@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/connection/saml/xmldsig.js

@@ -0,0 +1,598 @@
+import { safeParseXml } from "./api.js";
+import { evaluateXPathToNodes, serializeXmlNode } from "./dom/select.js";
+import { toUtf8String } from "./encoding.js";
+import { rsaSign, rsaVerify, sha1Base64, sha256Base64 } from "./crypto.js";
+import { getTransformByAlgorithm } from "./c14n.js";
+
+//#region src/server/connection/saml/xmldsig.ts
+function selectNodes(expression, source) {
+	/**
+	* The XPath engine descends from an `Element` or `Document`; every `source`
+	* passed here is one of those at runtime (a parsed signature document or an
+	* element selected from one). This bridges the nominal `Node` supertype to the
+	* engine's `Element | Document` container across the xmldom/global-DOM boundary.
+	*/
+	return evaluateXPathToNodes(expression, source);
+}
+function normalizePem(pem) {
+	return `${(pem.trim().replace(/(\r\n|\r)/g, "\n").match(/.{1,64}/g) || []).join("\n")}\n`;
+}
+function derToPem(derBase64, pemLabel) {
+	return normalizePem(`-----BEGIN ${pemLabel}-----\n${derBase64.replace(/(\r\n|\r|\n)/g, "").trim()}\n-----END ${pemLabel}-----`);
+}
+function normalizeCertificateBody(raw) {
+	return raw.replace(/-----BEGIN CERTIFICATE-----/g, "").replace(/-----END CERTIFICATE-----/g, "").replace(/\s+/g, "");
+}
+/**
+* Map a signature-scheme name or algorithm URI to its WebCrypto hash.
+*
+* Accepts the `pkcs1-sha1` / `pkcs1-sha256` short-hands as well as `sha-256`,
+* defaulting to SHA-1 when nothing matches.
+*/
+function schemeToHash(scheme) {
+	const normalized = scheme.toLowerCase();
+	if (normalized.includes("sha256")) return "SHA-256";
+	if (normalized.includes("sha1")) return "SHA-1";
+	if (normalized.includes("sha-256")) return "SHA-256";
+	return "SHA-1";
+}
+function isElementNode(node) {
+	return typeof node === "object" && node !== null && node.nodeType === 1;
+}
+function isAttributeNode(node) {
+	return typeof node === "object" && node !== null && node.nodeType === 2;
+}
+function isTextNode(node) {
+	return typeof node === "object" && node !== null && node.nodeType === 3;
+}
+function isDocument(node) {
+	return node.nodeType === 9;
+}
+function findChildren(node, localName) {
+	const element = isDocument(node) ? node.documentElement || node : node;
+	const res = [];
+	if (!element.childNodes) return res;
+	for (let i = 0; i < element.childNodes.length; i++) {
+		const child = element.childNodes.item(i);
+		if (isElementNode(child) && child.localName === localName) res.push(child);
+	}
+	return res;
+}
+function findAttr(element, localName, namespace) {
+	for (let i = 0; i < element.attributes.length; i++) {
+		const attr = element.attributes[i];
+		if (attr.localName === localName && (namespace == null || attr.namespaceURI === namespace || !attr.namespaceURI && element.namespaceURI === namespace)) return attr;
+	}
+	return null;
+}
+function isArrayHasLength(input) {
+	return Array.isArray(input) && input.length > 0;
+}
+function getElementNamespaceDeclarations(node) {
+	const out = [];
+	for (let i = 0; i < node.attributes.length; i++) {
+		const attr = node.attributes[i];
+		if (attr.nodeName.search(/^xmlns:?/) !== -1) out.push({
+			prefix: attr.nodeName.replace(/^xmlns:?/, ""),
+			namespaceURI: attr.nodeValue || ""
+		});
+	}
+	return out;
+}
+function findAncestorNs(doc, docSubsetXpath) {
+	if (!docSubsetXpath) return [];
+	const docSubset = selectNodes(docSubsetXpath, doc);
