@c9up/transit 0.1.0

package/dist/drivers/SamlDriver.js

@@ -0,0 +1,228 @@
+/**
+ * SAML 2.0 Web Browser SSO.
+ *
+ * The pieces are the four layers below this one; what this adds is the walk
+ * between them, and the two bindings a browser sign-in uses: the request
+ * leaves deflated in a query string, and the response comes back base64 in a
+ * form POST.
+ *
+ * The order here is the security. The signature is checked FIRST, and
+ * everything read afterwards comes out of the element it covers — the status
+ * being the one exception, and a deliberate one.
+ */
+import { randomUUID } from "node:crypto";
+import { deflateRawSync } from "node:zlib";
+import { verifyXmlSignature } from "../dsig.js";
+import { inProduction } from "../nodeEnv.js";
+import { MemoryAssertionReplayStore, } from "../replay.js";
+import { assertionInside, assertResponseSucceeded, SamlError, validateAssertion, } from "../saml.js";
+import { assertOAuthState } from "../types.js";
+import { parseXml } from "../xml.js";
+const PROTOCOL_NS = "urn:oasis:names:tc:SAML:2.0:protocol";
+const ASSERTION_NS = "urn:oasis:names:tc:SAML:2.0:assertion";
+const HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+const EMAIL_FORMAT = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+/**
+ * The attribute names providers actually use for the same three things. A
+ * config names its own when its provider invents another.
+ */
+const EMAIL_CLAIMS = [
+    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
+    "urn:oid:0.9.2342.19200300.100.1.3",
+    "email",
+    "mail",
+    "emailAddress",
+];
+const NAME_CLAIMS = [
+    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
+    "urn:oid:2.16.840.1.113730.3.1.241",
+    "displayName",
+    "cn",
+    "name",
+];
+const NICK_CLAIMS = [
+    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
+    "urn:oid:0.9.2342.19200300.100.1.1",
+    "uid",
+    "givenName",
+];
+/**
+ * Refuse to fall into the memory replay store by DEFAULT in production.
+ *
+ * A store that bounds replay per process is real protection on one replica and
+ * none at all on two, and nothing here can tell which is deployed. Defaulting
+ * quietly means the protection disappears exactly when a service is scaled —
+ * the moment nobody is looking at this file.
+ *
+ * Outside production the default stands: a single dev process is the case it
+ * is correct for.
+ */
+function refuseImplicitMemoryReplayStoreInProduction() {
+    if (!inProduction())
+        return;
+    throw new SamlError("SAML replay protection has no store configured, and the in-process default only bounds replay within ONE process — behind a second replica the same assertion is accepted again on each.\n" +
+        "  Set `replayStore: replayStores.redis({ connection })` to share the record across replicas,\n" +
+        "  or `replayStores.memory()` to state that a single process is intended.");
+}
+export class SamlDriver {
+    #config;
+    #replay;
+    constructor(config) {
+        if (config.certificates.length === 0) {
+            // Without a certificate there is nothing to verify against, and a
+            // driver that discovered that at the first sign-in would have let the
+            // application boot looking healthy.
+            throw new SamlError(`no signing certificate for '${config.issuer}' — take them from the provider's metadata`);
+        }
+        if (config.replayStore === undefined) {
+            // Decided here, not on the first sign-in: a driver that discovered
+            // this mid-request would have let the application boot looking
+            // healthy, and reported it to whoever happened to sign in first.
+            refuseImplicitMemoryReplayStoreInProduction();
+        }
+        this.#config = config;
+    }
+    /**
+     * A SAML request carries its own id, and that id is what the response has
+     * to answer. There is nothing to build without minting one.
+     */
+    redirectUrl() {
+        throw new Error("[transit] a SAML sign-in carries a request id the response must answer. Use begin() instead of redirect().");
+    }
+    async begin(state = randomUUID()) {
+        // A SAML id is an XML name: it may not start with a digit, and a bare
+        // UUID often does.
+        const requestId = `_${randomUUID()}`;
+        const request = this.#authnRequest(requestId);
+        // The redirect binding carries the request deflated — raw, with no zlib
+        // header, which is what the specification asks for.
+        const deflated = deflateRawSync(Buffer.from(request, "utf8")).toString("base64");
+        const params = new URLSearchParams({
+            SAMLRequest: deflated,
+            RelayState: state,
+        });
+        return {
+            url: `${this.#config.signOnUrl}${this.#config.signOnUrl.includes("?") ? "&" : "?"}${params}`,
+            state,
+            // The response is checked against this id; storing it is not optional.
+            secret: requestId,
+        };
+    }
+    /**
+     * `code` is the base64 `SAMLResponse` from the form post, `state` the
+     * `RelayState` that came back, `expectedState` the one sent, and `secret`
