@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/connection/saml.js

@@ -0,0 +1,762 @@
+import { log } from "../log.js";
+import { finalizeNormalizedProfile, normalizeStringArray } from "./profile.js";
+import { asRecord, getGroupSamlUrls } from "./shared.js";
+import { getSamlConfig } from "./config.js";
+import { BINDING_URI, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE } from "./saml/constants.js";
+import { safeParseXml, setSchemaValidator } from "./saml/api.js";
+import { createIdentityProvider } from "./saml/identity/provider.js";
+import { createServiceProvider } from "./saml/service/provider.js";
+import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding } from "@oslojs/encoding";
+
+//#region src/server/connection/saml.ts
+function formDataEntries(formData) {
+	return formData.entries();
+}
+const _samlifyPermissiveValidator = { validate: (_xml) => Promise.resolve("OK") };
+/**
+* Register the SAML schema validator before parsing any SAML response.
+*
+* A permissive validator that always resolves is used because Convex's edge
+* runtime has no file-system access for XML schema files, and structural
+* correctness is already ensured by the XML parser. This is called directly
+* before each parse operation since Convex can restart the V8 isolate between
+* requests, resetting module-level state.
+*/
+function ensureSamlifyValidator() {
+	setSchemaValidator(_samlifyPermissiveValidator);
+}
+function escapeHtmlAttribute(value) {
+	return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+/**
+* Build an auto-submitting HTML form that POSTs a SAML message to the IdP/SP
+* endpoint (HTTP-POST binding). All interpolated values are HTML-attribute
+* escaped to prevent markup injection.
+* @internal
+*/
+function createSamlPostBindingResponse(opts) {
+	const fields = [`<input type="hidden" name="${opts.parameter}" value="${escapeHtmlAttribute(opts.value)}" />`, opts.relayState ? `<input type="hidden" name="RelayState" value="${escapeHtmlAttribute(opts.relayState)}" />` : ""].join("");
+	return new Response(`<!doctype html><html><body><form method="POST" action="${escapeHtmlAttribute(opts.endpoint)}">${fields}</form><script>document.forms[0].submit();<\/script></body></html>`, {
+		status: 200,
+		headers: { "Content-Type": "text/html; charset=utf-8" }
+	});
+}
+/**
+* Decode a base64url RelayState into its JSON object, returning `{}` on any
+* decode/parse failure.
+* @internal
+*/
+function decodeRelayState(value) {
+	if (!value) return {};
+	try {
+		return JSON.parse(new TextDecoder().decode(decodeBase64urlIgnorePadding(value)));
+	} catch {
+		return {};
+	}
+}
+/**
+* Encode a group connection's SAML RelayState (source, signature, requestId,
+* state, redirectTo) as a base64url JSON string.
+* @internal
+*/
+function encodeGroupSamlRelayState(value) {
+	return encodeBase64urlNoPadding(new TextEncoder().encode(JSON.stringify({
+		source: `${value.source.kind}:${value.source.id}`,
+		signature: value.signature,
+		requestId: value.requestId,
+		state: value.state,
+		redirectTo: value.redirectTo
+	})));
+}
+/**
+* Decode and validate a group connection's SAML RelayState, throwing if it is
+* missing, malformed, or not a `connection:<id>` source.
+* @internal
+*/
+function decodeGroupSamlRelayStateOrThrow(value) {
+	if (!value) throw new Error("Missing SAML RelayState.");
+	const decoded = decodeRelayState(value);
+	if (typeof decoded.source !== "string" || typeof decoded.signature !== "string" || typeof decoded.requestId !== "string" || typeof decoded.state !== "string") throw new Error("Invalid SAML RelayState.");
+	const [kind, ...rest] = decoded.source.split(":");
+	const id = rest.join(":");
+	if (kind !== "connection" || id.length === 0) throw new Error("Invalid group connection SAML source.");
+	return {
+		source: {
+			kind,
+			id
+		},
+		signature: decoded.signature,
+		requestId: decoded.requestId,
+		state: decoded.state,
+		redirectTo: typeof decoded.redirectTo === "string" ? decoded.redirectTo : void 0
+	};
+}
+/**
+* Read a form-encoded (urlencoded or multipart) request body into a flat
+* string map; returns `{}` for any other content type.
+* @internal
+*/
+async function readRequestBody(request) {
+	const contentType = request.headers.get("Content-Type") ?? "";
+	if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+		const form = await request.formData();
+		const body = {};
+		for (const [key, value] of formDataEntries(form)) body[key] = typeof value === "string" ? value : value.name;
+		return body;
+	}
+	return {};
+}
+/**
+* Normalize an incoming SAML HTTP request into a {@link GroupSamlHttpRequest},
+* resolving the binding (redirect vs post) and extracting RelayState and the
+* presence of SAMLRequest/SAMLResponse from query or body.
