@mcp-abap-adt/auth-providers 3.0.0 → 4.0.0

package/dist/auth/saml2Auth.d.ts

@@ -9,7 +9,11 @@ export interface Saml2AuthConfig {
     relayState?: string;
     authorizationUrl?: string;
 }
-export declare function buildSamlAuthorizationUrl(config: Saml2AuthConfig): string;
+export interface BuiltAuthorizationUrl {
+    readonly url: string;
+    /** Present only when this function minted the request. */
+    readonly requestId?: string;
+}
+export declare function buildSamlAuthorizationUrl(config: Saml2AuthConfig): BuiltAuthorizationUrl;
 export declare const withSamlCallbackServer: CallbackServerFactory<string>;
-export declare function parseSamlNotOnOrAfter(samlResponse: string): number | undefined;
 //# sourceMappingURL=saml2Auth.d.ts.map

package/dist/auth/saml2Auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2Auth.d.ts","sourceRoot":"","sources":["../../src/auth/saml2Auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAyBD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAazE;AAED,eAAO,MAAM,sBAAsB,EAAE,qBAAqB,CAAC,MAAM,CAgC9D,CAAC;AAEJ,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAYpB"}
+{"version":3,"file":"saml2Auth.d.ts","sourceRoot":"","sources":["../../src/auth/saml2Auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA4BD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,eAAe,GACtB,qBAAqB,CAkBvB;AAED,eAAO,MAAM,sBAAsB,EAAE,qBAAqB,CAAC,MAAM,CAgC9D,CAAC"}

package/dist/auth/saml2Auth.js

@@ -8,7 +8,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.withSamlCallbackServer = void 0;
 exports.buildSamlAuthorizationUrl = buildSamlAuthorizationUrl;
-exports.parseSamlNotOnOrAfter = parseSamlNotOnOrAfter;
 const node_crypto_1 = require("node:crypto");
 const node_zlib_1 = require("node:zlib");
 const express_1 = __importDefault(require("express"));
@@ -18,9 +17,8 @@ function base64Encode(input) {
         ? input.toString('base64')
         : Buffer.from(input, 'utf8').toString('base64');
 }
-function buildAuthnRequestXml(spEntityId, acsUrl) {
+function buildAuthnRequestXml(id, spEntityId, acsUrl) {
     const issueInstant = new Date().toISOString();
-    const id = `_${(0, node_crypto_1.randomUUID)()}`;
     return [
         '<?xml version="1.0" encoding="UTF-8"?>',
         '<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"',
@@ -36,15 +34,20 @@ function buildAuthnRequestXml(spEntityId, acsUrl) {
 }
 function buildSamlAuthorizationUrl(config) {
     if (config.authorizationUrl) {
-        return config.authorizationUrl;
+        // Somebody else built the request; its ID is not ours to know.
+        return { url: config.authorizationUrl };
     }
-    const xml = buildAuthnRequestXml(config.spEntityId, config.acsUrl);
+    const requestId = `_${(0, node_crypto_1.randomUUID)()}`;
+    const xml = buildAuthnRequestXml(requestId, config.spEntityId, config.acsUrl);
     const deflated = (0, node_zlib_1.deflateRawSync)(Buffer.from(xml, 'utf8'));
     const samlRequest = encodeURIComponent(base64Encode(deflated));
     const relayState = config.relayState
         ? `&RelayState=${encodeURIComponent(config.relayState)}`
         : '';
-    return `${config.idpSsoUrl}?SAMLRequest=${samlRequest}${relayState}`;
+    return {
+        url: `${config.idpSsoUrl}?SAMLRequest=${samlRequest}${relayState}`,
+        requestId,
+    };
 }
 const withSamlCallbackServer = (options, use) => (0, callbackServer_1.runCallbackScope)(options, (app, settle) => {
     app.use(express_1.default.urlencoded({ extended: false, limit: '5mb' }));
@@ -69,17 +72,3 @@ const withSamlCallbackServer = (options, use) => (0, callbackServer_1.runCallbac
     });
 }, use);
 exports.withSamlCallbackServer = withSamlCallbackServer;
-function parseSamlNotOnOrAfter(samlResponse) {
-    try {
-        const decoded = Buffer.from(samlResponse, 'base64').toString('utf8');
-        const match = decoded.match(/NotOnOrAfter="([^"]+)"/);
-        if (!match) {
-            return undefined;
-        }
-        const date = Date.parse(match[1]);
-        return Number.isNaN(date) ? undefined : date;
-    }
-    catch {
-        return undefined;
-    }
-}

