@c9up/transit 0.1.6 → 0.1.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +24 -1
- package/dist/drivers/LdapDirectory.d.ts.map +1 -1
- package/dist/drivers/LdapDirectory.js +3 -1
- package/dist/drivers/LdapDirectory.js.map +1 -1
- package/dist/drivers/SamlDriver.d.ts +17 -0
- package/dist/drivers/SamlDriver.d.ts.map +1 -1
- package/dist/drivers/SamlDriver.js +45 -4
- package/dist/drivers/SamlDriver.js.map +1 -1
- package/dist/ldap.d.ts.map +1 -1
- package/dist/ldap.js +35 -4
- package/dist/ldap.js.map +1 -1
- package/dist/oidc.d.ts.map +1 -1
- package/dist/oidc.js +7 -4
- package/dist/oidc.js.map +1 -1
- package/dist/quasar.d.ts +7 -2
- package/dist/quasar.d.ts.map +1 -1
- package/dist/quasar.js +8 -2
- package/dist/quasar.js.map +1 -1
- package/dist/replay.d.ts +3 -1
- package/dist/replay.d.ts.map +1 -1
- package/dist/replay.js +11 -5
- package/dist/replay.js.map +1 -1
- package/dist/saml.d.ts +9 -1
- package/dist/saml.d.ts.map +1 -1
- package/dist/saml.js +1 -0
- package/dist/saml.js.map +1 -1
- package/dist/vendor/quasarConnection.d.ts +26 -3
- package/dist/vendor/quasarConnection.d.ts.map +1 -1
- package/dist/vendor/quasarConnection.js +44 -23
- package/dist/vendor/quasarConnection.js.map +1 -1
- package/package.json +1 -1
- package/src/drivers/LdapDirectory.ts +3 -1
- package/src/drivers/SamlDriver.ts +65 -4
- package/src/ldap.ts +39 -4
- package/src/oidc.ts +7 -4
- package/src/quasar.ts +9 -2
- package/src/replay.ts +17 -7
- package/src/saml.ts +10 -1
- package/src/vendor/quasarConnection.ts +84 -22
package/dist/saml.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"saml.js","sourceRoot":"","sources":["../src/saml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAmB,MAAM,UAAU,CAAC;AAExE,MAAM,CAAC,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AACzE,MAAM,cAAc,GAAG,4CAA4C,CAAC;AACpE,MAAM,MAAM,GAAG,uCAAuC,CAAC;AAEvD,MAAM,OAAO,SAAU,SAAQ,KAAK;IACnC,YAAY,OAAe;QAC1B,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IACzB,CAAC;CACD;
|
|
1
|
+
{"version":3,"file":"saml.js","sourceRoot":"","sources":["../src/saml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAmB,MAAM,UAAU,CAAC;AAExE,MAAM,CAAC,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AACzE,MAAM,cAAc,GAAG,4CAA4C,CAAC;AACpE,MAAM,MAAM,GAAG,uCAAuC,CAAC;AAEvD,MAAM,OAAO,SAAU,SAAQ,KAAK;IACnC,YAAY,OAAe;QAC1B,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IACzB,CAAC;CACD;AA4CD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAoB;IAC3D,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM;QAClB,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,KAAK,GAAG,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC;IACvE,IAAI,KAAK,KAAK,cAAc;QAAE,OAAO;IAErC,MAAM,OAAO,GAAG,MAAM;QACrB,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,IAAI,SAAS,CAClB,qCAAqC,KAAK,IAAI,WAAW,GACxD,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAC5C,EAAE,CACF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAChC,SAAqB,EACrB,QAA0B;IAE1B,IACC,SAAS,CAAC,YAAY,KAAK,iBAAiB;QAC5C,SAAS,CAAC,KAAK,KAAK,WAAW,EAC9B,CAAC;QACF,MAAM,IAAI,SAAS,CAClB,4DAA4D,SAAS,CAAC,KAAK,GAAG,CAC9E,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,WAAW,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CAClB,+BAA+B,WAAW,IAAI,QAAQ,cAAc,QAAQ,CAAC,MAAM,GAAG,CACtF,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC;IAC9E,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,aAAa,CACjC,OAAO,EACP,iBAAiB,EACjB,qBAAqB,CACrB,CAAC,IAAI,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,MAAM,CACvE,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,MAAM,IAAI,SAAS,CAClB,mGAAmG,CACnG,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CACzB,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,CACzB,CAAC,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,EAAE,KAAK,CAAC;IAC9E,IAAI,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtC,gEAAgE;QAChE,uCAAuC;QACvC,MAAM,IAAI,SAAS,CAClB,8BAA8B,SAAS,IAAI,SAAS,uCAAuC,QAAQ,CAAC,SAAS,GAAG,CAChH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,CACjC,EAAE,KAAK,CAAC;IACT,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,QAAQ,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;YACxC,kEAAkE;YAClE,qBAAqB;YACrB,MAAM,IAAI,SAAS,CAClB,0EAA0E,CAC1E,CAAC;QACH,CAAC;IACF,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAClB,+DAA+D,CAC/D,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAG,KAAK,CAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,CAAC,EAAE,KAAK,CAC9D,CAAC;IACF,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,CACtB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,EAAE,KAAK,CACjE,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CACzB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,CAAC,EAAE,KAAK,CACpE,CAAC;IACF,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAC9B,UAAU,EACV,iBAAiB,EACjB,qBAAqB,CACrB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CACzB,aAAa,CAAC,WAAW,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAChB,CACD,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CAClB,uEAAuE,CACvE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAClB,wBAAwB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,QAAQ,CAAC,QAAQ,GAAG,CACnH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAC1B,SAAS,EACT,iBAAiB,EACjB,gBAAgB,CAChB,CAAC,CAAC,CAAC,CAAC;IAEL,OAAO;QACN,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE;QACpC,YAAY,EAAE,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;YACvE,EAAE,KAAK;QACR,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC;QACrC,WAAW;QACX,YAAY;QACZ,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,GAAG,IAAI;QAChE,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,CAAC;YACtE,EAAE,KAAK;KACR,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,SAAqB;IAC5C,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,aAAa,CACpC,SAAS,EACT,iBAAiB,EACjB,oBAAoB,CACpB,EAAE,CAAC;QACH,KAAK,MAAM,SAAS,IAAI,aAAa,CACpC,SAAS,EACT,iBAAiB,EACjB,WAAW,CACX,EAAE,CAAC;YACH,MAAM,IAAI,GACT,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,KAAK;gBAC3D,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,CAAC,EAAE,KAAK,CAAC;YACrE,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,MAAM,GAAG,aAAa,CAC3B,SAAS,EACT,iBAAiB,EACjB,gBAAgB,CAChB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;QACtB,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,MAAkB;IACjD,IACC,MAAM,CAAC,KAAK,KAAK,WAAW;QAC5B,MAAM,CAAC,YAAY,KAAK,iBAAiB,EACxC,CAAC;QACF,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAC1C,CAAC,OAAO,EAAE,EAAE,CACX,OAAO,CAAC,YAAY,KAAK,iBAAiB;QAC1C,OAAO,CAAC,KAAK,KAAK,WAAW,CAC9B,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAClB,+BAA+B,UAAU,CAAC,MAAM,iCAAiC,CACjF,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAe,CAAC;AACpC,CAAC;AAED,SAAS,GAAG,CAAC,MAAkB,EAAE,KAAa;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAClB,iBAAiB,KAAK,qCAAqC,KAAK,CAAC,MAAM,EAAE,CACzE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAe,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,SAAS,KAAK,CAAC,KAAyB;IACvC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AACrE,CAAC"}
|
|
@@ -1,4 +1,19 @@
|
|
|
1
|
-
|
|
1
|
+
/**
|
|
2
|
+
* The commands among `commands` that `value` does not carry as functions.
|
|
3
|
+
*
|
|
4
|
+
* Reads go through the same catch as above, so a command whose read throws
|
|
5
|
+
* counts as missing.
|
|
6
|
+
*/
|
|
7
|
+
export declare function missingCommands(value: unknown, commands: readonly string[]): string[];
|
|
8
|
+
/**
|
|
9
|
+
* Whether `value` carries every one of `commands` as a function.
|
|
10
|
+
*
|
|
11
|
+
* The building block of the guard a caller passes as `isConnection`, over the
|
|
12
|
+
* same list it passes as `required` — which is what names the gap when the
|
|
13
|
+
* guard says no.
|
|
14
|
+
*/
|
|
15
|
+
export declare function hasCommands(value: unknown, commands: readonly string[]): value is object;
|
|
16
|
+
export interface QuasarConnectionRequest<T> {
|
|
2
17
|
/** The package asking. It prefixes every message this can raise. */
|
|
3
18
|
pkg: string;
|
|
4
19
|
/**
|
|
@@ -12,8 +27,16 @@ export interface QuasarConnectionRequest {
|
|
|
12
27
|
raise: (reason: "quasar-missing" | "incomplete-connection", message: string, cause?: unknown) => Error;
|
|
13
28
|
/** Connection name, or `undefined` for quasar's default. */
|
|
14
29
|
name?: string;
|
|
15
|
-
/** The commands the caller will actually issue. */
|
|
30
|
+
/** The commands the caller will actually issue, named in the message. */
|
|
16
31
|
required: readonly string[];
|
|
32
|
+
/**
|
|
33
|
+
* The caller's check that the connection is the client it needs.
|
|
34
|
+
*
|
|
35
|
+
* Written by the caller over the commands it issues (`hasCommands` with
|
|
36
|
+
* `required` does it), because only the caller knows its client type. The
|
|
37
|
+
* connection is handed over only once this has said yes.
