@c9up/transit 0.1.0

package/dist/jwt.js

@@ -0,0 +1,167 @@
+/**
+ * Verifying an OpenID Connect `id_token`.
+ *
+ * This is the file that decides whether a sign-in is genuine, so it is written
+ * to refuse rather than to accept. Three rules shape it:
+ *
+ *   - The algorithm is chosen by US, never read from the token. A verifier that
+ *     trusts the header's `alg` accepts `none`, and accepts an RS256 public key
+ *     replayed as an HS256 shared secret — the two oldest JWT forgeries there
+ *     are.
+ *   - Every claim that binds the token to this exchange is checked: the issuer,
+ *     the audience, the expiry, and the nonce. A token that is perfectly valid
+ *     for somebody else is not valid here.
+ *   - Nothing is decoded before the signature holds.
+ *
+ * No dependency: Node verifies RSA and EC against a JWK on its own.
+ */
+import { constants, createPublicKey, createVerify, verify as verifySignature, } from "node:crypto";
+/**
+ * The algorithms this verifies. Asymmetric only, and deliberately so: the
+ * symmetric family signs with the client secret, so anyone holding it — every
+ * copy of the config, every log line that leaked it — can mint a token for any
+ * user. `none` is not an algorithm.
+ */
+const SUPPORTED = {
+    RS256: { hash: "sha256", kind: "rsa", kty: "RSA" },
+    RS384: { hash: "sha384", kind: "rsa", kty: "RSA" },
+    RS512: { hash: "sha512", kind: "rsa", kty: "RSA" },
+    PS256: { hash: "sha256", kind: "rsa-pss", kty: "RSA" },
+    PS384: { hash: "sha384", kind: "rsa-pss", kty: "RSA" },
+    PS512: { hash: "sha512", kind: "rsa-pss", kty: "RSA" },
+    ES256: { hash: "sha256", kind: "ec", kty: "EC", crv: "P-256" },
+    ES384: { hash: "sha384", kind: "ec", kty: "EC", crv: "P-384" },
+    ES512: { hash: "sha512", kind: "ec", kty: "EC", crv: "P-521" },
+};
+export function isSupportedAlg(value) {
+    return typeof value === "string" && value in SUPPORTED;
+}
+/**
+ * Split and decode a compact JWS. This says nothing about whether the token is
+ * genuine — it is what the caller needs to find the right key.
+ */
+export function decodeJws(token) {
+    const segments = token.split(".");
+    if (segments.length !== 3) {
+        throw new Error("[transit] id_token is not a compact JWS (three segments)");
+    }
+    const [encodedHeader, encodedPayload, encodedSignature] = segments;
+    return {
+        header: decodeSegment(encodedHeader, "header"),
+        payload: decodeSegment(encodedPayload, "payload"),
+        signingInput: `${encodedHeader}.${encodedPayload}`,
+        signature: Buffer.from(encodedSignature, "base64url"),
+    };
+}
+/**
+ * Check a token's signature against one key.
+ *
+ * `alg` is the caller's choice, not the token's. Passing the header's own
+ * value would be the vulnerability this exists to avoid.
+ */
+export function verifyJwsSignature(parts, jwk, alg) {
+    const spec = SUPPORTED[alg];
+    assertKeyMatchesAlg(jwk, alg);
+    const key = createPublicKey({ key: jwk, format: "jwk" });
+    const data = Buffer.from(parts.signingInput, "ascii");
+    if (spec.kind === "ec") {
+        // JOSE concatenates R and S; Node reads DER unless told otherwise, and
+        // would reject every valid signature without this.
+        return verifySignature(spec.hash, data, { key, dsaEncoding: "ieee-p1363" }, parts.signature);
+    }
+    if (spec.kind === "rsa-pss") {
+        return verifySignature(spec.hash, data, {
+            key,
+            padding: constants.RSA_PKCS1_PSS_PADDING,
+            saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
+        }, parts.signature);
+    }
+    const verifier = createVerify(spec.hash);
+    verifier.update(data);
+    verifier.end();
+    return verifier.verify(key, parts.signature);
+}
+/**
+ * Check every claim that binds this token to this exchange.