+* @internal
+*/
+async function readGroupConnectionSamlHttpRequest(request) {
+	const url = new URL(request.url);
+	const body = await readRequestBody(request);
+	return {
+		url,
+		body,
+		query: Object.fromEntries(url.searchParams),
+		binding: request.method === "GET" ? "redirect" : body.SAMLResponse || body.SAMLRequest ? "post" : "redirect",
+		relayState: body.RelayState ?? url.searchParams.get("RelayState") ?? void 0,
+		hasSamlRequest: Boolean(body.SAMLRequest ?? url.searchParams.get("SAMLRequest")),
+		hasSamlResponse: Boolean(body.SAMLResponse ?? url.searchParams.get("SAMLResponse"))
+	};
+}
+function getSamlSecurityConfig(config) {
+	return getSamlConfig(config).security ?? {};
+}
+/**
+* Parse IdP SAML metadata XML into a {@link ParsedSamlMetadata} (entityID,
+* SSO/SLO bindings, signing/encryption certs, NameID formats).
+*
+* Rejects metadata containing DTD or entity declarations to prevent XXE /
+* entity-expansion attacks against the downstream XML parser.
+* @internal
+*/
+function parseSamlIdpMetadata(metadata) {
+	const source = typeof metadata === "string" ? metadata : String(metadata);
+	if (/<!DOCTYPE|<!ENTITY/i.test(source)) throw new Error("SAML metadata must not contain DTD or entity declarations.");
+	const entityId = source.match(/<[^>]*EntityDescriptor\b[^>]*\bentityID="([^"]+)"/i)?.[1] ?? null;
+	if (!entityId) throw new Error("SAML metadata is missing EntityDescriptor@entityID.");
+	const parseAttributes = (source$1) => {
+		const attributes = {};
+		for (const match of source$1.matchAll(/([A-Za-z_:][\w:.-]*)="([^"]*)"/g)) attributes[match[1]] = match[2];
+		return attributes;
+	};
+	const readServiceBindings = (tagName) => {
+		const bindings = {};
+		const pattern = new RegExp(`<(?:[A-Za-z0-9_.-]+:)?${tagName}\\b([^>]*)\\/?>(?:<\\/(?:[A-Za-z0-9_.-]+:)?${tagName}>)?`, "gi");
+		for (const match of source.matchAll(pattern)) {
+			const attrs = parseAttributes(match[1] ?? "");
+			const binding = attrs.Binding ?? attrs.binding;
+			const location = attrs.Location ?? attrs.location;
+			if (!binding || !location) continue;
+			if (binding.includes("HTTP-Redirect")) bindings.redirect = location;
+			if (binding.includes("HTTP-POST")) bindings.post = location;
+		}
+		return bindings;
+	};
+	const readCertificates = (use) => {
+		const certs = [];
+		const blockPattern = new RegExp(`<(?:[A-Za-z0-9_.-]+:)?KeyDescriptor\\b([^>]*)>([\\s\\S]*?)<\\/(?:[A-Za-z0-9_.-]+:)?KeyDescriptor>`, "gi");
+		for (const match of source.matchAll(blockPattern)) {
+			const attrs = parseAttributes(match[1] ?? "");
+			if ((attrs.use ?? attrs.Use ?? "signing").toLowerCase() !== use) continue;
+			for (const certMatch of (match[2] ?? "").matchAll(/<(?:[A-Za-z0-9_.-]+:)?X509Certificate\b[^>]*>([\s\S]*?)<\/(?:[A-Za-z0-9_.-]+:)?X509Certificate>/gi)) {
+				const certificate = certMatch[1]?.replace(/\s+/g, "").trim();
+				if (certificate) certs.push(certificate);
+			}
+		}
+		if (certs.length === 0) return null;
+		return certs.length === 1 ? certs[0] : certs;
+	};
+	const nameIdFormats = [...source.matchAll(/<(?:[A-Za-z0-9_.-]+:)?NameIDFormat>([\s\S]*?)<\/(?:[A-Za-z0-9_.-]+:)?NameIDFormat>/gi)].map((match) => match[1]?.trim()).filter((value) => Boolean(value));
+	return {
+		entityId,
+		issuer: entityId,
+		connection: readServiceBindings("SingleSignOnService"),
+		slo: readServiceBindings("SingleLogoutService"),
+		signingCert: readCertificates("signing"),
+		encryptionCert: readCertificates("encryption"),
+		nameIdFormats,
+		wantsSignedAuthnRequests: /WantAuthnRequestsSigned="(?:true|1)"/i.test(source)
+	};
+}
+/**
+* Throw if the IdP metadata XML exceeds the connection's configured
+* `maxMetadataSize`, bounding parser work against oversized payloads.