+     * the request id `begin()` minted.
+     */
+    async callback(code, state, expectedState, secret) {
+        assertOAuthState(state, expectedState);
+        if (!secret) {
+            throw new SamlError("the request id from begin() is missing — store it with the state and pass it back, or any assertion can be posted here");
+        }
+        const document = parseXml(decode(code));
+        if (document.namespaceUri !== PROTOCOL_NS ||
+            document.local !== "Response") {
+            throw new SamlError(`expected a <Response>, and the document is <${document.qname}>`);
+        }
+        // Read from the unsigned document exactly once, and only this: a refusal
+        // arrives unsigned when the assertion is what carries the signature, and
+        // it exists to be reported rather than trusted. Flipping it the other
+        // way cannot produce an assertion that verifies.
+        assertResponseSucceeded(document);
+        // From here on, only what the signature covers.
+        const signed = verifyXmlSignature(document, {
+            certificates: this.#config.certificates,
+        });
+        const assertion = assertionInside(signed);
+        const identity = validateAssertion(assertion, {
+            issuer: this.#config.issuer,
+            audience: this.#config.entityId,
+            recipient: this.#config.callbackUrl,
+            inResponseTo: secret,
+            clockSkewSeconds: this.#config.clockSkewSeconds,
+        });
+        const fresh = await this.#replayStore().remember(identity.assertionId, identity.notOnOrAfter);
+        if (!fresh) {
+            // Everything above passes on a captured response posted a second
+            // time. This is what does not.
+            throw new SamlError("this assertion has already been used — a response cannot sign somebody in twice");
+        }
+        return {
+            user: this.#mapUser(identity),
+            // SAML hands over a statement, not a token to go asking with. The
+            // session index is what a single logout would name.
+            token: { accessToken: identity.sessionIndex ?? identity.assertionId },
+        };
+    }
+    #replayStore() {
+        if (!this.#replay) {
+            const configured = this.#config.replayStore;
+            this.#replay =
+                typeof configured === "function"
+                    ? configured()
+                    : (configured ?? new MemoryAssertionReplayStore());
+        }
+        return this.#replay;
+    }
+    #authnRequest(id) {
+        const format = this.#config.nameIdFormat;
+        return (`<samlp:AuthnRequest xmlns:samlp="${PROTOCOL_NS}"` +
+            ` ID="${escapeXml(id)}" Version="2.0"` +
+            ` IssueInstant="${new Date().toISOString()}"` +
+            ` Destination="${escapeXml(this.#config.signOnUrl)}"` +
+            ` AssertionConsumerServiceURL="${escapeXml(this.#config.callbackUrl)}"` +
+            ` ProtocolBinding="${HTTP_POST}">` +
+            `<saml:Issuer xmlns:saml="${ASSERTION_NS}">${escapeXml(this.#config.entityId)}</saml:Issuer>` +
+            (format
+                ? `<samlp:NameIDPolicy Format="${escapeXml(format)}" AllowCreate="true"/>`
+                : "") +
+            "</samlp:AuthnRequest>");
+    }
+    #mapUser(identity) {
+        const claims = this.#config.claims ?? {};
+        const email = pick(identity, claims.email, EMAIL_CLAIMS) ??
+            (identity.nameIdFormat === EMAIL_FORMAT ? identity.nameId : undefined);
+        const name = pick(identity, claims.name, NAME_CLAIMS);
+        return {
+            // The NameID is what the provider calls this person, and the only
+            // value guaranteed to be there.
+            id: identity.nameId,
+            email: email ?? "",
+            name: name ?? identity.nameId,
+            nickName: pick(identity, claims.nickName, NICK_CLAIMS),
+            // A provider that asserts an address has vouched for it: that is what
+            // its directory is.
+            emailVerificationState: email === undefined ? "unsupported" : "verified",
+            raw: {
+                nameId: identity.nameId,
+                nameIdFormat: identity.nameIdFormat,
+                sessionIndex: identity.sessionIndex,
+                attributes: identity.attributes,
+            },
+        };
+    }
+}
+/** The first value among the configured name, then the usual ones. */
+function pick(identity, configured, candidates) {
+    const names = configured ? [configured] : candidates;
+    for (const name of names) {
+        const value = identity.attributes[name]?.[0];
+        if (value !== undefined && value !== "")
+            return value;
+    }
+    return undefined;
+}
+function decode(value) {
+    const text = Buffer.from(value.replace(/\s+/g, ""), "base64").toString("utf8");
+    if (!text.includes("<")) {
+        throw new SamlError("the SAMLResponse is not base64-encoded XML");
+    }
+    return text;
+}
+function escapeXml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+//# sourceMappingURL=SamlDriver.js.map