+	if (!isArrayHasLength(docSubset)) return [];
+	const first = docSubset[0];
+	if (!isElementNode(first)) throw new Error("Document subset must be list of elements");
+	const nsList = [];
+	let parent = first.parentNode;
+	while (parent && isElementNode(parent)) {
+		nsList.push(...getElementNamespaceDeclarations(parent));
+		parent = parent.parentNode;
+	}
+	const unique = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of nsList) if (!seen.has(entry.prefix)) {
+		seen.add(entry.prefix);
+		unique.push(entry);
+	}
+	const subsetPrefix = (() => {
+		for (let i = 0; i < first.attributes.length; i++) {
+			const nodeName = first.attributes[i].nodeName;
+			if (nodeName.search(/^xmlns:?/) !== -1) return nodeName.replace(/^xmlns:?/, "");
+		}
+		return first.prefix || "";
+	})();
+	return unique.filter((v) => v.prefix !== subsetPrefix);
+}
+const sha1 = {
+	getHash(xml) {
+		return sha1Base64(xml);
+	},
+	getAlgorithmName() {
+		return "http://www.w3.org/2000/09/xmldsig#sha1";
+	}
+};
+const sha256 = {
+	getHash(xml) {
+		return sha256Base64(xml);
+	},
+	getAlgorithmName() {
+		return "http://www.w3.org/2001/04/xmlenc#sha256";
+	}
+};
+const rsaSha1 = {
+	async getSignature(signedInfo, privateKey) {
+		return rsaSign(privateKey, signedInfo, "SHA-1");
+	},
+	async verifySignature(material, key, signatureValue) {
+		return rsaVerify(key, material, signatureValue, "SHA-1");
+	},
+	getAlgorithmName() {
+		return "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
+	}
+};
+const rsaSha256 = {
+	async getSignature(signedInfo, privateKey) {
+		return rsaSign(privateKey, signedInfo, "SHA-256");
+	},
+	async verifySignature(material, key, signatureValue) {
+		return rsaVerify(key, material, signatureValue, "SHA-256");
+	},
+	getAlgorithmName() {
+		return "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";
+	}
+};
+const HASH_ALGORITHMS = {
+	"http://www.w3.org/2000/09/xmldsig#sha1": sha1,
+	"http://www.w3.org/2001/04/xmlenc#sha256": sha256
+};
+const SIGNATURE_ALGORITHMS = {
+	"http://www.w3.org/2000/09/xmldsig#rsa-sha1": rsaSha1,
+	"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256": rsaSha256
+};
+function findHashAlgorithm(name) {
+	const algo = HASH_ALGORITHMS[name];
+	if (!algo) throw new Error(`hash algorithm '${name}' is not supported`);
+	return algo;
+}
+function findSignatureAlgorithm(name) {
+	if (!name) throw new Error("signatureAlgorithm is required");
+	const algo = SIGNATURE_ALGORITHMS[name];
+	if (!algo) throw new Error(`signature algorithm '${name}' is not supported`);
+	return algo;
+}
+const defaultNsForPrefix = { ds: "http://www.w3.org/2000/09/xmldsig#" };
+function staticGetKeyInfoContent({ publicCert, prefix }) {
+	if (!publicCert) return null;
+	const currentPrefix = prefix ? `${prefix}:` : "";
+	const certBody = normalizeCertificateBody(publicCert);
+	if (!certBody) return null;
+	return `<${currentPrefix}X509Data><${currentPrefix}X509Certificate>${certBody}</${currentPrefix}X509Certificate></${currentPrefix}X509Data>`;
+}
+function staticGetCertFromKeyInfo(keyInfo) {
+	if (!isElementNode(keyInfo)) return null;
+	const certNode = selectNodes(".//*[local-name(.)='X509Certificate']", keyInfo)[0];
+	if (isElementNode(certNode) && typeof certNode.textContent === "string") return derToPem(certNode.textContent, "CERTIFICATE");
+	return null;
+}
+/** Create a fresh XML-dsig signer/verifier instance. */
+function createSignedXml() {
+	const self = {
+		signatureAlgorithm: void 0,
