@getstrata/core 1.0.9 → 1.1.1

package/dist/entries/auth/oauth/samlProvider.js

@@ -1,107 +1,585 @@
 // @bun
-// ../../src/core/runtime/appEnv.ts
-var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
-function normalizeEnvValue(value) {
-  return (value ?? "").trim().toLowerCase();
-}
-function isProductionEnv(env = process.env) {
-  const appEnv = normalizeEnvValue(env.APP_ENV);
-  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
-  if (appEnv === "production" || nodeEnv === "production") {
-    return true;
-  }
-  if (appEnv === "") {
+// ../../src/core/runtime/optionalPeer.ts
+function missingOptionalPeer(packageName, reason, error) {
+  return new Error(`Install ${packageName} ${reason} (\`bun add ${packageName}\`).`, {
+    cause: error
+  });
+}
+
+// ../../src/core/security/timingSafeCompare.ts
+import { timingSafeEqual } from "crypto";
+function timingSafeCompareString(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
     return false;
   }
-  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+// ../../src/core/database/boundConnection.ts
+var BOUND_CONNECTION_KEY = Symbol.for("@getstrata/boundDatabaseConnection");
+function boundConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[BOUND_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { connection: null };
+  globalRecord[BOUND_CONNECTION_KEY] = created;
+  return created;
+}
+function getBoundDatabaseConnection() {
+  return boundConnectionState().connection;
+}
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+function hasActiveDatabaseConnection() {
+  return activeConnection.getStore() !== undefined;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+
+// ../../src/core/database/defaultConnection.ts
+var DEFAULT_CONNECTION_KEY = Symbol.for("@getstrata/defaultDatabaseConnection");
+function defaultConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[DEFAULT_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { pool: null, query: null };
+  globalRecord[DEFAULT_CONNECTION_KEY] = created;
+  return created;
+}
+function getDefaultDatabasePool() {
+  const pool = defaultConnectionState().pool;
+  if (!pool) {
+    throw new Error("Default database pool is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return pool;
+}
+
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
+  }
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
+  }
+  if (normalized === "sqlite") {
+    return "sqlite";
+  }
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
+  }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
+  }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
+  }
+  return null;
 }
-function envFlagEnabled(value) {
-  return value === "true";
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
+  }
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
+  }
+  return "pgsql";
 }
 
-// ../../src/core/runtime/appKeyPrefix.ts
-function appKeyPrefix() {
-  return process.env.APP_KEY_PREFIX?.trim() || "strata";
+// ../../src/core/database/dialect.ts
+function assertSafeIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return identifier;
+}
+function quoteIdentifierFor(dialect, column) {
+  return dialect.quoteIdentifier(column);
+}
+var postgresDialect = {
+  driver: "pgsql",
+  placeholder(index) {
+    return `$${index}`;
+  },
+  quoteIdentifier(identifier) {
+    return `"${assertSafeIdentifier(identifier)}"`;
+  },
+  nowExpression() {
+    return "NOW()";
+  },
+  timestampValue(value) {
+    return value.toISOString();
+  },
+  returningClause(columns) {
+    return ` RETURNING ${columns}`;
+  },
+  ilikeOperator() {
+    return "ILIKE";
+  },
+  nullsLastSuffix() {
+    return " NULLS LAST";
+  },
+  castToText(expression) {
+    return `${expression}::text`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+    if (updateColumns.length === 0) {
+      return ` ON CONFLICT (${target}) DO NOTHING`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = excluded.${quoted}`;
+    }).join(", ");