package/dist/drivers/SamlDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SamlDriver.js","sourceRoot":"","sources":["../../src/drivers/SamlDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAEN,0BAA0B,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,SAAS,EAET,iBAAiB,GACjB,MAAM,YAAY,CAAC;AAOpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAC3D,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAC7D,MAAM,SAAS,GAAG,gDAAgD,CAAC;AACnE,MAAM,YAAY,GAAG,wDAAwD,CAAC;AAE9E;;;GAGG;AACH,MAAM,YAAY,GAAG;IACpB,oEAAoE;IACpE,mCAAmC;IACnC,OAAO;IACP,MAAM;IACN,cAAc;CACd,CAAC;AACF,MAAM,WAAW,GAAG;IACnB,4DAA4D;IAC5D,mCAAmC;IACnC,aAAa;IACb,IAAI;IACJ,MAAM;CACN,CAAC;AACF,MAAM,WAAW,GAAG;IACnB,iEAAiE;IACjE,mCAAmC;IACnC,KAAK;IACL,WAAW;CACX,CAAC;AA+BF;;;;;;;;;;GAUG;AACH,SAAS,2CAA2C;IACnD,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,MAAM,IAAI,SAAS,CAClB,4LAA4L;QAC3L,gGAAgG;QAChG,0EAA0E,CAC3E,CAAC;AACH,CAAC;AAED,MAAM,OAAO,UAAU;IACb,OAAO,CAAa;IAC7B,OAAO,CAAmC;IAE1C,YAAY,MAAkB;QAC7B,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,kEAAkE;YAClE,sEAAsE;YACtE,oCAAoC;YACpC,MAAM,IAAI,SAAS,CAClB,+BAA+B,MAAM,CAAC,MAAM,4CAA4C,CACxF,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,mEAAmE;YACnE,+DAA+D;YAC/D,iEAAiE;YACjE,2CAA2C,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,WAAW;QACV,MAAM,IAAI,KAAK,CACd,4GAA4G,CAC5G,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,UAAU,EAAE;QACvC,sEAAsE;QACtE,mBAAmB;QACnB,MAAM,SAAS,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAE9C,wEAAwE;QACxE,oDAAoD;QACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CACrE,QAAQ,CACR,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,OAAO;YACN,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,EAAE;YAC5F,KAAK;YACL,uEAAuE;YACvE,MAAM,EAAE,SAAS;SACjB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB,EACtB,MAAe;QAEf,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAClB,wHAAwH,CACxH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,IACC,QAAQ,CAAC,YAAY,KAAK,WAAW;YACrC,QAAQ,CAAC,KAAK,KAAK,UAAU,EAC5B,CAAC;YACF,MAAM,IAAI,SAAS,CAClB,+CAA+C,QAAQ,CAAC,KAAK,GAAG,CAChE,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,iDAAiD;QACjD,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAElC,gDAAgD;QAChD,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE;YAC3C,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SACvC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE;YAC7C,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACnC,YAAY,EAAE,MAAM;YACpB,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;SAC/C,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,QAAQ,CAC/C,QAAQ,CAAC,WAAW,EACpB,QAAQ,CAAC,YAAY,CACrB,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,iEAAiE;YACjE,+BAA+B;YAC/B,MAAM,IAAI,SAAS,CAClB,iFAAiF,CACjF,CAAC;QACH,CAAC;QAED,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,kEAAkE;YAClE,oDAAoD;YACpD,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,WAAW,EAAE;SACrE,CAAC;IACH,CAAC;IAED,YAAY;QACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC,OAAO;gBACX,OAAO,UAAU,KAAK,UAAU;oBAC/B,CAAC,CAAC,UAAU,EAAE;oBACd,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,0BAA0B,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,aAAa,CAAC,EAAU;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACzC,OAAO,CACN,oCAAoC,WAAW,GAAG;YAClD,QAAQ,SAAS,CAAC,EAAE,CAAC,iBAAiB;YACtC,kBAAkB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG;YAC7C,iBAAiB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG;YACrD,iCAAiC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG;YACvE,qBAAqB,SAAS,IAAI;YAClC,4BAA4B,YAAY,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;YAC7F,CAAC,MAAM;gBACN,CAAC,CAAC,+BAA+B,SAAS,CAAC,MAAM,CAAC,wBAAwB;gBAC1E,CAAC,CAAC,EAAE,CAAC;YACN,uBAAuB,CACvB,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,QAAsB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GACV,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC;YAC1C,CAAC,QAAQ,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEtD,OAAO;YACN,kEAAkE;YAClE,gCAAgC;YAChC,EAAE,EAAE,QAAQ,CAAC,MAAM;YACnB,KAAK,EAAE,KAAK,IAAI,EAAE;YAClB,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,MAAM;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC;YACtD,sEAAsE;YACtE,oBAAoB;YACpB,sBAAsB,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU;YACxE,GAAG,EAAE;gBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;aAC/B;SACD,CAAC;IACH,CAAC;CACD;AAED,sEAAsE;AACtE,SAAS,IAAI,CACZ,QAAsB,EACtB,UAA8B,EAC9B,UAAoB;IAEpB,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CACrE,MAAM,CACN,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,OAAO,KAAK;SACV,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC3B,CAAC"}

