@mcp-abap-adt/auth-providers 2.2.2 → 4.0.0

package/dist/__tests__/integration/stand/formLogin.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Plays the user in an interactive login against a stand server's own login
+ * page: follows redirects, keeps cookies, finds the form with a password
+ * field, fills it in with every hidden field it carries (UAA's CSRF token,
+ * Keycloak's session code), and submits it.
+ *
+ * Deliberately small: enough for UAA's and Keycloak's stock login pages, which
+ * the pinned image versions keep stable. It is a test helper, not a browser.
+ */
+export interface Credentials {
+    username: string;
+    password: string;
+}
+export declare class FormBrowser {
+    private readonly cookies;
+    /** GET `url` and follow redirects until `stop(url)` or a page is served. */
+    open(url: string, stop?: (next: string) => boolean): Promise<{
+        url: string;
+        html?: string;
+    }>;
+    /**
+     * Submit the login form on `page`, then follow redirects until `stop` says
+     * the next location is the one the caller wants — typically the client's
+     * redirect URI carrying the code — without requesting it.
+     */
+    submitLogin(page: {
+        url: string;
+        html?: string;
+    }, credentials: Credentials, stop?: (next: string) => boolean): Promise<{
+        url: string;
+        html?: string;
+    }>;
+    /**
+     * Accept a consent page ("Do you grant these access privileges?"): submit
+     * the form that carries an `accept` button, with its hidden fields.
+     */
+    acceptConsent(page: {
+        url: string;
+        html?: string;
+    }): Promise<{
+        url: string;
+        html?: string;
+    }>;
+    private follow;
+    private remember;
+    private cookieHeader;
+}
+/**
+ * Log in through the authorization URL and return the redirect URI the server
+ * sends the browser back to, with its `code` — not requested, since nothing
+ * listens there.
+ */
+export declare function authorizeByForm(authorizationUrl: string, redirectUri: string, credentials: Credentials): Promise<URL>;
+/**
+ * Approve a device authorization the way a user would: open the verification
+ * URI (with the user code already in it), log in, and grant access.
+ */
+export declare function approveDevice(verificationUriComplete: string, credentials: Credentials): Promise<void>;
+/**
+ * A SAML login at an identity provider: open the AuthnRequest URL, log in,
+ * and take the SAMLResponse from the auto-posting form the IdP answers with —
+ * what a browser would post to the assertion consumer service.
+ */
+export declare function samlResponseByForm(authnRequestUrl: string, credentials: Credentials): Promise<{
+    samlResponse: string;
+    acsUrl: string;
+}>;
+//# sourceMappingURL=formLogin.d.ts.map

package/dist/__tests__/integration/stand/formLogin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formLogin.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/integration/stand/formLogin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAErD,4EAA4E;IACtE,IAAI,CACR,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAqB,GAC5C,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAI1C;;;;OAIG;IACG,WAAW,CACf,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACpC,WAAW,EAAE,WAAW,EACxB,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAqB,GAC5C,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB1C;;;OAGG;IACG,aAAa,CAAC,IAAI,EAAE;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YAgC7B,MAAM;IA4BpB,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,YAAY;CAGrB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAcd;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,uBAAuB,EAAE,MAAM,EAC/B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnD"}

