@mcp-abap-adt/auth-broker 3.1.0 → 4.1.0

package/dist/bindingOf.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * What a destination's means bind its secret to: the one
+ * place the broker chooses which binding a destination has. `getProvider`
+ * builds each provider with it, and `persist` writes what it gives beside every
+ * secret; `bindingOf` hands the same to a consumer.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.destinationBinding = destinationBinding;
+exports.bindingOf = bindingOf;
+const binding_1 = require("./binding");
+const destinations_1 = require("./destinations");
+/**
+ * The binding of a `jwt` or `saml` destination with the grant it states: the
+ * UAA grants and `saml2_bearer` by `uaaUrl` and the client, the OIDC grants by
+ * the issuer and the client, `saml2_pure` by its ACS, and `none` by what the
+ * means state.
+ */
+function destinationBinding(authType, grant, means, client) {
+    if (grant === 'none')
+        return (0, binding_1.handedOverBinding)(authType, means, client);
+    if ((0, destinations_1.isOidcGrant)(grant))
+        return (0, binding_1.oidcBinding)(means, client);
+    if (grant === 'saml2_pure')
+        return (0, binding_1.samlPureBinding)(means);
+    return (0, binding_1.uaaBinding)(means, client);
+}
+/**
+ * The binding the broker writes beside a secret for a destination with these
+ * means and this client — canonical, exactly what `getProvider` compares a
+ * stored secret against. For a consumer that hands over a credential the
+ * broker cannot obtain (a `none` destination: a token or cookies it was
+ * given) and writes it to the session store itself: written with this binding,
+ * `getProvider` presents it; written with any other, it refuses.
+ *
+ * `means` are the key store's (`authType`, `grantType`, `serviceUrl`,
+ * `sapClient`, the issuer or ACS); `client` is the key store's client, when the
+ * destination has one. A destination that states no `jwt` / `saml` type or no
+ * grant binds nothing: `{}`. Never logs, never throws.
+ */
+function bindingOf(means, client = null) {
+    const authType = means.authType;
+    const grant = means.grantType;
+    if ((authType !== 'jwt' && authType !== 'saml') || !grant)
+        return {};
+    const { issuedFor, issuedBy } = destinationBinding(authType, grant, means, client);
+    const binding = {};
+    if (issuedFor !== undefined)
+        binding.issuedFor = issuedFor;
+    if (issuedBy !== undefined)
+        binding.issuedBy = issuedBy;
+    return binding;
+}

package/dist/clientAuthentication.d.ts

@@ -0,0 +1,109 @@
+/**
+ * How a destination's client authenticates to the authorization server — the
+ * consumer's choice, as a strategy (`AuthBrokerConfig.clientAuthentication`).
+ *
+ * The broker ships two factories, each failing closed: one answers the
+ * certificate the key store holds, one the secret. Neither falls back to the
+ * other; a consumer that wants a fallback composes it, and its order is the
+ * consumer's statement. Whatever a strategy throws, the broker turns into a
+ * `DestinationConfigError` in fixed words (`resolveClientAuthentication`) —
+ * nothing of the thrown value, no `cause`.
+ */
+import type { IClientAuthentication } from '@mcp-abap-adt/interfaces-auth';
+import type { IClientCertificate } from '@mcp-abap-adt/interfaces-auth-broker';
+import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
+/**
+ * Every grant whose client authenticates to the authorization server: the
+ * three UAA grants, the OIDC grants and `saml2_bearer`. (`saml2_pure` and the
+ * basic, SNC and handed-over rows authenticate no client and never call the
+ * strategy.)
+ */
+export type ClientAuthenticationGrant = 'client_credentials' | 'authorization_code' | 'passcode' | 'oidc_authorization_code' | 'device_code' | 'password' | 'token_exchange' | 'saml2_bearer';
+/** What a strategy is given, once per build of a destination's provider. */
+export interface ClientAuthenticationContext {
+    readonly destination: string;
+    readonly grant: ClientAuthenticationGrant;
+    /**
+     * The secret client the key store's `getAuthorizationConfig` answered —
+     * `uaaUrl`, `uaaClientId`, `uaaClientSecret` only, never a refresh token —
+     * or null.