+		canonicalizationAlgorithm: void 0,
+		inclusiveNamespacesPrefixList: [],
+		keyInfoAttributes: {},
+		getKeyInfoContent: (args) => staticGetKeyInfoContent(args),
+		getCertFromKeyInfo: (keyInfo) => staticGetCertFromKeyInfo(keyInfo),
+		id: 0,
+		signedXml: "",
+		signatureXml: "",
+		signatureNode: null,
+		signatureValue: "",
+		originalXmlWithIds: "",
+		keyInfo: null,
+		references: [],
+		signedReferences: [],
+		idAttributes: [
+			"Id",
+			"ID",
+			"id"
+		],
+		privateKey: void 0,
+		publicCert: void 0,
+		addReference({ xpath, transforms, digestAlgorithm, uri = "", digestValue, inclusiveNamespacesPrefixList = [], isEmptyUri = false }) {
+			if (!digestAlgorithm) throw new Error("digestAlgorithm is required");
+			if (!isArrayHasLength(transforms)) throw new Error("transforms must contain at least one transform algorithm");
+			self.references.push({
+				xpath,
+				transforms,
+				digestAlgorithm,
+				uri,
+				digestValue,
+				inclusiveNamespacesPrefixList,
+				isEmptyUri
+			});
+		},
+		getSignedReferences() {
+			return [...self.signedReferences];
+		},
+		getCanonXml(transforms, node, options = {}) {
+			options.defaultNsForPrefix = options.defaultNsForPrefix || defaultNsForPrefix;
+			options.signatureNode = self.signatureNode === null ? void 0 : self.signatureNode;
+			let transformed = node.cloneNode(true);
+			transforms.forEach((transformName) => {
+				if (typeof transformed !== "string") transformed = getTransformByAlgorithm(transformName).process(transformed, options);
+			});
+			return typeof transformed === "string" ? transformed : transformed.toString();
+		},
+		ensureHasId(node) {
+			for (const idAttr of self.idAttributes) {
+				const attr = findAttr(node, idAttr);
+				if (attr) return attr.value;
+			}
+			const id = `_${self.id++}`;
+			node.setAttribute("Id", id);
+			return id;
+		},
+		getCanonReferenceXml(doc, ref, node) {
+			if (Array.isArray(ref.transforms)) ref.ancestorNamespaces = findAncestorNs(doc, ref.xpath);
+			const c14nOptions = {
+				inclusiveNamespacesPrefixList: ref.inclusiveNamespacesPrefixList,
+				ancestorNamespaces: ref.ancestorNamespaces
+			};
+			return self.getCanonXml(ref.transforms, node, c14nOptions);
+		},
+		getCanonSignedInfoXml(doc) {
+			if (self.signatureNode == null) throw new Error("No signature found.");
+			if (typeof self.canonicalizationAlgorithm !== "string") throw new Error("Missing canonicalizationAlgorithm when trying to get signed info for XML");
+			const signedInfo = findChildren(self.signatureNode, "SignedInfo");
+			if (signedInfo.length === 0) throw new Error("could not find SignedInfo element in the message");
+			if (signedInfo.length > 1) throw new Error("could not get canonicalized signed info for a signature that contains multiple SignedInfo nodes");
+			const ancestorNamespaces = findAncestorNs(doc, "//*[local-name()='SignedInfo']");
+			return self.getCanonXml([self.canonicalizationAlgorithm], signedInfo[0], { ancestorNamespaces });
+		},
+		createReferences(doc, prefix) {
+			const currentPrefix = prefix ? `${prefix}:` : "";
+			let res = "";
+			for (const ref of self.references) {
+				const nodes = selectNodes(ref.xpath || "", doc);
+				if (!isArrayHasLength(nodes)) throw new Error(`the following xpath cannot be signed because it was not found: ${ref.xpath}`);
+				for (const selected of nodes) {
+					if (!isElementNode(selected)) continue;
+					const node = selected;