+ *
+ * Each of these has been a real vulnerability somewhere: a token from another
+ * issuer, a token minted for another client of the same issuer, an expired one
+ * replayed, and — the one people forget — a token from an older sign-in of the
+ * same user, which is what the nonce catches.
+ */
+export function assertIdTokenClaims(payload, expected) {
+    const leeway = expected.leewaySeconds ?? 60;
+    const now = expected.now ?? Math.floor(Date.now() / 1000);
+    const iss = payload.iss;
+    if (iss !== expected.issuer) {
+        throw new Error(`[transit] id_token issuer mismatch: expected '${expected.issuer}'`);
+    }
+    const sub = payload.sub;
+    if (typeof sub !== "string" || sub === "") {
+        throw new Error("[transit] id_token carries no subject");
+    }
+    const aud = payload.aud;
+    const audiences = Array.isArray(aud) ? aud : [aud];
+    if (!audiences.includes(expected.audience)) {
+        throw new Error("[transit] id_token was not issued for this client — check the audience");
+    }
+    if (audiences.length > 1 && payload.azp !== expected.audience) {
+        // With several audiences the spec requires `azp`, and it has to name us:
+        // otherwise a token minted for a sibling client would pass the check
+        // above.
+        throw new Error("[transit] id_token has several audiences and no azp naming this client");
+    }
+    const exp = payload.exp;
+    if (typeof exp !== "number") {
+        throw new Error("[transit] id_token carries no expiry");
+    }
+    if (exp + leeway < now) {
+        throw new Error("[transit] id_token has expired");
+    }
+    const iat = payload.iat;
+    if (typeof iat === "number" && iat - leeway > now) {
+        // A token issued in the future is either a clock problem or a forgery;
+        // neither should sign anybody in.
+        throw new Error("[transit] id_token is issued in the future");
+    }
+    if (payload.nonce !== expected.nonce) {
+        // Without this, a token captured from an earlier sign-in of the same user
+        // at the same provider can be replayed into a fresh session.
+        throw new Error("[transit] id_token nonce does not match this sign-in");
+    }
+    return payload;
+}
+function decodeSegment(segment, what) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    }
+    catch {
+        throw new Error(`[transit] id_token ${what} is not valid JSON`);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`[transit] id_token ${what} is not an object`);
+    }
+    return parsed;
+}
+/**
+ * Refuse a key that is not what the algorithm is defined over.
+ *
+ * Node ignores the EC-specific options when handed an RSA key, so verifying an
+ * "ES256" token against an RSA key quietly becomes an RSA verification. That
+ * is not a forgery on its own — it still needs a real signature — but a
+ * verifier that reports success for a path it did not take is not one worth
+ * trusting. The curve is checked for the same reason: ES256 is defined over
+ * P-256 and nothing else.
