@mcp-abap-adt/auth-providers 3.0.0 → 4.0.0

package/dist/validation/documentIds.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findDuplicateId = findDuplicateId;
+exports.readRequiredId = readRequiredId;
+/**
+ * The `ID` rules, which run before any signature reference is resolved.
+ *
+ * XML-DSig resolves its reference by `ID`. Two elements sharing one make
+ * "which element is signed" a question the parser answers rather than the
+ * specification, and that ambiguity is the classic lever for signature
+ * wrapping. So uniqueness is established first, across the whole document —
+ * not only across the two elements this validator happens to read.
+ */
+/** The first ID value appearing more than once, or null when all are unique. */
+function findDuplicateId(doc) {
+    const seen = new Set();
+    const elements = doc.getElementsByTagName('*');
+    for (let i = 0; i < elements.length; i++) {
+        const id = elements[i].getAttribute('ID');
+        if (!id)
+            continue;
+        if (seen.has(id))
+            return id;
+        seen.add(id);
+    }
+    return null;
+}
+/** The element's ID, or null when it is absent or empty. */
+function readRequiredId(element) {
+    const id = element.getAttribute('ID');
+    return id ? id : null;
+}

package/dist/validation/inMemoryReplayStore.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Remembering assertions so a replay is refused.
+ *
+ * In memory, and therefore per process. That is honest rather than sufficient:
+ * a deployment running several processes needs a shared store, which is why
+ * the interface exists at all. What this must not be is per provider instance —
+ * a store an attacker escapes by causing a second provider to be constructed
+ * is no store.
+ *
+ * Pruning is lazy, on access, so nothing here holds a timer and nothing needs
+ * disposing.
+ */
+import type { IAssertionReplayStore } from '@mcp-abap-adt/interfaces-auth';
+/** A store of its own, for a test or a consumer wanting isolation. */
+export declare function createInMemoryReplayStore(): IAssertionReplayStore;
+/**
+ * The store the shipped validator uses when the consumer supplies none.
+ *
+ * Module-level, so every default validator in the process shares it.
+ */
+export declare const defaultReplayStore: IAssertionReplayStore;
+//# sourceMappingURL=inMemoryReplayStore.d.ts.map

package/dist/validation/inMemoryReplayStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inMemoryReplayStore.d.ts","sourceRoot":"","sources":["../../src/validation/inMemoryReplayStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAEV,qBAAqB,EACtB,MAAM,+BAA+B,CAAC;AAOvC,sEAAsE;AACtE,wBAAgB,yBAAyB,IAAI,qBAAqB,CAuBjE;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,qBACJ,CAAC"}

package/dist/validation/inMemoryReplayStore.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * Remembering assertions so a replay is refused.
+ *
+ * In memory, and therefore per process. That is honest rather than sufficient:
+ * a deployment running several processes needs a shared store, which is why
+ * the interface exists at all. What this must not be is per provider instance —
+ * a store an attacker escapes by causing a second provider to be constructed
+ * is no store.
+ *
+ * Pruning is lazy, on access, so nothing here holds a timer and nothing needs
+ * disposing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultReplayStore = void 0;
+exports.createInMemoryReplayStore = createInMemoryReplayStore;
+const compositeKey = (key) => 
+// The issuer is length-prefixed so that two different pairs cannot collide
+// by putting the separator inside an identifier.
+`${key.issuer.length}:${key.issuer}:${key.assertionId}`;
+/** A store of its own, for a test or a consumer wanting isolation. */
+function createInMemoryReplayStore() {
+    const seen = new Map();
+    return {
+        async recordIfUnseen(key, retainUntil) {
+            const now = Date.now();
+            // Lazy prune: drop everything whose retention has passed, so the map
+            // cannot grow without bound and no timer is needed.
+            for (const [existing, until] of seen) {
+                if (until <= now)
+                    seen.delete(existing);
+            }
+            const composite = compositeKey(key);
+            if (seen.has(composite))
+                return false;
+            // Nothing awaits between the check and the write, so this is atomic
+            // against other callers on the same event loop. A shared-store
+            // implementation must achieve the same with a conditional write.
+            seen.set(composite, retainUntil.getTime());
+            return true;
+        },
+    };
+}
+/**
+ * The store the shipped validator uses when the consumer supplies none.
+ *
+ * Module-level, so every default validator in the process shares it.
+ */
+exports.defaultReplayStore = createInMemoryReplayStore();

