@mcp-abap-adt/auth-providers 2.2.2 → 4.0.0

package/dist/validation/assertionValidator.js

@@ -0,0 +1,444 @@
+"use strict";
+/**
+ * The shipped assertion validator: the spec's check table, in order.
+ *
+ * Two properties matter more than any individual check. First, the signature
+ * is resolved to an element and every assertion-level field is read *from that
+ * element* — a document holding a validly signed fragment beside a forged one
+ * is the wrapping attack, and reading the wrong node is how it succeeds.
+ * Second, no two refusals share a distinguishing phrase, so a test cannot pass
+ * for a neighbouring check's reason.
+ *
+ * Three fields live on the Response rather than the assertion: Status,
+ * Response/Issuer and Destination. The signed-Response validator reads them,
+ * because there they are inside the signature. The assertion-only validator
+ * does not read them at all — not weakly. That is safe because a declined
+ * login carries no assertion, so flipping Status buys an attacker nothing they
+ * can sign, and addressing rests on Recipient inside the signed assertion.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSignedAssertionValidator = exports.createSignedResponseValidator = void 0;
+exports.isShippedValidator = isShippedValidator;
+const xmldom_1 = require("@xmldom/xmldom");
+const strictXml_1 = require("../auth/strictXml");
+const AssertionValidationError_1 = require("../errors/AssertionValidationError");
+const documentIds_1 = require("./documentIds");
+const inMemoryReplayStore_1 = require("./inMemoryReplayStore");
+const signedNode_1 = require("./signedNode");
+const xsdDateTime_1 = require("./xsdDateTime");
+const SAML_NS = 'urn:oasis:names:tc:SAML:2.0:assertion';
+const PROTOCOL_NS = 'urn:oasis:names:tc:SAML:2.0:protocol';
+const BEARER = 'urn:oasis:names:tc:SAML:2.0:cm:bearer';
+const SUCCESS = 'urn:oasis:names:tc:SAML:2.0:status:Success';
+/**
+ * Marks a validator as one of the two shipped here. Module-private and
+ * non-enumerable, so it is neither part of the public surface nor visible to
+ * a consumer spreading or serialising the object.
+ *
+ * It exists for one reason: a shipped validator fails closed without
+ * `expectedIssuer`, so a provider handed one must insist on `idpEntityId` at
+ * construction — otherwise the mistake surfaces only as an `issuer` refusal
+ * after a human has finished a browser login. A custom validator carries no
+ * brand and may establish trust however it likes.
+ */
+const SHIPPED = Symbol('mcp-abap-adt.shippedAssertionValidator');
+function brand(validator) {
+    Object.defineProperty(validator, SHIPPED, {
+        value: true,
+        enumerable: false,
+    });
+    return validator;
+}
+/** Whether this validator came from one of the two shipped factories. */
+function isShippedValidator(validator) {
+    return validator[SHIPPED] === true;
+}
+const createSignedResponseValidator = (options) => brand(createValidator('response', options));
+exports.createSignedResponseValidator = createSignedResponseValidator;
+const createSignedAssertionValidator = (options) => brand(createValidator('assertion', options));
+exports.createSignedAssertionValidator = createSignedAssertionValidator;
+function createValidator(require, options) {
+    const skew = options.clockSkewMs ?? 0;
+    if (!Number.isInteger(skew) || skew < 0) {
+        throw new Error(`clockSkewMs must be a finite non-negative integer, got ${String(options.clockSkewMs)}`);
+    }
+    if (options.idpCertificates.length === 0) {
+        throw new Error('idpCertificates must not be empty: nothing could be verified');
+    }
+    // Normalised and proved here, once, rather than inside verification. Three
+    // reasons, and the last bites hardest: a malformed entry standing first in
+    // the list would abort the rotation loop before a later valid certificate
+    // was tried; a constructor is where this package already refuses a bad
+    // configuration; and a login happens after a human has used a browser, so a
+    // formatting mistake found then wastes their work, not ours.
+    const certificates = options.idpCertificates.map(signedNode_1.toPem);
+    const store = options.replayStore ?? inMemoryReplayStore_1.defaultReplayStore;
+    return {
+        async validate(samlResponse, context) {
+            // 1. Parses, and the document element is a samlp:Response.