+					if (ref.isEmptyUri) res += `<${currentPrefix}Reference URI="">`;
+					else {
+						const id = self.ensureHasId(node);
+						ref.uri = id;
+						res += `<${currentPrefix}Reference URI="#${id}">`;
+					}
+					res += `<${currentPrefix}Transforms>`;
+					for (const trans of ref.transforms || []) {
+						const transform = getTransformByAlgorithm(trans);
+						res += `<${currentPrefix}Transform Algorithm="${transform.getAlgorithmName()}"`;
+						if (isArrayHasLength(ref.inclusiveNamespacesPrefixList)) {
+							res += ">";
+							res += `<InclusiveNamespaces PrefixList="${ref.inclusiveNamespacesPrefixList.join(" ")}" xmlns="${transform.getAlgorithmName()}"/>`;
+							res += `</${currentPrefix}Transform>`;
+						} else res += " />";
+					}
+					const canonXml = self.getCanonReferenceXml(doc, ref, node);
+					const digestAlgorithm = findHashAlgorithm(ref.digestAlgorithm);
+					res += `</${currentPrefix}Transforms><${currentPrefix}DigestMethod Algorithm="${digestAlgorithm.getAlgorithmName()}" /><${currentPrefix}DigestValue>${digestAlgorithm.getHash(canonXml)}</${currentPrefix}DigestValue></${currentPrefix}Reference>`;
+				}
+			}
+			return res;
+		},
+		createSignedInfo(doc, prefix) {
+			if (typeof self.canonicalizationAlgorithm !== "string") throw new Error("Missing canonicalizationAlgorithm when trying to create signed info for XML");
+			const transform = getTransformByAlgorithm(self.canonicalizationAlgorithm);
+			const algo = findSignatureAlgorithm(self.signatureAlgorithm);
+			const currentPrefix = prefix ? `${prefix}:` : "";
+			let res = `<${currentPrefix}SignedInfo>`;
+			res += `<${currentPrefix}CanonicalizationMethod Algorithm="${transform.getAlgorithmName()}"`;
+			if (isArrayHasLength(self.inclusiveNamespacesPrefixList)) {
+				res += ">";
+				res += `<InclusiveNamespaces PrefixList="${self.inclusiveNamespacesPrefixList.join(" ")}" xmlns="${transform.getAlgorithmName()}"/>`;
+				res += `</${currentPrefix}CanonicalizationMethod>`;
+			} else res += " />";
+			res += `<${currentPrefix}SignatureMethod Algorithm="${algo.getAlgorithmName()}" />`;
+			res += self.createReferences(doc, prefix);
+			res += `</${currentPrefix}SignedInfo>`;
+			return res;
+		},
+		createSignature(prefix) {
+			let xmlNsAttr = "xmlns";
+			let currentPrefix = "";
+			if (prefix) {
+				xmlNsAttr += `:${prefix}`;
+				currentPrefix = `${prefix}:`;
+			}
+			const signatureValueXml = `<${currentPrefix}SignatureValue>${self.signatureValue}</${currentPrefix}SignatureValue>`;
+			return safeParseXml(`<${currentPrefix}Signature ${xmlNsAttr}="http://www.w3.org/2000/09/xmldsig#">${signatureValueXml}</${currentPrefix}Signature>`, "text/xml").documentElement.firstChild;
+		},
+		async calculateSignatureValue(doc) {
+			const signedInfoCanon = self.getCanonSignedInfoXml(doc);
+			const signer = findSignatureAlgorithm(self.signatureAlgorithm);
+			if (self.privateKey == null) throw new Error("Private key is required to compute signature");
+			self.signatureValue = await signer.getSignature(signedInfoCanon, self.privateKey);
+		},
+		getKeyInfo(prefix) {
+			const currentPrefix = prefix ? `${prefix}:` : "";
+			let keyInfoAttrs = "";
+			if (self.keyInfoAttributes) Object.keys(self.keyInfoAttributes).forEach((name) => {
+				keyInfoAttrs += ` ${name}="${self.keyInfoAttributes[name]}"`;
+			});
+			const keyInfoContent = self.getKeyInfoContent({
+				publicCert: self.publicCert,
+				prefix
+			});