+     */
+    readonly client: IAuthorizationConfig | null;
+    /**
+     * The key store's certificate client, read only when called and at most
+     * once per build; `null` when the store has none or implements no
+     * `getClientCertificate`.
+     */
+    readCertificate(): Promise<IClientCertificate | null>;
+}
+/** The strategy `AuthBrokerConfig.clientAuthentication` takes. */
+export type ClientAuthenticationStrategy = (context: ClientAuthenticationContext) => Promise<IClientAuthentication>;
+/**
+ * `tls_client_auth` with the certificate and key the key store holds, against
+ * `${certUrl}/oauth/token`. The material is handed over as given and checked
+ * before the factory answers — auth-providers checks it only on first use, so
+ * a malformed, incomplete or expired PEM would otherwise surface only at the
+ * first token request, in a provider already built and cached.
+ *
+ * Throws "the destination has no client certificate" when the store answers
+ * `null` or implements no `getClientCertificate`.
+ */
+export declare function fromServiceKeyCertificate(): ClientAuthenticationStrategy;
+/** How `fromServiceKeySecret` writes the client id and secret. */
+export interface FromServiceKeySecretOptions {
+    /**
+     * `'raw'`: `base64(id:secret)` as given — XSUAA accepts only this
+     * (measured). `'form'`: each component form-encoded first (RFC 6749
+     * §2.3.1) — UAA, Keycloak. Required: it depends on the server.
+     */
+    readonly encoding: 'raw' | 'form';
+}
+/**
+ * `client_secret_basic` with the secret client the key store holds.
+ *
+ * Throws "the destination has no client secret" when the store answers no
+ * secret client, or one with an empty secret. A missing or unknown `encoding`
+ * is refused when the factory is made.
+ */
+export declare function fromServiceKeySecret(options: FromServiceKeySecretOptions): ClientAuthenticationStrategy;
+/**
+ * What a strategy is told of the secret client: an allowlist — who it is
+ * (`uaaUrl`, `uaaClientId`) and its secret (`uaaClientSecret`, which
+ * `fromServiceKeySecret` sends) — never a refresh token or any other field a
+ * store's `getAuthorizationConfig` carried, which no binding has checked.
+ */
+export declare function contextClient(client: IAuthorizationConfig | null): IAuthorizationConfig | null;
+/**
+ * The context for one build: the client through `contextClient`;
+ * `readCertificate` lazy and memoised — the first call reads, every later one
+ * gets the same answer.
+ */
+export declare function clientAuthenticationContext(destination: string, grant: ClientAuthenticationGrant, client: IAuthorizationConfig | null, read: () => Promise<IClientCertificate | null>): ClientAuthenticationContext;
+/**
+ * Runs the strategy inside the guard. Any throw — the strategy's own, a
+ * store's, a malformed PEM — and any answer that is no client authentication
+ * becomes a `DestinationConfigError` naming `clientAuthentication`, in fixed
+ * words: no `cause`, nothing of the thrown value.
+ */
+export declare function resolveClientAuthentication(strategy: ClientAuthenticationStrategy, context: ClientAuthenticationContext): Promise<IClientAuthentication>;
+/**
+ * Who the client is — its authorization server and client id — and nothing
+ * else: no secret field, so it can never be taken for a (public) secret
+ * client, and never PEM.
+ */
+export interface ClientIdentity {
+    readonly uaaUrl: string;
+    readonly uaaClientId: string;
+}
+/**
+ * The client identity a strategy-authenticated row and its binding take: the
+ * secret client's `uaaUrl` and `uaaClientId` when the key store has one, else
+ * the certificate client's `uaaUrl` and `clientId` — read through the
+ * context's memoised `readCertificate`, so at most once per build — else
+ * `null`. The secret stays behind: beside a strategy a row passes none.
+ *
+ * A failing read is a `DestinationConfigError` naming `clientAuthentication`
+ * in fixed words — nothing of what the store threw, no `cause`.