+            const xml = Buffer.from(samlResponse, 'base64').toString('utf8');
+            // No DTD, ever. A SAML message has no use for one, and a DOCTYPE is
+            // where parsers diverge — entity expansion, internal subsets — and this
+            // document is parsed twice: by @xmldom/xmldom 0.9 here and by the 0.8
+            // nested inside xml-crypto. Refused before either parse is trusted.
+            if (/<!DOCTYPE/i.test(xml)) {
+                return fail('document', 'the SAMLResponse carries a DOCTYPE declaration, which is never accepted');
+            }
+            let doc;
+            try {
+                doc = (0, strictXml_1.parseStrictXml)(xml);
+            }
+            catch {
+                return fail('document', 'the SAMLResponse did not parse as XML');
+            }
+            const root = doc.documentElement;
+            if (!root)
+                return fail('document', 'the SAMLResponse did not parse as XML');
+            const rootIsResponse = root.localName === 'Response' && root.namespaceURI === PROTOCOL_NS;
+            const rootIsAssertion = root.localName === 'Assertion' && root.namespaceURI === SAML_NS;
+            // A bare Assertion is a document only the assertion-only validator
+            // accepts: the saml2-bearer grant exchanges an Assertion, and 3.0.0
+            // already takes one as Saml2BearerProvider's payload.
+            if (!rootIsResponse && !(require === 'assertion' && rootIsAssertion)) {
+                return fail('document', require === 'assertion'
+                    ? `expected a samlp:Response or a saml:Assertion, got ${(0, signedNode_1.quoteUntrusted)(root.localName ?? '')}`
+                    : `expected the document element to be a samlp:Response, got ${(0, signedNode_1.quoteUntrusted)(root.localName ?? '')}`);
+            }
+            // 1b. Unique IDs, before any reference is resolved.
+            const duplicate = (0, documentIds_1.findDuplicateId)(doc);
+            if (duplicate) {
+                return fail('duplicateId', `the document uses the ID ${(0, signedNode_1.quoteUntrusted)(duplicate)} more than once, so which element is signed is ambiguous`);
+            }
+            // 2 + 3. Verify every signature, then take the element this validator
+            // requires from among those they cover. A response signed at both
+            // levels — as many identity providers send — satisfies either validator.
+            let covered;
+            try {
+                covered = (0, signedNode_1.resolveSignedElements)(xml, doc, certificates);
+            }
+            catch (error) {
+                return fail('signature', error.message);
+            }
+            // The element this validator reads is fixed by the document's shape,
+            // not by which signature happens to come first: the Response itself, or
+            // for the assertion-only validator the bare root Assertion or the
+            // Response's single direct-child Assertion. Taking "the first covered
+            // Assertion" instead would pick a signed assertion nested in Advice
+            // whenever its signature precedes the outer one's in document order.
+            const target = require === 'response'
+                ? root
+                : rootIsAssertion
+                    ? root
+                    : (() => {
+                        const children = directChildren(root, SAML_NS, 'Assertion');
+                        return children.length === 1 ? children[0] : null;
+                    })();
+            const signed = target
+                ? covered.find((element) => element === target)
+                : undefined;
+            // The signed element must be the Assertion, or a Response holding exactly
+            // one. Everything below is read from `assertion` and nowhere else.
+            const assertion = signed ? assertionInside(signed, root, require) : null;
+            if (!signed || !assertion) {
+                return fail('signedNode', 'the signature does not cover the assertion this response carries');
+            }
+            // 3b. Nothing assertion-shaped outside the one read. Wherever the
+            // signature sits, the payload travels on whole — Saml2PureProvider hands
+            // it to the cookie provider — so an Assertion or EncryptedAssertion in
+            // an unsigned part of it (Extensions, a sibling, a wrapper) is something
+            // a later reader may take for the real one.
+            if (!everyAssertionWithin(doc, assertion)) {
+                return fail('signedNode', 'the document carries a saml:Assertion or saml:EncryptedAssertion outside the one the signature covers');
+            }
+            // 4. Status. Only when the Response is the signed element: otherwise it
+            // lies outside the signature, and checking a field an attacker sets is
+            // worse than not checking it — it reads like verification.