package/dist/__tests__/integration/stand/formLogin.js

@@ -0,0 +1,194 @@
+"use strict";
+/**
+ * Plays the user in an interactive login against a stand server's own login
+ * page: follows redirects, keeps cookies, finds the form with a password
+ * field, fills it in with every hidden field it carries (UAA's CSRF token,
+ * Keycloak's session code), and submits it.
+ *
+ * Deliberately small: enough for UAA's and Keycloak's stock login pages, which
+ * the pinned image versions keep stable. It is a test helper, not a browser.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FormBrowser = void 0;
+exports.authorizeByForm = authorizeByForm;
+exports.approveDevice = approveDevice;
+exports.samlResponseByForm = samlResponseByForm;
+const MAX_HOPS = 20;
+class FormBrowser {
+    cookies = new Map();
+    /** GET `url` and follow redirects until `stop(url)` or a page is served. */
+    async open(url, stop = () => false) {
+        return this.follow(url, { method: 'GET' }, stop);
+    }
+    /**
+     * Submit the login form on `page`, then follow redirects until `stop` says
+     * the next location is the one the caller wants — typically the client's
+     * redirect URI carrying the code — without requesting it.
+     */
+    async submitLogin(page, credentials, stop = () => false) {
+        const form = findPasswordForm(page.html ?? '');
+        if (!form) {
+            throw new Error(`no login form on ${page.url}`);
+        }
+        const body = new URLSearchParams(form.hidden);
+        body.set(form.userField, credentials.username);
+        body.set(form.passwordField, credentials.password);
+        return this.follow(new URL(form.action, page.url).toString(), {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        }, stop);
+    }
+    /**
+     * Accept a consent page ("Do you grant these access privileges?"): submit
+     * the form that carries an `accept` button, with its hidden fields.
+     */
+    async acceptConsent(page) {
+        for (const match of (page.html ?? '').matchAll(/<form\b[^>]*>[\s\S]*?<\/form>/gi)) {
+            const formHtml = match[0];
+            const inputs = [...formHtml.matchAll(/<(?:input|button)\b[^>]*>/gi)].map((m) => m[0]);
+            const accept = inputs.find((i) => attribute(i, 'name') === 'accept');
+            if (!accept)
+                continue;
+            const body = new URLSearchParams();
+            for (const input of inputs) {
+                const name = attribute(input, 'name');
+                if (name && attribute(input, 'type') === 'hidden') {
+                    body.set(name, attribute(input, 'value') ?? '');
+                }
+            }
+            body.set('accept', attribute(accept, 'value') ?? 'Yes');
+            const formTag = /<form\b[^>]*>/i.exec(formHtml)?.[0] ?? '';
+            return this.follow(new URL(attribute(formTag, 'action') ?? '', page.url).toString(), {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: body.toString(),
+            }, () => false);
+        }
+        throw new Error(`no consent form on ${page.url}`);
+    }
+    async follow(url, init, stop) {
+        let current = url;
+        let request = init;
+        for (let hop = 0; hop < MAX_HOPS; hop++) {
+            const response = await fetch(current, {
+                ...request,
+                redirect: 'manual',
+                headers: { ...(request.headers ?? {}), Cookie: this.cookieHeader() },
+                signal: AbortSignal.timeout(15_000),
+            });
+            this.remember(response);
+            const location = response.headers.get('location');
+            if (response.status >= 300 && response.status < 400 && location) {
+                const next = new URL(location, current).toString();
+                if (stop(next))
+                    return { url: next };
+                current = next;
+                request = { method: 'GET' };
+                continue;
+            }
+            return { url: current, html: await response.text() };
+        }
+        throw new Error(`more than ${MAX_HOPS} redirects from ${url}`);
+    }
+    remember(response) {
+        for (const line of response.headers.getSetCookie()) {
+            const [pair] = line.split(';');
+            const eq = pair.indexOf('=');
+            if (eq > 0) {
+                this.cookies.set(pair.slice(0, eq).trim(), pair.slice(eq + 1).trim());
+            }
+        }
+    }
+    cookieHeader() {
+        return [...this.cookies].map(([k, v]) => `${k}=${v}`).join('; ');
+    }
+}
+exports.FormBrowser = FormBrowser;
+/**
+ * Log in through the authorization URL and return the redirect URI the server
+ * sends the browser back to, with its `code` — not requested, since nothing
+ * listens there.
+ */
+async function authorizeByForm(authorizationUrl, redirectUri, credentials) {
+    const reached = (next) => next.startsWith(redirectUri);
+    const browser = new FormBrowser();
+    const page = await browser.open(authorizationUrl, reached);
+    const done = page.html === undefined
+        ? page
+        : await browser.submitLogin(page, credentials, reached);
+    if (!reached(done.url)) {
+        throw new Error(`login did not return to ${redirectUri}; ended at ${done.url}`);
+    }
+    return new URL(done.url);
+}
+/**
+ * Approve a device authorization the way a user would: open the verification
+ * URI (with the user code already in it), log in, and grant access.
+ */
+async function approveDevice(verificationUriComplete, credentials) {
+    const browser = new FormBrowser();
+    const page = await browser.open(verificationUriComplete);
+    const consent = await browser.submitLogin(page, credentials);
+    await browser.acceptConsent(consent);
+}
+/**
+ * A SAML login at an identity provider: open the AuthnRequest URL, log in,
+ * and take the SAMLResponse from the auto-posting form the IdP answers with —
+ * what a browser would post to the assertion consumer service.
+ */
+async function samlResponseByForm(authnRequestUrl, credentials) {
+    const browser = new FormBrowser();
+    const page = await browser.submitLogin(await browser.open(authnRequestUrl), credentials);
+    const html = page.html ?? '';
+    const input = [...html.matchAll(/<input\b[^>]*>/gi)]
+        .map((m) => m[0])
+        .find((i) => attribute(i, 'name') === 'SAMLResponse');
+    const samlResponse = input ? attribute(input, 'value') : undefined;
+    const formTag = /<form\b[^>]*>/i.exec(html)?.[0] ?? '';
+    if (!samlResponse) {
+        throw new Error(`no SAMLResponse form on ${page.url}`);
+    }
+    return { samlResponse, acsUrl: attribute(formTag, 'action') ?? '' };
+}
+const decode = (value) => value
+    .replace(/&amp;/g, '&')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>');
+const attribute = (tag, name) => {
+    const match = new RegExp(`\\s${name}\\s*=\\s*("([^"]*)"|'([^']*)')`, 'i').exec(tag);
+    return match ? decode(match[2] ?? match[3] ?? '') : undefined;
+};
+function findPasswordForm(html) {
+    for (const match of html.matchAll(/<form\b[^>]*>[\s\S]*?<\/form>/gi)) {
+        const formHtml = match[0];
+        const inputs = [...formHtml.matchAll(/<input\b[^>]*>/gi)].map((m) => m[0]);
+        const password = inputs.find((i) => attribute(i, 'type') === 'password');
+        if (!password)
+            continue;
+        const hidden = {};
+        let userField = 'username';
+        for (const input of inputs) {
+            const type = (attribute(input, 'type') ?? 'text').toLowerCase();
+            const name = attribute(input, 'name');
+            if (!name)
+                continue;
+            if (type === 'hidden')
+                hidden[name] = attribute(input, 'value') ?? '';
+            if ((type === 'text' || type === 'email') &&
+                /user|email|login/i.test(name)) {
+                userField = name;
+            }
+        }
+        const formTag = /<form\b[^>]*>/i.exec(formHtml)?.[0] ?? '';
+        return {
+            action: attribute(formTag, 'action') ?? '',
+            userField,
+            passwordField: attribute(password, 'name') ?? 'password',
+            hidden,
+        };
+    }
+    return undefined;
+}

