC;YAEjB,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC;YAC3B,CAAC;iBAAM,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;gBACrB,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC/B,MAAM;gBACN,QAAQ,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;gBACrC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ;gBACvD,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU;gBACnC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;oBAC3C,CAAC,CAAC,UAAU,CAAC,gBAAgB;oBAC7B,CAAC,CAAC,wDAAwD;aAC7D,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;gBAC1C,SAAS,EAAE,WAAW,CAAC,EAAE;gBACzB,SAAS,kCACJ,aAAa,KAChB,SAAS,EAAE,UAAU,CAAC,QAAQ,GAC/B;gBACD,QAAQ;aACT,CAAC,CAAC;YAEH,IAAI,WAAW,CAAC;YAChB,IAAI,aAAa,CAAC;YAElB,2DAA2D;YAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE;oBACrC,UAAU,EAAE,UAAU;oBACtB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBACxF,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE;oBAC1C;wBACE,IAAI,EAAE,YAAY;wBAClB,KAAK,EAAE,UAAU;qBAClB;oBACD;wBACE,IAAI,EAAE,aAAa;wBACnB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;qBAC3D;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,YAAY,EAAE,WAAW;gBACzB,cAAc,EAAE,aAAa;aAC9B,CAAC;QACJ,CAAC;KAAA;IAEK,iBAAiB;6DAAC,EACtB,UAAU,EACV,aAAa,EACb,QAAQ,EACR,SAAS,GAMV;;YACC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,YAAY,CAAC,oDAAoD,EAAE,GAAG,CAAC,CAAC;YACpF,CAAC;YAED,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,UAAU,CAAC,YAAY,CAAC;YAEnF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;gBAC7C,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;oBACxC,YAAY;oBACZ,QAAQ;oBACR,QAAQ;oBACR,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC;gBACzD,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;gBACjF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvC,MAAM,cAAc,GAAG,CAAA,MAAA,IAAI,CAAC,IAAI,CAAC,MAAM,0CAAE,mBAAmB;oBAC1D,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;oBAChC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAExB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;oBAC1C,SAAS,EAAE,UAAU,CAAC,QAAQ;oBAC9B,SAAS,EAAE,aAAa;oBACxB,gBAAgB;oBAChB,SAAS;oBACT,QAAQ;iBACT,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,CAAC,UAAU,EAAE;oBACtD,KAAK,EAAE,cAAc;yBAClB,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,wBAAwB;yBACtF,IAAI,CAAC,GAAG,CAAC;oBACZ,cAAc;oBACd,qBAAqB,EAAE,MAAM;oBAC7B,KAAK,EAAE,UAAU;oBACjB,KAAK,EAAE,SAAS;oBAChB,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ;iBACzD,CAAC,CAAC,IAAI,CAAC;gBAER,OAAO;oBACL,YAAY,EAAE,MAAM;oBACpB,cAAc,EAAE,IAAI;iBACrB,CAAC;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnB,MAAM,IAAI,YAAY,CAAC,sCAAsC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;KAAA;CA0FF"}

package/dist/src/controller/utils.d.ts

@@ -1,84 +0,0 @@
-import * as jose from 'jose';
-import type { Configuration, authorizationCodeGrant } from 'openid-client' with { 'resolution-mode': 'import' };
-import type { ConnectionType, OAuthErrorHandlerParams, SAMLSSOConnectionWithEncodedMetadata, SAMLSSOConnectionWithRawMetadata, OIDCSSOConnectionWithDiscoveryUrl, OIDCSSOConnectionWithMetadata, Profile, SAMLSSORecord, OIDCSSORecord, Directory } from '../typings';
-export declare enum IndexNames {
-    EntityID = "entityID",
-    TenantProduct = "tenantProduct",
-    OIDCProviderClientID = "OIDCProviderClientID",
-    SSOClientID = "SSOClientID",
-    Product = "product",
-    Service = "service",
-    SetupToken = "token",
-    ProductService = "productService",
-    TenantProductService = "tenantProductService"
-}
-export declare const storeNamespacePrefix: {
-    dsync: {
-        config: string;
-        logs: string;