+			if (keyInfoAttrs || keyInfoContent) return `<${currentPrefix}KeyInfo${keyInfoAttrs}>${keyInfoContent || ""}</${currentPrefix}KeyInfo>`;
+			return "";
+		},
+		async computeSignature(xml, options) {
+			options = options || {};
+			const doc = safeParseXml(xml, "text/xml");
+			let xmlNsAttr = "xmlns";
+			const signatureAttrs = [];
+			const validActions = [
+				"append",
+				"prepend",
+				"before",
+				"after"
+			];
+			const prefix = options.prefix;
+			const attrs = options.attrs || {};
+			const location = options.location || {};
+			const existingPrefixes = options.existingPrefixes || {};
+			location.reference = location.reference || "/*";
+			location.action = location.action || "append";
+			if (validActions.indexOf(location.action) === -1) throw new Error(`location.action option has an invalid action: ${location.action}, must be any of the following values: ${validActions.join(", ")}`);
+			let currentPrefix = "";
+			if (prefix) {
+				xmlNsAttr += `:${prefix}`;
+				currentPrefix = `${prefix}:`;
+			}
+			Object.keys(attrs).forEach((name) => {
+				if (name !== "xmlns" && name !== xmlNsAttr) signatureAttrs.push(`${name}="${attrs[name]}"`);
+			});
+			signatureAttrs.push(`${xmlNsAttr}="http://www.w3.org/2000/09/xmldsig#"`);
+			let signatureXml = `<${currentPrefix}Signature ${signatureAttrs.join(" ")}>`;
+			signatureXml += self.createSignedInfo(doc, prefix);
+			signatureXml += self.getKeyInfo(prefix);
+			signatureXml += `</${currentPrefix}Signature>`;
+			self.originalXmlWithIds = serializeXmlNode(doc);
+			let existingPrefixesString = "";
+			Object.keys(existingPrefixes).forEach((key) => {
+				existingPrefixesString += `xmlns:${key}="${existingPrefixes[key]}" `;
+			});
+			const signatureDoc = safeParseXml(`<Dummy ${existingPrefixesString}>${signatureXml}</Dummy>`, "text/xml").documentElement.firstChild;
+			const referenceNode = selectNodes(location.reference, doc)[0];
+			if (!isElementNode(referenceNode)) throw new Error(`the following xpath cannot be used because it was not found: ${location.reference}`);
+			if (location.action === "append") referenceNode.appendChild(signatureDoc);
+			else if (location.action === "prepend") referenceNode.insertBefore(signatureDoc, referenceNode.firstChild);
+			else if (location.action === "before") {
+				if (!referenceNode.parentNode) throw new Error("`location.reference` refers to the root node (by default), so we cannot insert `before`");
+				referenceNode.parentNode.insertBefore(signatureDoc, referenceNode);
+			} else if (location.action === "after") {
+				if (!referenceNode.parentNode) throw new Error("`location.reference` refers to the root node (by default), so we cannot insert `after`");
+				referenceNode.parentNode.insertBefore(signatureDoc, referenceNode.nextSibling);
+			}
+			self.signatureNode = signatureDoc;
+			const signedInfoNodes = findChildren(self.signatureNode, "SignedInfo");
+			if (signedInfoNodes.length === 0) throw new Error("could not find SignedInfo element in the message");
+			await self.calculateSignatureValue(doc);
+			signatureDoc.insertBefore(self.createSignature(prefix), signedInfoNodes[0].nextSibling);
+			self.signatureXml = signatureDoc.toString();
+			self.signedXml = serializeXmlNode(doc);
+		},
+		loadReference(refNode) {
+			const nodeStr = (n) => n.toString();
+			let nodes = findChildren(refNode, "DigestMethod");
+			if (nodes.length === 0) throw new Error(`could not find DigestMethod in reference ${nodeStr(refNode)}`);