+*
+* When no limit is configured a generous default
+* ({@link DEFAULT_MAX_SAML_METADATA_SIZE}) applies so the cap is never silently
+* off; an operator may override it per connection or disable it entirely with a
+* non-positive value.
+* @internal
+*/
+function enforceSamlMetadataSize(opts) {
+	const configured = getSamlSecurityConfig(opts.config).maxMetadataSize;
+	const maxMetadataSize = typeof configured === "number" ? configured : DEFAULT_MAX_SAML_METADATA_SIZE;
+	if (maxMetadataSize > 0 && opts.metadataXml.length > maxMetadataSize) throw new Error("SAML metadata exceeds the configured size limit.");
+}
+/**
+* Size-check then parse IdP metadata: {@link enforceSamlMetadataSize} followed
+* by {@link parseSamlIdpMetadata}.
+* @internal
+*/
+function parseSamlIdpMetadataChecked(opts) {
+	enforceSamlMetadataSize(opts);
+	return parseSamlIdpMetadata(opts.metadataXml);
+}
+/**
+* Throw if the encoded SAMLResponse exceeds the connection's configured
+* `maxResponseSize`, bounding decode/parse work against oversized payloads.
+*
+* The ACS handler base64-decodes and DOM-parses the response *before* verifying
+* its signature, so this runs on unauthenticated input. When no limit is
+* configured a generous default ({@link DEFAULT_MAX_SAML_RESPONSE_SIZE}) applies
+* so the pre-auth parser can never be handed an unbounded document; an operator
+* may override it per connection or disable it with a non-positive value.
+* @internal
+*/
+function enforceSamlResponseSize(opts) {
+	const configured = getSamlSecurityConfig(opts.config).maxResponseSize;
+	const maxResponseSize = typeof configured === "number" ? configured : DEFAULT_MAX_SAML_RESPONSE_SIZE;
+	if (maxResponseSize <= 0) return;
+	const encoded = opts.request.body.SAMLResponse ?? opts.request.query.SAMLResponse;
+	if (typeof encoded === "string" && encoded.length > maxResponseSize) throw new Error("SAML response exceeds the configured size limit.");
+}
+/**
+* Build the SP's SAML metadata XML (entityID, ACS/SLO endpoints, signing and
+* encryption certs) for publication to the IdP.
+* @internal
+*/
+function createServiceProviderMetadata(opts) {
+	const binding = BINDING_URI;
+	return createServiceProvider({
+		entityID: opts.entityId,
+		authnRequestsSigned: opts.authnRequestsSigned ?? false,
+		privateKey: opts.privateKey,
+		privateKeyPass: opts.privateKeyPass,
+		signingCert: opts.signingCert,
+		encryptCert: opts.encryptCert,
+		encPrivateKey: opts.encPrivateKey,
+		encPrivateKeyPass: opts.encPrivateKeyPass,
+		assertionConsumerService: [{
+			Binding: binding.post,
+			Location: opts.acsUrl
+		}],
+		singleLogoutService: opts.sloUrl ? [{
+			Binding: binding.redirect,
+			Location: opts.sloUrl
+		}, {
+			Binding: binding.post,
+			Location: opts.sloUrl
+		}] : void 0
+	}).getMetadata();
+}
+/**
+* Render the SP metadata XML for a specific group connection, deriving SP
+* options from its stored config via {@link getSamlServiceProviderOptions}.
+* @internal
+*/
+function createGroupConnectionSamlMetadataXml(opts) {
+	return createServiceProviderMetadata(getSamlServiceProviderOptions({
+		rootUrl: opts.rootUrl,
+		source: opts.source,
+		config: opts.config
+	}));
+}
+/**
+* Resolve effective SP options for a group connection, layering caller
+* `overrides` over stored `serviceProvider` config over the default group
+* SAML URLs.
+* @internal
+*/
+function getSamlServiceProviderOptions(opts) {
+	const saml = getSamlConfig(opts.config);
+	const sp = asRecord(saml.serviceProvider) ?? {};
+	const clockSkewMs = ((asRecord(saml.security) ?? {}).clockSkewSeconds ?? 300) * 1e3;
+	const urls = getGroupSamlUrls({
+		rootUrl: opts.rootUrl,
+		source: opts.source
+	});
+	return {
+		entityId: opts.overrides?.entityId ?? sp.entityId ?? urls.metadataUrl,
+		acsUrl: opts.overrides?.acsUrl ?? sp.acsUrl ?? urls.acsUrl,
+		sloUrl: opts.overrides?.sloUrl ?? sp.sloUrl ?? urls.sloUrl,
+		relayState: opts.relayState,
+		authnRequestsSigned: saml.request?.signAuthnRequests,
+		signingCert: sp.signingCert,
+		encryptCert: sp.encryptCert,
+		privateKey: sp.privateKey,
+		privateKeyPass: sp.privateKeyPass,
+		encPrivateKey: sp.encPrivateKey,
+		encPrivateKeyPass: sp.encPrivateKeyPass,
+		clockDrifts: [-clockSkewMs, clockSkewMs]
+	};
+}
+/**
+* Construct a samlify ServiceProvider from resolved SP options (entityID,
+* ACS/SLO endpoints, signing config).