+    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+  }
+};
+var mysqlDialect = {
+  driver: "mysql",
+  placeholder() {
+    return "?";
+  },
+  quoteIdentifier(identifier) {
+    return `\`${assertSafeIdentifier(identifier)}\``;
+  },
+  nowExpression() {
+    return "CURRENT_TIMESTAMP";
+  },
+  timestampValue(value) {
+    return value.toISOString().slice(0, 19).replace("T", " ");
+  },
+  returningClause() {
+    return "";
+  },
+  ilikeOperator() {
+    return "LIKE";
+  },
+  nullsLastSuffix() {
+    return "";
+  },
+  castToText(expression) {
+    return `CAST(${expression} AS CHAR)`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    if (updateColumns.length === 0) {
+      const anchor = quoteIdentifierFor(this, conflictColumns[0] ?? "");
+      return ` ON DUPLICATE KEY UPDATE ${anchor} = ${anchor}`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = VALUES(${quoted})`;
+    }).join(", ");
+    return ` ON DUPLICATE KEY UPDATE ${assignments}`;
+  }
+};
+var sqliteDialect = {
+  driver: "sqlite",
+  placeholder() {
+    return "?";
+  },
+  quoteIdentifier(identifier) {
+    return `"${assertSafeIdentifier(identifier)}"`;
+  },
+  nowExpression() {
+    return "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
+  },
+  timestampValue(value) {
+    return value.toISOString();
+  },
+  returningClause(columns) {
+    return ` RETURNING ${columns}`;
+  },
+  ilikeOperator() {
+    return "LIKE";
+  },
+  nullsLastSuffix() {
+    return "";
+  },
+  castToText(expression) {
+    return `CAST(${expression} AS TEXT)`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+    if (updateColumns.length === 0) {
+      return ` ON CONFLICT (${target}) DO NOTHING`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = excluded.${quoted}`;
+    }).join(", ");
+    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+  }
+};
+var dialects = {
+  pgsql: postgresDialect,
+  mysql: mysqlDialect,
+  sqlite: sqliteDialect
+};
+var dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
+var dialectOverride = null;
+function dialectFor(driver) {
+  return dialects[driver];
+}
+function currentSqlDialect() {
+  return dialectContext.getStore() ?? dialectOverride ?? dialectFor(resolveDatabaseDriver());
+}
+
+// ../../src/core/database/errors.ts
+import {
+  BadRequestError,
+  ConflictError,
+  InternalServerError,
+  toHttpError,
+  UnprocessableEntityError
+} from "@getstrata/core/errors/http";
+function isPostgresError(error) {
+  return typeof error === "object" && error !== null && (("errno" in error) || ("code" in error));
+}
+function getPostgresSqlState(error) {
+  if (typeof error.errno === "string" && /^\d{5}$/.test(error.errno)) {
+    return error.errno;
+  }
+  if (typeof error.errno === "number") {
+    return String(error.errno).padStart(5, "0");
+  }
+  if (typeof error.code === "string" && /^\d{5}$/.test(error.code)) {
+    return error.code;
+  }
+  return;
+}
+var MYSQL_ERRNO_MESSAGES = {
+  1062: () => new ConflictError("A record with these values already exists."),
+  1451: () => new UnprocessableEntityError("Record is still referenced by other records."),
+  1452: () => new UnprocessableEntityError("Referenced record does not exist."),
+  1048: () => new BadRequestError("Required field is missing."),
+  3819: () => new BadRequestError("Value violates a database constraint.")
+};
+function mapSqliteError(error) {
+  const code = typeof error.code === "string" ? error.code : "";
+  if (!code.startsWith("SQLITE_")) {
+    return null;
+  }
+  if (code === "SQLITE_CONSTRAINT_UNIQUE" || code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    return new ConflictError("A record with these values already exists.");
+  }
+  if (code === "SQLITE_CONSTRAINT_FOREIGNKEY") {
+    return new UnprocessableEntityError("Referenced record does not exist.");
+  }
+  if (code === "SQLITE_CONSTRAINT_NOTNULL") {
+    return new BadRequestError("Required field is missing.");
+  }
+  if (code.startsWith("SQLITE_CONSTRAINT")) {