+ */
+export declare function clientIdentity(context: ClientAuthenticationContext): Promise<ClientIdentity | null>;
+//# sourceMappingURL=clientAuthentication.d.ts.map

package/dist/clientAuthentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientAuthentication.d.ts","sourceRoot":"","sources":["../src/clientAuthentication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAG9E;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GACjC,oBAAoB,GACpB,oBAAoB,GACpB,UAAU,GACV,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,GAChB,cAAc,CAAC;AAEnB,4EAA4E;AAC5E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC7C;;;;OAIG;IACH,eAAe,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CACvD;AAED,kEAAkE;AAClE,MAAM,MAAM,4BAA4B,GAAG,CACzC,OAAO,EAAE,2BAA2B,KACjC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAsBpC;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,IAAI,4BAA4B,CAgBxE;AAED,kEAAkE;AAClE,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,MAAM,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,4BAA4B,CAc9B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,oBAAoB,GAAG,IAAI,CAO7B;AAmBD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,yBAAyB,EAChC,MAAM,EAAE,oBAAoB,GAAG,IAAI,EACnC,IAAI,EAAE,MAAM,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAC7C,2BAA2B,CAW7B;AAiCD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,4BAA4B,EACtC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAyBhC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAiBhC"}

package/dist/clientAuthentication.js

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * How a destination's client authenticates to the authorization server — the
+ * consumer's choice, as a strategy (`AuthBrokerConfig.clientAuthentication`).
+ *
+ * The broker ships two factories, each failing closed: one answers the
+ * certificate the key store holds, one the secret. Neither falls back to the
+ * other; a consumer that wants a fallback composes it, and its order is the
+ * consumer's statement. Whatever a strategy throws, the broker turns into a
+ * `DestinationConfigError` in fixed words (`resolveClientAuthentication`) —
+ * nothing of the thrown value, no `cause`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fromServiceKeyCertificate = fromServiceKeyCertificate;
+exports.fromServiceKeySecret = fromServiceKeySecret;
+exports.contextClient = contextClient;
+exports.clientAuthenticationContext = clientAuthenticationContext;
+exports.resolveClientAuthentication = resolveClientAuthentication;
+exports.clientIdentity = clientIdentity;
+const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
+const DestinationConfigError_1 = require("./DestinationConfigError");
+const NO_CERTIFICATE = 'the destination has no client certificate';
+const NO_SECRET = 'the destination has no client secret';
+/**
+ * A shipped factory's refusal. Module-private, so nothing outside this file
+ * can make one — but a consumer composing a factory can catch and alter it,
+ * so the guard reads only `missing` and picks the words itself.
+ */
+class ClientUnavailableError extends Error {
+    missing;
+    constructor(missing) {
+        super(missing === 'certificate' ? NO_CERTIFICATE : NO_SECRET);
+        this.missing = missing;
+        this.name = 'ClientUnavailableError';
+    }
+}
+/** The broker's words for auth-providers' CertificateMaterialError, by its flags. */
+const CERTIFICATE_INCOMPLETE = 'the client certificate is incomplete';
+const CERTIFICATE_EXPIRED = 'the client certificate has expired';
+const CERTIFICATE_UNUSABLE = 'the client certificate could not be used';
+/**
+ * `tls_client_auth` with the certificate and key the key store holds, against
+ * `${certUrl}/oauth/token`. The material is handed over as given and checked
+ * before the factory answers — auth-providers checks it only on first use, so
+ * a malformed, incomplete or expired PEM would otherwise surface only at the
+ * first token request, in a provider already built and cached.
+ *
+ * Throws "the destination has no client certificate" when the store answers
+ * `null` or implements no `getClientCertificate`.
+ */
+function fromServiceKeyCertificate() {
+    return async (context) => {
+        const certificate = await context.readCertificate();
+        if (!certificate) {
+            throw new ClientUnavailableError('certificate');
+        }
+        const authentication = (0, auth_providers_1.tlsClientCertificate)({
+            material: { cert: certificate.certificate, key: certificate.key },
+            endpoint: `${certificate.certUrl.replace(/\/+$/, '')}/oauth/token`,
+        });
+        if (typeof authentication.tlsMaterial !== 'function') {
+            throw new ClientUnavailableError('certificate');
+        }
+        await authentication.tlsMaterial();
+        return authentication;
+    };
+}
+/**
+ * `client_secret_basic` with the secret client the key store holds.