package/dist/auth/samlBearerAssertion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"samlBearerAssertion.d.ts","sourceRoot":"","sources":["../../src/auth/samlBearerAssertion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmDzD"}
+{"version":3,"file":"samlBearerAssertion.d.ts","sourceRoot":"","sources":["../../src/auth/samlBearerAssertion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmDzD"}

package/dist/auth/samlBearerAssertion.js

@@ -24,6 +24,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.toBearerAssertion = toBearerAssertion;
 const xmldom_1 = require("@xmldom/xmldom");
+const strictXml_1 = require("./strictXml");
 const SAML_ASSERTION_NS = 'urn:oasis:names:tc:SAML:2.0:assertion';
 const SAML_PROTOCOL_NS = 'urn:oasis:names:tc:SAML:2.0:protocol';
 function toBearerAssertion(payload) {
@@ -34,7 +35,7 @@ function toBearerAssertion(payload) {
     }
     let root;
     try {
-        root = new xmldom_1.DOMParser().parseFromString(xml, 'text/xml').documentElement;
+        root = (0, strictXml_1.parseStrictXml)(xml).documentElement;
     }
     catch (error) {
         throw new Error(`SAML bearer payload is not well-formed XML: ${error instanceof Error ? error.message : String(error)}`);

package/dist/auth/strictXml.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Parsing untrusted XML so that any fault is a refusal.
+ *
+ * @xmldom/xmldom's defaults are wrong for a security boundary in two ways:
+ * without `onError` it reports every fault to the console — so a malformed
+ * callback from anyone writes to the process's stderr, past `ILogger` — and it
+ * recovers from `error`-level faults (an undeclared entity, say) by handing
+ * back a repaired document instead of failing. Throwing from `onError` turns
+ * every level into a `ParseError`, silently.
+ */
+import { type Document } from '@xmldom/xmldom';
+export declare function parseStrictXml(xml: string): Document;
+//# sourceMappingURL=strictXml.d.ts.map

package/dist/auth/strictXml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strictXml.d.ts","sourceRoot":"","sources":["../../src/auth/strictXml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAMpD"}

package/dist/auth/strictXml.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * Parsing untrusted XML so that any fault is a refusal.
+ *
+ * @xmldom/xmldom's defaults are wrong for a security boundary in two ways:
+ * without `onError` it reports every fault to the console — so a malformed
+ * callback from anyone writes to the process's stderr, past `ILogger` — and it
+ * recovers from `error`-level faults (an undeclared entity, say) by handing
+ * back a repaired document instead of failing. Throwing from `onError` turns
+ * every level into a `ParseError`, silently.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseStrictXml = parseStrictXml;
+const xmldom_1 = require("@xmldom/xmldom");
+function parseStrictXml(xml) {
+    return new xmldom_1.DOMParser({
+        onError: (level, message) => {
+            throw new Error(`XML ${level}: ${message}`);
+        },
+    }).parseFromString(xml, 'text/xml');
+}

package/dist/errors/AssertionValidationError.d.ts

@@ -0,0 +1,15 @@
+/**
+ * An assertion was refused, and by which check.
+ *
+ * The check is a field rather than something to read out of the message: a
+ * consumer telling "your identity provider declined" from "this was not
+ * addressed to us" should not be parsing prose to do it.
+ */
+import { TokenProviderError } from './TokenProviderErrors';
+/** The checks the shipped validator performs, in the order it performs them. */
+export type AssertionCheck = 'document' | 'duplicateId' | 'signature' | 'signedNode' | 'status' | 'assertionId' | 'issuer' | 'conditions' | 'notBefore' | 'notOnOrAfter' | 'audience' | 'bearerConfirmation' | 'destination' | 'replay';
+export declare class AssertionValidationError extends TokenProviderError {
+    readonly check: AssertionCheck;
+    constructor(check: AssertionCheck, message: string);
+}
+//# sourceMappingURL=AssertionValidationError.d.ts.map