+ */
+function assertKeyMatchesAlg(jwk, alg) {
+    const spec = SUPPORTED[alg];
+    if (jwk.kty !== spec.kty) {
+        throw new Error(`[transit] ${alg} needs a ${spec.kty} key, and the provider published a ${String(jwk.kty)} one`);
+    }
+    const curve = "crv" in spec ? spec.crv : undefined;
+    if (curve !== undefined && jwk.crv !== curve) {
+        throw new Error(`[transit] ${alg} is defined over ${curve}, and the key is on ${String(jwk.crv)}`);
+    }
+}
+//# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACN,SAAS,EACT,eAAe,EACf,YAAY,EACZ,MAAM,IAAI,eAAe,GACzB,MAAM,aAAa,CAAC;AAsBrB;;;;;GAKG;AACH,MAAM,SAAS,GAAG;IACjB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;IAClD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;IAClD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;IAClD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE;IACtD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE;IACtD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE;IACtD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;IAC9D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;IAC9D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;CAI9D,CAAC;AAIF,MAAM,UAAU,cAAc,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,SAAS,CAAC;AACxD,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,QAIzD,CAAC;IACF,OAAO;QACN,MAAM,EAAE,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC;QAC9C,OAAO,EAAE,aAAa,CAAC,cAAc,EAAE,SAAS,CAAC;QACjD,YAAY,EAAE,GAAG,aAAa,IAAI,cAAc,EAAE;QAClD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;KACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,KAAY,EACZ,GAAQ,EACR,GAAiB;IAEjB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAElE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACxB,uEAAuE;QACvE,mDAAmD;QACnD,OAAO,eAAe,CACrB,IAAI,CAAC,IAAI,EACT,IAAI,EACJ,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAClC,KAAK,CAAC,SAAS,CACf,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,eAAe,CACrB,IAAI,CAAC,IAAI,EACT,IAAI,EACJ;YACC,GAAG;YACH,OAAO,EAAE,SAAS,CAAC,qBAAqB;YACxC,UAAU,EAAE,SAAS,CAAC,sBAAsB;SAC5C,EACD,KAAK,CAAC,SAAS,CACf,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,CAAC;IACf,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AAC9C,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAClC,OAAgC,EAChC,QAA2B;IAE3B,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACd,iDAAiD,QAAQ,CAAC,MAAM,GAAG,CACnE,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACd,wEAAwE,CACxE,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC/D,yEAAyE;QACzE,qEAAqE;QACrE,SAAS;QACT,MAAM,IAAI,KAAK,CACd,wEAAwE,CACxE,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC;QACnD,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtC,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,OAAmC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,IAAY;IACnD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,mBAAmB,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAiC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,GAAQ,EAAE,GAAiB;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACd,aAAa,GAAG,YAAY,IAAI,CAAC,GAAG,sCAAsC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAC/F,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACd,aAAa,GAAG,oBAAoB,KAAK,uBAAuB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CACjF,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/ldap.d.ts

@@ -0,0 +1,82 @@
+/**
+ * The slice of LDAP an application needs to sign somebody in: connect, bind,
+ * search, close.
+ *
+ * Three things here are the difference between an LDAP sign-in that works and
+ * one that lets anybody through:
+ *
+ *   - **An empty password is refused before the socket is touched.** A simple
+ *     bind with no password is an ANONYMOUS bind, and the server answers
+ *     success. A login form that passes a blank password straight through
+ *     therefore authenticates as whoever was named. It is the oldest bug in
+ *     LDAP authentication and it is one `if`.
+ *   - **Filters are structures, not text.** Values are written as
+ *     length-prefixed octets, so a username cannot become syntax.
+ *   - **TLS unless told otherwise.** A simple bind sends the password as it
+ *     was typed.
+ */
+export declare class LdapError extends Error {
+    readonly code: number | undefined;
+    constructor(message: string, code?: number);
+}
+/** A filter, as a shape. There is no filter string, on purpose. */
+export type LdapFilter = {
+    equals: [attribute: string, value: string];
+} | {
+    present: string;
+} | {
+    and: LdapFilter[];
+} | {
+    or: LdapFilter[];
+} | {
+    not: LdapFilter;
+};
+export interface LdapEntry {
+    dn: string;
+    attributes: Record<string, string[]>;
+}
+export interface LdapOptions {
+    /** `ldaps://host:636` or `ldap://host:389`. */
+    url: string;
+    /**
+     * Allow a plaintext connection. A simple bind sends the password as typed,
+     * so this has to be asked for.
+     */
+    allowInsecure?: boolean;
+    /** How long to wait for the server, in milliseconds. Default 10 000. */
+    timeoutMs?: number;
+    /** Refuse a server certificate that does not check out. Default true. */
+    rejectUnauthorized?: boolean;
+}
+/**
+ * One connection, for one exchange.
+ *
+ * A connection carries the identity of whatever last bound on it, so this is
+ * deliberately short-lived: verifying a password means binding as that person,
+ * and nothing else may run on the connection afterwards.
+ */
+export declare class LdapConnection {
+    #private;
+    constructor(options: LdapOptions);
+    connect(): Promise<void>;
+    /**
+     * Bind as `dn` with `password`.