+ *
+ * Throws "the destination has no client secret" when the store answers no
+ * secret client, or one with an empty secret. A missing or unknown `encoding`
+ * is refused when the factory is made.
+ */
+function fromServiceKeySecret(options) {
+    const encoding = options?.encoding;
+    if (encoding !== 'raw' && encoding !== 'form') {
+        throw new TypeError("fromServiceKeySecret: encoding must be 'raw' or 'form'");
+    }
+    return async (context) => {
+        const secret = context.client?.uaaClientSecret;
+        if (typeof secret !== 'string' || secret.length === 0) {
+            throw new ClientUnavailableError('secret');
+        }
+        return (0, auth_providers_1.clientSecretBasic)(secret, { encoding });
+    };
+}
+/**
+ * What a strategy is told of the secret client: an allowlist — who it is
+ * (`uaaUrl`, `uaaClientId`) and its secret (`uaaClientSecret`, which
+ * `fromServiceKeySecret` sends) — never a refresh token or any other field a
+ * store's `getAuthorizationConfig` carried, which no binding has checked.
+ */
+function contextClient(client) {
+    if (!client)
+        return null;
+    return {
+        uaaUrl: client.uaaUrl,
+        uaaClientId: client.uaaClientId,
+        uaaClientSecret: client.uaaClientSecret,
+    };
+}
+/**
+ * The certificate client as the contract declares it — `uaaUrl`, `clientId`,
+ * `certificate`, `key`, `certUrl` — and nothing else a store answered with it.
+ */
+function certificateOf(answer) {
+    if (!answer)
+        return null;
+    return {
+        uaaUrl: answer.uaaUrl,
+        clientId: answer.clientId,
+        certificate: answer.certificate,
+        key: answer.key,
+        certUrl: answer.certUrl,
+    };
+}
+/**
+ * The context for one build: the client through `contextClient`;
+ * `readCertificate` lazy and memoised — the first call reads, every later one
+ * gets the same answer.
+ */
+function clientAuthenticationContext(destination, grant, client, read) {
+    let certificate;
+    return {
+        destination,
+        grant,
+        client: contextClient(client),
+        readCertificate: () => {
+            certificate ??= read().then(certificateOf);
+            return certificate;
+        },
+    };
+}
+const FAILED = 'the clientAuthentication strategy failed';
+const REFUSED = 'the clientAuthentication strategy refused';
+/**
+ * The fixed words for what a strategy threw. Every word is this module's own:
+ * the thrown value only selects among them, through `instanceof` and flags
+ * compared with `===` — never a message, never its `words`. Classifying may
+ * itself throw (a Proxy, a getter), so it runs in its own try and falls back
+ * to the generic words.
+ */
+function refusalWords(error) {
+    try {
+        if (error instanceof ClientUnavailableError) {
+            const missing = error.missing;
+            if (missing === 'certificate')
+                return `${REFUSED}: ${NO_CERTIFICATE}`;
+            if (missing === 'secret')
+                return `${REFUSED}: ${NO_SECRET}`;
+            return FAILED;
+        }
+        if (error instanceof auth_providers_1.CertificateMaterialError) {
+            if (error.incomplete === true) {
+                return `${REFUSED}: ${CERTIFICATE_INCOMPLETE}`;
+            }
+            if (error.expired === true)
+                return `${REFUSED}: ${CERTIFICATE_EXPIRED}`;
+            return `${REFUSED}: ${CERTIFICATE_UNUSABLE}`;
+        }
+    }
+    catch {
+        // Fall through: the thrown value could not even be classified.
+    }
+    return FAILED;
+}
+/**
+ * Runs the strategy inside the guard. Any throw — the strategy's own, a
+ * store's, a malformed PEM — and any answer that is no client authentication
+ * becomes a `DestinationConfigError` naming `clientAuthentication`, in fixed
+ * words: no `cause`, nothing of the thrown value.
+ */
+async function resolveClientAuthentication(strategy, context) {
+    let answer;
+    let usable;
+    try {
+        answer = await strategy(context);
+        // Read inside the guard: a getter on the answer may throw too.