package/dist/auth/callbackServer.js

@@ -163,8 +163,8 @@ async function runCallbackScope(options, routes, use) {
             setTimeout(() => {
                 if (finished)
                     return;
-                // Grace expired — on Node 18.x `close()` does not end idle connections,
-                // and an active one may simply be stuck. Force it, bounded.
+                // Grace expired — an active connection may simply be stuck. Force it,
+                // bounded.
                 server.closeIdleConnections?.();
                 server.closeAllConnections?.();
                 for (const socket of sockets)

package/dist/auth/passcodeAuth.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The UAA one-time passcode exchange — what `cf login --sso` does.
+ *
+ * The user opens `<uaa>/passcode` in any browser, logs in however the
+ * identity zone lets them (SSO, a corporate IdP, MFA), and copies the
+ * "Temporary Authentication Code" shown there. That code is exchanged here
+ * through the password grant, with `passcode` in place of a username and
+ * password. It is a UAA extension, not an RFC; XSUAA inherits it.
+ *
+ * UAA hands the request to its passcode filter chain only when its Accept
+ * header names JSON (`passcodeTokenMatcher` accepts `application/json` or
+ * `application/x-www-form-urlencoded`). Otherwise it falls through to the
+ * ordinary password grant, which answers `invalid_client: No password
+ * supplied` — what a bare `fetch`, which sends `*\/*`, gets. axios's default
+ * Accept happens to include `application/json`; the header is set explicitly
+ * so the exchange does not depend on an HTTP client's defaults.
+ */
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
+export interface PasscodeTokens {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+}
+export declare function exchangePasscode(uaaUrl: string, clientId: string, clientSecret: string | undefined, passcode: string, logger?: ILogger): Promise<PasscodeTokens>;
+//# sourceMappingURL=passcodeAuth.d.ts.map