+            if (require === 'response') {
+                const status = directChild(root, PROTOCOL_NS, 'Status');
+                const codeValue = status
+                    ? directChild(status, PROTOCOL_NS, 'StatusCode')?.getAttribute('Value')
+                    : null;
+                if (!codeValue)
+                    return fail('status', 'the response must carry exactly one samlp:Status holding exactly one StatusCode with a Value');
+                if (codeValue !== SUCCESS) {
+                    return fail('status', `the identity provider declined the login: ${codeValue}`);
+                }
+            }
+            // 4b. The assertion's own ID.
+            const assertionId = (0, documentIds_1.readRequiredId)(assertion);
+            if (!assertionId)
+                return fail('assertionId', 'the assertion carries no ID');
+            // 5. The assertion's Issuer — inside the signature either way, so both
+            // validators check it.
+            const issuer = directChild(assertion, SAML_NS, 'Issuer')?.textContent ?? '';
+            if (!issuer) {
+                return fail('issuer', 'the assertion must carry exactly one non-empty saml:Issuer');
+            }
+            // Fail closed: with nothing to compare against, any issuer whose key is
+            // configured would pass, which is not what this validator promises.
+            if (!context.expectedIssuer) {
+                return fail('issuer', 'no expectedIssuer was configured, so the assertion issuer cannot be trusted');
+            }
+            if (issuer !== context.expectedIssuer) {
+                return fail('issuer', `the assertion was issued by ${issuer}, not the trusted issuer`);
+            }
+            // 5b. The cross-check against the Response's Issuer belongs to the
+            // signed-Response validator alone: only there are both inside the
+            // signature.
+            if (require === 'response') {
+                // Optional, so none is fine; but two are an ambiguity, and one that is
+                // present must agree — empty included, since empty is not absent.
+                const responseIssuers = directChildren(root, SAML_NS, 'Issuer');
+                if (responseIssuers.length > 1) {
+                    return fail('issuer', 'the response must carry at most one saml:Issuer');
+                }
+                if (responseIssuers.length === 1 &&
+                    (responseIssuers[0].textContent ?? '') !== issuer) {
+                    return fail('issuer', 'the response and the assertion name different issuers');
+                }
+            }
+            // 6, 7, 8. Conditions and their window.
+            const conditions = directChild(assertion, SAML_NS, 'Conditions');
+            if (!conditions)
+                return fail('conditions', 'the assertion must carry exactly one saml:Conditions');
+            const notBeforeRaw = conditions.getAttribute('NotBefore');
+            if (notBeforeRaw) {
+                const notBefore = (0, xsdDateTime_1.parseXsdDateTime)(notBeforeRaw);
+                if (!notBefore) {
+                    return fail('notBefore', `Conditions NotBefore is not a valid xsd:dateTime: ${notBeforeRaw}`);
+                }
+                if (notBefore.getTime() - skew > Date.now()) {
+                    return fail('notBefore', 'the assertion is not valid yet');
+                }
+            }
+            const conditionsExpiry = (0, xsdDateTime_1.parseXsdDateTime)(conditions.getAttribute('NotOnOrAfter'));
+            if (!conditionsExpiry) {
+                return fail('notOnOrAfter', 'Conditions carries no usable NotOnOrAfter, so the assertion states no lifetime');
+            }
+            if (conditionsExpiry.getTime() + skew <= Date.now()) {
+                return fail('notOnOrAfter', 'the assertion has expired');
+            }
+            // 9. Every AudienceRestriction must name us; several Audience inside one
+            // are alternatives.
+            const restrictions = directChildren(conditions, SAML_NS, 'AudienceRestriction');
+            if (restrictions.length === 0) {
+                return fail('audience', 'the assertion restricts no audience');
+            }
+            for (const restriction of restrictions) {
+                const names = directChildren(restriction, SAML_NS, 'Audience').map((a) => a.textContent ?? '');
+                if (!names.includes(context.audience)) {
+                    return fail('audience', 'an AudienceRestriction on this assertion does not name us');
+                }
+            }
+            // 10. One bearer confirmation satisfying everything together.
+            const chosen = chooseBearerConfirmation(assertion, context, skew);
+            if (!chosen) {
+                return fail('bearerConfirmation', 'no single bearer SubjectConfirmation, under exactly one saml:Subject and with exactly one SubjectConfirmationData, answers our request, names our ACS and is still open');
+            }
+            // 11. Destination — the signed-Response validator only, for the same
+            // reason as Status. Addressing in the other flow rests on Recipient,
+            // which step 10 required and which sits inside the signed assertion.