+* @internal
+*/
+function createSamlServiceProvider(opts) {
+	const binding = BINDING_URI;
+	return createServiceProvider({
+		entityID: opts.entityId,
+		relayState: opts.relayState ?? "",
+		authnRequestsSigned: opts.authnRequestsSigned ?? false,
+		privateKey: opts.privateKey,
+		privateKeyPass: opts.privateKeyPass,
+		signingCert: opts.signingCert,
+		encryptCert: opts.encryptCert,
+		encPrivateKey: opts.encPrivateKey,
+		encPrivateKeyPass: opts.encPrivateKeyPass,
+		clockDrifts: opts.clockDrifts,
+		assertionConsumerService: [{
+			Binding: binding.post,
+			Location: opts.acsUrl
+		}],
+		singleLogoutService: opts.sloUrl ? [{
+			Binding: binding.redirect,
+			Location: opts.sloUrl
+		}, {
+			Binding: binding.post,
+			Location: opts.sloUrl
+		}] : void 0
+	});
+}
+/**
+* Build the per-request SAML runtime (SP, IdP, and group URLs) for a group
+* connection. Throws if the connection has no stored IdP metadata XML.
+* @internal
+*/
+function createGroupConnectionSamlRuntime(opts) {
+	const saml = getSamlConfig(opts.config);
+	const spOptions = getSamlServiceProviderOptions({
+		rootUrl: opts.rootUrl,
+		source: opts.source,
+		config: opts.config,
+		relayState: opts.relayState,
+		overrides: opts.overrides
+	});
+	if (typeof saml.idp?.metadataXml !== "string") throw new Error("SAML IdP metadata is missing.");
+	return {
+		saml,
+		sp: createSamlServiceProvider(spOptions),
+		idp: createIdentityProvider({ metadata: saml.idp.metadataXml }),
+		urls: getGroupSamlUrls({
+			rootUrl: opts.rootUrl,
+			source: opts.source
+		})
+	};
+}
+function verifySamlTimeWindow(notBefore, notOnOrAfter, clockSkewSeconds) {
+	const now = Date.now();
+	const drift = clockSkewSeconds * 1e3;
+	if (notBefore) {
+		const notBeforeTime = new Date(notBefore).getTime();
+		if (!Number.isFinite(notBeforeTime)) throw new Error("SAML assertion has an invalid NotBefore timestamp.");
+		if (now < notBeforeTime - drift) throw new Error("SAML assertion is not yet valid.");
+	}
+	if (notOnOrAfter) {
+		const notOnOrAfterTime = new Date(notOnOrAfter).getTime();
+		if (!Number.isFinite(notOnOrAfterTime)) throw new Error("SAML assertion has an invalid NotOnOrAfter timestamp.");
+		if (now >= notOnOrAfterTime + drift) throw new Error("SAML assertion has expired.");
+	}
+}
+function normalizeSamlUrl(value) {
+	return value.trim().replace(/\/$/, "");
+}
+function toStringArray(value) {
+	if (Array.isArray(value)) return value;
+	if (typeof value === "string") return [value];
+	return [];
+}
+function localName(node) {
+	return typeof node === "object" && node !== null ? node.localName ?? node.nodeName : void 0;
+}
+function isElementNode(node) {
+	return localName(node) !== void 0;
+}
+function elementChildren(node) {
+	const childNodes = typeof node === "object" && node !== null ? node.childNodes : void 0;
+	return childNodes ? Array.from(childNodes).filter(isElementNode) : [];
+}
+function findDirectChild(node, name) {
+	return elementChildren(node).find((child) => localName(child) === name);
+}
+function findDescendant(node, name) {
+	for (const child of elementChildren(node)) {
+		if (localName(child) === name) return child;
+		const nested = findDescendant(child, name);
+		if (nested) return nested;
+	}
+}
+function getAttribute(node, name) {
+	if (typeof node !== "object" || node === null) return;
+	const value = node.getAttribute?.call(node, name);
+	return typeof value === "string" ? value : void 0;
+}
+function signatureMetadataFromNode(signatureNode) {
+	if (!signatureNode) return;
+	const signatureMethod = findDescendant(signatureNode, "SignatureMethod");
+	const digestMethod = findDescendant(signatureNode, "DigestMethod");
+	return {
+		signatureAlgorithm: getAttribute(signatureMethod, "Algorithm"),
+		digestAlgorithm: getAttribute(digestMethod, "Algorithm")
+	};
+}
+function extractSignatureMetadataFromXml(content) {
+	try {
+		const root = safeParseXml(content, "text/xml").documentElement;
+		if (localName(root) === "Signature") return { responseSignature: signatureMetadataFromNode(root) };
+		const responseSignature = signatureMetadataFromNode(findDirectChild(root, "Signature"));
+		const assertion = localName(root) === "Assertion" ? root : findDirectChild(root, "Assertion");
+		return {
+			responseSignature,
+			assertionSignature: localName(root) === "Assertion" ? signatureMetadataFromNode(findDirectChild(root, "Signature")) : signatureMetadataFromNode(findDirectChild(assertion, "Signature"))
+		};
+	} catch {
+		return {};
+	}
+}
+/**
+* Read the `Assertion/@ID` from cryptographically-verified SAML content,
+* whether the content is the assertion element itself or a response wrapping
+* one. Returns `undefined` when no assertion ID can be resolved (in which case
+* the caller must fail closed rather than treat the response as unique).