+        usable =
+            typeof answer === 'object' &&
+                answer !== null &&
+                typeof answer.authenticate === 'function';
+    }
+    catch (error) {
+        throw new DestinationConfigError_1.DestinationConfigError(context.destination, ['clientAuthentication'], refusalWords(error));
+    }
+    if (!usable) {
+        throw new DestinationConfigError_1.DestinationConfigError(context.destination, ['clientAuthentication'], 'the clientAuthentication strategy answered no client authentication');
+    }
+    return answer;
+}
+/**
+ * The client identity a strategy-authenticated row and its binding take: the
+ * secret client's `uaaUrl` and `uaaClientId` when the key store has one, else
+ * the certificate client's `uaaUrl` and `clientId` — read through the
+ * context's memoised `readCertificate`, so at most once per build — else
+ * `null`. The secret stays behind: beside a strategy a row passes none.
+ *
+ * A failing read is a `DestinationConfigError` naming `clientAuthentication`
+ * in fixed words — nothing of what the store threw, no `cause`.
+ */
+async function clientIdentity(context) {
+    const client = context.client;
+    if (client) {
+        return { uaaUrl: client.uaaUrl, uaaClientId: client.uaaClientId };
+    }
+    let certificate;
+    try {
+        certificate = await context.readCertificate();
+    }
+    catch {
+        throw new DestinationConfigError_1.DestinationConfigError(context.destination, ['clientAuthentication'], 'the client certificate could not be read');
+    }
+    if (!certificate)
+        return null;
+    return { uaaUrl: certificate.uaaUrl, uaaClientId: certificate.clientId };
+}

package/dist/destinations.d.ts

@@ -0,0 +1,164 @@
+/**
+ * What a destination states, and the provider it states.
+ *
+ * Two fields choose the provider — `authType` and, for `jwt` and `saml`,
+ * `grantType` — and nothing else: no field's presence or absence is ever
+ * read to pick a row. Both come from the key store's means.
+ */
+import { type IDeviceCodePresenter, type OidcCallbackResult } from '@mcp-abap-adt/auth-providers';
+import type { IAssertionReplayStore, IAuthorizationStrategy, IAuthProvider, IClientAuthentication, ITokenResult } from '@mcp-abap-adt/interfaces-auth';
+import type { DestinationGrant, IConfig, IConnectionConfig } from '@mcp-abap-adt/interfaces-auth-broker';
+import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
+import { type Binding } from './binding';
+import type { ClientIdentity } from './clientAuthentication';
+type StatedAuthType = NonNullable<IConnectionConfig['authType']>;
+/** The stated `authType`, or the error naming it. */
+export declare function statedAuthType(destination: string, means: IConnectionConfig | null): StatedAuthType;
+/** The stated grant of a `jwt` or `saml` destination, or the error naming it. */
+export declare function statedGrant(destination: string, authType: 'jwt' | 'saml', means: IConnectionConfig): DestinationGrant;
+/**
+ * A row's client: the key store's secret client, or — on the strategy path
+ * without one — the certificate client's identity, which carries no secret
+ * field at all, so it can never pass for a (public) secret client.
+ */
+export type RowClient = IAuthorizationConfig | ClientIdentity;
+/** `basic` → `BasicAuthProvider(username, password)`, from the means alone. */
+export declare function basicProvider(destination: string, means: IConnectionConfig): IAuthProvider;
+/**
+ * `snc` → the Secure Login Client recipe, from the four SNC fields. Only the
+ * partner name is required: the contract says the library is discovered when
+ * `sncLib` is absent and the user's name taken from the credential when
+ * `sncMyName` is, and the provider documents its own `qop` default.
+ */
+export declare function sncProvider(destination: string, means: IConnectionConfig, logger: ILogger): IAuthProvider;
+/**
+ * `none` → the credential handed over, from the session: the only way in, so
+ * required. Read from the secret alone — the means are not a seed.
+ *
+ * The broker did not obtain it and cannot obtain it again, so a binding that
+ * does not match is refused, never discarded: `issuedFor`
+ * must always equal the destination's resource — it is what stops the
+ * credential going to another one; `issuedBy` is compared only when the means
+ * state an issuer.