+			const digestAlgoNode = nodes[0];
+			const digestAttr = findAttr(digestAlgoNode, "Algorithm");
+			if (!digestAttr) throw new Error(`could not find Algorithm attribute in node ${nodeStr(digestAlgoNode)}`);
+			const digestAlgo = digestAttr.value;
+			nodes = findChildren(refNode, "DigestValue");
+			if (nodes.length === 0) throw new Error(`could not find DigestValue node in reference ${nodeStr(refNode)}`);
+			if (nodes.length > 1) throw new Error(`could not load reference for a node that contains multiple DigestValue nodes: ${nodeStr(refNode)}`);
+			const digestValue = nodes[0].textContent || "";
+			if (!digestValue) throw new Error(`could not find the value of DigestValue in ${nodeStr(refNode)}`);
+			const transforms = [];
+			let inclusiveNamespacesPrefixList = [];
+			nodes = findChildren(refNode, "Transforms");
+			if (nodes.length !== 0) {
+				const transformsNode = nodes[0];
+				const transformsAll = findChildren(transformsNode, "Transform");
+				for (const transform of transformsAll) {
+					const transformAttr = findAttr(transform, "Algorithm");
+					if (transformAttr) transforms.push(transformAttr.value);
+				}
+				const lastTransform = transformsAll[transformsAll.length - 1];
+				if (lastTransform) {
+					const inclusiveNamespaces = findChildren(lastTransform, "InclusiveNamespaces");
+					if (isArrayHasLength(inclusiveNamespaces)) {
+						const values = [];
+						inclusiveNamespaces.forEach((namespaceNode) => {
+							(namespaceNode.getAttribute("PrefixList") || "").split(" ").forEach((v) => {
+								if (v.length > 0) values.push(v);
+							});
+						});
+						inclusiveNamespacesPrefixList = values;
+					}
+				}
+			}
+			if (transforms.length === 0 || transforms[transforms.length - 1] === "http://www.w3.org/2000/09/xmldsig#enveloped-signature") transforms.push("http://www.w3.org/2001/10/xml-exc-c14n#");
+			const refUri = isElementNode(refNode) ? refNode.getAttribute("URI") : null;
+			self.addReference({
+				transforms,
+				digestAlgorithm: digestAlgo,
+				uri: refUri === null ? void 0 : refUri,
+				digestValue,
+				inclusiveNamespacesPrefixList,
+				isEmptyUri: refUri === ""
+			});
+		},
+		loadSignature(signatureNode) {
+			if (typeof signatureNode === "string") self.signatureNode = safeParseXml(signatureNode, "text/xml");
+			else self.signatureNode = signatureNode;
+			self.signatureXml = self.signatureNode.toString();
+			const canonicalizationAlgorithmNode = selectNodes(".//*[local-name(.)='CanonicalizationMethod']/@Algorithm", self.signatureNode)[0];
+			if (!canonicalizationAlgorithmNode) throw new Error("could not find CanonicalizationMethod/@Algorithm element");
+			if (isAttributeNode(canonicalizationAlgorithmNode)) self.canonicalizationAlgorithm = canonicalizationAlgorithmNode.value;
+			const signatureAlgorithmNode = selectNodes(".//*[local-name(.)='SignatureMethod']/@Algorithm", self.signatureNode)[0];
+			if (isAttributeNode(signatureAlgorithmNode)) self.signatureAlgorithm = signatureAlgorithmNode.value;
+			const signedInfoNodes = findChildren(self.signatureNode, "SignedInfo");
+			if (!isArrayHasLength(signedInfoNodes)) throw new Error("no signed info node found");
+			if (signedInfoNodes.length > 1) throw new Error("could not load signature that contains multiple SignedInfo nodes");
+			self.references = [];
+			self.signedReferences = [];
+			const signatureValueNode = selectNodes(".//*[local-name(.)='SignatureValue']/text()", self.signatureNode)[0];