+*/
+function assertionIdFromXml(content) {
+	try {
+		const root = safeParseXml(content, "text/xml").documentElement;
+		const id = getAttribute(localName(root) === "Assertion" ? root : findDirectChild(root, "Assertion"), "ID");
+		return typeof id === "string" && id.length > 0 ? id : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Derive the identifiers a SAML ACS handler needs to prevent replay from a
+* parsed login response: the assertion's `ID` (verified from the canonical
+* bytes), the `InResponseTo` binding the response to a pending AuthnRequest,
+* and the tightest `NotOnOrAfter` upper bound (from `<SubjectConfirmationData>`
+* or `<Conditions>`) used to bound the seen-assertion cache's TTL.
+* @internal
+*/
+function samlReplayIdentifiers(parsed) {
+	const extract = parsed.extract;
+	const notOnOrAfter = extract?.subjectConfirmation?.notOnOrAfter ?? extract?.conditions?.notOnOrAfter ?? void 0;
+	return {
+		assertionId: assertionIdFromXml(parsed.samlContent),
+		inResponseTo: extract?.subjectConfirmation?.inResponseTo ?? extract?.response?.inResponseTo,
+		notOnOrAfter
+	};
+}
+function normalizeSignatureMetadata(value) {
+	if (typeof value === "object" && value !== null) {
+		const signatureAlgorithm = value.signatureAlgorithm;
+		const digestAlgorithm = value.digestAlgorithm;
+		if (typeof signatureAlgorithm === "string" || typeof digestAlgorithm === "string") return {
+			signatureAlgorithm: typeof signatureAlgorithm === "string" ? signatureAlgorithm : void 0,
+			digestAlgorithm: typeof digestAlgorithm === "string" ? digestAlgorithm : void 0
+		};
+	}
+	if (typeof value === "string") return extractSignatureMetadataFromXml(value).responseSignature;
+}
+function attachSamlSignatureMetadata(parsed) {
+	const fromXml = extractSignatureMetadataFromXml(parsed.samlContent);
+	const responseSignature = normalizeSignatureMetadata(parsed.extract?.signature) ?? fromXml.responseSignature;
+	const assertionSignature = normalizeSignatureMetadata(parsed.extract?.assertionSignature) ?? fromXml.assertionSignature;
+	return {
+		...parsed,
+		extract: {
+			...parsed.extract,
+			signature: responseSignature,
+			assertionSignature
+		}
+	};
+}
+function signatureMetadataList(extract) {
+	return [normalizeSignatureMetadata(extract?.signature), normalizeSignatureMetadata(extract?.assertionSignature)].filter((metadata) => metadata !== void 0);
+}
+function validateSamlRequiredSignature(extract, security) {
+	if (security.requireSignedAssertions === true && typeof normalizeSignatureMetadata(extract?.assertionSignature)?.signatureAlgorithm !== "string") throw new Error("SAML assertion must be signed.");
+}
+function validateSamlRequiredTimestamps(extract, security) {
+	if (security.requireTimestamps === false) return;
+	if (!(Boolean(extract?.conditions?.notOnOrAfter) || Boolean(extract?.subjectConfirmation?.notOnOrAfter))) throw new Error("SAML assertion is missing a validity window (NotOnOrAfter).");
+}
+function validateSamlTimeWindow(extract, security) {
+	const skew = security.clockSkewSeconds ?? 300;
+	const conditions = extract?.conditions;
+	if (conditions?.notBefore || conditions?.notOnOrAfter) verifySamlTimeWindow(conditions.notBefore, conditions.notOnOrAfter, skew);
+	const subjectNotOnOrAfter = extract?.subjectConfirmation?.notOnOrAfter;
+	if (subjectNotOnOrAfter) verifySamlTimeWindow(void 0, subjectNotOnOrAfter, skew);
+}
+function validateSamlAudience(extract, expectedAudience) {
+	if (expectedAudience !== void 0) {
+		if (!toStringArray(extract?.audience).includes(expectedAudience)) throw new Error("SAML assertion audience does not match this service provider.");
+	}
+}
+function validateSamlRecipient(extract, expectedAcsUrl) {
+	if (expectedAcsUrl !== void 0) {
+		const normalizedAcsUrl = normalizeSamlUrl(expectedAcsUrl);
+		const recipient = extract?.subjectConfirmation?.recipient;
+		if (typeof recipient !== "string" || normalizeSamlUrl(recipient) !== normalizedAcsUrl) throw new Error("SAML assertion recipient does not match this ACS URL.");
+		const destination = extract?.response?.destination;
+		if (typeof destination === "string" && normalizeSamlUrl(destination) !== normalizedAcsUrl) throw new Error("SAML response destination does not match this ACS URL.");
+	}
+}
+/**
+* Enforce the connection's SAML security policy on a parsed assertion:
+* weak-algorithm rejection, required assertion signature, required timestamp
+* conditions, the NotBefore/NotOnOrAfter validity window (with clock skew),
+* the expected audience, and recipient/destination matching the SP's ACS URL.