package/dist/errors/AssertionValidationError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AssertionValidationError.d.ts","sourceRoot":"","sources":["../../src/errors/AssertionValidationError.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,gFAAgF;AAChF,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,aAAa,GACb,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,cAAc,GACd,UAAU,GACV,oBAAoB,GACpB,aAAa,GACb,QAAQ,CAAC;AAEb,qBAAa,wBAAyB,SAAQ,kBAAkB;IAC9D,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;gBAEnB,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM;CAQnD"}

package/dist/errors/AssertionValidationError.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * An assertion was refused, and by which check.
+ *
+ * The check is a field rather than something to read out of the message: a
+ * consumer telling "your identity provider declined" from "this was not
+ * addressed to us" should not be parsing prose to do it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AssertionValidationError = void 0;
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
+const TokenProviderErrors_1 = require("./TokenProviderErrors");
+class AssertionValidationError extends TokenProviderErrors_1.TokenProviderError {
+    check;
+    constructor(check, message) {
+        super(message, interfaces_auth_1.ASSERTION_ERROR_CODES.VALIDATION_ERROR);
+        this.name = 'AssertionValidationError';
+        this.check = check;
+        // Every sibling in TokenProviderErrors.ts does this; without it
+        // `instanceof` fails across a compiled boundary.
+        Object.setPrototypeOf(this, AssertionValidationError.prototype);
+    }
+}
+exports.AssertionValidationError = AssertionValidationError;

package/dist/errors/TokenProviderErrors.d.ts

@@ -46,4 +46,6 @@ export declare class BrowserAuthError extends TokenProviderError {
     readonly cause?: Error | undefined;
     constructor(message: string, cause?: Error | undefined);
 }
+export type { AssertionCheck } from './AssertionValidationError';
+export { AssertionValidationError } from './AssertionValidationError';
 //# sourceMappingURL=TokenProviderErrors.d.ts.map

package/dist/errors/TokenProviderErrors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TokenProviderErrors.d.ts","sourceRoot":"","sources":["../../src/errors/TokenProviderErrors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAM/B;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;aAGnC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,kBAAkB;aAGhC,KAAK,CAAC,EAAE,KAAK;gBAD7B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,KAAK,YAAA;CAMhC;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,kBAAkB;aAGpC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;aAGnC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,kBAAkB;aAGpC,KAAK,CAAC,EAAE,KAAK;gBAD7B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,KAAK,YAAA;CAMhC"}
+{"version":3,"file":"TokenProviderErrors.d.ts","sourceRoot":"","sources":["../../src/errors/TokenProviderErrors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAM/B;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;aAGnC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,kBAAkB;aAGhC,KAAK,CAAC,EAAE,KAAK;gBAD7B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,KAAK,YAAA;CAMhC;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,kBAAkB;aAGpC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;aAGnC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,kBAAkB;aAGpC,KAAK,CAAC,EAAE,KAAK;gBAD7B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,KAAK,YAAA;CAMhC;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/errors/TokenProviderErrors.js

@@ -6,7 +6,7 @@
  * to enable better error handling and debugging.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BrowserAuthError = exports.ServiceKeyError = exports.SessionDataError = exports.RefreshError = exports.ValidationError = exports.TokenProviderError = void 0;
+exports.AssertionValidationError = exports.BrowserAuthError = exports.ServiceKeyError = exports.SessionDataError = exports.RefreshError = exports.ValidationError = exports.TokenProviderError = void 0;
 const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 /**
  * Base class for all token provider errors
@@ -86,3 +86,5 @@ class BrowserAuthError extends TokenProviderError {
     }
 }
 exports.BrowserAuthError = BrowserAuthError;
+var AssertionValidationError_1 = require("./AssertionValidationError");
+Object.defineProperty(exports, "AssertionValidationError", { enumerable: true, get: function () { return AssertionValidationError_1.AssertionValidationError; } });

