@c9up/transit 0.1.0

package/src/drivers/OidcDriver.ts

@@ -0,0 +1,379 @@
+/**
+ * Generic OpenID Connect.
+ *
+ * One driver for every provider that conforms: Keycloak, Auth0, Okta,
+ * Entra ID, Authentik, Zitadel, Ping, Google. It is given an issuer and reads
+ * the rest — endpoints, keys, supported algorithms — from what the provider
+ * publishes about itself.
+ *
+ * What separates this from a plain OAuth2 driver is that the answer is a
+ * SIGNED STATEMENT about who the user is, not just a token to go ask with.
+ * That statement is only worth anything once it has been verified, which is
+ * what `jwt.ts` does and what most of this class exists to feed.
+ */
+
+import { randomUUID } from "node:crypto";
+import {
+	assertIdTokenClaims,
+	decodeJws,
+	type IdTokenClaims,
+	isSupportedAlg,
+	type SupportedAlg,
+	verifyJwsSignature,
+} from "../jwt.js";
+import { challengeFor, createCodeVerifier } from "../Oauth2Driver.js";
+import {
+	JwksCache,
+	OidcDiscovery,
+	type OidcMetadata,
+	type RemoteOptions,
+} from "../oidc.js";
+import type {
+	OAuthToken,
+	RedirectRequest,
+	TransitDriver,
+	TransitUser,
+} from "../types.js";
+import { assertOAuthState } from "../types.js";
+
+export interface OidcConfig {
+	/** The provider's issuer URL, exactly as it appears in its tokens. */
+	issuer: string;
+	clientId: string;
+	/**
+	 * The client secret, or something that mints one. Apple has no static
+	 * secret — it expects a short-lived JWT signed with a private key — so this
+	 * is resolved at each token request rather than read once.
+	 */
+	clientSecret: string | (() => string | Promise<string>);
+	callbackUrl: string;
+	/** Default `["openid", "profile", "email"]`. `openid` is added if omitted. */
+	scopes?: string[];
+	/** Extra parameters on the authorize URL — `prompt`, `login_hint`, `acr_values`. */
+	authorizeParams?: Record<string, string>;
+	/**
+	 * Also call the userinfo endpoint, when the provider advertises one.
+	 * Default `true`: the id_token often carries only the subject.
+	 */
+	userinfo?: boolean;
+	/** Tolerance for clock drift against the provider, in seconds. Default 60. */
+	leewaySeconds?: number;
+	/** Cache tuning for the discovery document and the signing keys. */
+	cache?: RemoteOptions;
+}
+
+/**
+ * `secret` carries two values here — the PKCE verifier and the nonce — and the
+ * caller only has to store it and hand it back. Joined by a dot, which the
+ * base64url alphabet does not contain, so neither half can forge a boundary.
+ */
+const SECRET_SEPARATOR = ".";
+
+export class OidcDriver implements TransitDriver {
+	readonly #config: OidcConfig;
+	readonly #discovery: OidcDiscovery;
+	readonly #jwks: JwksCache;
+
+	constructor(config: OidcConfig) {
+		this.#config = config;
+		this.#discovery = new OidcDiscovery(config.issuer, config.cache);
+		this.#jwks = new JwksCache(config.cache);
+	}
+
+	/**
+	 * The endpoints are only known once the provider has been asked, so there
+	 * is nothing to build offline.
+	 */
+	redirectUrl(): string {
+		throw new Error(
+			"[transit] an OpenID Connect provider publishes its endpoints, so the redirect is fetched. Use begin() instead of redirect().",
+		);
+	}
+
+	async begin(state: string = randomUUID()): Promise<RedirectRequest> {
+		const metadata = await this.#discovery.metadata();
+		const verifier = createCodeVerifier();
+		const nonce = randomUUID();
+
+		const params = new URLSearchParams({
+			client_id: this.#config.clientId,
+			redirect_uri: this.#config.callbackUrl,
+			response_type: "code",
+			scope: this.#scopes().join(" "),
+			state,
+			nonce,
+			...this.#config.authorizeParams,
+		});
+
+		// PKCE is not optional for a public client and costs nothing for a
+		// confidential one, so it is sent unless the provider says outright that
+		// it does not take S256.