package/dist/drivers/SpotifyDriver.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Spotify OAuth2 driver.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+import type { TransitUser } from "../types.js";
+export declare class SpotifyDriver extends Oauth2Driver {
+    protected readonly provider = "Spotify";
+    protected readonly authorizeUrl = "https://accounts.spotify.com/authorize";
+    protected readonly accessTokenUrl = "https://accounts.spotify.com/api/token";
+    protected readonly userInfoUrl = "https://api.spotify.com/v1/me";
+    protected readonly defaultScopes: readonly ["user-read-email"];
+    /** Spotify wants the client credentials as HTTP Basic on the token request. */
+    protected readonly tokenAuth: "basic";
+    protected mapUser(raw: Record<string, unknown>): TransitUser;
+}
+//# sourceMappingURL=SpotifyDriver.d.ts.map

package/dist/drivers/SpotifyDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SpotifyDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/SpotifyDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,qBAAa,aAAc,SAAQ,YAAY;IAC9C,SAAS,CAAC,QAAQ,CAAC,QAAQ,aAAa;IACxC,SAAS,CAAC,QAAQ,CAAC,YAAY,4CAA4C;IAC3E,SAAS,CAAC,QAAQ,CAAC,cAAc,4CAA4C;IAC7E,SAAS,CAAC,QAAQ,CAAC,WAAW,mCAAmC;IACjE,SAAS,CAAC,QAAQ,CAAC,aAAa,+BAAgC;IAChE,+EAA+E;IAC/E,mBAA4B,SAAS,EAAG,OAAO,CAAU;IAEzD,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CAa5D"}