+* Throws on the first violation.
+* @internal
+*/
+function enforceGroupConnectionSamlSecurity(opts) {
+	enforceSamlAlgorithmPolicy(opts);
+	const security = asRecord(getSamlConfig(opts.config).security) ?? {};
+	validateSamlRequiredSignature(opts.extract, security);
+	validateSamlRequiredTimestamps(opts.extract, security);
+	validateSamlTimeWindow(opts.extract, security);
+	validateSamlAudience(opts.extract, opts.expectedAudience);
+	validateSamlRecipient(opts.extract, opts.expectedAcsUrl);
+}
+/**
+* Reconstruct the HTTP-Redirect binding's signed octet string from the raw query
+* string, in the SAML-mandated order (`SAMLRequest`|`SAMLResponse`, then
+* `RelayState` if present, then `SigAlg`), preserving each value's exact
+* URL-encoded bytes — re-encoding decoded values would not reproduce what the IdP
+* signed. Returns `undefined` when no SAML message parameter is present, in which
+* case message-signature verification stays fail-closed.
+* @internal
+*/
+function reconstructRedirectOctetString(url) {
+	const raw = url.search.replace(/^\?/, "");
+	const encoded = /* @__PURE__ */ new Map();
+	for (const pair of raw.split("&")) {
+		if (pair.length === 0) continue;
+		const eq = pair.indexOf("=");
+		const key = eq === -1 ? pair : pair.slice(0, eq);
+		if (!encoded.has(key)) encoded.set(key, eq === -1 ? "" : pair.slice(eq + 1));
+	}
+	const message = encoded.has("SAMLRequest") ? `SAMLRequest=${encoded.get("SAMLRequest")}` : encoded.has("SAMLResponse") ? `SAMLResponse=${encoded.get("SAMLResponse")}` : void 0;
+	if (message === void 0) return;
+	const parts = [message];
+	if (encoded.has("RelayState")) parts.push(`RelayState=${encoded.get("RelayState")}`);
+	if (encoded.has("SigAlg")) parts.push(`SigAlg=${encoded.get("SigAlg")}`);
+	return parts.join("&");
+}
+function toSamlHttpRequest(request) {
+	return {
+		query: request.query,
+		body: request.body,
+		...request.binding === "redirect" ? { octetString: reconstructRedirectOctetString(request.url) } : {}
+	};
+}
+/**
+* Create the IdP-bound SAML AuthnRequest for a group connection, returning the
+* binding plus either a redirect URL (HTTP-Redirect) or POST endpoint/value
+* (HTTP-POST), along with the encoded RelayState carrying the signed flow
+* state and request id.
+* @internal
+*/
+async function createGroupConnectionSamlSignInRequest(opts) {
+	const runtime = createGroupConnectionSamlRuntime({
+		rootUrl: opts.rootUrl,
+		source: opts.source,
+		config: opts.config
+	});
+	const binding = runtime.saml.idp?.connection?.redirect ? "redirect" : "post";
+	const loginRequest = await runtime.sp.createLoginRequest(runtime.idp, binding);
+	const relayState = encodeGroupSamlRelayState({
+		source: opts.source,
+		signature: opts.signature,
+		requestId: loginRequest.id,
+		state: opts.state,
+		redirectTo: opts.redirectTo
+	});
+	return {
+		requestId: loginRequest.id,
+		binding,
+		relayState,
+		redirectUrl: binding === "redirect" ? (() => {
+			const redirectUrl = new URL(loginRequest.context);
+			redirectUrl.searchParams.set("RelayState", relayState);
+			return redirectUrl.toString();
+		})() : void 0,
+		post: binding === "post" ? {
+			endpoint: loginRequest.entityEndpoint,
+			value: loginRequest.context
+		} : void 0
+	};
+}
+/**
+* Parse and partially validate a SAML login Response for a group connection:
+* enforces the response size limit, builds the runtime, parses the response,
+* attaches signature metadata, warns on weak algorithms, and decodes the
+* RelayState. Does not itself enforce the full security policy — callers must
+* also run {@link enforceGroupConnectionSamlSecurity}.
