@mcp-abap-adt/auth-providers 2.2.2 → 4.0.0

package/dist/providers/saml2Utils.js

@@ -4,10 +4,13 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateSamlConfig = validateSamlConfig;
+exports.resolveAssertionValidator = resolveAssertionValidator;
 exports.resolveTokenUrl = resolveTokenUrl;
 exports.getSamlAssertion = getSamlAssertion;
 const saml2Auth_1 = require("../auth/saml2Auth");
+const TokenProviderErrors_1 = require("../errors/TokenProviderErrors");
 const strategies_1 = require("../strategies");
+const assertionValidator_1 = require("../validation/assertionValidator");
 /** Throw at construction rather than half-verify at runtime. */
 function validateSamlConfig(config) {
     if (config.authorizationUrl && !config.acsUrl) {
@@ -15,6 +18,48 @@ function validateSamlConfig(config) {
             'pre-built SAML request cannot be read, so it must be declared.');
     }
 }
+/**
+ * The consumer's validator when supplied, otherwise the provider's default —
+ * `createSignedAssertionValidator` for `"bearer"`, since the token endpoint
+ * receives the Assertion alone (#40) and its own signature is what that
+ * endpoint verifies; `createSignedResponseValidator` for `"pure"`, since the
+ * whole response is handed on and `Status`/`Destination` must be inside a
+ * signature. See the spec's "A bare Assertion, and which validator each
+ * provider defaults to".
+ */
+function resolveAssertionValidator(config, provider) {
+    if (config.assertionValidator) {
+        // A shipped validator fails closed without expectedIssuer, so supplying
+        // one without idpEntityId would construct fine and then refuse every
+        // login at `issuer` — after the browser step. A custom validator needs
+        // no idpEntityId: it may establish trust some other way.
+        if ((0, assertionValidator_1.isShippedValidator)(config.assertionValidator) && !config.idpEntityId) {
+            throw new TokenProviderErrors_1.ValidationError('The supplied assertionValidator is a shipped one ' +
+                '(createSignedResponseValidator or createSignedAssertionValidator), ' +
+                'which refuses every assertion without an expected issuer: missing ' +
+                'idpEntityId.', ['idpEntityId']);
+        }
+        return config.assertionValidator;
+    }
+    const missing = [];
+    if (!config.idpCertificates?.length)
+        missing.push('idpCertificates');
+    if (!config.idpEntityId)
+        missing.push('idpEntityId');
+    if (missing.length > 0) {
+        throw new TokenProviderErrors_1.ValidationError(`The default assertion validator needs the identity provider it should ` +
+            `trust: missing ${missing.join(', ')}. Supply these, or supply an ` +
+            `assertionValidator of your own.`, missing);
+    }
+    const options = {
+        idpCertificates: config.idpCertificates,
+        clockSkewMs: config.clockSkewMs,
+        replayStore: config.assertionReplayStore,
+    };
+    return provider === 'bearer'
+        ? (0, assertionValidator_1.createSignedAssertionValidator)(options)
+        : (0, assertionValidator_1.createSignedResponseValidator)(options);
+}
 function resolveTokenUrl(config) {
     if (config.tokenUrl) {
         return config.tokenUrl;
@@ -26,9 +71,21 @@ function resolveTokenUrl(config) {
 }
 async function getSamlAssertion(config) {
     const declaredAcs = config.acsUrl;
+    let mintedRequestId;
     const request = {
         logger: config.logger,
         buildAuthorizationUrl: async (redirectUri) => {
+            // An IdP-initiated login sends no AuthnRequest, and without a pre-built
+            // authorizationUrl the only URL this could produce is one carrying a
+            // freshly minted request. Refused here, before any URL exists, so the
+            // mistake surfaces before a browser opens rather than after a login.
+            if (config.idpInitiated && !config.authorizationUrl) {
+                throw new TokenProviderErrors_1.ValidationError('SAML idpInitiated is true and no authorizationUrl is configured, ' +
+                    'but the authorization strategy asked for an authorization URL: ' +
+                    'the only one this package can build carries an AuthnRequest. ' +
+                    'Configure the IdP-initiated SSO URL as authorizationUrl, or use a ' +
+                    'strategy that does not call buildAuthorizationUrl.', ['authorizationUrl']);
+            }
             // A declared ACS is registered with the IdP; the strategy must be
             // listening exactly there, and an ephemeral port cannot be.
             const acsUrl = declaredAcs ?? redirectUri;
@@ -36,13 +93,15 @@ async function getSamlAssertion(config) {
                 throw new Error(`SAML acsUrl is ${declaredAcs}, but the authorization strategy is ` +
                     `listening on ${redirectUri}. They must match.`);
             }
-            return (0, saml2Auth_1.buildSamlAuthorizationUrl)({
+            const built = (0, saml2Auth_1.buildSamlAuthorizationUrl)({
                 idpSsoUrl: config.idpSsoUrl,
                 spEntityId: config.spEntityId,
                 acsUrl,
                 relayState: config.relayState,
                 authorizationUrl: config.authorizationUrl,
             });
+            mintedRequestId = built.requestId;
+            return built.url;
         },
     };
     const supplied = config.authorization;
@@ -55,7 +114,12 @@ async function getSamlAssertion(config) {
             throw new Error(`SAML acsUrl is ${declaredAcs}, but the authorization strategy used ` +
                 `${outcome.redirectUri}. They must match.`);
         }
-        return outcome.payload;
+        const requestId = resolveExpectedRequestId(config, mintedRequestId);
+        return {
+            payload: outcome.payload,
+            requestId,
+            acsUrl: outcome.redirectUri,
+        };
     }
     finally {
         if (!supplied) {
@@ -67,3 +131,31 @@ async function getSamlAssertion(config) {
         }
     }
 }
+/**
+ * The ID `InResponseTo` must answer, from the three sources the spec allows:
+ * minted, declared, or none by explicit `idpInitiated: true`. Anything else —
+ * no ID and no declaration, or `idpInitiated` combined with an ID from either
+ * of the other two sources — is a configuration error, not a validation
+ * failure blamed on the assertion.
+ */
+function resolveExpectedRequestId(config, mintedRequestId) {
+    const declaredRequestId = config.authnRequestId;
+    if (config.idpInitiated) {
+        if (mintedRequestId || declaredRequestId) {
+            throw new TokenProviderErrors_1.ValidationError('SAML idpInitiated is true, but a request ID was also minted or ' +
+                'configured (an authorization strategy called buildAuthorizationUrl, ' +
+                'or authnRequestId is set). An IdP-initiated login sends no request, ' +
+                'so an ID means the configuration describes two different logins.', ['idpInitiated']);
+        }
+        return undefined;
+    }
+    const requestId = mintedRequestId ?? declaredRequestId;
+    if (!requestId) {
+        throw new TokenProviderErrors_1.ValidationError('Cannot validate InResponseTo: this login did not build its own AuthnRequest, ' +
+            'so authnRequestId must be configured — or, if the identity provider ' +
+            'starts this login itself, idpInitiated: true. This happens with a ' +
+            'pre-built authorizationUrl, or an authorization strategy that supplies an ' +
+            'assertion without asking for a URL.', ['authnRequestId']);
+    }
+    return requestId;
+}

