@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/connection/saml/template.js

@@ -0,0 +1,68 @@
+import camelCase from "camelcase";
+import xmlEscape from "xml-escape";
+
+//#region src/server/connection/saml/template.ts
+/** Map a SAML message type to the redirect-binding query param (`SAMLRequest`/`SAMLResponse`). */
+const QUERY_PARAM_BY_KIND = {
+	SAMLRequest: "SAMLRequest",
+	LogoutRequest: "SAMLRequest",
+	SAMLResponse: "SAMLResponse",
+	LogoutResponse: "SAMLResponse"
+};
+/** The redirect/POST query-param name carrying a message of the given kind. */
+function getQueryParamByType(type) {
+	const param = QUERY_PARAM_BY_KIND[type];
+	if (param === void 0) throw new Error("ERR_UNDEFINED_QUERY_PARAMS");
+	return param;
+}
+/** Default login request template. */
+const defaultLoginRequestTemplate = { context: "<samlp:AuthnRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"{ID}\" Version=\"2.0\" IssueInstant=\"{IssueInstant}\" Destination=\"{Destination}\" ProtocolBinding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" AssertionConsumerServiceURL=\"{AssertionConsumerServiceURL}\"><saml:Issuer>{Issuer}</saml:Issuer><samlp:NameIDPolicy Format=\"{NameIDFormat}\" AllowCreate=\"{AllowCreate}\"/></samlp:AuthnRequest>" };
+/** Default AttributeStatement template. */
+const defaultAttributeStatementTemplate = { context: "<saml:AttributeStatement>{Attributes}</saml:AttributeStatement>" };
+/** Default Attribute template. */
+const defaultAttributeTemplate = { context: "<saml:Attribute Name=\"{Name}\" NameFormat=\"{NameFormat}\"><saml:AttributeValue xmlns:xs=\"{ValueXmlnsXs}\" xmlns:xsi=\"{ValueXmlnsXsi}\" xsi:type=\"{ValueXsiType}\">{Value}</saml:AttributeValue></saml:Attribute>" };
+/** Default logout response template. */
+const defaultLogoutResponseTemplate = { context: "<samlp:LogoutResponse xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"{ID}\" Version=\"2.0\" IssueInstant=\"{IssueInstant}\" Destination=\"{Destination}\" InResponseTo=\"{InResponseTo}\"><saml:Issuer>{Issuer}</saml:Issuer><samlp:Status><samlp:StatusCode Value=\"{StatusCode}\"/></samlp:Status></samlp:LogoutResponse>" };
+function tagging(prefix, content) {
+	const camelContent = camelCase(content, { locale: "en-us" });
+	return prefix + camelContent.charAt(0).toUpperCase() + camelContent.slice(1);
+}
+function stringifyTagValue(value) {
+	if (value === null || value === void 0) return "";
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint" || typeof value === "symbol") return value.toString();
+	return value.toString();
+}
+function escapeTag(replacement) {
+	return (_match, quote) => {
+		const text = stringifyTagValue(replacement);
+		return quote ? `${quote}${xmlEscape(text)}` : text;
+	};
+}
+/** Replace `{tag}` placeholders inside a raw XML string with their tag values. */
+function replaceTagsByValue(rawXML, tagValues) {
+	Object.keys(tagValues).forEach((t) => {
+		rawXML = rawXML.replace(new RegExp(`("?)\\{${t}\\}`, "g"), escapeTag(tagValues[t]));
+	});
+	return rawXML;
+}
+/** Build a `<saml:AttributeStatement>` from attribute configs and the attribute templates. */
+function attributeStatementBuilder(attributes, attributeTemplate = defaultAttributeTemplate, attributeStatementTemplate = defaultAttributeStatementTemplate) {
+	const attr = attributes.map(({ name, nameFormat, valueTag, valueXsiType, valueXmlnsXs, valueXmlnsXsi }) => {
+		const defaultValueXmlnsXs = "http://www.w3.org/2001/XMLSchema";
+		const defaultValueXmlnsXsi = "http://www.w3.org/2001/XMLSchema-instance";
+		let attributeLine = attributeTemplate.context;
+		attributeLine = attributeLine.replace("{Name}", name);
+		attributeLine = attributeLine.replace("{NameFormat}", nameFormat);
+		attributeLine = attributeLine.replace("{ValueXmlnsXs}", valueXmlnsXs ? valueXmlnsXs : defaultValueXmlnsXs);
+		attributeLine = attributeLine.replace("{ValueXmlnsXsi}", valueXmlnsXsi ? valueXmlnsXsi : defaultValueXmlnsXsi);
+		attributeLine = attributeLine.replace("{ValueXsiType}", valueXsiType);
+		attributeLine = attributeLine.replace("{Value}", `{${tagging("attr", valueTag)}}`);
+		return attributeLine;
+	}).join("");
+	return attributeStatementTemplate.context.replace("{Attributes}", attr);
+}
+
+//#endregion
+export { attributeStatementBuilder, defaultAttributeStatementTemplate, defaultAttributeTemplate, defaultLoginRequestTemplate, defaultLogoutResponseTemplate, getQueryParamByType, replaceTagsByValue };
+//# sourceMappingURL=template.js.map