package/dist/auth/passcodeAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passcodeAuth.d.ts","sourceRoot":"","sources":["../../src/auth/passcodeAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,cAAc,CAAC,CAiDzB"}

package/dist/auth/passcodeAuth.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * The UAA one-time passcode exchange — what `cf login --sso` does.
+ *
+ * The user opens `<uaa>/passcode` in any browser, logs in however the
+ * identity zone lets them (SSO, a corporate IdP, MFA), and copies the
+ * "Temporary Authentication Code" shown there. That code is exchanged here
+ * through the password grant, with `passcode` in place of a username and
+ * password. It is a UAA extension, not an RFC; XSUAA inherits it.
+ *
+ * UAA hands the request to its passcode filter chain only when its Accept
+ * header names JSON (`passcodeTokenMatcher` accepts `application/json` or
+ * `application/x-www-form-urlencoded`). Otherwise it falls through to the
+ * ordinary password grant, which answers `invalid_client: No password
+ * supplied` — what a bare `fetch`, which sends `*\/*`, gets. axios's default
+ * Accept happens to include `application/json`; the header is set explicitly
+ * so the exchange does not depend on an HTTP client's defaults.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangePasscode = exchangePasscode;
+const axios_1 = __importDefault(require("axios"));
+async function exchangePasscode(uaaUrl, clientId, clientSecret, passcode, logger) {
+    const tokenUrl = `${uaaUrl.replace(/\/+$/, '')}/oauth/token`;
+    const params = new URLSearchParams();
+    params.append('grant_type', 'password');
+    params.append('passcode', passcode);
+    logger?.info('[UAA] Exchanging passcode for token', { tokenUrl });
+    // A public client — `cf` is one — authenticates with an empty secret.
+    const basic = Buffer.from(`${clientId}:${clientSecret ?? ''}`).toString('base64');
+    let response;
+    try {
+        response = await axios_1.default.post(tokenUrl, params.toString(), {
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+                Authorization: `Basic ${basic}`,
+            },
+        });
+    }
+    catch (error) {
+        // UAA says why in the body — "Invalid passcode" for a mistyped or
+        // already spent code — which is what the user needs to read.
+        if (axios_1.default.isAxiosError(error) && error.response) {
+            const body = error.response.data;
+            const reason = body?.error_description ?? body?.error ?? 'no reason given';
+            throw new Error(`Passcode exchange failed (${error.response.status}): ${reason}`);
+        }
+        throw error;
+    }
+    const data = response.data;
+    if (!data?.access_token) {
+        throw new Error('Passcode exchange returned no access_token');
+    }
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresIn: data.expires_in,
+    };
+}

package/dist/auth/saml2Auth.d.ts

@@ -9,7 +9,11 @@ export interface Saml2AuthConfig {
     relayState?: string;
     authorizationUrl?: string;
 }
-export declare function buildSamlAuthorizationUrl(config: Saml2AuthConfig): string;
+export interface BuiltAuthorizationUrl {
+    readonly url: string;
+    /** Present only when this function minted the request. */
+    readonly requestId?: string;
+}
+export declare function buildSamlAuthorizationUrl(config: Saml2AuthConfig): BuiltAuthorizationUrl;
 export declare const withSamlCallbackServer: CallbackServerFactory<string>;
-export declare function parseSamlNotOnOrAfter(samlResponse: string): number | undefined;
 //# sourceMappingURL=saml2Auth.d.ts.map

package/dist/auth/saml2Auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2Auth.d.ts","sourceRoot":"","sources":["../../src/auth/saml2Auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAyBD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAazE;AAED,eAAO,MAAM,sBAAsB,EAAE,qBAAqB,CAAC,MAAM,CAgC9D,CAAC;AAEJ,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAYpB"}
+{"version":3,"file":"saml2Auth.d.ts","sourceRoot":"","sources":["../../src/auth/saml2Auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA4BD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,eAAe,GACtB,qBAAqB,CAkBvB;AAED,eAAO,MAAM,sBAAsB,EAAE,qBAAqB,CAAC,MAAM,CAgC9D,CAAC"}