+ */
+export declare function handedOverProvider(destination: string, authType: 'jwt' | 'saml', secret: IConfig | null, binding: Binding): IAuthProvider;
+/** The UAA grants: one client, one token endpoint (`<uaaUrl>/oauth/token`). */
+export type UaaGrant = 'authorization_code' | 'client_credentials' | 'passcode';
+export declare function isUaaGrant(grant: DestinationGrant): grant is UaaGrant;
+/** What a UAA row is built from. */
+export interface UaaRow {
+    destination: string;
+    grant: UaaGrant;
+    /**
+     * The client: the key store's `getAuthorizationConfig` — or, with a
+     * strategy and no secret client, the certificate client's identity.
+     */
+    client: RowClient | null;
+    /** The session secret — the seed; `null` when there is no session. */
+    secret: IConfig | null;
+    /**
+     * The consumer strategy's answer. Given, the provider authenticates its
+     * client with it and gets no `clientSecret`; absent, 4.0.0's secret.
+     */
+    clientAuthentication?: IClientAuthentication;
+    /** The consumer's `authorization` option. */
+    authorization: ((destination: string, grant: 'authorization_code' | 'passcode') => IAuthorizationStrategy<string>) | undefined;
+    logger: ILogger;
+    onTokens: (result: ITokenResult) => Promise<void>;
+}
+/**
+ * `jwt` / `authorization_code` → `AuthorizationCodeProvider`,
+ * `client_credentials` → `ClientCredentialsProvider`, `passcode` →
+ * `UaaPasscodeProvider`: the client from the key store, the seed from the
+ * session (not for `client_credentials`, whose row takes the client alone).
+ *
+ * Every field and option the row lacks is named in one error, before the
+ * consumer's `authorization` is called. `serviceUrl` is not among them: the
+ * providers read the client and `uaaUrl` only. Without a strategy,
+ * `uaaClientSecret: ''` is a public client: `passcode` takes it as no secret;
+ * the other two rows' providers require a secret, so for them `''` is
+ * missing. On the strategy path the client may be a certificate client's
+ * identity, which holds no secret field at all (`RowClient`).
+ *
+ * With the strategy's answer (`clientAuthentication`) no secret is required
+ * and none is passed: the provider authenticates its client with the answer.
+ */
+export declare function uaaProvider(row: UaaRow): IAuthProvider;
+/** The OIDC grants: a client, and an issuer or explicit endpoints. */
+export type OidcGrant = 'oidc_authorization_code' | 'device_code' | 'password' | 'token_exchange';
+export declare function isOidcGrant(grant: DestinationGrant): grant is OidcGrant;
+/** What an OIDC row is built from. */
+export interface OidcRow {
+    destination: string;
+    grant: OidcGrant;
+    means: IConnectionConfig;
+    /** The client, from the key store's `getAuthorizationConfig`. */
+    client: RowClient | null;
+    /** The session secret — the seed; `null` when there is none, or it is not bound here. */
+    secret: IConfig | null;
+    /** The consumer strategy's answer: given, it replaces the secret. */
+    clientAuthentication?: IClientAuthentication;
+    oidcAuthorization: ((destination: string) => IAuthorizationStrategy<OidcCallbackResult>) | undefined;
+    deviceCodePresenter: ((destination: string) => IDeviceCodePresenter) | undefined;
+    logger: ILogger;
+    onTokens: (result: ITokenResult) => Promise<void>;
+}
+/**
+ * `jwt` / `oidc_authorization_code` → `OidcBrowserProvider`, `device_code` →
+ * `OidcDeviceFlowProvider`, `password` → `OidcPasswordProvider`,
+ * `token_exchange` → `OidcTokenExchangeProvider`: the client id (and secret,
+ * `''` being a public client) from the key store's client, the grant's data
+ * from its `oidc*` fields, the seed from the session.
+ *
+ * The endpoints: `oidcIssuerUrl`, from which the provider discovers them, or
+ * every explicit endpoint the row uses — without either the error names the
+ * issuer and the endpoints missing. Every field and option the row lacks is
+ * named in one error, before any collaborator is called. `token_exchange`
+ * takes one scope string: the stored scopes joined by a space.