+			if (isTextNode(signatureValueNode)) self.signatureValue = signatureValueNode.data.replace(/\r?\n/g, "");
+			const keyInfoNode = selectNodes(".//*[local-name(.)='KeyInfo']", self.signatureNode)[0];
+			if (isElementNode(keyInfoNode)) self.keyInfo = keyInfoNode;
+		},
+		validateReference(ref, doc) {
+			const uri = ref.uri && ref.uri[0] === "#" ? ref.uri.substring(1) : ref.uri;
+			let elem = null;
+			if (uri === "") {
+				const firstNode = selectNodes("//*", doc)[0];
+				elem = isElementNode(firstNode) ? firstNode : null;
+			} else if (uri && uri.indexOf("'") !== -1) throw new Error("Cannot validate a uri with quotes inside it");
+			else if (uri) {
+				let numElementsForId = 0;
+				for (const attr of self.idAttributes) {
+					const tmpElemXpath = `//*[@*[local-name(.)='${attr}']='${uri}']`;
+					const tmpElem = selectNodes(tmpElemXpath, doc);
+					if (isArrayHasLength(tmpElem)) {
+						numElementsForId += tmpElem.length;
+						if (numElementsForId > 1) throw new Error("Cannot validate a document which contains multiple elements with the same value for ID attributes");
+						const matched = tmpElem[0];
+						elem = isElementNode(matched) ? matched : null;
+						ref.xpath = tmpElemXpath;
+					}
+				}
+			}
+			if (!elem) {
+				ref.validationError = /* @__PURE__ */ new Error(`invalid signature: the signature references an element with uri ${ref.uri} but could not find such element in the xml`);
+				return false;
+			}
+			const canonXml = self.getCanonReferenceXml(doc, ref, elem);
+			const digest = findHashAlgorithm(ref.digestAlgorithm).getHash(canonXml);
+			if (digest !== ref.digestValue) {
+				ref.validationError = /* @__PURE__ */ new Error(`invalid signature: for uri ${ref.uri} calculated digest is ${digest} but xml supplies digest ${ref.digestValue}`);
+				return false;
+			}
+			self.signedReferences.push(canonXml);
+			ref.signedReference = canonXml;
+			return true;
+		},
+		async checkSignature(xml) {
+			self.signedXml = xml;
+			const doc = safeParseXml(xml, "text/xml");
+			self.references = [];
+			const unverifiedSignedInfoCanon = self.getCanonSignedInfoXml(doc);
+			if (!unverifiedSignedInfoCanon) throw new Error("Canonical signed info cannot be empty");
+			const unverifiedSignedInfoDoc = safeParseXml(unverifiedSignedInfoCanon, "text/xml").documentElement;
+			if (!unverifiedSignedInfoDoc) throw new Error("Could not parse unverifiedSignedInfoCanon into a document");
+			const references = findChildren(unverifiedSignedInfoDoc, "Reference");
+			if (!isArrayHasLength(references)) throw new Error("could not find any Reference elements");
+			for (const reference of references) self.loadReference(reference);
+			if (!self.references.every((ref) => self.validateReference(ref, doc))) {
+				self.signedReferences = [];
+				self.references.forEach((ref) => {
+					ref.signedReference = void 0;
+				});
+				return false;
+			}
+			const signer = findSignatureAlgorithm(self.signatureAlgorithm);
+			const key = self.publicCert || self.getCertFromKeyInfo(self.keyInfo) || self.privateKey;
+			if (key == null) throw new Error("KeyInfo or publicCert or privateKey is required to validate signature");
+			const result = await signer.verifySignature(unverifiedSignedInfoCanon, key, self.signatureValue);
+			if (!result) {
+				self.signedReferences = [];
+				self.references.forEach((ref) => {
+					ref.signedReference = void 0;
+				});
+			}
+			return result;