package/dist/drivers/SpotifyDriver.js

@@ -0,0 +1,34 @@
+/**
+ * Spotify OAuth2 driver.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+export class SpotifyDriver extends Oauth2Driver {
+    provider = "Spotify";
+    authorizeUrl = "https://accounts.spotify.com/authorize";
+    accessTokenUrl = "https://accounts.spotify.com/api/token";
+    userInfoUrl = "https://api.spotify.com/v1/me";
+    defaultScopes = ["user-read-email"];
+    /** Spotify wants the client credentials as HTTP Basic on the token request. */
+    tokenAuth = "basic";
+    mapUser(raw) {
+        return {
+            id: String(raw.id ?? ""),
+            email: String(raw.email ?? ""),
+            name: String(raw.display_name ?? ""),
+            nickName: typeof raw.display_name === "string" ? raw.display_name : undefined,
+            avatarUrl: firstImage(raw),
+            // Spotify says nothing about the address it returns.
+            emailVerificationState: "unsupported",
+            raw,
+        };
+    }
+}
+/** Spotify returns a list of images; the first is the one to show. */
+function firstImage(raw) {
+    const images = raw.images;
+    if (!Array.isArray(images) || images.length === 0)
+        return undefined;
+    const url = Reflect.get(Object(images[0]), "url");
+    return typeof url === "string" && url !== "" ? url : undefined;
+}
+//# sourceMappingURL=SpotifyDriver.js.map

package/dist/drivers/SpotifyDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SpotifyDriver.js","sourceRoot":"","sources":["../../src/drivers/SpotifyDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC3B,QAAQ,GAAG,SAAS,CAAC;IACrB,YAAY,GAAG,wCAAwC,CAAC;IACxD,cAAc,GAAG,wCAAwC,CAAC;IAC1D,WAAW,GAAG,+BAA+B,CAAC;IAC9C,aAAa,GAAG,CAAC,iBAAiB,CAAU,CAAC;IAChE,+EAA+E;IACnD,SAAS,GAAG,OAAgB,CAAC;IAE/C,OAAO,CAAC,GAA4B;QAC7C,OAAO;YACN,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YACpC,QAAQ,EACP,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;YACpE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC;YAC1B,qDAAqD;YACrD,sBAAsB,EAAE,aAAa;YACrC,GAAG;SACH,CAAC;IACH,CAAC;CACD;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,GAA4B;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC"}

package/dist/drivers/TwitterDriver.d.ts

@@ -0,0 +1,21 @@
+/**
+ * X (Twitter) OAuth1 driver.
+ *
+ * The older of X's two flows. `TwitterXDriver` is the OAuth2 one, and is what
+ * a new application wants; this one exists for an application already built
+ * on OAuth1 tokens, and it is also the only flow that returns the address
+ * through `verify_credentials`.
+ */
+import { Oauth1Driver } from "../Oauth1Driver.js";
+import type { TransitUser } from "../types.js";
+export declare class TwitterDriver extends Oauth1Driver {
+    protected readonly provider = "X";
+    protected readonly requestTokenUrl = "https://api.twitter.com/oauth/request_token";
+    /** `authenticate`, not `authorize`: a returning user is not asked twice. */
+    protected readonly authorizeUrl = "https://api.twitter.com/oauth/authenticate";
+    protected readonly accessTokenUrl = "https://api.twitter.com/oauth/access_token";
+    protected readonly userInfoUrl = "https://api.twitter.com/1.1/account/verify_credentials.json";
+    protected userInfoParams(): Record<string, string>;
+    protected mapUser(raw: Record<string, unknown>): TransitUser;
+}
+//# sourceMappingURL=TwitterDriver.d.ts.map