+		const pkce =
+			metadata.code_challenge_methods_supported?.includes("S256") !== false;
+		if (pkce) {
+			params.set("code_challenge", challengeFor(verifier));
+			params.set("code_challenge_method", "S256");
+		}
+
+		// Whether PKCE was used travels in `secret`. Sending a verifier for a
+		// challenge that was never sent is at best noise, and a strict provider
+		// refuses the exchange over it.
+		return {
+			url: `${metadata.authorization_endpoint}?${params}`,
+			state,
+			secret: `${pkce ? verifier : ""}${SECRET_SEPARATOR}${nonce}`,
+		};
+	}
+
+	async callback(
+		code: string,
+		state?: string,
+		expectedState?: string,
+		secret?: string,
+	): Promise<{ user: TransitUser; token: OAuthToken }> {
+		assertOAuthState(state, expectedState);
+		const { verifier, nonce } = splitSecret(secret);
+
+		const metadata = await this.#discovery.metadata();
+		const tokens = await this.#exchange(metadata, code, verifier);
+
+		const idToken = tokens.id_token;
+		if (typeof idToken !== "string" || idToken === "") {
+			throw new Error(
+				"[transit] the provider returned no id_token — check that the 'openid' scope is granted",
+			);
+		}
+		const claims = await this.#verifyIdToken(metadata, idToken, nonce);
+
+		const accessToken = String(tokens.access_token ?? "");
+		const profile = await this.#profile(metadata, accessToken, claims);
+
+		return {
+			user: this.mapUser(profile),
+			token: {
+				accessToken,
+				...(typeof tokens.refresh_token === "string"
+					? { refreshToken: tokens.refresh_token }
+					: {}),
+				...(typeof tokens.expires_in === "number"
+					? { expiresIn: tokens.expires_in }
+					: {}),
+			},
+		};
+	}
+
+	/** Read a profile behind a token already held, through the userinfo endpoint. */
+	async userFromToken(accessToken: string): Promise<TransitUser> {
+		const metadata = await this.#discovery.metadata();
+		if (!metadata.userinfo_endpoint) {
+			throw new Error(
+				`[transit] '${this.#config.issuer}' publishes no userinfo endpoint, so a profile cannot be read from a token alone.`,
+			);
+		}
+		return this.mapUser(
+			await this.#userinfo(metadata.userinfo_endpoint, accessToken),
+		);
+	}
+
+	/**
+	 * Turn the claims into the shape every driver answers with. A provider that
+	 * spells a standard claim its own way overrides this.
+	 */
+	protected mapUser(raw: Record<string, unknown>): TransitUser {
+		return mapOidcUser(raw);
+	}
+
+	/** The secret for one token request. */
+	async #clientSecret(): Promise<string> {
+		const secret = this.#config.clientSecret;
+		return typeof secret === "function" ? await secret() : secret;
+	}
+
+	#scopes(): string[] {
+		const scopes = [...(this.#config.scopes ?? ["openid", "profile", "email"])];
+		// Without `openid` the provider runs a plain OAuth2 flow and returns no
+		// id_token, which fails later with a much less obvious message.
+		if (!scopes.includes("openid")) scopes.unshift("openid");
+		return scopes;
+	}
+
+	async #exchange(
+		metadata: OidcMetadata,
+		code: string,
+		verifier: string,
+	): Promise<Record<string, unknown>> {
+		const body = new URLSearchParams({
+			grant_type: "authorization_code",
+			code,
+			redirect_uri: this.#config.callbackUrl,
+			client_id: this.#config.clientId,
+			client_secret: await this.#clientSecret(),
+			// Only when a challenge was actually sent.
+			...(verifier === "" ? {} : { code_verifier: verifier }),
+		});
+		const response = await fetch(metadata.token_endpoint, {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/x-www-form-urlencoded",
+			},
+			body,
+		});
+		if (!response.ok) {
+			throw new Error(
+				`[transit] OpenID Connect token exchange failed (HTTP ${response.status})`,
+			);
+		}
+		return (await response.json()) as Record<string, unknown>;
+	}
+
+	/**
+	 * The signature first, then every claim. The algorithm comes from what the
+	 * provider declared it signs with, intersected with what can be verified —
+	 * never from the token's own header.