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export { withBrowserCallbackServer } from './auth/callbackServer';
 export type { OidcCallbackResult } from './auth/oidcBrowserAuth';
 export { withOidcCallbackServer } from './auth/oidcBrowserAuth';
 export { withSamlCallbackServer } from './auth/saml2Auth';
+export { type AssertionCheck, AssertionValidationError, } from './errors/AssertionValidationError';
 export { BrowserAuthError, RefreshError, ServiceKeyError, SessionDataError, TokenProviderError, ValidationError, } from './errors/TokenProviderErrors';
 export type { AuthorizationCodeProviderConfig, ClientCredentialsProviderConfig, OidcBrowserProviderConfig, OidcDeviceFlowProviderConfig, OidcPasswordProviderConfig, OidcTokenExchangeProviderConfig, Saml2BearerProviderConfig, Saml2PureProviderConfig, UaaPasscodeProviderConfig, } from './providers';
 export { AuthorizationCodeProvider, BaseTokenProvider, ClientCredentialsProvider, OidcBrowserProvider, OidcDeviceFlowProvider, OidcPasswordProvider, OidcTokenExchangeProvider, Saml2BearerProvider, Saml2PureProvider, UaaPasscodeProvider, } from './providers';
@@ -15,4 +16,6 @@ export { SsoProviderFactory } from './sso/SsoProviderFactory';
 export type { SsoProviderConfig, SsoProviderInstance } from './sso/types';
 export type { BrowserCallbackStrategyOptions, CallbackStrategyOptions, ExternalCodeStrategyOptions, ManualStrategyOptions, StaticCodeStrategyOptions, } from './strategies';
 export { asOidcResult, BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, externalCodeStrategy, manualPasscodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, oidcCallbackStrategy, samlCallbackStrategy, staticCodeStrategy, } from './strategies';
+export { createSignedAssertionValidator, createSignedResponseValidator, type ShippedValidatorOptions, } from './validation/assertionValidator';
+export { createInMemoryReplayStore, defaultReplayStore, } from './validation/inMemoryReplayStore';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,KAAK,cAAc,EACnB,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -6,7 +6,7 @@
  * Provides token providers
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.staticCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.manualPasscodeStrategy = exports.externalCodeStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = exports.SsoProviderFactory = exports.UaaPasscodeProvider = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = exports.withSamlCallbackServer = exports.withOidcCallbackServer = exports.withBrowserCallbackServer = void 0;
+exports.defaultReplayStore = exports.createInMemoryReplayStore = exports.createSignedResponseValidator = exports.createSignedAssertionValidator = exports.staticCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.manualPasscodeStrategy = exports.externalCodeStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = exports.SsoProviderFactory = exports.UaaPasscodeProvider = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = exports.AssertionValidationError = exports.withSamlCallbackServer = exports.withOidcCallbackServer = exports.withBrowserCallbackServer = void 0;
 // Callback server factories — "take the transport this package gives".
 var callbackServer_1 = require("./auth/callbackServer");
 Object.defineProperty(exports, "withBrowserCallbackServer", { enumerable: true, get: function () { return callbackServer_1.withBrowserCallbackServer; } });
@@ -15,6 +15,8 @@ Object.defineProperty(exports, "withOidcCallbackServer", { enumerable: true, get
 var saml2Auth_1 = require("./auth/saml2Auth");
 Object.defineProperty(exports, "withSamlCallbackServer", { enumerable: true, get: function () { return saml2Auth_1.withSamlCallbackServer; } });
 // Errors
+var AssertionValidationError_1 = require("./errors/AssertionValidationError");
+Object.defineProperty(exports, "AssertionValidationError", { enumerable: true, get: function () { return AssertionValidationError_1.AssertionValidationError; } });
 var TokenProviderErrors_1 = require("./errors/TokenProviderErrors");
 Object.defineProperty(exports, "BrowserAuthError", { enumerable: true, get: function () { return TokenProviderErrors_1.BrowserAuthError; } });
 Object.defineProperty(exports, "RefreshError", { enumerable: true, get: function () { return TokenProviderErrors_1.RefreshError; } });
@@ -51,3 +53,11 @@ Object.defineProperty(exports, "manualSamlResponseStrategy", { enumerable: true,
 Object.defineProperty(exports, "oidcCallbackStrategy", { enumerable: true, get: function () { return strategies_1.oidcCallbackStrategy; } });
 Object.defineProperty(exports, "samlCallbackStrategy", { enumerable: true, get: function () { return strategies_1.samlCallbackStrategy; } });
 Object.defineProperty(exports, "staticCodeStrategy", { enumerable: true, get: function () { return strategies_1.staticCodeStrategy; } });
+// SAML assertion validation — the two shipped validators and the replay store,
+// or bring your own IAssertionValidator / IAssertionReplayStore.
+var assertionValidator_1 = require("./validation/assertionValidator");
+Object.defineProperty(exports, "createSignedAssertionValidator", { enumerable: true, get: function () { return assertionValidator_1.createSignedAssertionValidator; } });
+Object.defineProperty(exports, "createSignedResponseValidator", { enumerable: true, get: function () { return assertionValidator_1.createSignedResponseValidator; } });
+var inMemoryReplayStore_1 = require("./validation/inMemoryReplayStore");
+Object.defineProperty(exports, "createInMemoryReplayStore", { enumerable: true, get: function () { return inMemoryReplayStore_1.createInMemoryReplayStore; } });
+Object.defineProperty(exports, "defaultReplayStore", { enumerable: true, get: function () { return inMemoryReplayStore_1.defaultReplayStore; } });