+            if (require === 'response') {
+                const destination = root.getAttribute('Destination');
+                if (!destination) {
+                    return fail('destination', 'the response carries no Destination');
+                }
+                if (destination !== context.acsUrl) {
+                    return fail('destination', `the response is addressed to ${destination}, not to us`);
+                }
+            }
+            // Expiry: the earlier of the two windows.
+            const expiresAt = new Date(Math.min(conditionsExpiry.getTime(), chosen.notOnOrAfter.getTime()));
+            // 12. Replay. Retention is NOT expiresAt: it must last for as long as
+            // this validator could accept the assertion again. Conditions bound
+            // that, but so does the LATEST bearer confirmation that can qualify —
+            // with confirmations closing at +120 s and +600 s the session ends at
+            // +120 s, yet at +200 s the second one still qualifies, and an entry
+            // dropped at +120 s would let the same assertion in a second time. The
+            // skew is added on top, since inside it the assertion is still accepted.
+            const retainUntil = new Date(Math.min(conditionsExpiry.getTime(), chosen.latestNotOnOrAfter.getTime()) + skew);
+            const fresh = await store.recordIfUnseen({ issuer, assertionId }, retainUntil);
+            if (!fresh) {
+                return fail('replay', 'this assertion has been presented before');
+            }
+            return {
+                expiresAt,
+                assertionId,
+                issuer,
+                nameId: (() => {
+                    // Subject, then NameID — no `?? assertion` fallback, which would
+                    // read a NameID from outside the Subject when the Subject is absent.
+                    const subject = directChild(assertion, SAML_NS, 'Subject');
+                    return subject
+                        ? (directChild(subject, SAML_NS, 'NameID')?.textContent ??
+                            undefined)
+                        : undefined;
+                })(),
+                raw: samlResponse,
+                // The signed element, not the response: this is what a consumer may
+                // parse without re-deriving what the signature covered.
+                signedXml: new xmldom_1.XMLSerializer().serializeToString(signed),
+            };
+        },
+    };
+}
+function fail(check, message) {
+    throw new AssertionValidationError_1.AssertionValidationError(check, message);
+}
+/**
+ * Direct children with this namespace and local name — **not** descendants.
+ *
+ * `getElementsByTagNameNS` searches the whole subtree, and that is the wrong
+ * tool for a structural path. An assertion with no `Conditions` of its own but
+ * a `Conditions` buried somewhere inside it would answer the descendant search
+ * and satisfy a check it does not meet; the same trick works for `Issuer`,
+ * `Status` and `Subject`. Each segment of a SAML path is therefore walked
+ * explicitly, one level at a time.
+ */
+function directChildren(parent, ns, local) {
+    const out = [];
+    const nodes = parent.childNodes;
+    for (let i = 0; i < nodes.length; i++) {
+        const node = nodes[i];
+        // nodeType 1 is ELEMENT_NODE; the constant is unavailable without the dom
+        // lib, which this project deliberately does not use.
+        if (node.nodeType === 1 &&
+            node.namespaceURI === ns &&
+            node.localName === local) {
+            out.push(node);
+        }
+    }
+    return out;
+}
+/** The single direct child with this name, or null when there is not exactly one. */
+function directChild(parent, ns, local) {
+    const found = directChildren(parent, ns, local);
+    // Not "the first": two siblings sharing a name is an ambiguity, and
+    // resolving it silently in favour of the first is how a forged element comes
+    // to be read in preference to a real one.
+    return found.length === 1 ? found[0] : null;
+}
+/**
+ * Whether every `saml:Assertion` and `saml:EncryptedAssertion` in the
+ * document is `assertion` itself or lies inside it.
+ */
+function everyAssertionWithin(doc, assertion) {
+    for (const local of ['Assertion', 'EncryptedAssertion']) {
+        const found = doc.getElementsByTagNameNS(SAML_NS, local);
+        for (let i = 0; i < found.length; i++) {
+            let node = found[i];
+            while (node && node !== assertion) {
+                node = node.parentNode;
+            }
+            if (!node)
+                return false;
+        }
+    }
+    return true;
+}
+/**
+ * The assertion the signature covers, or null when the signed element is not
+ * one and does not contain exactly one.
+ *
+ * "Exactly one" matters: a signed Response wrapping two assertions leaves
+ * "which did we verify" ambiguous, which is the wrapping question again.