+	 */
+	async #verifyIdToken(
+		metadata: OidcMetadata,
+		idToken: string,
+		nonce: string,
+	): Promise<IdTokenClaims> {
+		const parts = decodeJws(idToken);
+		const alg = this.#algorithmFor(metadata, parts.header.alg);
+		const kid =
+			typeof parts.header.kid === "string" ? parts.header.kid : undefined;
+
+		const key = await this.#jwks.key(metadata.jwks_uri, kid);
+		if (!verifyJwsSignature(parts, key, alg)) {
+			throw new Error("[transit] id_token signature does not verify");
+		}
+
+		return assertIdTokenClaims(parts.payload, {
+			issuer: metadata.issuer,
+			audience: this.#config.clientId,
+			nonce,
+			leewaySeconds: this.#config.leewaySeconds,
+		});
+	}
+
+	/**
+	 * Which algorithm to verify with.
+	 *
+	 * The header's value is used only to CHOOSE among what the provider says it
+	 * signs with; it can never introduce one that was not declared, and it can
+	 * never select a family this refuses.
+	 */
+	#algorithmFor(metadata: OidcMetadata, headerAlg: unknown): SupportedAlg {
+		// Every conforming provider supports RS256 and publishes the list; the
+		// narrow reading when it does not is that RS256 is all there is.
+		const declared = metadata.id_token_signing_alg_values_supported ?? [
+			"RS256",
+		];
+		const allowed = declared.filter(isSupportedAlg);
+		if (allowed.length === 0) {
+			throw new Error(
+				`[transit] '${this.#config.issuer}' signs id_tokens only with algorithms Transit refuses (${declared.join(", ")}). Asymmetric signatures are required.`,
+			);
+		}
+		if (!isSupportedAlg(headerAlg)) {
+			throw new Error(
+				`[transit] id_token announces '${String(headerAlg)}', which Transit does not verify — only asymmetric signatures are accepted`,
+			);
+		}
+		if (!allowed.includes(headerAlg)) {
+			throw new Error(
+				`[transit] id_token announces '${headerAlg}', which '${this.#config.issuer}' did not declare it signs with`,
+			);
+		}
+		// The header only ever SELECTS from the set computed above. It cannot
+		// introduce an algorithm, which is what keeps `none` and the
+		// shared-secret families away from the verifier entirely.
+		return headerAlg;
+	}
+
+	/**
+	 * The claims, plus userinfo when there is one. The subject must be the same
+	 * in both: a userinfo response describing another user is a substituted
+	 * token, not a richer profile.
+	 */
+	async #profile(
+		metadata: OidcMetadata,
+		accessToken: string,
+		claims: IdTokenClaims,
+	): Promise<Record<string, unknown>> {
+		if (
+			this.#config.userinfo === false ||
+			!metadata.userinfo_endpoint ||
+			accessToken === ""
+		) {
+			return claims as unknown as Record<string, unknown>;
+		}
+		const info = await this.#userinfo(metadata.userinfo_endpoint, accessToken);
+		if (info.sub !== claims.sub) {
+			throw new Error(
+				"[transit] the userinfo response describes a different subject than the id_token",
+			);
+		}
+		return { ...(claims as unknown as Record<string, unknown>), ...info };
+	}
+
+	async #userinfo(
+		endpoint: string,
+		accessToken: string,
+	): Promise<Record<string, unknown>> {
+		const response = await fetch(endpoint, {
+			headers: {
+				Authorization: `Bearer ${accessToken}`,
+				Accept: "application/json",
+			},
+		});
+		if (!response.ok) {
+			throw new Error(
+				`[transit] OpenID Connect userinfo request failed (HTTP ${response.status})`,
+			);
+		}
+		return (await response.json()) as Record<string, unknown>;
+	}
+}
+
+/** Standard OpenID Connect claims, in the shape every driver answers with. */
+export function mapOidcUser(raw: Record<string, unknown>): TransitUser {
+	const given = str(raw, "given_name");
+	const family = str(raw, "family_name");
+	const email = str(raw, "email");
+	return {
+		id: String(raw.sub ?? ""),
+		email: email ?? "",
+		name: str(raw, "name") ?? [given, family].filter(Boolean).join(" "),
+		nickName: str(raw, "preferred_username") ?? given,
+		avatarUrl: str(raw, "picture"),
+		emailVerificationState:
+			email === undefined
+				? "unsupported"
+				: raw.email_verified === true
+					? "verified"
+					: "unverified",
+		raw,
+	};
+}
+
+function str(raw: Record<string, unknown>, key: string): string | undefined {
+	const value = raw[key];
+	return typeof value === "string" && value !== "" ? value : undefined;
+}
+
+/** Split the value `begin()` asked the caller to keep. */
+function splitSecret(secret: string | undefined): {
+	verifier: string;
+	nonce: string;
+} {
+	const index = secret?.indexOf(SECRET_SEPARATOR) ?? -1;
+	// An empty verifier is legitimate — it says PKCE was not used. A missing
+	// separator, or a missing nonce, is a value that did not come from begin().
