@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/connection/saml/xmlenc.js

@@ -0,0 +1,162 @@
+import { safeParseXml } from "./api.js";
+import { evaluateXPathToNodes } from "./dom/select.js";
+import { toUtf8String } from "./encoding.js";
+import { pemToDer, pkcs1ToPkcs8 } from "./crypto.js";
+import { decodeBase64, encodeBase64 } from "@oslojs/encoding";
+
+//#region src/server/connection/saml/xmlenc.ts
+const utf8Encoder = new TextEncoder();
+const utf8Decoder = new TextDecoder();
+const DATA_ALGORITHMS = {
+	"http://www.w3.org/2001/04/xmlenc#aes128-cbc": {
+		mode: "AES-CBC",
+		keyBytes: 16,
+		ivBytes: 16
+	},
+	"http://www.w3.org/2001/04/xmlenc#aes256-cbc": {
+		mode: "AES-CBC",
+		keyBytes: 32,
+		ivBytes: 16
+	},
+	"http://www.w3.org/2009/xmlenc11#aes128-gcm": {
+		mode: "AES-GCM",
+		keyBytes: 16,
+		ivBytes: 12
+	},
+	"http://www.w3.org/2009/xmlenc11#aes256-gcm": {
+		mode: "AES-GCM",
+		keyBytes: 32,
+		ivBytes: 12
+	}
+};
+const KEY_ALGORITHMS = { RSA_OAEP_MGF1P: "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" };
+function selectNodes(expression, source) {
+	return evaluateXPathToNodes(expression, source);
+}
+function isElement(value) {
+	return typeof value === "object" && value !== null && value.nodeType === 1;
+}
+function firstElement(expression, source) {
+	const node = selectNodes(expression, source)[0];
+	return isElement(node) ? node : void 0;
+}
+function hasWebCrypto() {
+	return !!(globalThis.crypto && globalThis.crypto.subtle && globalThis.crypto.getRandomValues);
+}
+function getSubtleCrypto() {
+	if (!hasWebCrypto()) throw new Error("ERR_WEBCRYPTO_NOT_AVAILABLE");
+	return globalThis.crypto.subtle;
+}
+function fromBase64(input) {
+	return decodeBase64(input.replace(/\s+/g, ""));
+}
+function uint8ArrayToArrayBuffer(input) {
+	const out = new Uint8Array(input.byteLength);
+	out.set(input);
+	return out.buffer;
+}
+async function importRsaOaepPrivateKey(privateKeyPem) {
+	const subtle = getSubtleCrypto();
+	let pkcs8;
+	if (privateKeyPem.includes("BEGIN RSA PRIVATE KEY")) pkcs8 = pkcs1ToPkcs8(privateKeyPem);
+	else pkcs8 = pemToDer(privateKeyPem);
+	return subtle.importKey("pkcs8", uint8ArrayToArrayBuffer(pkcs8), {
+		name: "RSA-OAEP",
+		hash: "SHA-1"
+	}, false, ["decrypt"]);
+}
+async function unwrapSymmetricKey(encryptedKey, privateKeyPem, keyEncryptionAlgorithm) {
+	if (keyEncryptionAlgorithm === KEY_ALGORITHMS.RSA_OAEP_MGF1P) {
+		const subtle = getSubtleCrypto();
+		const privateKey = await importRsaOaepPrivateKey(privateKeyPem);
+		const decrypted = await subtle.decrypt({ name: "RSA-OAEP" }, privateKey, uint8ArrayToArrayBuffer(encryptedKey));
+		return new Uint8Array(decrypted);
+	}
+	throw new Error(`ERR_KEY_ENCRYPTION_ALGORITHM_NOT_SUPPORTED: ${keyEncryptionAlgorithm}`);
+}
+async function decryptAes(encrypted, symmetricKey, mode, iv) {
+	const subtle = getSubtleCrypto();
+	const key = await subtle.importKey("raw", uint8ArrayToArrayBuffer(symmetricKey), { name: mode }, false, ["decrypt"]);
+	const params = mode === "AES-GCM" ? {
+		name: "AES-GCM",
+		iv,