package/dist/auth/saml2Auth.js

@@ -8,7 +8,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.withSamlCallbackServer = void 0;
 exports.buildSamlAuthorizationUrl = buildSamlAuthorizationUrl;
-exports.parseSamlNotOnOrAfter = parseSamlNotOnOrAfter;
 const node_crypto_1 = require("node:crypto");
 const node_zlib_1 = require("node:zlib");
 const express_1 = __importDefault(require("express"));
@@ -18,9 +17,8 @@ function base64Encode(input) {
         ? input.toString('base64')
         : Buffer.from(input, 'utf8').toString('base64');
 }
-function buildAuthnRequestXml(spEntityId, acsUrl) {
+function buildAuthnRequestXml(id, spEntityId, acsUrl) {
     const issueInstant = new Date().toISOString();
-    const id = `_${(0, node_crypto_1.randomUUID)()}`;
     return [
         '<?xml version="1.0" encoding="UTF-8"?>',
         '<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"',
@@ -36,15 +34,20 @@ function buildAuthnRequestXml(spEntityId, acsUrl) {
 }
 function buildSamlAuthorizationUrl(config) {
     if (config.authorizationUrl) {
-        return config.authorizationUrl;
+        // Somebody else built the request; its ID is not ours to know.
+        return { url: config.authorizationUrl };
     }
-    const xml = buildAuthnRequestXml(config.spEntityId, config.acsUrl);
+    const requestId = `_${(0, node_crypto_1.randomUUID)()}`;
+    const xml = buildAuthnRequestXml(requestId, config.spEntityId, config.acsUrl);
     const deflated = (0, node_zlib_1.deflateRawSync)(Buffer.from(xml, 'utf8'));
     const samlRequest = encodeURIComponent(base64Encode(deflated));
     const relayState = config.relayState
         ? `&RelayState=${encodeURIComponent(config.relayState)}`
         : '';
-    return `${config.idpSsoUrl}?SAMLRequest=${samlRequest}${relayState}`;
+    return {
+        url: `${config.idpSsoUrl}?SAMLRequest=${samlRequest}${relayState}`,
+        requestId,
+    };
 }
 const withSamlCallbackServer = (options, use) => (0, callbackServer_1.runCallbackScope)(options, (app, settle) => {
     app.use(express_1.default.urlencoded({ extended: false, limit: '5mb' }));
@@ -69,17 +72,3 @@ const withSamlCallbackServer = (options, use) => (0, callbackServer_1.runCallbac
     });
 }, use);
 exports.withSamlCallbackServer = withSamlCallbackServer;
-function parseSamlNotOnOrAfter(samlResponse) {
-    try {
-        const decoded = Buffer.from(samlResponse, 'base64').toString('utf8');
-        const match = decoded.match(/NotOnOrAfter="([^"]+)"/);
-        if (!match) {
-            return undefined;
-        }
-        const date = Date.parse(match[1]);
-        return Number.isNaN(date) ? undefined : date;
-    }
-    catch {
-        return undefined;
-    }
-}

package/dist/auth/samlBearerAssertion.d.ts

@@ -0,0 +1,24 @@
+/**
+ * What the SAML 2.0 bearer grant accepts, from what a SAML login delivers.
+ *
+ * RFC 7522 §2.1: the `assertion` parameter is a single SAML 2.0 Assertion,
+ * base64url-encoded. An interactive login delivers something else — the
+ * identity provider's whole `samlp:Response`, in standard base64 — and a
+ * token endpoint that follows the RFC refuses it: Cloud Foundry UAA answers
+ * 401 to a Response in either encoding. So the Assertion is taken out of the
+ * Response here and re-encoded.
+ *
+ * The Assertion is serialised as an element of its own, and every namespace
+ * declaration it inherited from the Response is copied onto it first. A
+ * serializer would add back only the prefixes used in element and attribute
+ * names; a prefix used only inside a value — `xsi:type="xs:string"` — would be
+ * lost, leaving a QName that no longer resolves. Copying all of them keeps the
+ * Assertion's in-scope namespaces exactly what they were. Its signature, over
+ * exclusive canonical XML, still verifies: canonicalisation renders a
+ * namespace where it is used, or where the signature's InclusiveNamespaces
+ * names it, not where it was declared. A signature over the Response alone does not
+ * survive the cut; the token endpoint then refuses the Assertion, as it
+ * would any unsigned one.
+ */
+export declare function toBearerAssertion(payload: string): string;
+//# sourceMappingURL=samlBearerAssertion.d.ts.map

