@intlayer/backend 7.0.8 → 7.0.9-canary.2

package/dist/cjs/node_modules/samlify/build/src/binding-redirect.cjs

@@ -0,0 +1,342 @@
+const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
+const require_utility$1 = require('./utility.cjs');
+const require_urn$1 = require('./urn.cjs');
+const require_libsaml$1 = require('./libsaml.cjs');
+
+//#region ../../node_modules/samlify/build/src/binding-redirect.js
+var require_binding_redirect = /* @__PURE__ */ require_rolldown_runtime.__commonJS({ "../../node_modules/samlify/build/src/binding-redirect.js": ((exports) => {
+	var __assign = exports && exports.__assign || function() {
+		__assign = Object.assign || function(t) {
+			for (var s, i = 1, n = arguments.length; i < n; i++) {
+				s = arguments[i];
+				for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p)) t[p] = s[p];
+			}
+			return t;
+		};
+		return __assign.apply(this, arguments);
+	};
+	var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+		if (k2 === void 0) k2 = k;
+		var desc = Object.getOwnPropertyDescriptor(m, k);
+		if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) desc = {
+			enumerable: true,
+			get: function() {
+				return m[k];
+			}
+		};
+		Object.defineProperty(o, k2, desc);
+	}) : (function(o, m, k, k2) {
+		if (k2 === void 0) k2 = k;
+		o[k2] = m[k];
+	}));
+	var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+		Object.defineProperty(o, "default", {
+			enumerable: true,
+			value: v
+		});
+	}) : function(o, v) {
+		o["default"] = v;
+	});
+	var __importStar = exports && exports.__importStar || function(mod) {
+		if (mod && mod.__esModule) return mod;
+		var result = {};
+		if (mod != null) {
+			for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+		}
+		__setModuleDefault(result, mod);
+		return result;
+	};
+	var __importDefault = exports && exports.__importDefault || function(mod) {
+		return mod && mod.__esModule ? mod : { "default": mod };
+	};
+	Object.defineProperty(exports, "__esModule", { value: true });
+	/**
+	* @file binding-redirect.ts
+	* @author tngan
+	* @desc Binding-level API, declare the functions using Redirect binding
+	*/
+	var utility_1 = __importStar(require_utility$1.default);
+	var libsaml_1 = __importDefault(require_libsaml$1.default);
+	var url = __importStar(require("url"));
+	var urn_1 = require_urn$1.default;
+	var binding = urn_1.wording.binding;
+	var urlParams = urn_1.wording.urlParams;
+	/**
+	* @private
+	* @desc Helper of generating URL param/value pair
+	* @param  {string} param     key
+	* @param  {string} value     value of key
+	* @param  {boolean} first    determine whether the param is the starting one in order to add query header '?'
+	* @return {string}
+	*/
+	function pvPair(param, value, first) {
+		return (first === true ? "?" : "&") + param + "=" + value;
+	}
+	/**
+	* @private
+	* @desc Refractored part of URL generation for login/logout request
+	* @param  {string} type
+	* @param  {boolean} isSigned
+	* @param  {string} rawSamlRequest
+	* @param  {object} entitySetting
+	* @return {string}
+	*/
+	function buildRedirectURL(opts) {
+		var baseUrl = opts.baseUrl, type = opts.type, isSigned = opts.isSigned, context = opts.context, entitySetting = opts.entitySetting;
+		var _a = opts.relayState, relayState = _a === void 0 ? "" : _a;
+		var noParams = (url.parse(baseUrl).query || []).length === 0;
+		var queryParam = libsaml_1.default.getQueryParamByType(type);
+		var samlRequest = encodeURIComponent(utility_1.default.base64Encode(utility_1.default.deflateString(context)));
+		if (relayState !== "") relayState = pvPair(urlParams.relayState, encodeURIComponent(relayState));
+		if (isSigned) {
+			var sigAlg = pvPair(urlParams.sigAlg, encodeURIComponent(entitySetting.requestSignatureAlgorithm));
+			var octetString = samlRequest + relayState + sigAlg;
+			return baseUrl + pvPair(queryParam, octetString, noParams) + pvPair(urlParams.signature, encodeURIComponent(libsaml_1.default.constructMessageSignature(queryParam + "=" + octetString, entitySetting.privateKey, entitySetting.privateKeyPass, void 0, entitySetting.requestSignatureAlgorithm).toString()));
+		}
+		return baseUrl + pvPair(queryParam, samlRequest + relayState, noParams);
+	}
+	/**
+	* @desc Redirect URL for login request
+	* @param  {object} entity                       object includes both idp and sp
+	* @param  {function} customTagReplacement      used when developers have their own login response template
+	* @return {string} redirect URL
+	*/