package/dist/validation/signedNode.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Which element the signature covers.
+ *
+ * Not "is there a valid signature" — that question has a true answer in a
+ * document built for a wrapping attack, where a genuinely signed fragment sits
+ * beside a forged one. The caller must read the element this returns and no
+ * other.
+ */
+import type { Document, Element } from '@xmldom/xmldom';
+/**
+ * PEM in, PEM out; bare base64 DER gets its armour — and the result is proved
+ * to be a certificate before anything uses it.
+ *
+ * The spec promises `idpCertificates` accepts either, and a consumer copying
+ * `<X509Certificate>` out of identity-provider metadata has bare base64 DER in
+ * their hand — the armour is not in the metadata. `xml-crypto` accepts only
+ * PEM or a Buffer: measured, a bare base64 certificate makes OpenSSL throw
+ * `DECODER routines::unsupported`, while the same bytes re-armoured verify.
+ *
+ * Left unnormalised that throw would be swallowed by the verification loop and
+ * reported as "the signature does not verify against any configured
+ * certificate" — blaming the assertion for the consumer's formatting.
+ *
+ * Base64 syntax alone does not make a string a certificate: `"AAAA"` passes
+ * the character class, armours cleanly, and fails only inside OpenSSL, which
+ * lands back at the same misleading message. So the armoured result is parsed
+ * with `node:crypto`'s `X509Certificate`, which rejects `"AAAA"` with
+ * `asn1 encoding routines::wrong tag` — measured, not assumed. Called once per
+ * certificate at construction, so the cost never falls on a login.
+ */
+export declare function toPem(certificate: string): string;
+/**
+ * A value taken from the document before any signature has been verified,
+ * made safe to put in a message: JSON-quoted, so a newline smuggled in as
+ * `&#10;` shows as `\n` rather than forging a line in a log, and cut to 64
+ * characters, so an attacker cannot fill a log with it.
+ */
+export declare function quoteUntrusted(value: string): string;
+/**
+ * Verifies every signature in the document against the certificates and
+ * returns the elements they reference. Throws when there is no signature, or
+ * when any one of them fails a rule below.
+ *
+ * `doc` must be the parse of `xml`, and nothing else: signatures are found and
+ * their references resolved in `doc`, while `xml-crypto` verifies the digests
+ * over `xml`. Handed a `doc` from different bytes, the element returned would
+ * not be the one whose bytes were verified.
+ *
+ * Several signatures are normal — identity providers often sign the Response
+ * and the Assertion both. Each is held to every rule on its own; the caller
+ * then takes the element it requires from the returned list.
+ */
+export declare function resolveSignedElements(xml: string, doc: Document, certificates: readonly string[]): Element[];
+//# sourceMappingURL=signedNode.d.ts.map

package/dist/validation/signedNode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signedNode.d.ts","sourceRoot":"","sources":["../../src/validation/signedNode.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAmB,MAAM,gBAAgB,CAAC;AAKzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAuBjD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,OAAO,EAAE,CAeX"}