+    return new BadRequestError("Value violates a database constraint.");
+  }
+  return new InternalServerError("Database operation failed.");
+}
+function mapMysqlError(error) {
+  const code = typeof error.code === "string" ? error.code : "";
+  if (!code.startsWith("ER_")) {
+    return null;
+  }
+  const factory = typeof error.errno === "number" ? MYSQL_ERRNO_MESSAGES[error.errno] : undefined;
+  return factory ? factory() : new InternalServerError("Database operation failed.");
 }
-function appCookieName(kind) {
-  return `${appKeyPrefix()}_${kind}`;
+function mapDatabaseError(error) {
+  const httpError = toHttpError(error);
+  if (httpError) {
+    return httpError;
+  }
+  if (!isPostgresError(error)) {
+    return new InternalServerError;
+  }
+  const sqlite = mapSqliteError(error);
+  if (sqlite) {
+    return sqlite;
+  }
+  const mysql = mapMysqlError(error);
+  if (mysql) {
+    return mysql;
+  }
+  const sqlState = getPostgresSqlState(error);
+  switch (sqlState) {
+    case "23505":
+      if (error.detail) {
+        console.error("[database] unique violation", error.detail);
+      }
+      return new ConflictError("A record with these values already exists.");
+    case "23503":
+      if (error.detail) {
+        console.error("[database] foreign-key violation", error.detail);
+      }
+      return new UnprocessableEntityError("Referenced record does not exist.");
+    case "23502":
+      if (error.detail) {
+        console.error("[database] not-null violation", error.detail);
+      }
+      return new BadRequestError("Required field is missing.");
+    case "23514":
+      if (error.detail) {
+        console.error("[database] check violation", error.detail);
+      }
+      return new BadRequestError("Value violates a database constraint.");
+    default:
+      return new InternalServerError("Database operation failed.");
+  }
 }
-function appDevSecret(kind) {
-  return `${appKeyPrefix()}-dev-${kind}`;
+async function withDatabaseErrorHandling(operation) {
+  try {
+    return await operation();
+  } catch (error) {
+    throw mapDatabaseError(error);
+  }
 }
-function requireConfiguredSecret(names, devKind, env = process.env) {
-  for (const name of names) {
-    const value = env[name]?.trim();
-    if (value) {
-      return value;
+function isUniqueConstraintError(error) {
+  if (!isPostgresError(error)) {
+    return false;
+  }
+  if (error.code === "SQLITE_CONSTRAINT_UNIQUE" || error.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    return true;
+  }
+  if (error.errno === 1062) {
+    return true;
+  }
+  return getPostgresSqlState(error) === "23505";
+}
+
+// ../../src/core/auth/saml/samlAssertionReplay.ts
+var REPLAY_RETENTION_MS = 60 * 60 * 1000;
+
+class InMemorySamlAssertionReplayStore {
+  seen = new Map;
+  async consume(assertionId) {
+    this.gc();
+    const consumedAt = this.seen.get(assertionId);
+    if (consumedAt !== undefined && Date.now() - consumedAt < REPLAY_RETENTION_MS) {
+      throw new Error("SAML assertion replay detected.");
+    }
+    this.seen.set(assertionId, Date.now());
+  }
+  clear() {
+    this.seen.clear();
+  }
+  gc() {
+    const cutoff = Date.now() - REPLAY_RETENTION_MS;
+    for (const [id, at] of this.seen) {
+      if (at < cutoff) {
+        this.seen.delete(id);
+      }
     }
   }
-  if (isProductionEnv(env)) {
-    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+}
+
+class SqlSamlAssertionReplayStore {
+  async consume(assertionId) {
+    const sql = getBoundDatabaseConnection() ?? getDefaultDatabasePool();
+    const dialect = currentSqlDialect();
+    try {
+      await sql.unsafe(`INSERT INTO auth_saml_assertions (assertion_id, consumed_at) VALUES (${dialect.placeholder(1)}, ${dialect.placeholder(2)})`, [assertionId, new Date().toISOString()]);
+    } catch (error) {
+      if (isUniqueConstraintError(error)) {
+        throw new Error("SAML assertion replay detected.");
+      }
+      throw error;
+    }