package/dist/drivers/TwitterDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwitterDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/TwitterDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,qBAAa,aAAc,SAAQ,YAAY;IAC9C,SAAS,CAAC,QAAQ,CAAC,QAAQ,OAAO;IAClC,SAAS,CAAC,QAAQ,CAAC,eAAe,iDACa;IAC/C,4EAA4E;IAC5E,SAAS,CAAC,QAAQ,CAAC,YAAY,gDACe;IAC9C,SAAS,CAAC,QAAQ,CAAC,cAAc,gDACa;IAC9C,SAAS,CAAC,QAAQ,CAAC,WAAW,iEACiC;cAE5C,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAM3D,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CAc5D"}

package/dist/drivers/TwitterDriver.js

@@ -0,0 +1,46 @@
+/**
+ * X (Twitter) OAuth1 driver.
+ *
+ * The older of X's two flows. `TwitterXDriver` is the OAuth2 one, and is what
+ * a new application wants; this one exists for an application already built
+ * on OAuth1 tokens, and it is also the only flow that returns the address
+ * through `verify_credentials`.
+ */
+import { Oauth1Driver } from "../Oauth1Driver.js";
+export class TwitterDriver extends Oauth1Driver {
+    provider = "X";
+    requestTokenUrl = "https://api.twitter.com/oauth/request_token";
+    /** `authenticate`, not `authorize`: a returning user is not asked twice. */
+    authorizeUrl = "https://api.twitter.com/oauth/authenticate";
+    accessTokenUrl = "https://api.twitter.com/oauth/access_token";
+    userInfoUrl = "https://api.twitter.com/1.1/account/verify_credentials.json";
+    userInfoParams() {
+        // The address is omitted unless asked for, and only reaches an
+        // application whose X app was granted it.
+        return { include_email: "true" };
+    }
+    mapUser(raw) {
+        return {
+            // `id_str`, never `id`: the numeric form loses precision past 2^53.
+            id: String(raw.id_str ?? ""),
+            email: String(raw.email ?? ""),
+            name: String(raw.name ?? raw.screen_name ?? ""),
+            nickName: typeof raw.screen_name === "string" ? raw.screen_name : undefined,
+            avatarUrl: fullSizeAvatar(raw),
+            // X vouches for nothing about the address it returns.
+            emailVerificationState: "unsupported",
+            raw,
+        };
+    }
+}
+/**
+ * The profile carries the 48px thumbnail. The full-size original is the same
+ * URL with the `_normal` suffix removed.
+ */
+function fullSizeAvatar(raw) {
+    const url = raw.profile_image_url_https;
+    if (typeof url !== "string" || url === "")
+        return undefined;
+    return url.replace(/_normal(\.[a-z]+)$/i, "$1");
+}
+//# sourceMappingURL=TwitterDriver.js.map

package/dist/drivers/TwitterDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwitterDriver.js","sourceRoot":"","sources":["../../src/drivers/TwitterDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC3B,QAAQ,GAAG,GAAG,CAAC;IACf,eAAe,GACjC,6CAA6C,CAAC;IAC/C,4EAA4E;IACzD,YAAY,GAC9B,4CAA4C,CAAC;IAC3B,cAAc,GAChC,4CAA4C,CAAC;IAC3B,WAAW,GAC7B,6DAA6D,CAAC;IAE5C,cAAc;QAChC,+DAA+D;QAC/D,0CAA0C;QAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAES,OAAO,CAAC,GAA4B;QAC7C,OAAO;YACN,oEAAoE;YACpE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;YAC5B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAC/C,QAAQ,EACP,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YAClE,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC;YAC9B,sDAAsD;YACtD,sBAAsB,EAAE,aAAa;YACrC,GAAG;SACH,CAAC;IACH,CAAC;CACD;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAA4B;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,uBAAuB,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC"}