package/dist/providers/Saml2BearerProvider.d.ts

@@ -14,6 +14,7 @@ export interface Saml2BearerProviderConfig extends Saml2CommonConfig, Saml2Beare
 }
 export declare class Saml2BearerProvider extends BaseTokenProvider {
     private config;
+    private readonly validator;
     constructor(config: Saml2BearerProviderConfig);
     protected getAuthType(): OAuth2GrantType;
     protected performLogin(): Promise<ITokenResult>;

package/dist/providers/Saml2BearerProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAM9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAOtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAiB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAsBrD;;;;OAIG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqBxD"}
+{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAEV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAM9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAQtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;gBAEpC,MAAM,EAAE,yBAAyB;IAqB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAgCrD;;;;OAIG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqBxD"}

package/dist/providers/Saml2BearerProvider.js

@@ -13,11 +13,16 @@ const BaseTokenProvider_1 = require("./BaseTokenProvider");
 const saml2Utils_1 = require("./saml2Utils");
 class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
     config;
+    validator;
     constructor(config) {
         super();
         // A pre-built URL with no declared ACS cannot be verified against whatever
         // the strategy binds, so it is refused here rather than at login time.
         (0, saml2Utils_1.validateSamlConfig)(config);
+        // Before anything reaches a browser or a network: a missing certificate is
+        // the consumer's mistake, and finding it after a completed login wastes
+        // theirs.
+        this.validator = (0, saml2Utils_1.resolveAssertionValidator)(config, 'bearer');
         this.config = config;
         this.logger = config.logger;
         if (config.accessToken) {
@@ -32,11 +37,21 @@ class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return interfaces_auth_1.AUTH_TYPE_SAML2_BEARER;
     }
     async performLogin() {
-        const samlResponse = await (0, saml2Utils_1.getSamlAssertion)(this.config);
+        const { payload, requestId, acsUrl } = await (0, saml2Utils_1.getSamlAssertion)(this.config);
+        // Validation establishes trust before anything reaches the token
+        // endpoint; it does not change what is sent beyond toBearerAssertion's
+        // conversion below.
+        await this.validator.validate(payload, {
+            expectedInResponseTo: requestId,
+            audience: this.config.spEntityId,
+            acsUrl,
+            expectedIssuer: this.config.idpEntityId,
+            logger: this.logger,
+        });
         const tokenUrl = (0, saml2Utils_1.resolveTokenUrl)(this.config);
         // RFC 7522 takes one base64url Assertion; a login delivers the whole
         // Response in standard base64, which a conforming endpoint refuses.
-        const tokens = await (0, saml2TokenExchange_1.exchangeSamlAssertion)((0, samlBearerAssertion_1.toBearerAssertion)(samlResponse), tokenUrl, this.config.clientId, this.config.clientSecret, this.logger);
+        const tokens = await (0, saml2TokenExchange_1.exchangeSamlAssertion)((0, samlBearerAssertion_1.toBearerAssertion)(payload), tokenUrl, this.config.clientId, this.config.clientSecret, this.logger);
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,