+	const nonce = secret === undefined ? "" : secret.slice(index + 1);
+	if (secret === undefined || index === -1 || nonce === "") {
+		throw new Error(
+			"[transit] OpenID Connect needs the value begin() returned as `secret` — store it with the state and pass it back here.",
+		);
+	}
+	return { verifier: secret.slice(0, index), nonce };
+}

package/src/drivers/SamlDriver.ts

@@ -0,0 +1,326 @@
+/**
+ * SAML 2.0 Web Browser SSO.
+ *
+ * The pieces are the four layers below this one; what this adds is the walk
+ * between them, and the two bindings a browser sign-in uses: the request
+ * leaves deflated in a query string, and the response comes back base64 in a
+ * form POST.
+ *
+ * The order here is the security. The signature is checked FIRST, and
+ * everything read afterwards comes out of the element it covers — the status
+ * being the one exception, and a deliberate one.
+ */
+
+import { randomUUID } from "node:crypto";
+import { deflateRawSync } from "node:zlib";
+import { verifyXmlSignature } from "../dsig.js";
+import { inProduction } from "../nodeEnv.js";
+import {
+	type AssertionReplayStore,
+	MemoryAssertionReplayStore,
+} from "../replay.js";
+import {
+	assertionInside,
+	assertResponseSucceeded,
+	SamlError,
+	type SamlIdentity,
+	validateAssertion,
+} from "../saml.js";
+import type {
+	OAuthToken,
+	RedirectRequest,
+	TransitDriver,
+	TransitUser,
+} from "../types.js";
+import { assertOAuthState } from "../types.js";
+import { parseXml } from "../xml.js";
+
+const PROTOCOL_NS = "urn:oasis:names:tc:SAML:2.0:protocol";
+const ASSERTION_NS = "urn:oasis:names:tc:SAML:2.0:assertion";
+const HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+const EMAIL_FORMAT = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+
+/**
+ * The attribute names providers actually use for the same three things. A
+ * config names its own when its provider invents another.
+ */
+const EMAIL_CLAIMS = [
+	"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
+	"urn:oid:0.9.2342.19200300.100.1.3",
+	"email",
+	"mail",
+	"emailAddress",
+];
+const NAME_CLAIMS = [
+	"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
+	"urn:oid:2.16.840.1.113730.3.1.241",
+	"displayName",
+	"cn",
+	"name",
+];
+const NICK_CLAIMS = [
+	"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
+	"urn:oid:0.9.2342.19200300.100.1.1",
+	"uid",
+	"givenName",
+];
+
+export interface SamlConfig {
+	/** This application's entity id, as the provider knows it. */
+	entityId: string;
+	/** Where the provider posts its response — this application's ACS URL. */
+	callbackUrl: string;
+	/** The provider's entity id, exactly as its metadata declares it. */
+	issuer: string;
+	/** The provider's sign-on endpoint, for the redirect binding. */
+	signOnUrl: string;
+	/**
+	 * The provider's signing certificates, from its metadata. Several are
+	 * accepted so a rotation can be prepared before it happens.
+	 */
+	certificates: string[];
+	/** The name identifier format to ask for. */
+	nameIdFormat?: string;
+	/** Tolerance for clock drift against the provider. Default 60 seconds. */
+	clockSkewSeconds?: number;
+	/**
+	 * Where used assertions are remembered.
+	 *
+	 * Defaults to this process's memory, which accepts the same assertion once
+	 * per replica — pass `replayStores.redis(…)` as soon as there are two.