+	function loginRequestRedirectURL(entity, customTagReplacement) {
+		var metadata = {
+			idp: entity.idp.entityMeta,
+			sp: entity.sp.entityMeta
+		};
+		var spSetting = entity.sp.entitySetting;
+		var id = "";
+		if (metadata && metadata.idp && metadata.sp) {
+			var base = metadata.idp.getSingleSignOnService(binding.redirect);
+			var rawSamlRequest = void 0;
+			if (spSetting.loginRequestTemplate && customTagReplacement) {
+				var info = customTagReplacement(spSetting.loginRequestTemplate);
+				id = (0, utility_1.get)(info, "id", null);
+				rawSamlRequest = (0, utility_1.get)(info, "context", null);
+			} else {
+				var nameIDFormat = spSetting.nameIDFormat;
+				var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+				id = spSetting.generateID();
+				rawSamlRequest = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLoginRequestTemplate.context, {
+					ID: id,
+					Destination: base,
+					Issuer: metadata.sp.getEntityID(),
+					IssueInstant: (/* @__PURE__ */ new Date()).toISOString(),
+					NameIDFormat: selectedNameIDFormat,
+					AssertionConsumerServiceURL: metadata.sp.getAssertionConsumerService(binding.post),
+					EntityID: metadata.sp.getEntityID(),
+					AllowCreate: spSetting.allowCreate
+				});
+			}
+			return {
+				id,
+				context: buildRedirectURL({
+					context: rawSamlRequest,
+					type: urlParams.samlRequest,
+					isSigned: metadata.sp.isAuthnRequestSigned(),
+					entitySetting: spSetting,
+					baseUrl: base,
+					relayState: spSetting.relayState
+				})
+			};
+		}
+		throw new Error("ERR_GENERATE_REDIRECT_LOGIN_REQUEST_MISSING_METADATA");
+	}
+	/**
+	* @desc Redirect URL for login response
+	* @param  {object} requestInfo             corresponding request, used to obtain the id
+	* @param  {object} entity                      object includes both idp and sp
+	* @param  {object} user                         current logged user (e.g. req.user)
+	* @param  {String} relayState                the relaystate sent by sp corresponding request
+	* @param  {function} customTagReplacement     used when developers have their own login response template
+	*/
+	function loginResponseRedirectURL(requestInfo, entity, user, relayState, customTagReplacement) {
+		if (user === void 0) user = {};
+		var idpSetting = entity.idp.entitySetting;
+		var spSetting = entity.sp.entitySetting;
+		var metadata = {
+			idp: entity.idp.entityMeta,
+			sp: entity.sp.entityMeta
+		};
+		var id = idpSetting.generateID();
+		if (metadata && metadata.idp && metadata.sp) {
+			var base = metadata.sp.getAssertionConsumerService(binding.redirect);
+			var rawSamlResponse = void 0;
+			var nameIDFormat = idpSetting.nameIDFormat;
+			var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+			var nowTime = /* @__PURE__ */ new Date();
+			var fiveMinutesLaterTime = new Date(nowTime.getTime() + 3e5);
+			var tvalue = {
+				ID: id,
+				AssertionID: idpSetting.generateID(),
+				Destination: base,
+				SubjectRecipient: base,
+				Issuer: metadata.idp.getEntityID(),
+				Audience: metadata.sp.getEntityID(),
+				EntityID: metadata.sp.getEntityID(),
+				IssueInstant: nowTime.toISOString(),
+				AssertionConsumerServiceURL: base,
+				StatusCode: urn_1.namespace.statusCode.success,
+				ConditionsNotBefore: nowTime.toISOString(),
+				ConditionsNotOnOrAfter: fiveMinutesLaterTime.toISOString(),
+				SubjectConfirmationDataNotOnOrAfter: fiveMinutesLaterTime.toISOString(),
+				NameIDFormat: selectedNameIDFormat,
+				NameID: user.email || "",
+				InResponseTo: (0, utility_1.get)(requestInfo, "extract.request.id", ""),
+				AuthnStatement: "",
+				AttributeStatement: ""
+			};
+			if (idpSetting.loginResponseTemplate && customTagReplacement) {
+				var template = customTagReplacement(idpSetting.loginResponseTemplate.context);
+				id = (0, utility_1.get)(template, "id", null);
+				rawSamlResponse = (0, utility_1.get)(template, "context", null);
+			} else {
+				if (requestInfo !== null) tvalue.InResponseTo = requestInfo.extract.request.id;
+				rawSamlResponse = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLoginResponseTemplate.context, tvalue);
+			}
+			var config = {
+				privateKey: idpSetting.privateKey,
+				privateKeyPass: idpSetting.privateKeyPass,
+				signatureAlgorithm: idpSetting.requestSignatureAlgorithm,
+				signingCert: metadata.idp.getX509Certificate("signing"),
+				isBase64Output: false
+			};
+			if (metadata.sp.isWantAssertionsSigned()) rawSamlResponse = libsaml_1.default.constructSAMLSignature(__assign(__assign({}, config), {