|
|
38
|
+
*/
|
|
39
|
+
isConnection: (value: unknown) => value is T;
|
|
17
40
|
/** What the caller does with them, for the message that names a gap. */
|
|
18
41
|
what: string;
|
|
19
42
|
/**
|
|
@@ -31,5 +54,5 @@ export interface QuasarConnectionRequest {
|
|
|
31
54
|
* handed over — a connection missing one would otherwise fail on the first
|
|
32
55
|
* command, far from the line that asked for it.
|
|
33
56
|
*/
|
|
34
|
-
export declare function quasarConnection<T>(request: QuasarConnectionRequest): Promise<T>;
|
|
57
|
+
export declare function quasarConnection<T>(request: QuasarConnectionRequest<T>): Promise<T>;
|
|
35
58
|
//# sourceMappingURL=quasarConnection.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"quasarConnection.d.ts","sourceRoot":"","sources":["../../src/vendor/quasarConnection.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"quasarConnection.d.ts","sourceRoot":"","sources":["../../src/vendor/quasarConnection.ts"],"names":[],"mappings":"AA0DA;;;;;GAKG;AACH,wBAAgB,eAAe,CAC9B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,SAAS,MAAM,EAAE,GACzB,MAAM,EAAE,CAIV;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAC1B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,SAAS,MAAM,EAAE,GACzB,KAAK,IAAI,MAAM,CAGjB;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC;IACzC,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,KAAK,EAAE,CACN,MAAM,EAAE,gBAAgB,GAAG,uBAAuB,EAClD,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,OAAO,KACX,KAAK,CAAC;IACX,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC;IAC7C,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACvC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC,GACjC,OAAO,CAAC,CAAC,CAAC,CAsDZ"}
|
|
@@ -3,29 +3,42 @@
|
|
|
3
3
|
// This package is published and built from its own repository, so the file
|
|
4
4
|
// has to exist here rather than be imported. `pnpm vendor:sync` rewrites it,
|
|
5
5
|
// and `pnpm vendor:check` fails if this copy has drifted from the original.
|
|
6
|
-
/**
|
|
7
|
-
* Read a member without assuming how the object answers.
|
|
8
|
-
*
|
|
9
|
-
* Two shapes have to work, and they disagree about `in`. Quasar's accessor is
|
|
10
|
-
* a Proxy over an empty null-prototype object with only a `get` trap, so
|
|
11
|
-
* `"connection" in manager` is FALSE while reading it returns the function —
|
|
12
|
-
* gating on `in` rejected the real manager. And a module namespace under a
|
|
13
|
-
* test double RAISES for an export it does not have, rather than answering
|
|
14
|
-
* undefined, so a bare read fails on the mock. Reading through a catch is what
|
|
15
|
-
* satisfies both.
|
|
16
|
-
*/
|
|
17
6
|
function readMember(value, name) {
|
|
18
7
|
if (typeof value !== "object" || value === null)
|
|
19
|
-
return undefined;
|
|
8
|
+
return { value: undefined };
|
|
20
9
|
try {
|
|
21
|
-
return Reflect.get(value, name);
|
|
10
|
+
return { value: Reflect.get(value, name) };
|
|
22
11
|
}
|
|
23
|
-
catch {
|
|
24
|
-
return
|
|
12
|
+
catch (threw) {
|
|
13
|
+
return { threw };
|
|
25
14
|
}
|
|
26
15
|
}
|
|
16
|
+
function memberValue(read) {
|
|
17
|
+
return "value" in read ? read.value : undefined;
|
|
18
|
+
}
|
|
27
19
|
function isConnectionSource(value) {
|
|
28
|
-
return typeof readMember(value, "connection") === "function";
|
|
20
|
+
return typeof memberValue(readMember(value, "connection")) === "function";
|
|
21
|
+
}
|
|
22
|
+
/**
|
|
23
|
+
* The commands among `commands` that `value` does not carry as functions.
|
|
24
|
+
*
|
|
25
|
+
* Reads go through the same catch as above, so a command whose read throws
|
|
26
|
+
* counts as missing.
|
|
27
|
+
*/
|
|
28
|
+
export function missingCommands(value, commands) {
|
|
29
|
+
return commands.filter((command) => typeof memberValue(readMember(value, command)) !== "function");
|
|
30
|
+
}
|
|
31
|
+
/**
|
|
32
|
+
* Whether `value` carries every one of `commands` as a function.
|
|
33
|
+
*
|
|
34
|
+
* The building block of the guard a caller passes as `isConnection`, over the
|
|
35
|
+
* same list it passes as `required` — which is what names the gap when the
|
|
36
|
+
* guard says no.
|
|
37
|
+
*/
|
|
38
|
+
export function hasCommands(value, commands) {
|
|
39
|
+
if (typeof value !== "object" || value === null)
|
|
40
|
+
return false;
|
|
41
|
+
return missingCommands(value, commands).length === 0;
|
|
29
42
|
}
|
|
30
43
|
/**
|
|
31
44
|
* The named connection, checked for the commands the caller needs BEFORE it is
|
|
@@ -33,7 +46,7 @@ function isConnectionSource(value) {
|
|
|
33
46
|
* command, far from the line that asked for it.