package/dist/providers/Saml2PureProvider.d.ts

@@ -13,6 +13,7 @@ export interface Saml2PureProviderConfig extends Saml2CommonConfig {
 }
 export declare class Saml2PureProvider extends BaseTokenProvider {
     private config;
+    private readonly validator;
     constructor(config: Saml2PureProviderConfig);
     protected getAuthType(): OAuth2GrantType;
     protected performLogin(): Promise<ITokenResult>;

package/dist/providers/Saml2PureProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Saml2PureProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2PureProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,qBAAa,iBAAkB,SAAQ,iBAAiB;IACtD,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,uBAAuB;IAU3C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAarC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAGxD"}
+{"version":3,"file":"Saml2PureProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2PureProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAEV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAOtD,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,qBAAa,iBAAkB,SAAQ,iBAAiB;IACtD,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;gBAEpC,MAAM,EAAE,uBAAuB;IAc3C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAuBrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAGxD"}

package/dist/providers/Saml2PureProvider.js

@@ -7,16 +7,20 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Saml2PureProvider = void 0;
 const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
-const saml2Auth_1 = require("../auth/saml2Auth");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
 const saml2Utils_1 = require("./saml2Utils");
 class Saml2PureProvider extends BaseTokenProvider_1.BaseTokenProvider {
     config;
+    validator;
     constructor(config) {
         super();
         // A pre-built URL with no declared ACS cannot be verified against whatever
         // the strategy binds, so it is refused here rather than at login time.
         (0, saml2Utils_1.validateSamlConfig)(config);
+        // Before anything reaches a browser or a network: a missing certificate is
+        // the consumer's mistake, and finding it after a completed login wastes
+        // theirs.
+        this.validator = (0, saml2Utils_1.resolveAssertionValidator)(config, 'pure');
         this.config = config;
         this.logger = config.logger;
         this.tokenType = 'saml';
@@ -25,14 +29,24 @@ class Saml2PureProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return interfaces_auth_1.AUTH_TYPE_USER_TOKEN;
     }
     async performLogin() {
-        const samlResponse = await (0, saml2Utils_1.getSamlAssertion)(this.config);
-        const expiresAt = (0, saml2Auth_1.parseSamlNotOnOrAfter)(samlResponse);
-        const sessionCookies = await this.config.cookieProvider(samlResponse);
+        const { payload, requestId, acsUrl } = await (0, saml2Utils_1.getSamlAssertion)(this.config);
+        // acsUrl is where the strategy actually listened — with an ephemeral port
+        // the configured value is usually absent and never authoritative.
+        const validated = await this.validator.validate(payload, {
+            expectedInResponseTo: requestId,
+            audience: this.config.spEntityId,
+            acsUrl,
+            expectedIssuer: this.config.idpEntityId,
+            logger: this.logger,
+        });
+        const sessionCookies = await this.config.cookieProvider(payload);
         return {
             authorizationToken: sessionCookies,
             authType: interfaces_auth_1.AUTH_TYPE_USER_TOKEN,
             tokenType: 'saml',
-            expiresAt,
+            // ITokenResult.expiresAt is an epoch-ms number, unlike
+            // ValidatedAssertion.expiresAt, which is a Date.
+            expiresAt: validated.expiresAt.getTime(),
         };
     }
     async performRefresh() {