package/dist/drivers/TwitterXDriver.d.ts

@@ -0,0 +1,22 @@
+/**
+ * X (Twitter) OAuth2 driver.
+ *
+ * X requires PKCE, so this driver refuses to build a redirect without a code
+ * verifier. Mint one with `createCodeVerifier()`, store it beside the state,
+ * and hand it back to `callback()`.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+import type { TransitUser } from "../types.js";
+export declare class TwitterXDriver extends Oauth2Driver {
+    protected readonly provider = "X";
+    protected readonly authorizeUrl = "https://x.com/i/oauth2/authorize";
+    protected readonly accessTokenUrl = "https://api.x.com/2/oauth2/token";
+    protected readonly userInfoUrl = "https://api.x.com/2/users/me";
+    protected readonly defaultScopes: readonly ["tweet.read", "users.read", "users.email"];
+    protected readonly requiresPkce = true;
+    /** X accepts the client credentials only as HTTP Basic. */
+    protected readonly tokenAuth: "basic";
+    protected userInfoParams(): Record<string, string>;
+    protected mapUser(raw: Record<string, unknown>): TransitUser;
+}
+//# sourceMappingURL=TwitterXDriver.d.ts.map

package/dist/drivers/TwitterXDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwitterXDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/TwitterXDriver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,qBAAa,cAAe,SAAQ,YAAY;IAC/C,SAAS,CAAC,QAAQ,CAAC,QAAQ,OAAO;IAClC,SAAS,CAAC,QAAQ,CAAC,YAAY,sCAAsC;IACrE,SAAS,CAAC,QAAQ,CAAC,cAAc,sCAAsC;IACvE,SAAS,CAAC,QAAQ,CAAC,WAAW,kCAAkC;IAChE,SAAS,CAAC,QAAQ,CAAC,aAAa,uDAIrB;IACX,mBAA4B,YAAY,QAAQ;IAChD,2DAA2D;IAC3D,mBAA4B,SAAS,EAAG,OAAO,CAAU;cAEtC,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;cAKxC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CAsBrE"}

package/dist/drivers/TwitterXDriver.js

@@ -0,0 +1,47 @@
+/**
+ * X (Twitter) OAuth2 driver.
+ *
+ * X requires PKCE, so this driver refuses to build a redirect without a code
+ * verifier. Mint one with `createCodeVerifier()`, store it beside the state,
+ * and hand it back to `callback()`.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+export class TwitterXDriver extends Oauth2Driver {
+    provider = "X";
+    authorizeUrl = "https://x.com/i/oauth2/authorize";
+    accessTokenUrl = "https://api.x.com/2/oauth2/token";
+    userInfoUrl = "https://api.x.com/2/users/me";
+    defaultScopes = [
+        "tweet.read",
+        "users.read",
+        "users.email",
+    ];
+    requiresPkce = true;
+    /** X accepts the client credentials only as HTTP Basic. */
+    tokenAuth = "basic";
+    userInfoParams() {
+        // Neither the picture nor the address is returned unless asked for.
+        return { "user.fields": "profile_image_url,confirmed_email" };
+    }
+    mapUser(raw) {
+        // The profile arrives wrapped: `{ data: { ... } }`.
+        const data = typeof raw.data === "object" && raw.data !== null
+            ? raw.data
+            : raw;
+        return {
+            id: String(data.id ?? ""),
+            email: String(data.confirmed_email ?? ""),
+            name: String(data.name ?? data.username ?? ""),
+            nickName: typeof data.username === "string" ? data.username : undefined,
+            avatarUrl: typeof data.profile_image_url === "string" &&
+                data.profile_image_url !== ""
+                ? data.profile_image_url
+                : undefined,
+            // The field is named `confirmed_email`, but X publishes no separate
+            // verification flag, so nothing here can be claimed.
+            emailVerificationState: "unsupported",
+            raw,
+        };
+    }
+}
+//# sourceMappingURL=TwitterXDriver.js.map