+	 */
+	replayStore?: AssertionReplayStore | (() => AssertionReplayStore);
+	/** The attribute names this provider uses, when they are not the usual ones. */
+	claims?: { email?: string; name?: string; nickName?: string };
+}
+
+/**
+ * Refuse to fall into the memory replay store by DEFAULT in production.
+ *
+ * A store that bounds replay per process is real protection on one replica and
+ * none at all on two, and nothing here can tell which is deployed. Defaulting
+ * quietly means the protection disappears exactly when a service is scaled —
+ * the moment nobody is looking at this file.
+ *
+ * Outside production the default stands: a single dev process is the case it
+ * is correct for.
+ */
+function refuseImplicitMemoryReplayStoreInProduction(): void {
+	if (!inProduction()) return;
+	throw new SamlError(
+		"SAML replay protection has no store configured, and the in-process default only bounds replay within ONE process — behind a second replica the same assertion is accepted again on each.\n" +
+			"  Set `replayStore: replayStores.redis({ connection })` to share the record across replicas,\n" +
+			"  or `replayStores.memory()` to state that a single process is intended.",
+	);
+}
+
+export class SamlDriver implements TransitDriver {
+	readonly #config: SamlConfig;
+	#replay: AssertionReplayStore | undefined;
+
+	constructor(config: SamlConfig) {
+		if (config.certificates.length === 0) {
+			// Without a certificate there is nothing to verify against, and a
+			// driver that discovered that at the first sign-in would have let the
+			// application boot looking healthy.
+			throw new SamlError(
+				`no signing certificate for '${config.issuer}' — take them from the provider's metadata`,
+			);
+		}
+		if (config.replayStore === undefined) {
+			// Decided here, not on the first sign-in: a driver that discovered
+			// this mid-request would have let the application boot looking
+			// healthy, and reported it to whoever happened to sign in first.
+			refuseImplicitMemoryReplayStoreInProduction();
+		}
+		this.#config = config;
+	}
+
+	/**
+	 * A SAML request carries its own id, and that id is what the response has
+	 * to answer. There is nothing to build without minting one.
+	 */
+	redirectUrl(): string {
+		throw new Error(
+			"[transit] a SAML sign-in carries a request id the response must answer. Use begin() instead of redirect().",
+		);
+	}
+
+	async begin(state: string = randomUUID()): Promise<RedirectRequest> {
+		// A SAML id is an XML name: it may not start with a digit, and a bare
+		// UUID often does.
+		const requestId = `_${randomUUID()}`;
+		const request = this.#authnRequest(requestId);
+
+		// The redirect binding carries the request deflated — raw, with no zlib
+		// header, which is what the specification asks for.
+		const deflated = deflateRawSync(Buffer.from(request, "utf8")).toString(
+			"base64",
+		);
+		const params = new URLSearchParams({
+			SAMLRequest: deflated,
+			RelayState: state,
+		});
+
+		return {
+			url: `${this.#config.signOnUrl}${this.#config.signOnUrl.includes("?") ? "&" : "?"}${params}`,
+			state,
+			// The response is checked against this id; storing it is not optional.
+			secret: requestId,
+		};
+	}
+
+	/**
+	 * `code` is the base64 `SAMLResponse` from the form post, `state` the
+	 * `RelayState` that came back, `expectedState` the one sent, and `secret`
+	 * the request id `begin()` minted.
+	 */
+	async callback(
+		code: string,
+		state?: string,
+		expectedState?: string,
+		secret?: string,
+	): Promise<{ user: TransitUser; token: OAuthToken }> {
+		assertOAuthState(state, expectedState);
+		if (!secret) {
+			throw new SamlError(
+				"the request id from begin() is missing — store it with the state and pass it back, or any assertion can be posted here",
+			);
+		}
+
+		const document = parseXml(decode(code));
+		if (
+			document.namespaceUri !== PROTOCOL_NS ||
+			document.local !== "Response"
+		) {
+			throw new SamlError(
+				`expected a <Response>, and the document is <${document.qname}>`,
+			);
+		}
+
+		// Read from the unsigned document exactly once, and only this: a refusal
+		// arrives unsigned when the assertion is what carries the signature, and
+		// it exists to be reported rather than trusted. Flipping it the other
+		// way cannot produce an assertion that verifies.
+		assertResponseSucceeded(document);
+
+		// From here on, only what the signature covers.