+     *
+     * An empty password is refused here, before anything is sent. The server
+     * would answer success: a simple bind with no password is an anonymous
+     * bind, and a login form that passes one through authenticates as whoever
+     * was named.
+     */
+    bind(dn: string, password: string): Promise<void>;
+    /** Search under `base`, and read the entries it answers with. */
+    search(options: {
+        base: string;
+        filter: LdapFilter;
+        attributes?: string[];
+        scope?: "base" | "one" | "sub";
+        sizeLimit?: number;
+    }): Promise<LdapEntry[]>;
+    /** Say goodbye and close. Never throws: this runs in a finally. */
+    close(): Promise<void>;
+}
+//# sourceMappingURL=ldap.d.ts.map

package/dist/ldap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ldap.d.ts","sourceRoot":"","sources":["../src/ldap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA8BH,qBAAa,SAAU,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;gBACtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;CAK1C;AAED,mEAAmE;AACnE,MAAM,MAAM,UAAU,GACnB;IAAE,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;CAAE,GAC9C;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,GAAG,EAAE,UAAU,EAAE,CAAA;CAAE,GACrB;IAAE,EAAE,EAAE,UAAU,EAAE,CAAA;CAAE,GACpB;IAAE,GAAG,EAAE,UAAU,CAAA;CAAE,CAAC;AAEvB,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,WAAW;IAC3B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;;gBAcd,OAAO,EAAE,WAAW;IAI1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA2C9B;;;;;;;OAOG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBvD,iEAAiE;IAC3D,MAAM,CAAC,OAAO,EAAE;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,UAAU,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;QAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAsBxB,mEAAmE;IAC7D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA0F5B"}

package/dist/ldap.js

@@ -0,0 +1,271 @@
+/**
+ * The slice of LDAP an application needs to sign somebody in: connect, bind,
+ * search, close.
+ *
+ * Three things here are the difference between an LDAP sign-in that works and
+ * one that lets anybody through:
+ *
+ *   - **An empty password is refused before the socket is touched.** A simple
+ *     bind with no password is an ANONYMOUS bind, and the server answers
+ *     success. A login form that passes a blank password straight through
+ *     therefore authenticates as whoever was named. It is the oldest bug in
+ *     LDAP authentication and it is one `if`.
+ *   - **Filters are structures, not text.** Values are written as
+ *     length-prefixed octets, so a username cannot become syntax.
+ *   - **TLS unless told otherwise.** A simple bind sends the password as it
+ *     was typed.
+ */
+import { connect as connectTcp } from "node:net";
+import { connect as connectTls } from "node:tls";
+import { application, applicationPrimitive, BOOLEAN, context, contextPrimitive, decode, decodeInteger, decodeSequence, decodeString, ENUMERATED, encodeBoolean, encodeInteger, encodeSequence, encodeString, messageLength, OCTET_STRING, } from "./ber.js";
+const BIND_REQUEST = application(0);
+const BIND_RESPONSE = application(1);
+const UNBIND_REQUEST = applicationPrimitive(2);
+const SEARCH_REQUEST = application(3);
+const SEARCH_ENTRY = application(4);
+const SEARCH_DONE = application(5);
+export class LdapError extends Error {
+    code;
+    constructor(message, code) {
+        super(`[transit] ${message}`);
+        this.name = "LdapError";
+        this.code = code;
+    }
+}
+/**
+ * One connection, for one exchange.
+ *
+ * A connection carries the identity of whatever last bound on it, so this is
+ * deliberately short-lived: verifying a password means binding as that person,
+ * and nothing else may run on the connection afterwards.