+		tagLength: 128
+	} : {
+		name: "AES-CBC",
+		iv
+	};
+	const decrypted = await subtle.decrypt(params, key, uint8ArrayToArrayBuffer(encrypted));
+	return new Uint8Array(decrypted);
+}
+function getRequiredAttrValue(node, attrName) {
+	if (!node) throw new Error(`ERR_MISSING_XML_NODE_FOR_ATTRIBUTE: ${attrName}`);
+	const value = node.getAttribute(attrName);
+	if (!value) throw new Error(`ERR_MISSING_XML_ATTRIBUTE: ${attrName}`);
+	return value;
+}
+function getCipherValueText(node) {
+	const cipherNode = selectNodes("./*[local-name(.)='CipherData']/*[local-name(.)='CipherValue']", node)[0];
+	if (!isElement(cipherNode) || typeof cipherNode.textContent !== "string") throw new Error("ERR_MISSING_CIPHER_VALUE");
+	return cipherNode.textContent;
+}
+function resolveEncryptedDataNode(doc) {
+	const encryptedDataNode = selectNodes("//*[local-name(.)='EncryptedData']", doc)[0];
+	if (!isElement(encryptedDataNode)) throw new Error("ERR_MISSING_ENCRYPTED_DATA");
+	return encryptedDataNode;
+}
+function resolveEncryptedKeyNode(doc, encryptedDataNode) {
+	const keyInfoNode = firstElement("./*[local-name(.)='KeyInfo']", encryptedDataNode);
+	if (!keyInfoNode) throw new Error("cant find encryption algorithm");
+	let encryptedKeyContainer = firstElement("./*[local-name(.)='EncryptedKey']", keyInfoNode);
+	if (!encryptedKeyContainer) {
+		const keyRetrievalMethod = firstElement("./*[local-name(.)='RetrievalMethod']", keyInfoNode);
+		const retrievalMethodUri = keyRetrievalMethod ? keyRetrievalMethod.getAttribute("URI") : null;
+		if (retrievalMethodUri && retrievalMethodUri.indexOf("#") === 0) {
+			const keyId = retrievalMethodUri.substring(1);
+			if (!/^[A-Za-z0-9_.:-]+$/.test(keyId)) throw new Error("ERR_INVALID_RETRIEVAL_METHOD_URI");
+			encryptedKeyContainer = firstElement(`//*[local-name(.)='EncryptedKey' and @Id='${keyId}']`, doc);
+		}
+	}
+	if (!encryptedKeyContainer) encryptedKeyContainer = firstElement(".//*[local-name(.)='EncryptedKey']", keyInfoNode);
+	if (!encryptedKeyContainer) throw new Error("cant find encryption algorithm");
+	const keyEncMethodNode = firstElement("./*[local-name(.)='EncryptionMethod']", encryptedKeyContainer) || firstElement(".//*[local-name(.)='EncryptionMethod']", encryptedKeyContainer);
+	if (!keyEncMethodNode) throw new Error("cant find encryption algorithm");
+	const keyEncryptionAlgorithm = getRequiredAttrValue(keyEncMethodNode, "Algorithm");
+	const encryptedKeyNode = firstElement("./*[local-name(.)='CipherData']/*[local-name(.)='CipherValue']", encryptedKeyContainer) || firstElement(".//*[local-name(.)='CipherData']/*[local-name(.)='CipherValue']", encryptedKeyContainer);
+	if (!encryptedKeyNode || typeof encryptedKeyNode.textContent !== "string") throw new Error("ERR_MISSING_ENCRYPTED_KEY");
+	return {
+		keyEncryptionAlgorithm,
+		encryptedKey: fromBase64(encryptedKeyNode.textContent)
+	};
+}
+/**
+* Decrypt an `<xenc:EncryptedData>` assertion produced by {@link encryptAssertion}.
+*
+* Unwraps the AES content key with the SP's RSA private key, then AES-decrypts
+* the assertion XML.