+* @internal
+*/
+async function parseGroupConnectionSamlLoginResponse(opts) {
+	ensureSamlifyValidator();
+	const httpRequest = await readGroupConnectionSamlHttpRequest(opts.request);
+	enforceSamlResponseSize({
+		request: httpRequest,
+		config: opts.config
+	});
+	const runtime = createGroupConnectionSamlRuntime({
+		rootUrl: opts.rootUrl,
+		source: opts.source,
+		config: opts.config
+	});
+	const parsed = attachSamlSignatureMetadata(await runtime.sp.parseLoginResponse(runtime.idp, httpRequest.binding, toSamlHttpRequest(httpRequest)));
+	warnWeakSamlAlgorithms(parsed);
+	return {
+		...httpRequest,
+		runtime,
+		parsed,
+		relayState: decodeGroupSamlRelayStateOrThrow(httpRequest.relayState ?? null)
+	};
+}
+const WEAK_SAML_ALGORITHMS = new Set([
+	"http://www.w3.org/2000/09/xmldsig#rsa-sha1",
+	"http://www.w3.org/2000/09/xmldsig#dsa-sha1",
+	"http://www.w3.org/2000/09/xmldsig#sha1",
+	"http://www.w3.org/2001/04/xmlenc#rsa-1_5",
+	"http://www.w3.org/2001/04/xmlenc#tripledes-cbc"
+]);
+/**
+* Warn when the SAML response uses weak cryptographic algorithms
+* such as SHA-1, RSA 1.5, or 3DES. Algorithm-check failures are non-critical
+* and swallowed so they never break the auth flow.
+*/
+function warnWeakSamlAlgorithms(parsed) {
+	try {
+		for (const metadata of signatureMetadataList(parsed.extract)) {
+			const sigAlg = metadata.signatureAlgorithm;
+			const digestAlg = metadata.digestAlgorithm;
+			if (sigAlg && WEAK_SAML_ALGORITHMS.has(sigAlg)) log("WARN", `[convex-auth] SAML response uses weak signature algorithm: ${sigAlg}. Consider upgrading your IdP to use RSA-SHA256 or stronger.`);
+			if (digestAlg && WEAK_SAML_ALGORITHMS.has(digestAlg)) log("WARN", `[convex-auth] SAML response uses weak digest algorithm: ${digestAlg}. Consider upgrading your IdP to use SHA-256 or stronger.`);
+		}
+	} catch {
+		return;
+	}
+}
+/**
+* Reject a SAML response/assertion whose signature or digest uses a known-weak
+* algorithm (SHA-1, RSA-1.5, 3DES). Secure by default: rejection is the default
+* and operators must explicitly set `security.weakAlgorithmHandling: "warn"` to
+* downgrade to a warning (mirroring the `requireTimestamps` opt-out).
+* @internal
+*/
+function enforceSamlAlgorithmPolicy(opts) {
+	if (getSamlSecurityConfig(opts.config).weakAlgorithmHandling === "warn") return;
+	for (const metadata of signatureMetadataList(opts.extract)) {
+		const sigAlg = metadata.signatureAlgorithm;
+		const digestAlg = metadata.digestAlgorithm;
+		if (sigAlg && WEAK_SAML_ALGORITHMS.has(sigAlg) || digestAlg && WEAK_SAML_ALGORITHMS.has(digestAlg)) throw new Error("SAML response uses a rejected weak cryptographic algorithm.");
+	}
+}
+/**
+* Bind the returned RelayState to the pending login request: throws unless its
+* source matches the connection and its requestId matches the assertion's
+* `InResponseTo`, defeating cross-connection and replayed responses.
+* @internal
+*/
+function validateGroupConnectionSamlLoginRelayState(opts) {
+	if (opts.relayState.source.kind !== opts.source.kind || opts.relayState.source.id !== opts.source.id || opts.relayState.requestId !== opts.inResponseTo) throw new Error("SAML RelayState did not match the pending login request.");
+}
+/**
+* Parse an inbound SAML single-logout message (request and/or response) for a
+* group connection, returning the parsed flow(s) alongside the runtime.