|
|
34
47
|
*/
|
|
35
48
|
export async function quasarConnection(request) {
|
|
36
|
-
const { pkg, name, required, what, raise, alternative } = request;
|
|
49
|
+
const { pkg, name, required, what, raise, alternative, isConnection } = request;
|
|
37
50
|
const specifier = "@c9up/quasar/services/main";
|
|
38
51
|
let loaded;
|
|
39
52
|
try {
|
|
@@ -43,20 +56,28 @@ export async function quasarConnection(request) {
|
|
|
43
56
|
throw raise("quasar-missing", `[${pkg}] ${what} asks for the quasar connection "${name ?? "default"}", but @c9up/quasar is not installed.\n` +
|
|
44
57
|
` pnpm add @c9up/quasar${alternative ? `, ${alternative}` : ""}`, cause);
|
|
45
58
|
}
|
|
46
|
-
|
|
59
|
+
// The namespace itself may be the manager (a test double); a throw there is
|
|
60
|
+
// the mock refusing an export it lacks, not an answer.
|
|
61
|
+
const direct = memberValue(readMember(loaded, "connection"));
|
|
62
|
+
const manager = typeof direct === "function"
|
|
47
63
|
? loaded
|
|
48
|
-
:
|
|
64
|
+
: memberValue(readMember(Object(loaded), "default"));
|
|
65
|
+
const read = readMember(manager, "connection");
|
|
66
|
+
if ("threw" in read) {
|
|
67
|
+
throw raise("quasar-missing", `[${pkg}] ${what} asks for the quasar connection "${name ?? "default"}", but @c9up/quasar's manager is not available yet: ` +
|
|
68
|
+
"its provider has not booted, or is not registered in this application's providers.", read.threw);
|
|
69
|
+
}
|
|
49
70
|
if (!isConnectionSource(manager)) {
|
|
50
71
|
throw raise("quasar-missing", `[${pkg}] @c9up/quasar/services/main did not expose a connection() manager`);
|
|
51
72
|
}
|
|
52
73
|
const connection = manager.connection(name);
|
|
53
|
-
const missing =
|
|
74
|
+
const missing = missingCommands(connection, required);
|
|
54
75
|
if (missing.length > 0) {
|
|
55
76
|
throw raise("incomplete-connection", `[${pkg}] the quasar connection${name ? ` '${name}'` : ""} is missing ${missing.join(", ")}, which ${what} issues`);
|
|
56
77
|
}
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
78
|
+
if (!isConnection(connection)) {
|
|
79
|
+
throw raise("incomplete-connection", `[${pkg}] the quasar connection${name ? ` '${name}'` : ""} is not the client ${what} needs`);
|
|
80
|
+
}
|
|
60
81
|
return connection;
|
|
61
82
|
}
|
|
62
83
|
//# sourceMappingURL=quasarConnection.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"quasarConnection.js","sourceRoot":"","sources":["../../src/vendor/quasarConnection.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;
|
|
1
|
+
{"version":3,"file":"quasarConnection.js","sourceRoot":"","sources":["../../src/vendor/quasarConnection.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAqC5E,SAAS,UAAU,CAAC,KAAc,EAAE,IAAY;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC7E,IAAI,CAAC;QACJ,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB;IACpC,OAAO,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,OAAO,OAAO,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,KAAK,UAAU,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC9B,KAAc,EACd,QAA2B;IAE3B,OAAO,QAAQ,CAAC,MAAM,CACrB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,UAAU,CAC1E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAC1B,KAAc,EACd,QAA2B;IAE3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACtD,CAAC;AA2CD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAAmC;IAEnC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,GACpE,OAAO,CAAC;IACT,MAAM,SAAS,GAAG,4BAA4B,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,CACV,gBAAgB,EAChB,IAAI,GAAG,KAAK,IAAI,oCAAoC,IAAI,IAAI,SAAS,yCAAyC;YAC7G,0BAA0B,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAClE,KAAK,CACL,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uDAAuD;IACvD,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GACZ,OAAO,MAAM,KAAK,UAAU;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,CACV,gBAAgB,EAChB,IAAI,GAAG,KAAK,IAAI,oCAAoC,IAAI,IAAI,SAAS,sDAAsD;YAC1H,oFAAoF,EACrF,IAAI,CAAC,KAAK,CACV,CAAC;IACH,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,CACV,gBAAgB,EAChB,IAAI,GAAG,oEAAoE,CAC3E,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,CACV,uBAAuB,EACvB,IAAI,GAAG,0BAA0B,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,SAAS,CAClH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,CACV,uBAAuB,EACvB,IAAI,GAAG,0BAA0B,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,IAAI,QAAQ,CAC3F,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC"}
|
package/package.json
CHANGED
|
@@ -165,7 +165,9 @@ export class LdapDirectory implements DirectoryDriver {
|
|
|
165
165
|
name: name ?? nickName ?? entry.dn,
|
|
166
166
|
nickName,
|
|
167
167
|
// A directory that holds an address has vouched for it: that is what
|
|
168
|
-
// a directory is.