+ */
+function assertionInside(signed, root, require) {
+    // The signature must cover what this validator was built to require. A
+    // signed-Response validator handed an assertion-signed document refuses
+    // here, and vice versa — that refusal is the whole point of shipping two.
+    const signedIsResponse = signed.localName === 'Response' && signed.namespaceURI === PROTOCOL_NS;
+    const signedIsAssertion = signed.localName === 'Assertion' && signed.namespaceURI === SAML_NS;
+    if (require === 'response' && !signedIsResponse)
+        return null;
+    if (require === 'assertion' && !signedIsAssertion)
+        return null;
+    // A bare Assertion is its own document: the only assertion there is, and
+    // it must be the element signed.
+    if (root.localName === 'Assertion' && root.namespaceURI === SAML_NS) {
+        return signed === root ? root : null;
+    }
+    // Whatever was signed, the response must carry exactly one assertion.
+    //
+    // Reading only from the signed element is not enough: Saml2PureProvider
+    // hands the whole response to the cookie provider, which reads whatever is
+    // in it. (toBearerAssertion refuses a second assertion on the bearer path
+    // too, but the validator does not lean on its caller.) A forged assertion
+    // placed beside the signed one must therefore end the login, not merely be
+    // ignored here.
+    const assertions = directChildren(root, SAML_NS, 'Assertion');
+    if (assertions.length !== 1)
+        return null;
+    const only = assertions[0];
+    if (signed.localName === 'Assertion' && signed.namespaceURI === SAML_NS) {
+        return signed === only ? only : null;
+    }
+    if (signed.localName === 'Response' && signed.namespaceURI === PROTOCOL_NS) {
+        return signed === root ? only : null;
+    }
+    return null;
+}
+/**
+ * The bearer confirmation this login may rely on.
+ *
+ * Every part must hold on the **same** element: gathering `InResponseTo` from
+ * one confirmation and `Recipient` from another is how a document satisfies a
+ * check nothing in it actually satisfies. When several qualify — which a real
+ * identity provider does not produce — the earliest window wins, so the
+ * outcome is a shorter session rather than a longer one.
+ *
+ * `latestNotOnOrAfter` answers a different question: until when could some
+ * confirmation let this assertion in? It is the latest `NotOnOrAfter` among
+ * the confirmations that satisfy every non-temporal part — including one whose
+ * `NotBefore` has not arrived yet, since it qualifies once it does. Replay
+ * retention needs that bound, not the session's; see the caller.
+ */
+function chooseBearerConfirmation(assertion, context, skew) {
+    const now = Date.now();
+    let best = null;
+    let latest = null;
+    const subject = directChild(assertion, SAML_NS, 'Subject');
+    if (!subject)
+        return null;
+    for (const confirmation of directChildren(subject, SAML_NS, 'SubjectConfirmation')) {
+        if (confirmation.getAttribute('Method') !== BEARER)
+            continue;
+        const data = directChild(confirmation, SAML_NS, 'SubjectConfirmationData');
+        if (!data)
+            continue;
+        // Option B: an expected ID must be matched exactly; no expected ID — an
+        // IdP-initiated login — means the attribute must not be there at all.
+        if (context.expectedInResponseTo === undefined) {
+            if (data.hasAttribute('InResponseTo'))
+                continue;
+        }
+        else if (data.getAttribute('InResponseTo') !== context.expectedInResponseTo) {
+            continue;
+        }
+        if (data.getAttribute('Recipient') !== context.acsUrl)
+            continue;
+        const notOnOrAfter = (0, xsdDateTime_1.parseXsdDateTime)(data.getAttribute('NotOnOrAfter'));
+        if (!notOnOrAfter)
+            continue;
+        const notBeforeRaw = data.getAttribute('NotBefore');
+        const notBefore = notBeforeRaw ? (0, xsdDateTime_1.parseXsdDateTime)(notBeforeRaw) : null;
+        if (notBeforeRaw && !notBefore)
+            continue;
+        // Could qualify at some instant: counts towards how long to remember.
+        if (!latest || notOnOrAfter.getTime() > latest.getTime()) {
+            latest = notOnOrAfter;
+        }
+        // Qualifies now: a candidate for the session's window.