+ */
+export declare function oidcProvider(row: OidcRow): IAuthProvider;
+/** The SAML grants: an identity provider's assertion, validated first. */
+export type SamlGrant = 'saml2_pure' | 'saml2_bearer';
+export declare function isSamlGrant(grant: DestinationGrant): grant is SamlGrant;
+/** What a SAML row is built from. */
+export interface SamlRow {
+    destination: string;
+    grant: SamlGrant;
+    means: IConnectionConfig;
+    /** `saml2_bearer`'s client, from the key store; `null` for `saml2_pure`. */
+    client: RowClient | null;
+    /** The session secret — the seed; `null` when there is none, or it is not bound here. */
+    secret: IConfig | null;
+    /** `saml2_bearer`: the consumer strategy's answer; given, it replaces the secret. */
+    clientAuthentication?: IClientAuthentication;
+    authorization: ((destination: string, grant: SamlGrant) => IAuthorizationStrategy<string>) | undefined;
+    samlCookies: ((destination: string) => (samlResponse: string) => Promise<string>) | undefined;
+    assertionReplayStore: ((destination: string) => IAssertionReplayStore) | undefined;
+    logger: ILogger;
+    onTokens: (result: ITokenResult) => Promise<void>;
+}
+/**
+ * `saml` / `saml2_pure` → `Saml2PureProvider`, `saml2_bearer` →
+ * `Saml2BearerProvider`, each validating the assertion before anything uses
+ * it, with the validator the broker composes from the destination's trust and
+ * the consumer's replay store: `createSignedResponseValidator` for
+ * `saml2_pure` — the Response signed, as the cookies' system receives it whole
+ * — and `createSignedAssertionValidator` for `saml2_bearer`, whose token
+ * endpoint gets the Assertion alone (auth-providers' own pairing). The
+ * expected issuer is `samlIdpEntityId`.
+ *
+ * `saml2_pure` is seeded with the stored cookies and `expiresAt`;
+ * `saml2_bearer` with the stored token, its refresh token and expiry, and
+ * takes the client (`uaaUrl`, `uaaClientId`; without a strategy,
+ * `uaaClientSecret` `''` a public client; on the strategy path the identity
+ * alone, no secret) and `samlTokenUrl` when stated.
+ *
+ * Every field and option the row lacks is named in one error, before any
+ * collaborator is called; so is a `samlClockSkewMs` that is not a whole number
+ * of milliseconds, and a certificate the validator cannot read — by name, never
+ * the value.
+ */
+export declare function samlProvider(row: SamlRow): IAuthProvider;
+export {};
+//# sourceMappingURL=destinations.d.ts.map

package/dist/destinations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destinations.d.ts","sourceRoot":"","sources":["../src/destinations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAML,KAAK,oBAAoB,EAEzB,KAAK,kBAAkB,EAWxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,qBAAqB,EAErB,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACb,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,gBAAgB,EAChB,OAAO,EACP,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,KAAK,OAAO,EAA4B,MAAM,WAAW,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,KAAK,cAAc,GAAG,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAwBjE,qDAAqD;AACrD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAC9B,cAAc,CAmBhB;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,iBAAiB,GACvB,gBAAgB,CAiBlB;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG,cAAc,CAAC;AAwD9D,+EAA+E;AAC/E,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GACvB,aAAa,CAaf;AAUD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,OAAO,GACd,aAAa,CA0Bf;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,MAAM,EAAE,OAAO,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,aAAa,CA2Bf;AAED,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,UAAU,CAAC;AAEhF,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,QAAQ,CAMrE;AAED,oCAAoC;AACpC,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,sEAAsE;IACtE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,6CAA6C;IAC7C,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,GAAG,UAAU,KACrC,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAqEtD;AAyBD,sEAAsE;AACtE,MAAM,MAAM,SAAS,GACjB,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,CAAC;AAErB,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAOvE;AAeD,sCAAsC;AACtC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,iEAAiE;IACjE,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,iBAAiB,EACb,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,GACrE,SAAS,CAAC;IACd,mBAAmB,EACf,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,oBAAoB,CAAC,GAC/C,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAyFxD;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAEtD,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAEvE;AAED,qCAAqC;AACrC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,4EAA4E;IAC5E,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,KACb,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,WAAW,EACP,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GACpE,SAAS,CAAC;IACd,oBAAoB,EAChB,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,qBAAqB,CAAC,GAChD,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAqGxD"}