+				rawSamlMessage: rawSamlResponse,
+				transformationAlgorithms: spSetting.transformationAlgorithms,
+				referenceTagXPath: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']",
+				signatureConfig: {
+					prefix: "ds",
+					location: {
+						reference: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']",
+						action: "after"
+					}
+				}
+			}));
+			return {
+				id,
+				context: buildRedirectURL({
+					baseUrl: base,
+					type: urlParams.samlResponse,
+					isSigned: true,
+					context: rawSamlResponse,
+					entitySetting: idpSetting,
+					relayState
+				})
+			};
+		}
+		throw new Error("ERR_GENERATE_REDIRECT_LOGIN_RESPONSE_MISSING_METADATA");
+	}
+	/**
+	* @desc Redirect URL for logout request
+	* @param  {object} user                        current logged user (e.g. req.user)
+	* @param  {object} entity                      object includes both idp and sp
+	* @param  {function} customTagReplacement     used when developers have their own login response template
+	* @return {string} redirect URL
+	*/
+	function logoutRequestRedirectURL(user, entity, relayState, customTagReplacement) {
+		var metadata = {
+			init: entity.init.entityMeta,
+			target: entity.target.entityMeta
+		};
+		var initSetting = entity.init.entitySetting;
+		var id = initSetting.generateID();
+		var nameIDFormat = initSetting.nameIDFormat;
+		var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+		if (metadata && metadata.init && metadata.target) {
+			var base = metadata.target.getSingleLogoutService(binding.redirect);
+			var rawSamlRequest = "";
+			var requiredTags = {
+				ID: id,
+				Destination: base,
+				EntityID: metadata.init.getEntityID(),
+				Issuer: metadata.init.getEntityID(),
+				IssueInstant: (/* @__PURE__ */ new Date()).toISOString(),
+				NameIDFormat: selectedNameIDFormat,
+				NameID: user.logoutNameID,
+				SessionIndex: user.sessionIndex
+			};
+			if (initSetting.logoutRequestTemplate && customTagReplacement) {
+				var info = customTagReplacement(initSetting.logoutRequestTemplate, requiredTags);
+				id = (0, utility_1.get)(info, "id", null);
+				rawSamlRequest = (0, utility_1.get)(info, "context", null);
+			} else rawSamlRequest = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLogoutRequestTemplate.context, requiredTags);
+			return {
+				id,
+				context: buildRedirectURL({
+					context: rawSamlRequest,
+					relayState,
+					type: urlParams.logoutRequest,
+					isSigned: entity.target.entitySetting.wantLogoutRequestSigned,
+					entitySetting: initSetting,
+					baseUrl: base
+				})
+			};
+		}
+		throw new Error("ERR_GENERATE_REDIRECT_LOGOUT_REQUEST_MISSING_METADATA");
+	}
+	/**
+	* @desc Redirect URL for logout response
+	* @param  {object} requescorresponding request, used to obtain the id
+	* @param  {object} entity                      object includes both idp and sp
+	* @param  {function} customTagReplacement     used when developers have their own login response template
+	*/
+	function logoutResponseRedirectURL(requestInfo, entity, relayState, customTagReplacement) {
+		var metadata = {
+			init: entity.init.entityMeta,
+			target: entity.target.entityMeta
+		};
+		var initSetting = entity.init.entitySetting;
+		var id = initSetting.generateID();
+		if (metadata && metadata.init && metadata.target) {
+			var base = metadata.target.getSingleLogoutService(binding.redirect);
+			var rawSamlResponse = void 0;
+			if (initSetting.logoutResponseTemplate && customTagReplacement) {
+				var template = customTagReplacement(initSetting.logoutResponseTemplate);
+				id = (0, utility_1.get)(template, "id", null);
+				rawSamlResponse = (0, utility_1.get)(template, "context", null);
+			} else {
+				var tvalue = {
+					ID: id,
+					Destination: base,
+					Issuer: metadata.init.getEntityID(),
+					EntityID: metadata.init.getEntityID(),
+					IssueInstant: (/* @__PURE__ */ new Date()).toISOString(),
+					StatusCode: urn_1.namespace.statusCode.success
+				};
+				if (requestInfo && requestInfo.extract && requestInfo.extract.request) tvalue.InResponseTo = requestInfo.extract.request.id;
+				rawSamlResponse = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLogoutResponseTemplate.context, tvalue);
+			}
+			return {
+				id,
+				context: buildRedirectURL({
+					baseUrl: base,
+					type: urlParams.logoutResponse,
+					isSigned: entity.target.entitySetting.wantLogoutResponseSigned,
+					context: rawSamlResponse,
+					entitySetting: initSetting,