|
|
168
|
+
// a directory is. Unlike a SAML provider, the directory is the one
|
|
169
|
+
// the operator configured and runs — if it is a customer's, its
|
|
170
|
+
// addresses are that customer's say-so (see the README).
|
|
169
171
|
emailVerificationState: email === undefined ? "unsupported" : "verified",
|
|
170
172
|
raw: { dn: entry.dn, attributes: entry.attributes },
|
|
171
173
|
};
|
|
@@ -26,6 +26,7 @@ import {
|
|
|
26
26
|
validateAssertion,
|
|
27
27
|
} from "../saml.js";
|
|
28
28
|
import type {
|
|
29
|
+
EmailVerificationState,
|
|
29
30
|
OAuthToken,
|
|
30
31
|
RedirectRequest,
|
|
31
32
|
TransitDriver,
|
|
@@ -92,6 +93,23 @@ export interface SamlConfig {
|
|
|
92
93
|
replayStore?: AssertionReplayStore | (() => AssertionReplayStore);
|
|
93
94
|
/** The attribute names this provider uses, when they are not the usual ones. */
|
|
94
95
|
claims?: { email?: string; name?: string; nickName?: string };
|
|
96
|
+
/**
|
|
97
|
+
* Mark every address this provider asserts as `"verified"`.
|
|
98
|
+
*
|
|
99
|
+
* Only for a provider that is authoritative for ALL the addresses it can
|
|
100
|
+
* assert — your own organisation's. Whoever administers the provider can
|
|
101
|
+
* assert any address, so with a customer's provider this hands them every
|
|
102
|
+
* account an application links by email. Default false: an asserted
|
|
103
|
+
* address is `"unsupported"`.
|
|
104
|
+
*/
|
|
105
|
+
trustEmail?: boolean;
|
|
106
|
+
/**
|
|
107
|
+
* The domains this provider is authoritative for. An asserted address in
|
|
108
|
+
* one of them is `"verified"`, any other is `"unverified"`. Compared without
|
|
109
|
+
* case on what follows the address's last `@`, exactly — a subdomain is
|
|
110
|
+
* listed on its own.
|
|
111
|
+
*/
|
|
112
|
+
trustedEmailDomains?: string[];
|
|
95
113
|
}
|
|
96
114
|
|
|
97
115
|
/**
|
|
@@ -116,6 +134,7 @@ function refuseImplicitMemoryReplayStoreInProduction(): void {
|
|
|
116
134
|
|
|
117
135
|
export class SamlDriver implements TransitDriver {
|
|
118
136
|
readonly #config: SamlConfig;
|
|
137
|
+
readonly #trustedDomains: ReadonlySet<string> | undefined;
|
|
119
138
|
#replay: AssertionReplayStore | undefined;
|
|
120
139
|
|
|
121
140
|
constructor(config: SamlConfig) {
|
|
@@ -133,6 +152,7 @@ export class SamlDriver implements TransitDriver {
|
|
|
133
152
|
// healthy, and reported it to whoever happened to sign in first.
|
|
134
153
|
refuseImplicitMemoryReplayStoreInProduction();
|
|
135
154
|
}
|
|
155
|
+
this.#trustedDomains = trustedDomains(config);
|
|
136
156
|
this.#config = config;
|
|
137
157
|
}
|
|
138
158
|
|
|
@@ -223,9 +243,12 @@ export class SamlDriver implements TransitDriver {
|
|
|
223
243
|
clockSkewSeconds: this.#config.clockSkewSeconds,
|
|
224
244
|
});
|
|
225
245
|
|
|
246
|
+
// Remembered for as long as the validation above would still accept the
|
|
247
|
+
// assertion — its later expiry plus the clock skew — not merely until
|
|
248
|
+
// the expiry it states.
|
|
226
249
|
const fresh = await this.#replayStore().remember(
|
|
227
250
|
identity.assertionId,
|
|
228
|
-
identity.
|
|
251
|
+
identity.rememberUntil,
|
|
229
252
|
);
|
|
230
253
|
if (!fresh) {
|
|
231
254
|
// Everything above passes on a captured response posted a second
|
|
@@ -271,6 +294,20 @@ export class SamlDriver implements TransitDriver {
|
|
|
271
294
|
);
|
|
272
295
|
}
|
|
273
296
|
|
|
297
|
+
/**
|
|
298
|
+
* Whoever administers a SAML provider can assert any address, so one is
|
|
299
|
+
* verified only when the config says this provider is authoritative for it.