+        if (notOnOrAfter.getTime() + skew <= now)
+            continue;
+        if (notBefore && notBefore.getTime() - skew > now)
+            continue;
+        if (!best || notOnOrAfter.getTime() < best.getTime())
+            best = notOnOrAfter;
+    }
+    // `latest` is set whenever `best` is: every qualifying confirmation was
+    // counted towards it first.
+    return best && latest
+        ? { notOnOrAfter: best, latestNotOnOrAfter: latest }
+        : null;
+}

package/dist/validation/documentIds.d.ts

@@ -0,0 +1,15 @@
+import type { Document, Element } from '@xmldom/xmldom';
+/**
+ * The `ID` rules, which run before any signature reference is resolved.
+ *
+ * XML-DSig resolves its reference by `ID`. Two elements sharing one make
+ * "which element is signed" a question the parser answers rather than the
+ * specification, and that ambiguity is the classic lever for signature
+ * wrapping. So uniqueness is established first, across the whole document —
+ * not only across the two elements this validator happens to read.
+ */
+/** The first ID value appearing more than once, or null when all are unique. */
+export declare function findDuplicateId(doc: Document): string | null;
+/** The element's ID, or null when it is absent or empty. */
+export declare function readRequiredId(element: Element): string | null;
+//# sourceMappingURL=documentIds.d.ts.map

package/dist/validation/documentIds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentIds.d.ts","sourceRoot":"","sources":["../../src/validation/documentIds.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAExD;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAU5D;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAG9D"}

package/dist/validation/documentIds.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findDuplicateId = findDuplicateId;
+exports.readRequiredId = readRequiredId;
+/**
+ * The `ID` rules, which run before any signature reference is resolved.
+ *
+ * XML-DSig resolves its reference by `ID`. Two elements sharing one make
+ * "which element is signed" a question the parser answers rather than the
+ * specification, and that ambiguity is the classic lever for signature
+ * wrapping. So uniqueness is established first, across the whole document —
+ * not only across the two elements this validator happens to read.
+ */
+/** The first ID value appearing more than once, or null when all are unique. */
+function findDuplicateId(doc) {
+    const seen = new Set();
+    const elements = doc.getElementsByTagName('*');
+    for (let i = 0; i < elements.length; i++) {
+        const id = elements[i].getAttribute('ID');
+        if (!id)
+            continue;
+        if (seen.has(id))
+            return id;
+        seen.add(id);
+    }
+    return null;
+}
+/** The element's ID, or null when it is absent or empty. */
+function readRequiredId(element) {
+    const id = element.getAttribute('ID');
+    return id ? id : null;
+}

package/dist/validation/inMemoryReplayStore.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Remembering assertions so a replay is refused.
+ *
+ * In memory, and therefore per process. That is honest rather than sufficient:
+ * a deployment running several processes needs a shared store, which is why
+ * the interface exists at all. What this must not be is per provider instance —
+ * a store an attacker escapes by causing a second provider to be constructed
+ * is no store.
+ *
+ * Pruning is lazy, on access, so nothing here holds a timer and nothing needs
+ * disposing.
+ */
+import type { IAssertionReplayStore } from '@mcp-abap-adt/interfaces-auth';
+/** A store of its own, for a test or a consumer wanting isolation. */
+export declare function createInMemoryReplayStore(): IAssertionReplayStore;
+/**
+ * The store the shipped validator uses when the consumer supplies none.
+ *
+ * Module-level, so every default validator in the process shares it.
+ */
+export declare const defaultReplayStore: IAssertionReplayStore;
+//# sourceMappingURL=inMemoryReplayStore.d.ts.map

package/dist/validation/inMemoryReplayStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inMemoryReplayStore.d.ts","sourceRoot":"","sources":["../../src/validation/inMemoryReplayStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAEV,qBAAqB,EACtB,MAAM,+BAA+B,CAAC;AAOvC,sEAAsE;AACtE,wBAAgB,yBAAyB,IAAI,qBAAqB,CAuBjE;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,qBACJ,CAAC"}

package/dist/validation/inMemoryReplayStore.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * Remembering assertions so a replay is refused.
+ *
+ * In memory, and therefore per process. That is honest rather than sufficient:
+ * a deployment running several processes needs a shared store, which is why
+ * the interface exists at all. What this must not be is per provider instance —
+ * a store an attacker escapes by causing a second provider to be constructed
+ * is no store.