+					relayState
+				})
+			};
+		}
+		throw new Error("ERR_GENERATE_REDIRECT_LOGOUT_RESPONSE_MISSING_METADATA");
+	}
+	var redirectBinding = {
+		loginRequestRedirectURL,
+		loginResponseRedirectURL,
+		logoutRequestRedirectURL,
+		logoutResponseRedirectURL
+	};
+	exports.default = redirectBinding;
+}) });
+
+//#endregion
+Object.defineProperty(exports, 'default', {
+  enumerable: true,
+  get: function () {
+    return require_binding_redirect();
+  }
+});
+//# sourceMappingURL=binding-redirect.cjs.map

package/dist/cjs/node_modules/samlify/build/src/binding-redirect.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-redirect.cjs","names":[],"sources":["../../../../../../../../node_modules/samlify/build/src/binding-redirect.js"],"sourcesContent":["\"use strict\";\nvar __assign = (this && this.__assign) || function () {\n    __assign = Object.assign || function(t) {\n        for (var s, i = 1, n = arguments.length; i < n; i++) {\n            s = arguments[i];\n            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))\n                t[p] = s[p];\n        }\n        return t;\n    };\n    return __assign.apply(this, arguments);\n};\nvar __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {\n    if (k2 === undefined) k2 = k;\n    var desc = Object.getOwnPropertyDescriptor(m, k);\n    if (!desc || (\"get\" in desc ? !m.__esModule : desc.writable || desc.configurable)) {\n      desc = { enumerable: true, get: function() { return m[k]; } };\n    }\n    Object.defineProperty(o, k2, desc);\n}) : (function(o, m, k, k2) {\n    if (k2 === undefined) k2 = k;\n    o[k2] = m[k];\n}));\nvar __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {\n    Object.defineProperty(o, \"default\", { enumerable: true, value: v });\n}) : function(o, v) {\n    o[\"default\"] = v;\n});\nvar __importStar = (this && this.__importStar) || function (mod) {\n    if (mod && mod.__esModule) return mod;\n    var result = {};\n    if (mod != null) for (var k in mod) if (k !== \"default\" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);\n    __setModuleDefault(result, mod);\n    return result;\n};\nvar __importDefault = (this && this.__importDefault) || function (mod) {\n    return (mod && mod.__esModule) ? mod : { \"default\": mod };\n};\nObject.defineProperty(exports, \"__esModule\", { value: true });\n/**\n* @file binding-redirect.ts\n* @author tngan\n* @desc Binding-level API, declare the functions using Redirect binding\n*/\nvar utility_1 = __importStar(require(\"./utility\"));\nvar libsaml_1 = __importDefault(require(\"./libsaml\"));\nvar url = __importStar(require(\"url\"));\nvar urn_1 = require(\"./urn\");\nvar binding = urn_1.wording.binding;\nvar urlParams = urn_1.wording.urlParams;\n/**\n* @private\n* @desc Helper of generating URL param/value pair\n* @param  {string} param     key\n* @param  {string} value     value of key\n* @param  {boolean} first    determine whether the param is the starting one in order to add query header '?'\n* @return {string}\n*/\nfunction pvPair(param, value, first) {\n    return (first === true ? '?' : '&') + param + '=' + value;\n}\n/**\n* @private\n* @desc Refractored part of URL generation for login/logout request\n* @param  {string} type\n* @param  {boolean} isSigned\n* @param  {string} rawSamlRequest\n* @param  {object} entitySetting\n* @return {string}\n*/\nfunction buildRedirectURL(opts) {\n    var baseUrl = opts.baseUrl, type = opts.type, isSigned = opts.isSigned, context = opts.context, entitySetting = opts.entitySetting;\n    var _a = opts.relayState, relayState = _a === void 0 ? '' : _a;\n    var noParams = (url.parse(baseUrl).query || []).length === 0;\n    var queryParam = libsaml_1.default.getQueryParamByType(type);\n    // In general, this xmlstring is required to do deflate -> base64 -> urlencode\n    var samlRequest = encodeURIComponent(utility_1.default.base64Encode(utility_1.default.deflateString(context)));\n    if (relayState !