package/dist/server/connection/saml/types.js

@@ -0,0 +1 @@
+export {  };

package/dist/server/connection/saml/validator.js

@@ -0,0 +1,32 @@
+//#region src/server/connection/saml/validator.ts
+/**
+* Check the current time against a SAML `NotBefore`/`NotOnOrAfter` window.
+*
+* @param drift `[before, after]` clock-skew tolerance in milliseconds.
+* @returns `true` when now falls within the (drift-adjusted) validity window.
+*/
+function verifyTime(utcNotBefore, utcNotOnOrAfter, drift = [0, 0]) {
+	const now = /* @__PURE__ */ new Date();
+	if (!utcNotBefore && !utcNotOnOrAfter) {
+		console.warn("You intend to have time validation however the document doesn't include the valid range.");
+		return true;
+	}
+	let notBeforeLocal = null;
+	let notOnOrAfterLocal = null;
+	const [notBeforeDrift, notOnOrAfterDrift] = drift;
+	if (utcNotBefore && !utcNotOnOrAfter) {
+		notBeforeLocal = new Date(utcNotBefore);
+		return +notBeforeLocal + notBeforeDrift <= +now;
+	}
+	if (!utcNotBefore && utcNotOnOrAfter) {
+		notOnOrAfterLocal = new Date(utcNotOnOrAfter);
+		return +now < +notOnOrAfterLocal + notOnOrAfterDrift;
+	}
+	notBeforeLocal = new Date(utcNotBefore);
+	notOnOrAfterLocal = new Date(utcNotOnOrAfter);
+	return +notBeforeLocal + notBeforeDrift <= +now && +now < +notOnOrAfterLocal + notOnOrAfterDrift;
+}
+
+//#endregion
+export { verifyTime };
+//# sourceMappingURL=validator.js.map

package/dist/server/connection/saml/xml/builder.js

@@ -0,0 +1,68 @@
+//#region src/server/connection/saml/xml/builder.ts
+function isXmlObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function escapeXmlText(input) {
+	return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function escapeXmlAttribute(input) {
+	return escapeXmlText(input).replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function renderScalar(value) {
+	return typeof value === "string" ? value : value.toString();
+}
+function renderAttributeValue(value) {
+	if (value === null || value === void 0) return "";
+	if (Array.isArray(value) || isXmlObject(value)) return renderValue(value);
+	return renderScalar(value);
+}
+function renderAttributes(attrs) {
+	return Object.keys(attrs).map((key) => {
+		const value = attrs[key];
+		return ` ${key}="${escapeXmlAttribute(renderAttributeValue(value))}"`;
+	}).join("");
+}
+function renderValue(value) {
+	if (value === null || value === void 0) return "";
+	if (Array.isArray(value)) return value.map(renderValue).join("");
+	if (isXmlObject(value)) return Object.keys(value).map((tagName) => renderElement(tagName, value[tagName])).join("");
+	return escapeXmlText(renderScalar(value));
+}
+function renderElement(tagName, value) {
+	let attrs = "";
+	let body = "";
+	if (Array.isArray(value)) {
+		value.forEach((item) => {
+			if (isXmlObject(item) && item._attr !== void 0 && isXmlObject(item._attr)) {
+				attrs += renderAttributes(item._attr);
+				return;
+			}
+			body += renderValue(item);
+		});
+		return `<${tagName}${attrs}>${body}</${tagName}>`;
+	}
+	if (isXmlObject(value)) {
+		if (value._attr !== void 0 && isXmlObject(value._attr)) {
+			attrs += renderAttributes(value._attr);
+			const copied = { ...value };
+			delete copied._attr;
+			body += renderValue(copied);
+		} else body += renderValue(value);
+		return `<${tagName}${attrs}>${body}</${tagName}>`;
+	}
+	body = renderValue(value);
+	return `<${tagName}${attrs}>${body}</${tagName}>`;
+}
+/**
+* Serialize a nested node description into an XML string.
+*
+* Objects become elements keyed by tag name; an `_attr` member supplies
+* attributes; arrays render their items in order. Text is XML-escaped.
+*/
+function buildXml(nodes) {
+	return nodes.map(renderValue).join("");
+}
+
+//#endregion
+export { buildXml };
+//# sourceMappingURL=builder.js.map