package/dist/strategies/index.d.ts

@@ -4,5 +4,5 @@ export { BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT
 export type { ExternalCodeStrategyOptions, StaticCodeStrategyOptions, } from './codeStrategies';
 export { externalCodeStrategy, staticCodeStrategy, } from './codeStrategies';
 export type { ManualStrategyOptions } from './manualStrategies';
-export { manualPasteStrategy, manualSamlResponseStrategy, } from './manualStrategies';
+export { manualPasscodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, } from './manualStrategies';
 //# sourceMappingURL=index.d.ts.map

package/dist/strategies/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/strategies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/strategies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC"}

package/dist/strategies/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.staticCodeStrategy = exports.externalCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = void 0;
+exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.manualPasscodeStrategy = exports.staticCodeStrategy = exports.externalCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = void 0;
 var asOidcResult_1 = require("./asOidcResult");
 Object.defineProperty(exports, "asOidcResult", { enumerable: true, get: function () { return asOidcResult_1.asOidcResult; } });
 var BrowserCallbackStrategy_1 = require("./BrowserCallbackStrategy");
@@ -14,5 +14,6 @@ var codeStrategies_1 = require("./codeStrategies");
 Object.defineProperty(exports, "externalCodeStrategy", { enumerable: true, get: function () { return codeStrategies_1.externalCodeStrategy; } });
 Object.defineProperty(exports, "staticCodeStrategy", { enumerable: true, get: function () { return codeStrategies_1.staticCodeStrategy; } });
 var manualStrategies_1 = require("./manualStrategies");
+Object.defineProperty(exports, "manualPasscodeStrategy", { enumerable: true, get: function () { return manualStrategies_1.manualPasscodeStrategy; } });
 Object.defineProperty(exports, "manualPasteStrategy", { enumerable: true, get: function () { return manualStrategies_1.manualPasteStrategy; } });
 Object.defineProperty(exports, "manualSamlResponseStrategy", { enumerable: true, get: function () { return manualStrategies_1.manualSamlResponseStrategy; } });