== '') {\n        relayState = pvPair(urlParams.relayState, encodeURIComponent(relayState));\n    }\n    if (isSigned) {\n        var sigAlg = pvPair(urlParams.sigAlg, encodeURIComponent(entitySetting.requestSignatureAlgorithm));\n        var octetString = samlRequest + relayState + sigAlg;\n        return baseUrl\n            + pvPair(queryParam, octetString, noParams)\n            + pvPair(urlParams.signature, encodeURIComponent(libsaml_1.default.constructMessageSignature(queryParam + '=' + octetString, entitySetting.privateKey, entitySetting.privateKeyPass, undefined, entitySetting.requestSignatureAlgorithm).toString()));\n    }\n    return baseUrl + pvPair(queryParam, samlRequest + relayState, noParams);\n}\n/**\n* @desc Redirect URL for login request\n* @param  {object} entity                       object includes both idp and sp\n* @param  {function} customTagReplacement      used when developers have their own login response template\n* @return {string} redirect URL\n*/\nfunction loginRequestRedirectURL(entity, customTagReplacement) {\n    var metadata = { idp: entity.idp.entityMeta, sp: entity.sp.entityMeta };\n    var spSetting = entity.sp.entitySetting;\n    var id = '';\n    if (metadata && metadata.idp && metadata.sp) {\n        var base = metadata.idp.getSingleSignOnService(binding.redirect);\n        var rawSamlRequest = void 0;\n        if (spSetting.loginRequestTemplate && customTagReplacement) {\n            var info = customTagReplacement(spSetting.loginRequestTemplate);\n            id = (0, utility_1.get)(info, 'id', null);\n            rawSamlRequest = (0, utility_1.get)(info, 'context', null);\n        }\n        else {\n            var nameIDFormat = spSetting.nameIDFormat;\n            var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;\n            id = spSetting.generateID();\n            rawSamlRequest = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLoginRequestTemplate.context, {\n                ID: id,\n                Destination: base,\n                Issuer: metadata.sp.getEntityID(),\n                IssueInstant: new Date().toISOString(),\n                NameIDFormat: selectedNameIDFormat,\n                AssertionConsumerServiceURL: metadata.sp.getAssertionConsumerService(binding.post),\n                EntityID: metadata.sp.getEntityID(),\n                AllowCreate: spSetting.allowCreate,\n            });\n        }\n        return {\n            id: id,\n            context: buildRedirectURL({\n                context: rawSamlRequest,\n                type: urlParams.samlRequest,\n                isSigned: metadata.sp.isAuthnRequestSigned(),\n                entitySetting: spSetting,\n                baseUrl: base,\n                relayState: spSetting.relayState,\n            }),\n        };\n    }\n    throw new Error('ERR_GENERATE_REDIRECT_LOGIN_REQUEST_MISSING_METADATA');\n}\n/**\n* @desc Redirect URL for login response\n* @param  {object} requestInfo             corresponding request, used to obtain the id\n* @param  {object} entity                      object includes both idp and sp\n* @param  {object} user                         current logged user (e.g. req.user)\n* @param  {String} relayState                the relaystate sent by sp corresponding request\n* @param  {function} customTagReplacement     used when developers have their own login response template\n*/\nfunction loginResponseRedirectURL(requestInfo, entity, user, relayState, customTagReplacement) {\n    if (user === void 0) { user = {}; }\n    var idpSetting = entity.idp.entitySetting;\n    var spSetting = entity.sp.entitySetting;\n    var metadata = {\n        idp: entity.idp.entityMeta,\n        sp: entity.sp.entityMeta,\n    };\n    var id = idpSetting.generateID();\n    if (metadata && metadata.idp && metadata.sp) {\n        var base = metadata.sp.getAssertionConsumerService(binding.redirect);\n        var rawSamlResponse = void 0;\n        //\n        var nameIDFormat = idpSetting.nameIDFormat;\n        var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;\n        var nowTime = new Date();\n        // Five minutes later : nowtime  + 5 * 60 * 1000 (in milliseconds)\n        var fiveMinutesLaterTime = new Date(nowTime.getTime() + 300000);\n        var tvalue = {\n            ID: id,\n            AssertionID: idpSetting.generateID(),\n            Destination: base,\n            SubjectRecipient: base,\n            Issuer: metadata.idp.getEntityID(),\n            Audience: metadata.sp.getEntityID(),\n            EntityID: metadata.sp.getEntityID(),\n            IssueInstant: nowTime.toISOString(),\n            AssertionConsumerServiceURL: base,\n            StatusCode: urn_1.namespace.statusCode.success,\n            // can be customized\n            ConditionsNotBefore: nowTime.toISOString(),\n            ConditionsNotOnOrAfter: fiveMinutesLaterTime.toISOString(),\n            SubjectConfirmationDataNotOnOrAfter: fiveMinutesLaterTime.toISOString(),\n            NameIDFormat: selectedNameIDFormat,\n            NameID: user.email || '',\n            InResponseTo: (0, utility_1.get)(requestInfo, 'extract.request.id', ''),\n            AuthnStatement: '',\n            AttributeStatement: '',\n        };\n        if (idpSetting.loginResponseTemplate && customTagReplacement) {\n            var template = customTagReplacement(idpSetting.loginResponseTemplate.context);\n            id = (0, utility_1.get)(template, 'id', null);\n            rawSamlResponse = (0, utility_1.get)(template, 'context', null);\n        }\n        else {\n            if (requestInfo !