+ */
+export class LdapConnection {
+    #socket;
+    #buffer = Buffer.alloc(0);
+    #nextMessage = 1;
+    #pending = new Map();
+    #options;
+    constructor(options) {
+        this.#options = options;
+    }
+    async connect() {
+        const url = new URL(this.#options.url);
+        const secure = url.protocol === "ldaps:";
+        if (!secure && this.#options.allowInsecure !== true) {
+            throw new LdapError(`'${this.#options.url}' is not encrypted, and a simple bind sends the password as it was typed. Use ldaps://, or set allowInsecure when the link is already protected.`);
+        }
+        const port = Number(url.port || (secure ? 636 : 389));
+        const host = url.hostname;
+        await new Promise((resolve, reject) => {
+            const socket = secure
+                ? connectTls({
+                    host,
+                    port,
+                    servername: host,
+                    rejectUnauthorized: this.#options.rejectUnauthorized !== false,
+                })
+                : connectTcp({ host, port });
+            const onError = (error) => {
+                this.#failAll(error);
+                reject(new LdapError(`could not reach ${host}:${port} — ${error.message}`));
+            };
+            socket.once("error", onError);
+            socket.once(secure ? "secureConnect" : "connect", () => {
+                socket.setTimeout(this.#options.timeoutMs ?? 10_000);
+                socket.on("data", (chunk) => this.#receive(chunk));
+                socket.on("timeout", () => this.#failAll(new LdapError("the directory stopped answering")));
+                socket.on("close", () => this.#failAll(new LdapError("the directory closed the connection")));
+                this.#socket = socket;
+                resolve();
+            });
+        });
+    }
+    /**
+     * Bind as `dn` with `password`.
+     *
+     * An empty password is refused here, before anything is sent. The server
+     * would answer success: a simple bind with no password is an anonymous
+     * bind, and a login form that passes one through authenticates as whoever
+     * was named.
+     */
+    async bind(dn, password) {
+        if (password === "") {
+            throw new LdapError("an empty password is an anonymous bind, which the directory accepts — refused here instead");
+        }
+        const body = encodeSequence([
+            encodeInteger(3),
+            encodeString(dn),
+            encodeString(password, contextPrimitive(0)),
+        ], BIND_REQUEST);
+        const [response] = await this.#exchange(body, [BIND_RESPONSE]);
+        if (!response)
+            throw new LdapError("the directory sent no bind response");
+        assertSuccess(response, "bind");
+    }
+    /** Search under `base`, and read the entries it answers with. */
+    async search(options) {
+        const scope = { base: 0, one: 1, sub: 2 }[options.scope ?? "sub"];
+        const body = encodeSequence([
+            encodeString(options.base),
+            encodeInteger(scope, ENUMERATED),
+            encodeInteger(0, ENUMERATED),
+            encodeInteger(options.sizeLimit ?? 2),
+            encodeInteger(0),
+            encodeBoolean(false, BOOLEAN),
+            encodeFilter(options.filter),
+            encodeSequence((options.attributes ?? []).map((a) => encodeString(a))),
+        ], SEARCH_REQUEST);
+        const parts = await this.#exchange(body, [SEARCH_ENTRY], SEARCH_DONE);
+        const done = parts.at(-1);
+        if (done)
+            assertSuccess(done, "search");
+        return parts.slice(0, -1).map(readEntry);
+    }
+    /** Say goodbye and close. Never throws: this runs in a finally. */
+    async close() {
+        const socket = this.#socket;
+        if (!socket)
+            return;
+        this.#socket = undefined;
+        try {
+            socket.write(encodeSequence([
+                encodeInteger(this.#nextMessage),
+                encodeSequence([], UNBIND_REQUEST),
+            ]));
+        }
+        catch {
+            // The point is to end the connection; failing to be polite about it
+            // changes nothing.