package/dist/strategies/manualStrategies.d.ts

@@ -17,4 +17,11 @@ export interface ManualStrategyOptions {
 export declare function manualPasteStrategy(options?: ManualStrategyOptions): IAuthorizationStrategy<string>;
 /** The user lifts `SAMLResponse` from the POST body — it never reaches the URL. */
 export declare function manualSamlResponseStrategy(options?: ManualStrategyOptions): IAuthorizationStrategy<string>;
+/**
+ * The UAA passcode, typed in by the user: shows where to fetch it —
+ * `<uaa>/passcode`, opened in any browser, on any machine — and reads the
+ * code they copy from that page. The default for `UaaPasscodeProvider`, so a
+ * login works on a machine with no browser at all, as `cf login --sso` does.
+ */
+export declare function manualPasscodeStrategy(options?: ManualStrategyOptions): IAuthorizationStrategy<string>;
 //# sourceMappingURL=manualStrategies.d.ts.map

package/dist/strategies/manualStrategies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manualStrategies.d.ts","sourceRoot":"","sources":["../../src/strategies/manualStrategies.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAGV,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAiCD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAmBhC;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAiBhC"}
+{"version":3,"file":"manualStrategies.d.ts","sourceRoot":"","sources":["../../src/strategies/manualStrategies.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAGV,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAiCD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAmBhC;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAiBhC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAgBhC"}

package/dist/strategies/manualStrategies.js

@@ -10,6 +10,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.manualPasteStrategy = manualPasteStrategy;
 exports.manualSamlResponseStrategy = manualSamlResponseStrategy;
+exports.manualPasscodeStrategy = manualPasscodeStrategy;
 const node_readline_1 = require("node:readline");
 const browserAuth_1 = require("../auth/browserAuth");
 const BrowserCallbackStrategy_1 = require("./BrowserCallbackStrategy");
@@ -75,3 +76,23 @@ function manualSamlResponseStrategy(options = {}) {
         },
     };
 }
+/**
+ * The UAA passcode, typed in by the user: shows where to fetch it —
+ * `<uaa>/passcode`, opened in any browser, on any machine — and reads the
+ * code they copy from that page. The default for `UaaPasscodeProvider`, so a
+ * login works on a machine with no browser at all, as `cf login --sso` does.
+ */
+function manualPasscodeStrategy(options = {}) {
+    const redirectUri = options.redirectUri ?? defaultRedirectUri();
+    const read = options.read ?? readFromTerminal;
+    return {
+        async authorize(request) {
+            const url = await request.buildAuthorizationUrl(redirectUri);
+            announce(request, url);
+            const code = (await read('Paste the Temporary Authentication Code (passcode): ')).trim();
+            if (!code)
+                throw new Error('No passcode was provided');
+            return { payload: code, redirectUri };
+        },
+    };
+}

package/dist/validation/assertionValidator.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The shipped assertion validator: the spec's check table, in order.
+ *
+ * Two properties matter more than any individual check. First, the signature
+ * is resolved to an element and every assertion-level field is read *from that
+ * element* — a document holding a validly signed fragment beside a forged one
+ * is the wrapping attack, and reading the wrong node is how it succeeds.
+ * Second, no two refusals share a distinguishing phrase, so a test cannot pass
+ * for a neighbouring check's reason.
+ *
+ * Three fields live on the Response rather than the assertion: Status,
+ * Response/Issuer and Destination. The signed-Response validator reads them,
+ * because there they are inside the signature. The assertion-only validator
+ * does not read them at all — not weakly. That is safe because a declined
+ * login carries no assertion, so flipping Status buys an attacker nothing they
+ * can sign, and addressing rests on Recipient inside the signed assertion.
+ */
+import type { IAssertionReplayStore, IAssertionValidator } from '@mcp-abap-adt/interfaces-auth';
+export interface ShippedValidatorOptions {
+    readonly idpCertificates: readonly string[];
+    readonly clockSkewMs?: number;
+    readonly replayStore?: IAssertionReplayStore;
+}
+/** Whether this validator came from one of the two shipped factories. */
+export declare function isShippedValidator(validator: IAssertionValidator): boolean;
+export declare const createSignedResponseValidator: (options: ShippedValidatorOptions) => IAssertionValidator;
+export declare const createSignedAssertionValidator: (options: ShippedValidatorOptions) => IAssertionValidator;
+//# sourceMappingURL=assertionValidator.d.ts.map

package/dist/validation/assertionValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertionValidator.d.ts","sourceRoot":"","sources":["../../src/validation/assertionValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAEV,qBAAqB,EACrB,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAiBvC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAgCD,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAE1E;AAED,eAAO,MAAM,6BAA6B,GACxC,SAAS,uBAAuB,KAC/B,mBAAkE,CAAC;AAEtE,eAAO,MAAM,8BAA8B,GACzC,SAAS,uBAAuB,KAC/B,mBAAmE,CAAC"}