-        users: string;
-        groups: string;
-        members: string;
-        providers: string;
-        events: string;
-        lock: string;
-    };
-    saml: {
-        config: string;
-    };
-};
-export declare const relayStatePrefix = "boxyhq_jackson_";
-export declare const clientIDFederatedPrefix = "fed_";
-export declare const clientIDOIDCPrefix = "oidc_";
-export declare const validateAbsoluteUrl: (url: any, message: any) => void;
-export declare const OAuthErrorResponse: ({ error, error_description, redirect_uri, state, }: OAuthErrorHandlerParams) => string;
-export declare function getErrorMessage(error: unknown): string;
-export declare const createRandomSecret: (length: number) => Promise<string>;
-export declare function loadJWSPrivateKey(key: string, alg: string): Promise<jose.KeyLike>;
-export declare function isJWSKeyPairLoaded(jwsKeyPair: {
-    private: string;
-    public: string;
-}): boolean;
-export declare const importJWTPublicKey: (key: string, jwsAlg: string) => Promise<jose.KeyLike>;
-export declare const exportPublicKeyJWK: (key: jose.KeyLike) => Promise<jose.JWK>;
-export declare const generateJwkThumbprint: (jwk: jose.JWK) => Promise<string>;
-export declare const computeKid: (key: string, jwsAlg: string) => Promise<string>;
-export declare const validateSSOConnection: (body: SAMLSSOConnectionWithRawMetadata | SAMLSSOConnectionWithEncodedMetadata | OIDCSSOConnectionWithDiscoveryUrl | OIDCSSOConnectionWithMetadata, strategy: ConnectionType) => void;
-export declare const validateRedirectUrl: ({ redirectUrlList, defaultRedirectUrl }: {
-    redirectUrlList: any;
-    defaultRedirectUrl: any;
-}) => void;
-export declare const extractRedirectUrls: (urls: string[] | string) => string[];
-export declare const extractHostName: (url: string) => string | null;
-export type AuthorizationCodeGrantResult = Awaited<ReturnType<typeof authorizationCodeGrant>>;
-export declare const extractOIDCUserProfile: (tokens: AuthorizationCodeGrantResult, oidcConfig: Configuration) => Promise<{
-    claims: Partial<Profile & {
-        raw: Record<string, unknown>;
-    }>;
-}>;
-export declare const getScopeValues: (scope?: string) => string[];
-export declare const getEncodedTenantProduct: (param: string) => {
-    tenant: string | null;
-    product: string | null;
-} | null;
-export declare const validateTenantAndProduct: (tenant: string, product: string) => void;
-export declare const appID: (tenant: string, product: string) => string;
-export declare const fedAppID: (tenant: string, product: string, type?: string) => string;
-declare const wellKnownProviders: {
-    readonly 'okta.com': "Okta";
-    readonly 'sts.windows.net': "Entra ID";
-    readonly 'mocksaml.com': "MockSAML";
-    readonly 'onelogin.com': "OneLogin";
-    readonly 'keycloak.com': "Keycloak";
-    readonly 'jumpcloud.com': "JumpCloud";
-    readonly 'google.com': "Google";
-    readonly 'auth0.com': "Auth0";
-    readonly 'pingone.com': "PingOne";
-};
-export declare const findFriendlyProviderName: (providerName: string) => keyof typeof wellKnownProviders | "null";
-export declare const transformConnections: (connections: Array<SAMLSSORecord | OIDCSSORecord>) => (SAMLSSORecord | OIDCSSORecord)[];
-export declare const transformConnection: (connection: SAMLSSORecord | OIDCSSORecord) => SAMLSSORecord | OIDCSSORecord;
-export declare const isLocalhost: (url: string) => boolean;
-export declare const isConnectionActive: (connection: SAMLSSORecord | OIDCSSORecord | Directory) => boolean;
-export declare const validateSortOrder: (sortOrder: unknown) => void;
-export {};