+        }
+        socket.destroy();
+        this.#failAll(new LdapError("the connection was closed"));
+    }
+    /** Send one request and collect the replies that carry its message id. */
+    async #exchange(body, collect, until) {
+        const socket = this.#socket;
+        if (!socket)
+            throw new LdapError("the connection is not open");
+        const id = this.#nextMessage++;
+        return new Promise((resolve, reject) => {
+            this.#pending.set(id, { resolve, reject, parts: [] });
+            this.#expect.set(id, { collect, until });
+            socket.write(encodeSequence([encodeInteger(id), body]), (error) => {
+                if (error) {
+                    this.#pending.delete(id);
+                    reject(new LdapError(`the request could not be sent — ${error.message}`));
+                }
+            });
+        });
+    }
+    #expect = new Map();
+    #receive(chunk) {
+        this.#buffer = Buffer.concat([this.#buffer, chunk]);
+        for (;;) {
+            const length = messageLength(this.#buffer);
+            if (length === undefined || this.#buffer.length < length)
+                return;
+            const message = this.#buffer.subarray(0, length);
+            this.#buffer = this.#buffer.subarray(length);
+            this.#dispatch(message);
+        }
+    }
+    #dispatch(message) {
+        const [idElement, op] = decodeSequence(decode(message).value);
+        if (!idElement || !op)
+            return;
+        const id = decodeInteger(idElement.value);
+        const waiting = this.#pending.get(id);
+        const expected = this.#expect.get(id);
+        if (!waiting || !expected)
+            return;
+        if (expected.until === undefined) {
+            // A single-reply operation: this is the answer.
+            this.#finish(id, [op.value]);
+            return;
+        }
+        waiting.parts.push(op.value);
+        if (op.tag === expected.until)
+            this.#finish(id, waiting.parts);
+    }
+    #finish(id, parts) {
+        const waiting = this.#pending.get(id);
+        this.#pending.delete(id);
+        this.#expect.delete(id);
+        waiting?.resolve(parts);
+    }
+    #failAll(error) {
+        for (const [id, waiting] of this.#pending) {
+            this.#pending.delete(id);
+            this.#expect.delete(id);
+            waiting.reject(error);
+        }
+    }
+}
+/** A filter, encoded. Values become octets, never syntax. */
+function encodeFilter(filter) {
+    if ("equals" in filter) {
+        const [attribute, value] = filter.equals;
+        return encodeSequence([encodeString(attribute), encodeString(value)], context(3));
+    }
+    if ("present" in filter) {
+        return encodeString(filter.present, contextPrimitive(7));
+    }
+    if ("and" in filter) {
+        return encodeSequence(filter.and.map(encodeFilter), context(0));
+    }
+    if ("or" in filter) {
+        return encodeSequence(filter.or.map(encodeFilter), context(1));
+    }
+    return encodeSequence([encodeFilter(filter.not)], context(2));
+}
+function readEntry(value) {
+    const [dnElement, attributesElement] = decodeSequence(value);
+    const attributes = {};
+    for (const attribute of attributesElement
+        ? decodeSequence(attributesElement.value)
+        : []) {
+        const [nameElement, valuesElement] = decodeSequence(attribute.value);
+        if (!nameElement)
+            continue;
+        attributes[decodeString(nameElement.value)] = valuesElement
+            ? decodeSequence(valuesElement.value).map((v) => decodeString(v.value))
+            : [];
+    }
+    return {
+        dn: dnElement ? decodeString(dnElement.value) : "",
+        attributes,
+    };
+}
+/** LDAP answers a code; anything but zero is a refusal worth reporting. */
+function assertSuccess(response, what) {
+    const [codeElement, , messageElement] = decodeSequence(response);
+    if (!codeElement)
+        throw new LdapError(`the ${what} response has no result code`);
+    const code = decodeInteger(codeElement.value);
+    if (code === 0)
+        return;
+    const detail = messageElement && messageElement.tag === OCTET_STRING
+        ? decodeString(messageElement.value)
+        : "";
+    throw new LdapError(`the directory refused the ${what}: ${describe(code)}${detail ? ` — ${detail}` : ""}`, code);
+}
+/** The result codes worth naming; the rest are reported by number. */
+function describe(code) {
+    switch (code) {
+        case 32:
+            return "no such object";
+        case 34:
+            return "invalid DN syntax";
+        case 48:
+            return "authentication is not allowed";
+        case 49:
+            return "invalid credentials";
+        case 50:
+            return "insufficient rights";
+        case 53:
+            return "the server is unwilling to perform this";