|
|
300
|
+
*/
|
|
301
|
+
#emailVerificationState(email: string | undefined): EmailVerificationState {
|
|
302
|
+
if (email === undefined) return "unsupported";
|
|
303
|
+
if (this.#config.trustEmail === true) return "verified";
|
|
304
|
+
const domains = this.#trustedDomains;
|
|
305
|
+
if (domains === undefined) return "unsupported";
|
|
306
|
+
const at = email.lastIndexOf("@");
|
|
307
|
+
const domain = at === -1 ? "" : email.slice(at + 1).toLowerCase();
|
|
308
|
+
return domains.has(domain) ? "verified" : "unverified";
|
|
309
|
+
}
|
|
310
|
+
|
|
274
311
|
#mapUser(identity: SamlIdentity): TransitUser {
|
|
275
312
|
const claims = this.#config.claims ?? {};
|
|
276
313
|
const email =
|
|
@@ -285,9 +322,7 @@ export class SamlDriver implements TransitDriver {
|
|
|
285
322
|
email: email ?? "",
|
|
286
323
|
name: name ?? identity.nameId,
|
|
287
324
|
nickName: pick(identity, claims.nickName, NICK_CLAIMS),
|
|
288
|
-
|
|
289
|
-
// its directory is.
|
|
290
|
-
emailVerificationState: email === undefined ? "unsupported" : "verified",
|
|
325
|
+
emailVerificationState: this.#emailVerificationState(email),
|
|
291
326
|
raw: {
|
|
292
327
|
nameId: identity.nameId,
|
|
293
328
|
nameIdFormat: identity.nameIdFormat,
|
|
@@ -298,6 +333,32 @@ export class SamlDriver implements TransitDriver {
|
|
|
298
333
|
}
|
|
299
334
|
}
|
|
300
335
|
|
|
336
|
+
/**
|
|
337
|
+
* The trusted domains, lower-cased, or undefined when none were configured.
|
|
338
|
+
* A malformed list fails at construction rather than marking nothing, or the
|
|
339
|
+
* wrong addresses, verified.
|
|
340
|
+
*/
|
|
341
|
+
function trustedDomains(config: SamlConfig): ReadonlySet<string> | undefined {
|
|
342
|
+
const domains = config.trustedEmailDomains;
|
|
343
|
+
if (domains === undefined) return undefined;
|
|
344
|
+
if (config.trustEmail === true) {
|
|
345
|
+
throw new SamlError(
|
|
346
|
+
`'${config.issuer}' sets both trustEmail and trustedEmailDomains — trustEmail already trusts every domain, so say which one is meant`,
|
|
347
|
+
);
|
|
348
|
+
}
|
|
349
|
+
const normalized = new Set<string>();
|
|
350
|
+
for (const domain of domains) {
|
|
351
|
+
const value = domain.trim().toLowerCase();
|
|
352
|
+
if (value === "" || value.includes("@")) {
|
|
353
|
+
throw new SamlError(
|
|
354
|
+
`trustedEmailDomains of '${config.issuer}' lists '${domain}', which is not a domain — write 'acme.com', not an address`,
|
|
355
|
+
);
|
|
356
|
+
}
|
|
357
|
+
normalized.add(value);
|
|
358
|
+
}
|
|
359
|
+
return normalized;
|
|
360
|
+
}
|
|
361
|
+
|
|
301
362
|
/** The first value among the configured name, then the usual ones. */
|
|
302
363
|
function pick(
|
|
303
364
|
identity: SamlIdentity,
|
package/src/ldap.ts
CHANGED
|
@@ -44,6 +44,7 @@ const UNBIND_REQUEST = applicationPrimitive(2);
|
|
|
44
44
|
const SEARCH_REQUEST = application(3);
|
|
45
45
|
const SEARCH_ENTRY = application(4);
|
|
46
46
|
const SEARCH_DONE = application(5);
|
|
47
|
+
const SEARCH_REFERENCE = application(19);
|
|
47
48
|
|
|
48
49
|
export class LdapError extends Error {
|
|
49
50
|
readonly code: number | undefined;
|
|
@@ -290,12 +291,40 @@ export class LdapConnection {
|
|
|
290
291
|
if (!waiting || !expected) return;
|
|
291
292
|
|
|
292
293
|
if (expected.until === undefined) {
|
|
293
|
-
// A single-reply operation:
|
|
294
|
-
|
|
294
|
+
// A single-reply operation: the answer is the one tag it expects, and
|
|
295
|
+
// any other reply under its id is the server saying something this
|
|
296
|
+
// operation cannot read as a result.
|
|
297
|
+
if (expected.collect.includes(op.tag)) {
|
|
298
|
+
this.#finish(id, [op.value]);
|
|
299
|
+
} else {
|
|
300
|
+
this.#fail(id, unexpectedReply(op.tag));
|
|
301
|
+
}
|
|
295
302
|
return;
|
|
296
303
|
}
|
|
297
|
-
|
|
298
|
-
|
|
304
|
+
if (op.tag === expected.until) {
|
|
305
|
+
waiting.parts.push(op.value);
|
|
306
|
+
this.#finish(id, waiting.parts);
|
|
307
|
+
return;
|
|
308
|
+
}
|
|
309
|
+
if (expected.collect.includes(op.tag)) {
|
|
310
|
+
waiting.parts.push(op.value);
|
|
311
|
+
return;
|
|
312
|
+
}
|
|
313
|
+
if (op.tag === SEARCH_REFERENCE) {
|
|
314
|
+
// A continuation reference names another server that may hold more
|
|
315
|
+
// of the subtree (RFC 4511 §4.5.3). It is not an entry, and chasing
|
|
316
|
+
// it would send the next bind to wherever the reply pointed. Active
|
|
317
|
+
// Directory answers several for any search from a domain root.