package/dist/drivers/TwitterXDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwitterXDriver.js","sourceRoot":"","sources":["../../src/drivers/TwitterXDriver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,OAAO,cAAe,SAAQ,YAAY;IAC5B,QAAQ,GAAG,GAAG,CAAC;IACf,YAAY,GAAG,kCAAkC,CAAC;IAClD,cAAc,GAAG,kCAAkC,CAAC;IACpD,WAAW,GAAG,8BAA8B,CAAC;IAC7C,aAAa,GAAG;QAClC,YAAY;QACZ,YAAY;QACZ,aAAa;KACJ,CAAC;IACiB,YAAY,GAAG,IAAI,CAAC;IAChD,2DAA2D;IAC/B,SAAS,GAAG,OAAgB,CAAC;IAEtC,cAAc;QAChC,oEAAoE;QACpE,OAAO,EAAE,aAAa,EAAE,mCAAmC,EAAE,CAAC;IAC/D,CAAC;IAEkB,OAAO,CAAC,GAA4B;QACtD,oDAAoD;QACpD,MAAM,IAAI,GACT,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;YAChD,CAAC,CAAE,GAAG,CAAC,IAAgC;YACvC,CAAC,CAAC,GAAG,CAAC;QACR,OAAO;YACN,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;YACzB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;YACzC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC9C,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACvE,SAAS,EACR,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;gBAC1C,IAAI,CAAC,iBAAiB,KAAK,EAAE;gBAC5B,CAAC,CAAC,IAAI,CAAC,iBAAiB;gBACxB,CAAC,CAAC,SAAS;YACb,oEAAoE;YACpE,qDAAqD;YACrD,sBAAsB,EAAE,aAAa;YACrC,GAAG;SACH,CAAC;IACH,CAAC;CACD"}

package/dist/dsig.d.ts

@@ -0,0 +1,51 @@
+/**
+ * XML Signature verification.
+ *
+ * The danger in XML-DSig is not the cryptography — it is that a signature can
+ * be perfectly valid over one part of a document while the application reads
+ * another. That is XML Signature Wrapping, and it has broken SAML
+ * implementations repeatedly. The mitigation is structural, not a check:
+ *
+ *   **This returns the element the signature actually covers, and the caller
+ *   must read that object. Never search the document again afterwards.**
+ *
+ * Everything else here exists to make that guarantee hold:
+ *
+ *   - Exactly one reference. Several is not a shape a signed assertion needs,
+ *     and it multiplies what "the signed element" could mean.
+ *   - The reference must resolve to exactly ONE element. A second element
+ *     carrying the same ID is the classic wrapping payload.
+ *   - The signature must sit inside the element it signs. A signature that
+ *     references a sibling is describing a document this refuses to reason
+ *     about.
+ *   - Only the enveloped-signature and exclusive-c14n transforms are accepted.
+ *     XPath and XSLT transforms are a way to make the digest cover something
+ *     other than the element, and XSLT is executable.
+ *   - SHA-1 is refused. Collisions against it are practical, and a signature
+ *     over attacker-influenced XML is exactly where that matters.
+ *   - The key comes from the caller, from the provider's metadata. The
+ *     certificate embedded in the document is checked against it, never
+ *     trusted on its own: verifying a document against a key it carries is
+ *     verifying it against itself.
+ */
+import { type XmlElement } from "./xml.js";
+export declare const DSIG_NS = "http://www.w3.org/2000/09/xmldsig#";
+export declare class SignatureError extends Error {
+    constructor(message: string);
+}
+export interface VerifyOptions {
+    /**
+     * The provider's signing certificates, from its metadata — PEM, or the
+     * bare base64 an `<X509Certificate>` element carries. Several are accepted
+     * so a rotation can be prepared before it happens.
+     */
+    certificates: string[];
+}
+/**
+ * Verify one signature under `root`, and answer with the element it covers.
+ *
+ * Read the returned element. Reading anything found by searching the document
+ * afterwards throws the guarantee away.
+ */
+export declare function verifyXmlSignature(root: XmlElement, options: VerifyOptions): XmlElement;
+//# sourceMappingURL=dsig.d.ts.map

package/dist/dsig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsig.d.ts","sourceRoot":"","sources":["../src/dsig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AASH,OAAO,EAIN,KAAK,UAAU,EAEf,MAAM,UAAU,CAAC;AAElB,eAAO,MAAM,OAAO,uCAAuC,CAAC;AAyC5D,qBAAa,cAAe,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI3B;AAED,MAAM,WAAW,aAAa;IAC7B;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,aAAa,GACpB,UAAU,CAkEZ"}