package/dist/auth/samlBearerAssertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"samlBearerAssertion.d.ts","sourceRoot":"","sources":["../../src/auth/samlBearerAssertion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmDzD"}

package/dist/auth/samlBearerAssertion.js

@@ -0,0 +1,102 @@
+"use strict";
+/**
+ * What the SAML 2.0 bearer grant accepts, from what a SAML login delivers.
+ *
+ * RFC 7522 §2.1: the `assertion` parameter is a single SAML 2.0 Assertion,
+ * base64url-encoded. An interactive login delivers something else — the
+ * identity provider's whole `samlp:Response`, in standard base64 — and a
+ * token endpoint that follows the RFC refuses it: Cloud Foundry UAA answers
+ * 401 to a Response in either encoding. So the Assertion is taken out of the
+ * Response here and re-encoded.
+ *
+ * The Assertion is serialised as an element of its own, and every namespace
+ * declaration it inherited from the Response is copied onto it first. A
+ * serializer would add back only the prefixes used in element and attribute
+ * names; a prefix used only inside a value — `xsi:type="xs:string"` — would be
+ * lost, leaving a QName that no longer resolves. Copying all of them keeps the
+ * Assertion's in-scope namespaces exactly what they were. Its signature, over
+ * exclusive canonical XML, still verifies: canonicalisation renders a
+ * namespace where it is used, or where the signature's InclusiveNamespaces
+ * names it, not where it was declared. A signature over the Response alone does not
+ * survive the cut; the token endpoint then refuses the Assertion, as it
+ * would any unsigned one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toBearerAssertion = toBearerAssertion;
+const xmldom_1 = require("@xmldom/xmldom");
+const strictXml_1 = require("./strictXml");
+const SAML_ASSERTION_NS = 'urn:oasis:names:tc:SAML:2.0:assertion';
+const SAML_PROTOCOL_NS = 'urn:oasis:names:tc:SAML:2.0:protocol';
+function toBearerAssertion(payload) {
+    // Node's base64 decoder accepts both alphabets, so this reads either.
+    const xml = Buffer.from(payload.trim(), 'base64').toString('utf8');
+    if (!xml.trimStart().startsWith('<')) {
+        throw new Error('SAML bearer payload is not base64-encoded XML');
+    }
+    let root;
+    try {
+        root = (0, strictXml_1.parseStrictXml)(xml).documentElement;
+    }
+    catch (error) {
+        throw new Error(`SAML bearer payload is not well-formed XML: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (isElement(root, SAML_ASSERTION_NS, 'Assertion')) {
+        return Buffer.from(xml, 'utf8').toString('base64url');
+    }
+    if (!isElement(root, SAML_PROTOCOL_NS, 'Response')) {
+        throw new Error('SAML bearer payload is neither a SAML Response nor an Assertion');
+    }
+    const children = childElements(root);
+    const assertions = children.filter((e) => isElement(e, SAML_ASSERTION_NS, 'Assertion'));
+    if (assertions.length === 0) {
+        if (children.some((e) => isElement(e, SAML_ASSERTION_NS, 'EncryptedAssertion'))) {
+            throw new Error('SAML Response carries only an EncryptedAssertion; encrypted Assertions are not supported');
+        }
+        throw new Error('SAML Response carries no Assertion');
+    }
+    if (assertions.length > 1) {
+        throw new Error(`SAML Response carries ${assertions.length} Assertions; a bearer grant takes one`);
+    }
+    const assertion = assertions[0];
+    declareInheritedNamespaces(assertion);
+    const serialized = new xmldom_1.XMLSerializer().serializeToString(assertion);
+    return Buffer.from(serialized, 'utf8').toString('base64url');
+}
+function isElement(node, namespace, localName) {
+    return (!!node && node.namespaceURI === namespace && node.localName === localName);
+}
+const XMLNS_NS = 'http://www.w3.org/2000/xmlns/';
+const isNamespaceDeclaration = (name) => name === 'xmlns' || name.startsWith('xmlns:');
+/**
+ * Copies onto `element` every namespace declaration in scope from its
+ * ancestors that it does not make itself. Ancestors are walked innermost
+ * first, so the nearest declaration of a prefix wins, as it did in place.
+ */
+function declareInheritedNamespaces(element) {
+    const declared = new Set();
+    for (let i = 0; i < element.attributes.length; i++) {
+        const name = element.attributes.item(i)?.name;
+        if (name && isNamespaceDeclaration(name))
+            declared.add(name);
+    }
+    for (let ancestor = element.parentNode; ancestor && ancestor.nodeType === 1; ancestor = ancestor.parentNode) {
+        const attributes = ancestor.attributes;
+        for (let i = 0; i < attributes.length; i++) {
+            const attribute = attributes.item(i);
+            if (attribute &&
+                isNamespaceDeclaration(attribute.name) &&
+                !declared.has(attribute.name)) {
+                element.setAttributeNS(XMLNS_NS, attribute.name, attribute.value);
+                declared.add(attribute.name);
+            }
+        }
+    }
+}
+function childElements(parent) {
+    const out = [];
+    for (let n = parent.firstChild; n; n = n.nextSibling) {
+        if (n.nodeType === 1)
+            out.push(n);
+    }
+    return out;
+}