+*/
+async function decryptAssertion(opts) {
+	const { encryptedAssertionXml, privateKey } = opts;
+	if (!encryptedAssertionXml) throw new Error("must provide XML to encrypt");
+	const privateKeyPem = toUtf8String(privateKey);
+	if (!privateKeyPem) throw new Error("key option is mandatory and you should provide a valid RSA private key");
+	const doc = safeParseXml(encryptedAssertionXml, "text/xml");
+	const encryptedDataNode = resolveEncryptedDataNode(doc);
+	const dataAlg = DATA_ALGORITHMS[getRequiredAttrValue(firstElement("./*[local-name(.)='EncryptionMethod']", encryptedDataNode), "Algorithm")];
+	if (!dataAlg || dataAlg.mode !== "AES-GCM") throw new Error("ERR_UNSUPPORTED_DATA_ENCRYPTION_ALGORITHM");
+	const keyInfo = resolveEncryptedKeyNode(doc, encryptedDataNode);
+	const keyEncryptionAlgorithm = keyInfo.keyEncryptionAlgorithm;
+	const encryptedKey = keyInfo.encryptedKey;
+	const symmetricKey = await unwrapSymmetricKey(encryptedKey, privateKeyPem, keyEncryptionAlgorithm);
+	const encryptedContent = fromBase64(getCipherValueText(encryptedDataNode));
+	if (encryptedContent.length < dataAlg.ivBytes) throw new Error("ERR_INVALID_ENCRYPTED_CONTENT");
+	const iv = encryptedContent.slice(0, dataAlg.ivBytes);
+	const decrypted = await decryptAes(encryptedContent.slice(dataAlg.ivBytes), symmetricKey, dataAlg.mode, iv);
+	const result = utf8Decoder.decode(decrypted);
+	if (!result) throw new Error("ERR_UNDEFINED_ENCRYPTED_ASSERTION");
+	return result;
+}
+
+//#endregion
+export { decryptAssertion };
+//# sourceMappingURL=xmlenc.js.map

package/dist/server/connection/saml.d.ts

@@ -0,0 +1,56 @@
+import { SAMLAttributeMapping } from "../types.js";
+
+//#region src/server/connection/saml.d.ts
+type SamlIdpConfig = {
+  metadataXml?: string;
+  entityId?: string;
+  issuer?: string;
+  metadataUrl?: string;
+  signingCert?: string | string[] | null;
+  connection?: {
+    redirect?: unknown;
+  };
+};
+type SamlSpConfig = {
+  entityId?: string;
+  acsUrl?: string;
+  sloUrl?: string;
+  signingCert?: string | string[];
+  encryptCert?: string | string[];
+  privateKey?: string;
+  privateKeyPass?: string;
+  encPrivateKey?: string;
+  encPrivateKeyPass?: string;
+};
+/**
+ * Canonical read-lens over a group connection's stored SAML config JSON.
+ * Shared by the runtime SAML flow and the admin/domain code paths; all
+ * fields are optional because the underlying config is loosely typed.
+ */
+type SamlConfigShape = {
+  enabled?: boolean;
+  request?: {
+    signAuthnRequests?: boolean;
+    nameIdFormat?: string;
+    forceAuthn?: boolean;
+    authnContextClassRefs?: string[];
+  };
+  security?: SamlSecurityConfig;
+  profile?: {
+    mapping?: SAMLAttributeMapping;
+    extraFields?: Record<string, string>;
+  };
+  idp?: SamlIdpConfig;
+  serviceProvider?: SamlSpConfig;
+};
+type SamlSecurityConfig = {
+  requireSignedAssertions?: boolean;
+  requireTimestamps?: boolean;
+  clockSkewSeconds?: number;
+  weakAlgorithmHandling?: "warn" | "reject";
+  maxMetadataSize?: number;
+  maxResponseSize?: number;
+}; //# sourceMappingURL=saml.d.ts.map
+//#endregion
+export { SamlConfigShape };
+//# sourceMappingURL=saml.d.ts.map