+		},
+		getSignedXml() {
+			return self.signedXml;
+		},
+		getSignatureXml() {
+			return self.signatureXml;
+		},
+		getOriginalXmlWithIds() {
+			return self.originalXmlWithIds;
+		},
+		setPrivateKey(privateKey) {
+			self.privateKey = toUtf8String(privateKey);
+		},
+		setPublicCert(publicCert) {
+			self.publicCert = publicCert;
+		}
+	};
+	return self;
+}
+function getSigningScheme(sigAlg, nrsaAliasMapping, defaultSignatureAlgorithm) {
+	if (sigAlg) {
+		const algAlias = nrsaAliasMapping[sigAlg];
+		if (!(algAlias === void 0)) return algAlias;
+	}
+	return nrsaAliasMapping[defaultSignatureAlgorithm];
+}
+/** Sign the octet string of a redirect-binding SAML message (detached signature). */
+async function constructMessageSignature(opts) {
+	const { octetString, key, passphrase, isBase64, signingAlgorithm, nrsaAliasMapping, defaultSignatureAlgorithm, readPrivateKey, signMessage } = opts;
+	const signature = await signMessage({
+		octetString,
+		privateKey: readPrivateKey(key, passphrase),
+		signingScheme: getSigningScheme(signingAlgorithm, nrsaAliasMapping, defaultSignatureAlgorithm),
+		isBase64Output: isBase64 !== false
+	});
+	return isBase64 !== false ? String(signature) : signature;
+}
+/** Verify the detached signature of a redirect-binding SAML message. */
+async function verifyMessageSignature(opts) {
+	const { octetString, signature, signCert, verifyAlgorithm, nrsaAliasMapping, defaultSignatureAlgorithm, getPublicKeyPemFromCertificate, verifyMessage } = opts;
+	const signingScheme = getSigningScheme(verifyAlgorithm, nrsaAliasMapping, defaultSignatureAlgorithm);
+	return verifyMessage({
+		octetString,
+		signature,
+		publicKey: getPublicKeyPemFromCertificate(signCert),
+		signingScheme
+	});
+}
+/** Build an enveloped XML-dsig signature over a SAML message or assertion. */
+async function constructSamlSignature(opts) {
+	const { rawSamlMessage, referenceTagXPath, privateKey, privateKeyPass, signatureAlgorithm, transformationAlgorithms = ["http://www.w3.org/2000/09/xmldsig#enveloped-signature", "http://www.w3.org/2001/10/xml-exc-c14n#"], signingCert, signatureConfig, isBase64Output = true, isMessageSigned = false, getDigestMethod, getKeyInfo, readPrivateKey, base64Encode } = opts;
+	const sig = createSignedXml();
+	const digestAlgorithm = getDigestMethod(signatureAlgorithm);
+	if (!digestAlgorithm) throw new Error("ERR_MISSING_DIGEST_ALGORITHM");
+	if (referenceTagXPath) sig.addReference({
+		xpath: referenceTagXPath,
+		transforms: transformationAlgorithms,
+		digestAlgorithm
+	});
+	if (isMessageSigned) sig.addReference({
+		xpath: "/*",
+		transforms: transformationAlgorithms,
+		digestAlgorithm
+	});
+	const signingCertString = toUtf8String(signingCert);
+	sig.signatureAlgorithm = signatureAlgorithm;
+	sig.setPublicCert(getKeyInfo(signingCertString, signatureConfig).getKey());
+	sig.getKeyInfoContent = getKeyInfo(signingCertString, signatureConfig).getKeyInfo;
+	sig.setPrivateKey(readPrivateKey(privateKey, privateKeyPass, true));
+	sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
+	if (signatureConfig) await sig.computeSignature(rawSamlMessage, signatureConfig);
+	else await sig.computeSignature(rawSamlMessage);
+	return isBase64Output !== false ? base64Encode(sig.getSignedXml()) : sig.getSignedXml();
+}
+
+//#endregion
+export { constructMessageSignature, constructSamlSignature, createSignedXml, schemeToHash, verifyMessageSignature };
+//# sourceMappingURL=xmldsig.js.map