+ *
+ * Pruning is lazy, on access, so nothing here holds a timer and nothing needs
+ * disposing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultReplayStore = void 0;
+exports.createInMemoryReplayStore = createInMemoryReplayStore;
+const compositeKey = (key) => 
+// The issuer is length-prefixed so that two different pairs cannot collide
+// by putting the separator inside an identifier.
+`${key.issuer.length}:${key.issuer}:${key.assertionId}`;
+/** A store of its own, for a test or a consumer wanting isolation. */
+function createInMemoryReplayStore() {
+    const seen = new Map();
+    return {
+        async recordIfUnseen(key, retainUntil) {
+            const now = Date.now();
+            // Lazy prune: drop everything whose retention has passed, so the map
+            // cannot grow without bound and no timer is needed.
+            for (const [existing, until] of seen) {
+                if (until <= now)
+                    seen.delete(existing);
+            }
+            const composite = compositeKey(key);
+            if (seen.has(composite))
+                return false;
+            // Nothing awaits between the check and the write, so this is atomic
+            // against other callers on the same event loop. A shared-store
+            // implementation must achieve the same with a conditional write.
+            seen.set(composite, retainUntil.getTime());
+            return true;
+        },
+    };
+}
+/**
+ * The store the shipped validator uses when the consumer supplies none.
+ *
+ * Module-level, so every default validator in the process shares it.
+ */
+exports.defaultReplayStore = createInMemoryReplayStore();

package/dist/validation/signedNode.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Which element the signature covers.
+ *
+ * Not "is there a valid signature" — that question has a true answer in a
+ * document built for a wrapping attack, where a genuinely signed fragment sits
+ * beside a forged one. The caller must read the element this returns and no
+ * other.
+ */
+import type { Document, Element } from '@xmldom/xmldom';
+/**
+ * PEM in, PEM out; bare base64 DER gets its armour — and the result is proved
+ * to be a certificate before anything uses it.
+ *
+ * The spec promises `idpCertificates` accepts either, and a consumer copying
+ * `<X509Certificate>` out of identity-provider metadata has bare base64 DER in
+ * their hand — the armour is not in the metadata. `xml-crypto` accepts only
+ * PEM or a Buffer: measured, a bare base64 certificate makes OpenSSL throw
+ * `DECODER routines::unsupported`, while the same bytes re-armoured verify.
+ *
+ * Left unnormalised that throw would be swallowed by the verification loop and
+ * reported as "the signature does not verify against any configured
+ * certificate" — blaming the assertion for the consumer's formatting.
+ *
+ * Base64 syntax alone does not make a string a certificate: `"AAAA"` passes
+ * the character class, armours cleanly, and fails only inside OpenSSL, which
+ * lands back at the same misleading message. So the armoured result is parsed
+ * with `node:crypto`'s `X509Certificate`, which rejects `"AAAA"` with
+ * `asn1 encoding routines::wrong tag` — measured, not assumed. Called once per
+ * certificate at construction, so the cost never falls on a login.
+ */
+export declare function toPem(certificate: string): string;
+/**
+ * A value taken from the document before any signature has been verified,
+ * made safe to put in a message: JSON-quoted, so a newline smuggled in as
+ * `&#10;` shows as `\n` rather than forging a line in a log, and cut to 64
+ * characters, so an attacker cannot fill a log with it.
+ */
+export declare function quoteUntrusted(value: string): string;
+/**
+ * Verifies every signature in the document against the certificates and
+ * returns the elements they reference. Throws when there is no signature, or
+ * when any one of them fails a rule below.
+ *
+ * `doc` must be the parse of `xml`, and nothing else: signatures are found and
+ * their references resolved in `doc`, while `xml-crypto` verifies the digests
+ * over `xml`. Handed a `doc` from different bytes, the element returned would
+ * not be the one whose bytes were verified.
+ *
+ * Several signatures are normal — identity providers often sign the Response
+ * and the Assertion both. Each is held to every rule on its own; the caller
+ * then takes the element it requires from the returned list.
+ */
+export declare function resolveSignedElements(xml: string, doc: Document, certificates: readonly string[]): Element[];
+//# sourceMappingURL=signedNode.d.ts.map

package/dist/validation/signedNode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signedNode.d.ts","sourceRoot":"","sources":["../../src/validation/signedNode.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAmB,MAAM,gBAAgB,CAAC;AAKzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAuBjD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,OAAO,EAAE,CAeX"}