+        default:
+            return `result code ${code}`;
+    }
+}
+//# sourceMappingURL=ldap.js.map

package/dist/ldap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ldap.js","sourceRoot":"","sources":["../src/ldap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAe,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EACN,WAAW,EACX,oBAAoB,EACpB,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,MAAM,EACN,aAAa,EACb,cAAc,EACd,YAAY,EACZ,UAAU,EACV,aAAa,EACb,aAAa,EACb,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,GACZ,MAAM,UAAU,CAAC;AAElB,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AACpC,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AACrC,MAAM,cAAc,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;AAC/C,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AACtC,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AACpC,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAEnC,MAAM,OAAO,SAAU,SAAQ,KAAK;IAC1B,IAAI,CAAqB;IAClC,YAAY,OAAe,EAAE,IAAa;QACzC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AA6BD;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IAC1B,OAAO,CAAqB;IAC5B,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,YAAY,GAAG,CAAC,CAAC;IACjB,QAAQ,GAAG,IAAI,GAAG,EAOf,CAAC;IACK,QAAQ,CAAc;IAE/B,YAAY,OAAoB;QAC/B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,IAAI,SAAS,CAClB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,kJAAkJ,CACvK,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE1B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,MAAM;gBACpB,CAAC,CAAC,UAAU,CAAC;oBACX,IAAI;oBACJ,IAAI;oBACJ,UAAU,EAAE,IAAI;oBAChB,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,KAAK,KAAK;iBAC9D,CAAC;gBACH,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAE9B,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE;gBAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACrB,MAAM,CACL,IAAI,SAAS,CAAC,mBAAmB,IAAI,IAAI,IAAI,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CACnE,CAAC;YACH,CAAC,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE;gBACtD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;gBACrD,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACnD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC,CAC/D,CAAC;gBACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC,CACnE,CAAC;gBACF,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;gBACtB,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,EAAU,EAAE,QAAgB;QACtC,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CAClB,4FAA4F,CAC5F,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAC1B;YACC,aAAa,CAAC,CAAC,CAAC;YAChB,YAAY,CAAC,EAAE,CAAC;YAChB,YAAY,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;SAC3C,EACD,YAAY,CACZ,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC1E,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,MAAM,CAAC,OAMZ;QACA,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,cAAc,CAC1B;YACC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1B,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC;YAChC,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC;YAC5B,aAAa,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;YACrC,aAAa,CAAC,CAAC,CAAC;YAChB,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;YAC7B,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5B,cAAc,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;SACtE,EACD,cAAc,CACd,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,IAAI;YAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,KAAK;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC;YACJ,MAAM,CAAC,KAAK,CACX,cAAc,CAAC;gBACd,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC;gBAChC,cAAc,CAAC,EAAE,EAAE,cAAc,CAAC;aAClC,CAAC,CACF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;YACpE,mBAAmB;QACpB,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS,CACd,IAAY,EACZ,OAAiB,EACjB,KAAc;QAEd,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAE/B,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjE,IAAI,KAAK,EAAE,CAAC;oBACX,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACzB,MAAM,CACL,IAAI,SAAS,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CACjE,CAAC;gBACH,CAAC;YACF,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAEQ,OAAO,GAAG,IAAI,GAAG,EAGvB,CAAC;IAEJ,QAAQ,CAAC,KAAa;QACrB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACpD,SAAS,CAAC;YACT,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM;gBAAE,OAAO;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACF,CAAC;IAED,SAAS,CAAC,OAAe;QACxB,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE;YAAE,OAAO;QAC9B,MAAM,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;YAAE,OAAO;QAElC,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAClC,gDAAgD;YAChD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,CAAC,EAAU,EAAE,KAAe;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,QAAQ,CAAC,KAAY;QACpB