|
|
318
|
+
return;
|
|
319
|
+
}
|
|
320
|
+
this.#fail(id, unexpectedReply(op.tag));
|
|
321
|
+
}
|
|
322
|
+
|
|
323
|
+
#fail(id: number, error: Error): void {
|
|
324
|
+
const waiting = this.#pending.get(id);
|
|
325
|
+
this.#pending.delete(id);
|
|
326
|
+
this.#expect.delete(id);
|
|
327
|
+
waiting?.reject(error);
|
|
299
328
|
}
|
|
300
329
|
|
|
301
330
|
#finish(id: number, parts: Buffer[]): void {
|
|
@@ -353,6 +382,12 @@ function readEntry(value: Buffer): LdapEntry {
|
|
|
353
382
|
};
|
|
354
383
|
}
|
|
355
384
|
|
|
385
|
+
function unexpectedReply(tag: number): LdapError {
|
|
386
|
+
return new LdapError(
|
|
387
|
+
`the directory answered with an unexpected reply (tag 0x${tag.toString(16)})`,
|
|
388
|
+
);
|
|
389
|
+
}
|
|
390
|
+
|
|
356
391
|
/** LDAP answers a code; anything but zero is a refusal worth reporting. */
|
|
357
392
|
function assertSuccess(response: Buffer, what: string): void {
|
|
358
393
|
const [codeElement, , messageElement] = decodeSequence(response);
|
package/src/oidc.ts
CHANGED
|
@@ -51,9 +51,10 @@ export class OidcDiscovery {
|
|
|
51
51
|
#inFlight: Promise<OidcMetadata> | undefined;
|
|
52
52
|
|
|
53
53
|
constructor(issuer: string, options: RemoteOptions = {}) {
|
|
54
|
-
//
|
|
55
|
-
//
|
|
56
|
-
|
|
54
|
+
// Kept byte for byte: the discovery document's `issuer` and every
|
|
55
|
+
// id_token's `iss` must be IDENTICAL to it (OpenID Connect Discovery
|
|
56
|
+
// §4.3), and some providers' issuers end with a slash (Auth0's do).
|
|
57
|
+
this.#issuer = issuer;
|
|
57
58
|
this.#ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
|
|
58
59
|
this.#now = options.now ?? Date.now;
|
|
59
60
|
}
|
|
@@ -63,7 +64,9 @@ export class OidcDiscovery {
|
|
|
63
64
|
}
|
|
64
65
|
|
|
65
66
|
get url(): string {
|
|
66
|
-
|
|
67
|
+
// Only the well-known URL drops the trailing slash, so it is joined
|
|
68
|
+
// without a double one.
|
|
69
|
+
return `${this.#issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`;
|
|
67
70
|
}
|
|
68
71
|
|
|
69
72
|
async metadata(): Promise<OidcMetadata> {
|
package/src/quasar.ts
CHANGED
|
@@ -11,17 +11,24 @@
|
|
|
11
11
|
|
|
12
12
|
import { quasarConnection as loadQuasarConnection } from "./vendor/quasarConnection.js";
|
|
13
13
|
|
|
14
|
-
/**
|
|
14
|
+
/**
|
|
15
|
+
* The named connection, checked for the commands the caller will issue.
|
|
16
|
+
*
|
|
17
|
+
* `isConnection` is the caller's check over those same commands: only the
|
|
18
|
+
* caller knows which client type it needs, so only it can vouch for it.
|
|
19
|
+
*/
|
|
15
20
|
export async function quasarConnection<T>(
|
|
16
21
|
name: string | undefined,
|
|
17
22
|
required: readonly string[],
|
|
18
23
|
what: string,
|
|
24
|
+
isConnection: (value: unknown) => value is T,
|
|
19
25
|
): Promise<T> {
|
|
20
|
-
return loadQuasarConnection
|
|
26
|
+
return loadQuasarConnection({
|
|
21
27
|
pkg: "transit",
|
|
22
28
|
name,
|
|
23
29
|
required,
|
|
24
30
|
what,
|
|
31
|
+
isConnection,
|
|
25
32
|
raise: (_reason, message, cause) => new Error(message, { cause }),
|
|
26
33
|
});
|
|
27
34
|
}
|
package/src/replay.ts
CHANGED
|
@@ -12,10 +12,13 @@
|
|
|
12
12
|
*/
|
|
13
13
|
|
|
14
14
|
import { quasarConnection } from "./quasar.js";
|
|
15
|
+
import { hasCommands } from "./vendor/quasarConnection.js";
|
|
15
16
|
|
|
16
17
|
export interface AssertionReplayStore {
|
|
17
18
|
/**
|
|
18
|
-
* Remember `assertionId` until `expiresAt` (epoch seconds)
|
|
19
|
+
* Remember `assertionId` until `expiresAt` (epoch seconds) — the
|
|
20
|
+
* `rememberUntil` of a validated assertion, which already counts the clock
|
|
21
|
+
* skew it was accepted with.