== null) {\n                tvalue.InResponseTo = requestInfo.extract.request.id;\n            }\n            rawSamlResponse = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLoginResponseTemplate.context, tvalue);\n        }\n        var privateKey = idpSetting.privateKey, privateKeyPass = idpSetting.privateKeyPass, signatureAlgorithm = idpSetting.requestSignatureAlgorithm;\n        var config = {\n            privateKey: privateKey,\n            privateKeyPass: privateKeyPass,\n            signatureAlgorithm: signatureAlgorithm,\n            signingCert: metadata.idp.getX509Certificate('signing'),\n            isBase64Output: false,\n        };\n        // step: sign assertion ? -> encrypted ? -> sign message ?\n        if (metadata.sp.isWantAssertionsSigned()) {\n            rawSamlResponse = libsaml_1.default.constructSAMLSignature(__assign(__assign({}, config), { rawSamlMessage: rawSamlResponse, transformationAlgorithms: spSetting.transformationAlgorithms, referenceTagXPath: \"/*[local-name(.)='Response']/*[local-name(.)='Assertion']\", signatureConfig: {\n                    prefix: 'ds',\n                    location: { reference: \"/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']\", action: 'after' },\n                } }));\n        }\n        // Like in post binding, SAML response is always signed\n        return {\n            id: id,\n            context: buildRedirectURL({\n                baseUrl: base,\n                type: urlParams.samlResponse,\n                isSigned: true,\n                context: rawSamlResponse,\n                entitySetting: idpSetting,\n                relayState: relayState,\n            }),\n        };\n    }\n    throw new Error('ERR_GENERATE_REDIRECT_LOGIN_RESPONSE_MISSING_METADATA');\n}\n/**\n* @desc Redirect URL for logout request\n* @param  {object} user                        current logged user (e.g. req.user)\n* @param  {object} entity                      object includes both idp and sp\n* @param  {function} customTagReplacement     used when developers have their own login response template\n* @return {string} redirect URL\n*/\nfunction logoutRequestRedirectURL(user, entity, relayState, customTagReplacement) {\n    var metadata = { init: entity.init.entityMeta, target: entity.target.entityMeta };\n    var initSetting = entity.init.entitySetting;\n    var id = initSetting.generateID();\n    var nameIDFormat = initSetting.nameIDFormat;\n    var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;\n    if (metadata && metadata.init && metadata.target) {\n        var base = metadata.target.getSingleLogoutService(binding.redirect);\n        var rawSamlRequest = '';\n        var requiredTags = {\n            ID: id,\n            Destination: base,\n            EntityID: metadata.init.getEntityID(),\n            Issuer: metadata.init.getEntityID(),\n            IssueInstant: new Date().toISOString(),\n            NameIDFormat: selectedNameIDFormat,\n            NameID: user.logoutNameID,\n            SessionIndex: user.sessionIndex,\n        };\n        if (initSetting.logoutRequestTemplate && customTagReplacement) {\n            var info = customTagReplacement(initSetting.logoutRequestTemplate, requiredTags);\n            id = (0, utility_1.get)(info, 'id', null);\n            rawSamlRequest = (0, utility_1.get)(info, 'context', null);\n        }\n        else {\n            rawSamlRequest = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLogoutRequestTemplate.context, requiredTags);\n        }\n        return {\n            id: id,\n            context: buildRedirectURL({\n                context: rawSamlRequest,\n                relayState: relayState,\n                type: urlParams.logoutRequest,\n                isSigned: entity.target.entitySetting.wantLogoutRequestSigned,\n                entitySetting: initSetting,\n                baseUrl: base,\n            }),\n        };\n    }\n    throw new