+    await sql.unsafe(`DELETE FROM auth_saml_assertions WHERE consumed_at < ${dialect.placeholder(1)}`, [new Date(Date.now() - REPLAY_RETENTION_MS).toISOString()]);
   }
-  return appDevSecret(devKind);
 }
-function namespacedRedisKey(kind) {
-  return `${appKeyPrefix()}:${kind}`;
+var sqlReplayStore = new SqlSamlAssertionReplayStore;
+var replayStoreOverride = null;
+function samlAssertionReplayStore() {
+  return replayStoreOverride ?? sqlReplayStore;
 }
-function smtpEhloHost() {
-  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
-  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
-  return safe || "strata.local";
+function setSamlAssertionReplayStoreForTests(store) {
+  replayStoreOverride = store;
 }
-function siemEventType() {
-  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+function resetSamlReplayCacheForTests() {
+  if (replayStoreOverride instanceof InMemorySamlAssertionReplayStore) {
+    replayStoreOverride.clear();
+    return;
+  }
+  replayStoreOverride = null;
 }
-function appUserAgent() {
-  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+async function consumeSamlAssertion(assertionId) {
+  await samlAssertionReplayStore().consume(assertionId);
 }
-function otelServiceName() {
-  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+
+// ../../src/core/auth/saml/samlServiceProvider.ts
+function readAssertionId(profile) {
+  if (typeof profile.ID === "string" && profile.ID.trim()) {
+    return profile.ID.trim();
+  }
+  const parsed = typeof profile.getAssertion === "function" ? profile.getAssertion() : null;
+  const assertionId = parsed?.Assertion?.$?.ID;
+  return typeof assertionId === "string" ? assertionId.trim() : "";
 }
-function appDisplayName() {
-  return process.env.APP_NAME?.trim() || "Strata";
+function requireSamlOption(value, name) {
+  const trimmed = value?.trim() ?? "";
+  if (!trimmed) {
+    throw new Error(`${name} is required.`);
+  }
+  return trimmed;
+}
+function readSamlEnvOptions() {
+  const idpSsoUrl = process.env.SAML_IDP_SSO_URL?.trim() ?? "";
+  const idpCert = process.env.SAML_IDP_CERT?.trim() ?? "";
+  const spEntityId = process.env.SAML_SP_ENTITY_ID?.trim() ?? "";
+  const acsUrl = process.env.SAML_ACS_URL?.trim() ?? "";
+  const idpIssuer = process.env.SAML_IDP_ISSUER?.trim() ?? "";
+  if (!idpSsoUrl || !idpCert || !spEntityId || !acsUrl || !idpIssuer) {
+    throw new Error("SAML requires SAML_IDP_SSO_URL, SAML_IDP_CERT, SAML_SP_ENTITY_ID, SAML_ACS_URL, and SAML_IDP_ISSUER.");
+  }
+  return {
+    idpSsoUrl,
+    idpCert,
+    spEntityId,
+    acsUrl,
+    idpIssuer,
+    wantAuthnResponseSigned: process.env.SAML_WANT_RESPONSE_SIGNED !== "false",
+    disableRequestedAuthnContext: process.env.SAML_DISABLE_REQUESTED_AUTHN_CONTEXT === "true"
+  };
 }
-function appEnv() {
-  return process.env.APP_ENV?.trim() || "local";
+var nodeSamlLoader = null;
+async function defaultLoadNodeSaml() {
+  return await import("@node-saml/node-saml");
 }
-function appUrl() {
-  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+async function loadNodeSaml() {
+  try {
+    return await (nodeSamlLoader ?? defaultLoadNodeSaml)();
+  } catch (error) {
+    throw missingOptionalPeer("@node-saml/node-saml", "to verify SAML assertions", error);
+  }
 }
-function apiPrefix() {
-  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
-  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
-  const trimmed = withSlash.replace(/\/+$/, "");
-  return trimmed || "/api/v1";
+function setNodeSamlLoaderForTests(loader) {
+  nodeSamlLoader = loader;
 }
-function sdkClientClassName() {
-  const override = process.env.APP_SDK_CLASS?.trim();
-  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
-    return override;
+
+class SamlServiceProvider {
+  options;
+  client = null;
+  constructor(options) {
+    this.options = options;
+    requireSamlOption(options.idpSsoUrl, "idpSsoUrl");
+    requireSamlOption(options.idpCert, "idpCert");
+    requireSamlOption(options.spEntityId, "spEntityId");