package/dist/auth/strictXml.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Parsing untrusted XML so that any fault is a refusal.
+ *
+ * @xmldom/xmldom's defaults are wrong for a security boundary in two ways:
+ * without `onError` it reports every fault to the console — so a malformed
+ * callback from anyone writes to the process's stderr, past `ILogger` — and it
+ * recovers from `error`-level faults (an undeclared entity, say) by handing
+ * back a repaired document instead of failing. Throwing from `onError` turns
+ * every level into a `ParseError`, silently.
+ */
+import { type Document } from '@xmldom/xmldom';
+export declare function parseStrictXml(xml: string): Document;
+//# sourceMappingURL=strictXml.d.ts.map

package/dist/auth/strictXml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strictXml.d.ts","sourceRoot":"","sources":["../../src/auth/strictXml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAMpD"}

package/dist/auth/strictXml.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * Parsing untrusted XML so that any fault is a refusal.
+ *
+ * @xmldom/xmldom's defaults are wrong for a security boundary in two ways:
+ * without `onError` it reports every fault to the console — so a malformed
+ * callback from anyone writes to the process's stderr, past `ILogger` — and it
+ * recovers from `error`-level faults (an undeclared entity, say) by handing
+ * back a repaired document instead of failing. Throwing from `onError` turns
+ * every level into a `ParseError`, silently.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseStrictXml = parseStrictXml;
+const xmldom_1 = require("@xmldom/xmldom");
+function parseStrictXml(xml) {
+    return new xmldom_1.DOMParser({
+        onError: (level, message) => {
+            throw new Error(`XML ${level}: ${message}`);
+        },
+    }).parseFromString(xml, 'text/xml');
+}

package/dist/errors/AssertionValidationError.d.ts

@@ -0,0 +1,15 @@
+/**
+ * An assertion was refused, and by which check.
+ *
+ * The check is a field rather than something to read out of the message: a
+ * consumer telling "your identity provider declined" from "this was not
+ * addressed to us" should not be parsing prose to do it.
+ */
+import { TokenProviderError } from './TokenProviderErrors';
+/** The checks the shipped validator performs, in the order it performs them. */
+export type AssertionCheck = 'document' | 'duplicateId' | 'signature' | 'signedNode' | 'status' | 'assertionId' | 'issuer' | 'conditions' | 'notBefore' | 'notOnOrAfter' | 'audience' | 'bearerConfirmation' | 'destination' | 'replay';
+export declare class AssertionValidationError extends TokenProviderError {
+    readonly check: AssertionCheck;
+    constructor(check: AssertionCheck, message: string);
+}
+//# sourceMappingURL=AssertionValidationError.d.ts.map

package/dist/errors/AssertionValidationError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AssertionValidationError.d.ts","sourceRoot":"","sources":["../../src/errors/AssertionValidationError.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,gFAAgF;AAChF,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,aAAa,GACb,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,cAAc,GACd,UAAU,GACV,oBAAoB,GACpB,aAAa,GACb,QAAQ,CAAC;AAEb,qBAAa,wBAAyB,SAAQ,kBAAkB;IAC9D,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;gBAEnB,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM;CAQnD"}