package/dist/providers/saml2Utils.d.ts

@@ -1,7 +1,7 @@
 /**
  * SAML2 provider shared helpers.
  */
-import type { IAuthorizationStrategy } from '@mcp-abap-adt/interfaces-auth';
+import type { IAssertionReplayStore, IAssertionValidator, IAuthorizationStrategy } from '@mcp-abap-adt/interfaces-auth';
 import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 export interface Saml2CommonConfig {
     idpSsoUrl: string;
@@ -17,6 +17,32 @@ export interface Saml2CommonConfig {
     /** How the login is conducted. Omitted means a browser callback. */
     authorization?: IAuthorizationStrategy<string>;
     logger?: ILogger;
+    /** PEM or bare base64 DER. Required when no `assertionValidator` is supplied. */
+    idpCertificates?: string[];
+    /**
+     * The `Issuer` the assertion must name. Required unless the supplied
+     * `assertionValidator` is a custom one: a shipped validator supplied there
+     * still needs it, since it fails closed without an expected issuer.
+     */
+    idpEntityId?: string;
+    /** Finite, non-negative, integer. Defaults to 0. */
+    clockSkewMs?: number;
+    /**
+     * The AuthnRequest ID this login answers, when this package did not mint one
+     * itself — a pre-built `authorizationUrl`, or a strategy that obtained the
+     * response some other way after a request the consumer sent.
+     */
+    authnRequestId?: string;
+    /**
+     * Declares that no AuthnRequest is sent: the assertion must carry no
+     * `InResponseTo`. Default `false`. Combining this with a minted or declared
+     * request ID is a configuration error: the two describe different logins.
+     */
+    idpInitiated?: boolean;
+    /** Which validator to use. Omitted means the provider's own default. */
+    assertionValidator?: IAssertionValidator;
+    /** A consumer's own replay store, for a deployment running more than one process. */
+    assertionReplayStore?: IAssertionReplayStore;
 }
 export interface Saml2BearerExchangeConfig {
     tokenUrl?: string;
@@ -26,6 +52,27 @@ export interface Saml2BearerExchangeConfig {
 }
 /** Throw at construction rather than half-verify at runtime. */
 export declare function validateSamlConfig(config: Saml2CommonConfig): void;
+/**
+ * The consumer's validator when supplied, otherwise the provider's default —
+ * `createSignedAssertionValidator` for `"bearer"`, since the token endpoint
+ * receives the Assertion alone (#40) and its own signature is what that
+ * endpoint verifies; `createSignedResponseValidator` for `"pure"`, since the
+ * whole response is handed on and `Status`/`Destination` must be inside a
+ * signature. See the spec's "A bare Assertion, and which validator each
+ * provider defaults to".
+ */
+export declare function resolveAssertionValidator(config: Saml2CommonConfig, provider: 'bearer' | 'pure'): IAssertionValidator;
 export declare function resolveTokenUrl(config: Saml2BearerExchangeConfig): string;
-export declare function getSamlAssertion(config: Saml2CommonConfig): Promise<string>;
+/** What `getSamlAssertion` hands back: the wire payload, plus what it knows about the login. */
+export interface SamlAssertionResult {
+    readonly payload: string;
+    /**
+     * `undefined` exactly when the login is declared `idpInitiated` and no ID
+     * was minted or declared for it.
+     */
+    readonly requestId?: string;
+    /** Where the strategy actually listened — `outcome.redirectUri`, never `config.acsUrl`. */
+    readonly acsUrl: string;
+}
+export declare function getSamlAssertion(config: Saml2CommonConfig): Promise<SamlAssertionResult>;
 //# sourceMappingURL=saml2Utils.d.ts.map

package/dist/providers/saml2Utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2Utils.d.ts","sourceRoot":"","sources":["../../src/providers/saml2Utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAI9D,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAOlE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAQzE;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,MAAM,CAAC,CA+CjB"}
+{"version":3,"file":"saml2Utils.d.ts","sourceRoot":"","sources":["../../src/providers/saml2Utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAU9D,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,mBAAmB,CAAC;IACzC,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAOlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,iBAAiB,EACzB,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAC1B,mBAAmB,CAsCrB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAQzE;AAED,gGAAgG;AAChG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CAuE9B"}