+    requireSamlOption(options.acsUrl, "acsUrl");
+    requireSamlOption(options.idpIssuer, "idpIssuer");
+  }
+  async getClient() {
+    if (this.client) {
+      return this.client;
+    }
+    const { SAML } = await loadNodeSaml();
+    this.client = new SAML({
+      callbackUrl: this.options.acsUrl,
+      entryPoint: this.options.idpSsoUrl,
+      issuer: this.options.spEntityId,
+      idpCert: this.options.idpCert,
+      audience: this.options.spEntityId,
+      idpIssuer: this.options.idpIssuer,
+      acceptedClockSkewMs: 5000,
+      wantAssertionsSigned: this.options.wantAssertionsSigned ?? true,
+      wantAuthnResponseSigned: this.options.wantAuthnResponseSigned ?? true,
+      disableRequestedAuthnContext: this.options.disableRequestedAuthnContext ?? false
+    });
+    return this.client;
   }
-  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
-  return fromName ? `${fromName}Client` : "AppClient";
+  async authorizationUrl(relayState) {
+    const client = await this.getClient();
+    return await client.getAuthorizeUrlAsync(relayState, undefined, {});
+  }
+  async consumePost(samlResponse, relayState) {
+    if (!samlResponse.trim()) {
+      throw new Error("SAML response is required.");
+    }
+    const client = await this.getClient();
+    const { profile, loggedOut } = await client.validatePostResponseAsync({
+      SAMLResponse: samlResponse,
+      ...relayState ? { RelayState: relayState } : {}
+    });
+    if (loggedOut || !profile) {
+      throw new Error("SAML assertion did not contain a signed user profile.");
+    }
+    const issuer = typeof profile.issuer === "string" ? profile.issuer.trim() : "";
+    if (!issuer || !timingSafeCompareString(issuer, this.options.idpIssuer)) {
+      throw new Error("SAML assertion issuer is invalid.");
+    }
+    const assertionId = readAssertionId(profile);
+    if (!assertionId) {
+      throw new Error("SAML assertion did not include an ID.");
+    }
+    await consumeSamlAssertion(assertionId);
+    const email = profile.email || (typeof profile["urn:oid:0.9.2342.19200300.100.1.3"] === "string" ? profile["urn:oid:0.9.2342.19200300.100.1.3"] : "") || "";
+    if (!email) {
+      throw new Error("SAML assertion did not include an email address.");
+    }
+    return {
+      providerUserId: profile.nameID || email,
+      email,
+      name: typeof profile.name === "string" && profile.name.trim() ? profile.name : email
+    };
+  }
+}
+function createSamlServiceProvider(options = readSamlEnvOptions()) {
+  return new SamlServiceProvider(options);
 }
 
 // ../../src/core/auth/oauth/samlProvider.ts
 class SamlProvider {
-  loginUrl;
   name = "saml";
-  constructor(loginUrl) {
-    this.loginUrl = loginUrl;
+  provider;
+  constructor(options) {
+    if (typeof options === "string") {
+      throw new Error("SamlProvider now requires IdP metadata (idpSsoUrl, idpCert, spEntityId, acsUrl, idpIssuer). The string constructor login stub has been removed.");
+    }
+    this.provider = createSamlServiceProvider(options);
   }
-  getAuthorizationUrl(state) {
-    return `${this.loginUrl}?state=${encodeURIComponent(state)}`;
+  getAuthorizationUrl(_state) {
+    throw new Error("SAML authorization is async. Use SamlServiceProvider.authorizationUrl().");
   }
-  async exchangeCode(code) {
-    if (!code.startsWith("saml:")) {
-      throw new Error("Invalid SAML assertion reference.");
-    }
-    const [, email, name] = code.split(":");
-    return {
-      providerUserId: email || "saml-user",
-      email: email || `saml-user@${appKeyPrefix()}.test`,
-      name: name ?? "SAML User"
-    };
+  async exchangeCode(_code) {
+    throw new Error("SAML login uses consumePost() with a signed SAMLResponse, not an OAuth code.");
+  }
+  authorizationUrl(relayState) {
+    return this.provider.authorizationUrl(relayState);
+  }
+  consumePost(samlResponse, relayState) {
+    return this.provider.consumePost(samlResponse, relayState);
   }
 }
 export {