Error('ERR_GENERATE_REDIRECT_LOGOUT_REQUEST_MISSING_METADATA');\n}\n/**\n* @desc Redirect URL for logout response\n* @param  {object} requescorresponding request, used to obtain the id\n* @param  {object} entity                      object includes both idp and sp\n* @param  {function} customTagReplacement     used when developers have their own login response template\n*/\nfunction logoutResponseRedirectURL(requestInfo, entity, relayState, customTagReplacement) {\n    var metadata = {\n        init: entity.init.entityMeta,\n        target: entity.target.entityMeta,\n    };\n    var initSetting = entity.init.entitySetting;\n    var id = initSetting.generateID();\n    if (metadata && metadata.init && metadata.target) {\n        var base = metadata.target.getSingleLogoutService(binding.redirect);\n        var rawSamlResponse = void 0;\n        if (initSetting.logoutResponseTemplate && customTagReplacement) {\n            var template = customTagReplacement(initSetting.logoutResponseTemplate);\n            id = (0, utility_1.get)(template, 'id', null);\n            rawSamlResponse = (0, utility_1.get)(template, 'context', null);\n        }\n        else {\n            var tvalue = {\n                ID: id,\n                Destination: base,\n                Issuer: metadata.init.getEntityID(),\n                EntityID: metadata.init.getEntityID(),\n                IssueInstant: new Date().toISOString(),\n                StatusCode: urn_1.namespace.statusCode.success,\n            };\n            if (requestInfo && requestInfo.extract && requestInfo.extract.request) {\n                tvalue.InResponseTo = requestInfo.extract.request.id;\n            }\n            rawSamlResponse = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLogoutResponseTemplate.context, tvalue);\n        }\n        return {\n            id: id,\n            context: buildRedirectURL({\n                baseUrl: base,\n                type: urlParams.logoutResponse,\n                isSigned: entity.target.entitySetting.wantLogoutResponseSigned,\n                context: rawSamlResponse,\n                entitySetting: initSetting,\n                relayState: relayState,\n            }),\n        };\n    }\n    throw new Error('ERR_GENERATE_REDIRECT_LOGOUT_RESPONSE_MISSING_METADATA');\n}\nvar redirectBinding = {\n    loginRequestRedirectURL: loginRequestRedirectURL,\n    loginResponseRedirectURL: loginResponseRedirectURL,\n    logoutRequestRedirectURL: logoutRequestRedirectURL,\n    logoutResponseRedirectURL: logoutResponseRedirectURL,\n};\nexports.default = redirectBinding;\n//# sourceMappingURL=binding-redirect.js.map"],"x_google_ignoreList":[0],"mappings":";;;;;;;CACA,IAAI,8BAAyB,YAAa,WAAY;AAClD,aAAW,OAAO,UAAU,SAAS,GAAG;AACpC,QAAK,IAAI,GAAG,IAAI,GAAG,IAAI,UAAU,QAAQ,IAAI,GAAG,KAAK;AACjD,QAAI,UAAU;AACd,SAAK,IAAI,KAAK,EAAG,KAAI,OAAO,UAAU,eAAe,KAAK,GAAG,EAAE,CAC3D,GAAE,KAAK,EAAE;;AAEjB,UAAO;;AAEX,SAAO,SAAS,MAAM,MAAM,UAAU;;CAE1C,IAAI,qCAAgC,oBAAqB,OAAO,UAAU,SAAS,GAAG,GAAG,GAAG,IAAI;AAC5F,MAAI,OAAO,OAAW,MAAK;EAC3B,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE;AAChD,MAAI,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,aAAa,KAAK,YAAY,KAAK,cAClE,QAAO;GAAE,YAAY;GAAM,KAAK,WAAW;AAAE,WAAO,EAAE;;GAAO;AAE/D,SAAO,eAAe,GAAG,IAAI,KAAK;OAChC,SAAS,GAAG,GAAG,GAAG,IAAI;AACxB,MAAI,OAAO,OAAW,MAAK;AAC3B,IAAE,MAAM,EAAE;;CAEd,IAAI,wCAAmC,uBAAwB,OAAO,UAAU,SAAS,GAAG,GAAG;AAC3F,SAAO,eAAe,GAAG,WAAW;GAAE,YAAY;GAAM,OAAO;GAAG,CAAC;MAClE,SAAS,GAAG,GAAG;AAChB,IAAE,aAAa;;CAEnB,IAAI,kCAA6B,gBAAiB,SAAU,KAAK;AAC7D,MAAI,OAAO,IAAI,WAAY,QAAO;EAClC,IAAI,SAAS,EAAE;AACf,MAAI,OAAO,MAAM;QAAK,IAAI,KAAK,IAAK,KAAI,MAAM,aAAa,OAAO,UAAU,eAAe,KAAK,KAAK,EAAE,CAAE,iBAAgB,QAAQ,KAAK,EAAE;;AACxI,qBAAmB,QAAQ,IAAI;AAC/B,SAAO;;CAEX,IAAI,qCAAgC,mBAAoB,SAAU,KAAK;AACnE,SAAQ,OAAO,IAAI,aAAc,MAAM,EAAE,WAAW,KAAK;;AAE7D,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;;;;;;CAM7D,IAAI,YAAY,uCAAkC;CAClD,IAAI,YAAY,0CAAqC;CACrD,IAAI,MAAM,aAAa,QAAQ,MAAM,CAAC;CACtC,IAAI;CACJ,IAAI,UAAU,MAAM,QAAQ;CAC5B,IAAI,YAAY,MAAM,QAAQ;;;;;;;;;CAS9B,SAAS,OAAO,OAAO,OAAO,OAAO;AACjC,UAAQ,UAAU,OAAO,MAAM,OAAO,QAAQ,MAAM;;;;;;;;;;;CAWxD,SAAS,iBAAiB,MAAM;EAC5B,IAAI,UAAU,KAAK,SAAS,OAAO,KAAK,MAAM,WAAW,KAAK,UAAU,UAAU,KAAK,SAAS,gBAAgB,KAAK;EACrH,IAAI,KAAK,KAAK,YAAY,aAAa,OAAO,KAAK,IAAI,KAAK;EAC5D,IAAI,YAAY,IAAI,MAAM,QAAQ,CAAC,SAAS,EAAE,EAAE,WAAW;EAC3D,IAAI,aAAa,UAAU,QAAQ,oBAAoB,KAAK;EAE5D,IAAI,cAAc,mBAAmB,UAAU,QAAQ,aAAa,UAAU,QAAQ,cAAc,QAAQ,CAAC,CAAC;AAC9G,MAAI,eAAe,GACf,cAAa,OAAO,UAAU,YAAY,mBAAmB,WAAW,CAAC;AAE7E,MAAI,UAAU;GACV,IAAI,SAAS,OAAO,UAAU,QAAQ,mBAAmB,cAAc,0BAA0B,CAAC;GAClG,IAAI,cAAc,cAAc,aAAa;AAC7C,UAAO,UACD,OAAO,YAAY,aAAa,SAAS,GACzC,OAAO,UAAU,WAAW,mBAAmB,UAAU,QAAQ,0BAA0B,aAAa,MAAM,aAAa,cAAc,YAAY,cAAc,gBAAgB,QAAW,cAAc,0BAA0B,CAAC,UAAU,CAAC,CAAC;;AAE7P,SAAO,UAAU,OAAO,YAAY,cAAc,YAAY,SAAS;;;;;;;;CAQ3E,SAAS,wBAAwB,QAAQ,sBAAsB;EAC3D,IAAI,WAAW;GAAE,KAAK,OAAO,IAAI;GAAY,IAAI,OAAO,GAAG;GAAY;EACvE,IAAI,YAAY,OAAO,GAAG;EAC1B,IAAI,KAAK;AACT,MAAI,YAAY,SAAS,OAAO,SAAS,IAAI;GACzC,IAAI,OAAO,SAAS,IAAI,uBAAuB,QAAQ,SAAS;GAChE,IAAI,iBAAiB,KAAK;AAC1B,OAAI,UAAU,wBAAwB,sBAAsB;IACxD,IAAI,OAAO,qBAAqB,UAAU,qBAAqB;AAC/D,UAAM,GAAG,UAAU,KAAK,MAAM,MAAM,KAAK;AACzC,sBAAkB,GAAG,UAAU,KAAK,MAAM,WAAW,KAAK;UAEzD;IACD,IAAI,eAAe,UAAU;IAC7B,IAAI,uBAAuB,MAAM,QAAQ,aAAa,GAAG,aAAa,KAAK;AAC3E,SAAK,UAAU,YAAY;AAC3B,qBAAiB,UAAU,QAAQ,mBAAmB,UAAU,QAAQ,4BAA4B,SAAS;KACzG,IAAI;KACJ,aAAa;KACb,QAAQ,SAAS,GAAG,aAAa;KACjC,+BAAc,IAAI,MAAM,EAAC,aAAa;KACtC,cAAc;KACd,6BAA6B,SAAS,GAAG,4BAA4B,QAAQ,KAAK;KAClF,UAAU,SAAS,GAAG,aAAa;KACnC,aAAa,UAAU;KAC1B,CAAC;;AAEN,UAAO;IACC;IACJ,SAAS,iBAAiB;KACtB,SAAS;KACT,MAAM,UAAU;KAChB,UAAU,SAAS,GAAG,sBAAsB;KAC5C,eAAe;KACf,SAAS;KACT,YAAY,UAAU;KACzB,CAAC;IACL;;AAEL,QAAM,IAAI,MAAM,uDAAuD;;;;;;;;;;CAU3E,SAAS,yBAAyB,aAAa,QAAQ,MAAM,YAAY,sBAAsB;AAC3F,MAAI,SAAS,KAAK,EAAK,QAAO,EAAE;EAChC,IAAI,aAAa,OAAO,IAAI;EAC5B,IAAI,YAAY,OAAO,GAAG;EAC1B,IAAI,WAAW;GACX,KAAK,OAAO,IAAI;GAChB,IAAI,OAAO,GAAG;GACjB;EACD,IAAI,KAAK,WAAW,YAAY;AAChC,MAAI,YAAY,SAAS,OAAO,SAAS,IAAI;GACzC,IAAI,OAAO,SAAS,GAAG,4BAA4B,QAAQ,SAAS;GACpE,IAAI,kBAAkB,KAAK;GAE3B,IAAI,eAAe,WAAW;GAC9B,IAAI,uBAAuB,MAAM,QAAQ,aAAa,GAAG,aAAa,KAAK;GAC3E,IAAI,0BAAU,IAAI,MAAM;GAExB,IAAI,uBAAuB,IAAI,KAAK,QAAQ,SAAS,GAAG,IAAO;GAC/D,IAAI,SAAS;IACT,IAAI;IACJ,aAAa,WAAW,YAAY;IACpC,aAAa;IACb,kBAAkB;IAClB,QAAQ,SAAS,IAAI,aAAa;IAClC,UAAU,SAAS,GAAG,aAAa;IACnC,UAAU,SAAS,GAAG,aAAa;IACnC,cAAc,QAAQ,aAAa;IACnC,6BAA6B;IAC7B,YAAY,MAAM,UAAU,WAAW;IAEvC,qBAAqB,QAAQ,aAAa;IAC1C,wBAAwB,qBAAqB,aAAa;IAC1D,qCAAqC,qBAAqB,aAAa;IACvE,cAAc;IACd,QAAQ,KAAK,SAAS;IACtB,eAAe,GAAG,UAAU,KAAK,aAAa,sBAAsB,GAAG;IACvE,gBAAgB;IAChB,oBAAoB;IACvB;AACD,OAAI,WAAW,yBAAyB,sBAAsB;IAC1D,IAAI,WAAW,qBAAqB,WAAW,sBAAsB,QAAQ;AAC7E,UAAM,GAAG,UAAU,KAAK,UAAU,MAAM,KAAK;AAC7C,uBAAmB,GAAG,UAAU,KAAK,UAAU,WAAW,KAAK;UAE9D;AACD,QAAI,gBAAgB,KAChB,QAAO,eAAe,YAAY,QAAQ,QAAQ;AAEtD,sBAAkB,UAAU,QAAQ,mBAAmB,UAAU,QAAQ,6BAA6B,SAAS,OAAO;;GAG1H,IAAI,SAAS;IACT,YAFa,WAAW;IAGxB,gBAHqD,WAAW;IAIhE,oBAJqG,WAAW;IAKhH,aAAa,SAAS,IAAI,mBAAmB,UAAU;IACvD,gBAAgB;IACnB;AAED,OAAI,SAAS,GAAG,wBAAwB,CACpC,mBAAkB,UAAU,QAAQ,uBAAuB,SAAS,SAAS,EAAE,EAAE,OAAO,EAAE;IAAE,gBAAgB;IAAiB,0BAA0B,UAAU;IAA0B,mBAAmB;IAA6D,iBAAiB;KACpR,QAAQ;KACR,UAAU;MAAE,WAAW;MAAuF,QAAQ;MAAS;KAClI;IAAE,CAAC,CAAC;AAGb,UAAO;IACC;IACJ,SAAS,iBAAiB;KACtB,SAAS;KACT,MAAM,UAAU;KAChB,UAAU;KACV,SAAS;KACT,eAAe;KACH;KACf,CAAC;IACL;;AAEL,QAAM,IAAI,MAAM,wDAAwD;;;;;;;;;CAS5E,SAAS,yBAAyB,MAAM,QAAQ,YAAY,sBAAsB;EAC9E,IAAI,WAAW;GAAE,MAAM,OAAO,KAAK;GAAY,QAAQ,OAAO,OAAO;GAAY;EACjF,IAAI,cAAc,OAAO,KAAK;EAC9B,IAAI,KAAK,YAAY,YAAY;EACjC,IAAI,eAAe,YAAY;EAC/B,IAAI,uBAAuB,MAAM,QAAQ,aAAa,GAAG,aAAa,KAAK;AAC3E,MAAI,YAAY,SAAS,QAAQ,SAAS,QAAQ;GAC9C,IAAI,OAAO,SAAS,OAAO,uBAAuB,QAAQ,SAAS;GACnE,IAAI,iBAAiB;GACrB,IAAI,eAAe;IACf,IAAI;IACJ,aAAa;IACb,UAAU,SAAS,KAAK,aAAa;IACrC,QAAQ,SAAS,KAAK,aAAa;IACnC,+BAAc,IAAI,MAAM,EAAC,aAAa;IACtC,cAAc;IACd,QAAQ,KAAK;IACb,cAAc,KAAK;IACtB;AACD,OAAI,YAAY,yBAAyB,sBAAsB;IAC3D,IAAI,OAAO,qBAAqB,YAAY,uBAAuB,aAAa;AAChF,UAAM,GAAG,UAAU,KAAK,MAAM,MAAM,KAAK;AACzC,sBAAkB,GAAG,UAAU,KAAK,MAAM,WAAW,KAAK;SAG1D,kBAAiB,UAAU,QAAQ,mBAAmB,UAAU,QAAQ,6BAA6B,SAAS,aAAa;AAE/H,UAAO;IACC;IACJ,SAAS,iBAAiB;KACtB,SAAS;KACG;KACZ,MAAM,UAAU;KAChB,UAAU,OAAO,OAAO,cAAc;KACtC,eAAe;KACf,SAAS;KACZ,CAAC;IACL;;AAEL,QAAM,IAAI,MAAM,wDAAwD;;;;;;;;CAQ5E,SAAS,0BAA0B,aAAa,QAAQ,YAAY,sBAAsB;EACtF,IAAI,WAAW;GACX,MAAM,OAAO,KAAK;GAClB,QAAQ,OAAO,OAAO;GACzB;EACD,IAAI,cAAc,OAAO,KAAK;EAC9B,IAAI,KAAK,YAAY,YAAY;AACjC,MAAI,YAAY,SAAS,QAAQ,SAAS,QAAQ;GAC9C,IAAI,OAAO,SAAS,OAAO,uBAAuB,QAAQ,SAAS;GACnE,IAAI,kBAAkB,KAAK;AAC3B,OAAI,YAAY,0BAA0B,sBAAsB;IAC5D,IAAI,WAAW,qBAAqB,YAAY,uBAAuB;AACvE,UAAM,GAAG,UAAU,KAAK,UAAU,MAAM,KAAK;AAC7C,uBAAmB,GAAG,UAAU,KAAK,UAAU,WAAW,KAAK;UAE9D;IACD,IAAI,SAAS;KACT,IAAI;KACJ,aAAa;KACb,QAAQ,SAAS,KAAK,aAAa;KACnC,UAAU,SAAS,KAAK,aAAa;KACrC,+BAAc,IAAI,MAAM,EAAC,aAAa;KACtC,YAAY,MAAM,UAAU,WAAW;KAC1C;AACD,QAAI,eAAe,YAAY,WAAW,YAAY,QAAQ,QAC1D,QAAO,eAAe,YAAY,QAAQ,QAAQ;AAEtD,sBAAkB,UAAU,QAAQ,mBAAmB,UAAU,QAAQ,8BAA8B,SAAS,OAAO;;AAE3H,UAAO;IACC;IACJ,SAAS,iBAAiB;KACtB,SAAS;KACT,MAAM,UAAU;KAChB,UAAU,OAAO,OAAO,cAAc;KACtC,SAAS;KACT,eAAe;KACH;KACf,CAAC;IACL;;AAEL,QAAM,IAAI,MAAM,yDAAyD;;CAE7E,IAAI,kBAAkB;EACO;EACC;EACA;EACC;EAC9B;AACD,SAAQ,UAAU"}