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;CACD;AAED,6DAA6D;AAC7D,SAAS,YAAY,CAAC,MAAkB;IACvC,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACzC,OAAO,cAAc,CACpB,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAC9C,OAAO,CAAC,CAAC,CAAC,CACV,CAAC;IACH,CAAC;IACD,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACrB,OAAO,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;QACpB,OAAO,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,cAAc,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,UAAU,GAA6B,EAAE,CAAC;IAChD,KAAK,MAAM,SAAS,IAAI,iBAAiB;QACxC,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACzC,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,UAAU,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,aAAa;YAC1D,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACvE,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO;QACN,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QAClD,UAAU;KACV,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACpD,MAAM,CAAC,WAAW,EAAE,AAAD,EAAG,cAAc,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,WAAW;QACf,MAAM,IAAI,SAAS,CAAC,OAAO,IAAI,8BAA8B,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO;IACvB,MAAM,MAAM,GACX,cAAc,IAAI,cAAc,CAAC,GAAG,KAAK,YAAY;QACpD,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC;QACpC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,IAAI,SAAS,CAClB,6BAA6B,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EACrF,IAAI,CACJ,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,IAAY;IAC7B,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,EAAE;YACN,OAAO,gBAAgB,CAAC;QACzB,KAAK,EAAE;YACN,OAAO,mBAAmB,CAAC;QAC5B,KAAK,EAAE;YACN,OAAO,+BAA+B,CAAC;QACxC,KAAK,EAAE;YACN,OAAO,qBAAqB,CAAC;QAC9B,KAAK,EAAE;YACN,OAAO,qBAAqB,CAAC;QAC9B,KAAK,EAAE;YACN,OAAO,yCAAyC,CAAC;QAClD;YACC,OAAO,eAAe,IAAI,EAAE,CAAC;IAC/B,CAAC;AACF,CAAC"}

package/dist/nodeEnv.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Reading `NODE_ENV`, with the aliases people actually set.
+ *
+ * `NODE_ENV=prod` is ordinary in a Dockerfile or a platform dashboard. Read
+ * verbatim it answers "not production" — and here that means the in-process
+ * SAML replay store is accepted on a production deployment, where it bounds
+ * replay within one replica and not beyond it.
+ *
+ * Duplicated rather than imported: transit depends on no other package in this
+ * workspace, and a security decision that only holds when an optional peer is
+ * installed is not a decision.
+ */
+/** The canonical name for whatever `NODE_ENV` holds. */
+export declare function normalizeNodeEnv(value: string | undefined): string;
+/** Whether this process is running in production, under any spelling. */
+export declare function inProduction(): boolean;
+//# sourceMappingURL=nodeEnv.d.ts.map

package/dist/nodeEnv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodeEnv.d.ts","sourceRoot":"","sources":["../src/nodeEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAOlE;AAED,yEAAyE;AACzE,wBAAgB,YAAY,IAAI,OAAO,CAEtC"}

package/dist/nodeEnv.js

@@ -0,0 +1,33 @@
+/**
+ * Reading `NODE_ENV`, with the aliases people actually set.
+ *
+ * `NODE_ENV=prod` is ordinary in a Dockerfile or a platform dashboard. Read
+ * verbatim it answers "not production" — and here that means the in-process
+ * SAML replay store is accepted on a production deployment, where it bounds
+ * replay within one replica and not beyond it.
+ *
+ * Duplicated rather than imported: transit depends on no other package in this
+ * workspace, and a security decision that only holds when an optional peer is
+ * installed is not a decision.
+ */
+const DEV_ENVS = ["dev", "develop", "development"];
+const PROD_ENVS = ["prod", "production"];
+const TEST_ENVS = ["test", "testing"];
+/** The canonical name for whatever `NODE_ENV` holds. */
+export function normalizeNodeEnv(value) {
+    if (!value || typeof value !== "string")
+        return "unknown";
+    const env = value.toLowerCase();
+    if (DEV_ENVS.includes(env))
+        return "development";
+    if (PROD_ENVS.includes(env))
+        return "production";
+    if (TEST_ENVS.includes(env))
+        return "test";
+    return env;
+}
+/** Whether this process is running in production, under any spelling. */
+export function inProduction() {
+    return normalizeNodeEnv(process.env.NODE_ENV) === "production";
+}
+//# sourceMappingURL=nodeEnv.js.map

package/dist/nodeEnv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodeEnv.js","sourceRoot":"","sources":["../src/nodeEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACzC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAEtC,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IACjD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3C,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY;IAC3B,OAAO,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC;AAChE,CAAC"}