+*
+* SECURITY — SLO messages are treated as UNAUTHENTICATED. samlify only verifies
+* an inbound `LogoutRequest`/`LogoutResponse` signature when the SP is built
+* with `wantLogoutRequestSigned`/`wantLogoutResponseSigned`; both default to
+* `false` and are intentionally left unset in {@link createSamlServiceProvider}
+* (many IdPs do not sign logout messages, and requiring it would break those
+* legitimate SLO flows). This is safe only because the sole caller,
+* `handleSamlSlo` in the connection HTTP router, DOES NOT terminate any local
+* session: for an inbound `LogoutRequest` it merely emits the protocol
+* `LogoutResponse` acknowledgment, and for an inbound `LogoutResponse` it
+* returns `204` and does nothing. A forged, replayed, or attacker-supplied
+* logout message therefore cannot force-log-out a user.
+*
+* DO NOT wire session termination onto this parse result without FIRST requiring
+* signed logout messages (via the `wantLogout*Signed` SP options above) and
+* rejecting unsigned ones — otherwise an unauthenticated caller could trigger a
+* logout-CSRF / denial-of-service.
+* @internal
+*/
+async function parseGroupConnectionSamlLogoutMessage(opts) {
+	ensureSamlifyValidator();
+	const httpRequest = await readGroupConnectionSamlHttpRequest(opts.request);
+	const runtime = createGroupConnectionSamlRuntime({
+		rootUrl: opts.rootUrl,
+		source: opts.source,
+		config: opts.config,
+		relayState: httpRequest.relayState
+	});
+	const parsedRequest = httpRequest.hasSamlRequest ? await runtime.sp.parseLogoutRequest(runtime.idp, httpRequest.binding, toSamlHttpRequest(httpRequest)) : void 0;
+	const parsedResponse = httpRequest.hasSamlResponse ? await runtime.sp.parseLogoutResponse(runtime.idp, httpRequest.binding, toSamlHttpRequest(httpRequest)) : void 0;
+	return {
+		...httpRequest,
+		runtime,
+		parsedRequest,
+		parsedResponse
+	};
+}
+/**
+* Map a parsed SAML assertion's attributes (via the connection's attribute
+* mapping, falling back to NameID for the subject) into a normalized profile.
+* Throws if no subject can be resolved.
+*
+* @remarks
+* `emailVerified` is always left `undefined`: SAML carries no `email_verified`
+* claim, so the assertion alone never proves the email. Verification is decided
+* downstream (`userOAuthImpl`) from whether the email's domain is a verified
+* connection domain, keeping a SAML-asserted email unverified by default so it
+* cannot drive cross-connection `verifiedEmail` account linking.
+* @internal
+*/
+function profileFromSamlExtract(extract, mapping) {
+	const attributes = typeof extract?.attributes === "object" && extract.attributes !== null ? extract.attributes : {};
+	const resolveFirst = (...keys) => {
+		for (const key of keys) {
+			if (!key) continue;
+			const attribute = attributes[key];
+			const value = Array.isArray(attribute) ? attribute[0] : attribute;
+			if (value !== void 0) return value;
+		}
+	};
+	const fieldResolvers = {
+		email: () => resolveFirst(mapping?.email),
+		groups: () => normalizeStringArray(resolveFirst(mapping?.groups)),
+		name: () => resolveFirst(mapping?.name) ?? ([resolveFirst(mapping?.firstName), resolveFirst(mapping?.lastName)].filter(Boolean).join(" ") || void 0),
+		roles: () => normalizeStringArray(resolveFirst(mapping?.roles)),
+		subject: () => resolveFirst(mapping?.subject) ?? extract?.nameID
+	};
+	const subject = fieldResolvers.subject();
+	if (subject === void 0) throw new Error("SAML profile is missing a subject. Configure `attributeMapping.subject` or ensure the assertion includes a NameID.");
+	return finalizeNormalizedProfile({
+		id: subject,
+		email: fieldResolvers.email(),
+		emailVerified: void 0,
+		groups: fieldResolvers.groups(),
+		name: fieldResolvers.name(),
+		roles: fieldResolvers.roles(),
+		samlAttributes: attributes,
+		samlSessionIndex: extract?.sessionIndex?.sessionIndex
+	});
+}
+
+//#endregion
+export { createGroupConnectionSamlMetadataXml, createGroupConnectionSamlSignInRequest, createSamlPostBindingResponse, createServiceProviderMetadata, encodeGroupSamlRelayState, enforceGroupConnectionSamlSecurity, getSamlServiceProviderOptions, parseGroupConnectionSamlLoginResponse, parseGroupConnectionSamlLogoutMessage, parseSamlIdpMetadataChecked, profileFromSamlExtract, samlReplayIdentifiers, validateGroupConnectionSamlLoginRelayState };
+//# sourceMappingURL=saml.js.map