+		const signed = verifyXmlSignature(document, {
+			certificates: this.#config.certificates,
+		});
+		const assertion = assertionInside(signed);
+
+		const identity = validateAssertion(assertion, {
+			issuer: this.#config.issuer,
+			audience: this.#config.entityId,
+			recipient: this.#config.callbackUrl,
+			inResponseTo: secret,
+			clockSkewSeconds: this.#config.clockSkewSeconds,
+		});
+
+		const fresh = await this.#replayStore().remember(
+			identity.assertionId,
+			identity.notOnOrAfter,
+		);
+		if (!fresh) {
+			// Everything above passes on a captured response posted a second
+			// time. This is what does not.
+			throw new SamlError(
+				"this assertion has already been used — a response cannot sign somebody in twice",
+			);
+		}
+
+		return {
+			user: this.#mapUser(identity),
+			// SAML hands over a statement, not a token to go asking with. The
+			// session index is what a single logout would name.
+			token: { accessToken: identity.sessionIndex ?? identity.assertionId },
+		};
+	}
+
+	#replayStore(): AssertionReplayStore {
+		if (!this.#replay) {
+			const configured = this.#config.replayStore;
+			this.#replay =
+				typeof configured === "function"
+					? configured()
+					: (configured ?? new MemoryAssertionReplayStore());
+		}
+		return this.#replay;
+	}
+
+	#authnRequest(id: string): string {
+		const format = this.#config.nameIdFormat;
+		return (
+			`<samlp:AuthnRequest xmlns:samlp="${PROTOCOL_NS}"` +
+			` ID="${escapeXml(id)}" Version="2.0"` +
+			` IssueInstant="${new Date().toISOString()}"` +
+			` Destination="${escapeXml(this.#config.signOnUrl)}"` +
+			` AssertionConsumerServiceURL="${escapeXml(this.#config.callbackUrl)}"` +
+			` ProtocolBinding="${HTTP_POST}">` +
+			`<saml:Issuer xmlns:saml="${ASSERTION_NS}">${escapeXml(this.#config.entityId)}</saml:Issuer>` +
+			(format
+				? `<samlp:NameIDPolicy Format="${escapeXml(format)}" AllowCreate="true"/>`
+				: "") +
+			"</samlp:AuthnRequest>"
+		);
+	}
+
+	#mapUser(identity: SamlIdentity): TransitUser {
+		const claims = this.#config.claims ?? {};
+		const email =
+			pick(identity, claims.email, EMAIL_CLAIMS) ??
+			(identity.nameIdFormat === EMAIL_FORMAT ? identity.nameId : undefined);
+		const name = pick(identity, claims.name, NAME_CLAIMS);
+
+		return {
+			// The NameID is what the provider calls this person, and the only
+			// value guaranteed to be there.
+			id: identity.nameId,
+			email: email ?? "",
+			name: name ?? identity.nameId,
+			nickName: pick(identity, claims.nickName, NICK_CLAIMS),
+			// A provider that asserts an address has vouched for it: that is what
+			// its directory is.
+			emailVerificationState: email === undefined ? "unsupported" : "verified",
+			raw: {
+				nameId: identity.nameId,
+				nameIdFormat: identity.nameIdFormat,
+				sessionIndex: identity.sessionIndex,
+				attributes: identity.attributes,
+			},
+		};
+	}
+}
+
+/** The first value among the configured name, then the usual ones. */
+function pick(
+	identity: SamlIdentity,
+	configured: string | undefined,
+	candidates: string[],
+): string | undefined {
+	const names = configured ? [configured] : candidates;
+	for (const name of names) {
+		const value = identity.attributes[name]?.[0];
+		if (value !== undefined && value !== "") return value;
+	}
+	return undefined;
+}
+
+function decode(value: string): string {
+	const text = Buffer.from(value.replace(/\s+/g, ""), "base64").toString(
+		"utf8",
+	);
+	if (!text.includes("<")) {
+		throw new SamlError("the SAMLResponse is not base64-encoded XML");
+	}
+	return text;
+}
+
+function escapeXml(value: string): string {
+	return value
+		.replace(/&/g, "&amp;")
+		.replace(/</g, "&lt;")
+		.replace(/>/g, "&gt;")
+		.replace(/"/g, "&quot;");
+}