|
|
19
22
|
*
|
|
20
23
|
* Answers `true` when this is the first time, `false` when the assertion
|
|
21
24
|
* has already been used. Implementations must decide that atomically:
|
|
@@ -54,6 +57,10 @@ export interface ReplayRedisClient {
|
|
|
54
57
|
set(key: string, value: string, ...args: unknown[]): Promise<unknown>;
|
|
55
58
|
}
|
|
56
59
|
|
|
60
|
+
function isReplayRedisClient(value: unknown): value is ReplayRedisClient {
|
|
61
|
+
return hasCommands(value, ["set"]);
|
|
62
|
+
}
|
|
63
|
+
|
|
57
64
|
export type ReplayRedisResolver =
|
|
58
65
|
| ReplayRedisClient
|
|
59
66
|
| (() => ReplayRedisClient | Promise<ReplayRedisClient>);
|
|
@@ -82,8 +89,9 @@ export class RedisAssertionReplayStore implements AssertionReplayStore {
|
|
|
82
89
|
|
|
83
90
|
async remember(assertionId: string, expiresAt: number): Promise<boolean> {
|
|
84
91
|
const client = await this.#client();
|
|
85
|
-
//
|
|
86
|
-
//
|
|
92
|
+
// `expiresAt` already covers the clock skew the validation allowed. The
|
|
93
|
+
// extra minute absorbs clock differences between the replica that
|
|
94
|
+
// stores the key and the one a replay lands on.
|
|
87
95
|
const ttl = Math.max(
|
|
88
96
|
1,
|
|
89
97
|
Math.ceil(expiresAt - Math.floor(Date.now() / 1000)) + 60,
|
|
@@ -121,15 +129,17 @@ export const replayStores = {
|
|
|
121
129
|
connection: ReplayRedisResolver | string;
|
|
122
130
|
prefix?: string;
|
|
123
131
|
}): () => AssertionReplayStore {
|
|
132
|
+
const { connection } = options;
|
|
124
133
|
const client: ReplayRedisResolver =
|
|
125
|
-
typeof
|
|
134
|
+
typeof connection === "string"
|
|
126
135
|
? () =>
|
|
127
|
-
quasarConnection
|
|
128
|
-
|
|
136
|
+
quasarConnection(
|
|
137
|
+
connection,
|
|
129
138
|
["set"],
|
|
130
139
|
"the assertion replay store",
|
|
140
|
+
isReplayRedisClient,
|
|
131
141
|
)
|
|
132
|
-
:
|
|
142
|
+
: connection;
|
|
133
143
|
return () =>
|
|
134
144
|
new RedisAssertionReplayStore(client, { prefix: options.prefix });
|
|
135
145
|
},
|
package/src/saml.ts
CHANGED
|
@@ -35,8 +35,16 @@ export interface SamlIdentity {
|
|
|
35
35
|
attributes: Record<string, string[]>;
|
|
36
36
|
/** The assertion's own id, for the replay check. */
|
|
37
37
|
assertionId: string;
|
|
38
|
-
/**
|
|
38
|
+
/** The `NotOnOrAfter` of the assertion's conditions, epoch seconds. */
|
|
39
39
|
notOnOrAfter: number;
|
|
40
|
+
/**
|
|
41
|
+
* Until when a replay record has to last, epoch seconds: the later of the
|
|
42
|
+
* two expiries the assertion carries (its conditions and its bearer
|
|
43
|
+
* confirmation) plus the clock skew this validation allowed. Before that
|
|
44
|
+
* instant the same assertion can still pass `validateAssertion`, so a
|
|
45
|
+
* record forgotten earlier lets a captured response sign in again.
|
|
46
|
+
*/
|
|
47
|
+
rememberUntil: number;
|
|
40
48
|
/** The provider's session, when it named one. */
|
|
41
49
|
sessionIndex: string | undefined;
|
|
42
50
|
}
|
|
@@ -232,6 +240,7 @@ export function validateAssertion(
|
|
|
232
240
|
attributes: readAttributes(assertion),
|
|
233
241
|
assertionId,
|
|
234
242
|
notOnOrAfter,
|
|
243
|
+
rememberUntil: Math.max(notOnOrAfter, confirmationExpiry) + skew,
|
|
235
244
|
sessionIndex: authn?.attributes.find((a) => a.local === "SessionIndex")
|
|
236
245
|
?.value,
|
|
237
246
|
};
|