package/dist/validation/signedNode.js

@@ -0,0 +1,171 @@
+"use strict";
+/**
+ * Which element the signature covers.
+ *
+ * Not "is there a valid signature" — that question has a true answer in a
+ * document built for a wrapping attack, where a genuinely signed fragment sits
+ * beside a forged one. The caller must read the element this returns and no
+ * other.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPem = toPem;
+exports.quoteUntrusted = quoteUntrusted;
+exports.resolveSignedElements = resolveSignedElements;
+const node_crypto_1 = require("node:crypto");
+const xml_crypto_1 = require("xml-crypto");
+const DSIG_NS = 'http://www.w3.org/2000/09/xmldsig#';
+/**
+ * PEM in, PEM out; bare base64 DER gets its armour — and the result is proved
+ * to be a certificate before anything uses it.
+ *
+ * The spec promises `idpCertificates` accepts either, and a consumer copying
+ * `<X509Certificate>` out of identity-provider metadata has bare base64 DER in
+ * their hand — the armour is not in the metadata. `xml-crypto` accepts only
+ * PEM or a Buffer: measured, a bare base64 certificate makes OpenSSL throw
+ * `DECODER routines::unsupported`, while the same bytes re-armoured verify.
+ *
+ * Left unnormalised that throw would be swallowed by the verification loop and
+ * reported as "the signature does not verify against any configured
+ * certificate" — blaming the assertion for the consumer's formatting.
+ *
+ * Base64 syntax alone does not make a string a certificate: `"AAAA"` passes
+ * the character class, armours cleanly, and fails only inside OpenSSL, which
+ * lands back at the same misleading message. So the armoured result is parsed
+ * with `node:crypto`'s `X509Certificate`, which rejects `"AAAA"` with
+ * `asn1 encoding routines::wrong tag` — measured, not assumed. Called once per
+ * certificate at construction, so the cost never falls on a login.
+ */
+function toPem(certificate) {
+    const trimmed = certificate.trim();
+    const pem = trimmed.includes('-----BEGIN')
+        ? trimmed
+        : (() => {
+            const body = trimmed.replace(/\s+/g, '');
+            if (!/^[A-Za-z0-9+/]+={0,2}$/.test(body)) {
+                throw new Error('a configured certificate is neither PEM nor base64 DER');
+            }
+            const wrapped = body.replace(/(.{64})/g, '$1\n').trim();
+            return `-----BEGIN CERTIFICATE-----\n${wrapped}\n-----END CERTIFICATE-----\n`;
+        })();
+    try {
+        new node_crypto_1.X509Certificate(pem);
+    }
+    catch (error) {
+        throw new Error(`a configured certificate is not a valid X.509 certificate: ${error.message}`);
+    }
+    return pem;
+}
+/**
+ * A value taken from the document before any signature has been verified,
+ * made safe to put in a message: JSON-quoted, so a newline smuggled in as
+ * `&#10;` shows as `\n` rather than forging a line in a log, and cut to 64
+ * characters, so an attacker cannot fill a log with it.
+ */
+function quoteUntrusted(value) {
+    const limit = 64;
+    return JSON.stringify(value.length > limit ? `${value.slice(0, limit)}…` : value);
+}
+/**
+ * Verifies every signature in the document against the certificates and
+ * returns the elements they reference. Throws when there is no signature, or
+ * when any one of them fails a rule below.
+ *
+ * `doc` must be the parse of `xml`, and nothing else: signatures are found and
+ * their references resolved in `doc`, while `xml-crypto` verifies the digests
+ * over `xml`. Handed a `doc` from different bytes, the element returned would
+ * not be the one whose bytes were verified.
+ *
+ * Several signatures are normal — identity providers often sign the Response
+ * and the Assertion both. Each is held to every rule on its own; the caller
+ * then takes the element it requires from the returned list.
+ */
+function resolveSignedElements(xml, doc, certificates) {
+    const signatures = doc.getElementsByTagNameNS(DSIG_NS, 'Signature');
+    if (signatures.length === 0) {
+        throw new Error('the document carries no signature');
+    }
+    // Every signature is held to every rule: an extra signature that fails is
+    // something that should not be there, not noise to skip. Two verifying
+    // signatures over one element cannot occur — under the enveloped-signature
+    // transform the later one changes the bytes the earlier one's digest
+    // covered — so no separate rule guards against it.
+    const covered = [];
+    for (let i = 0; i < signatures.length; i++) {
+        covered.push(resolveOne(xml, doc, signatures[i], certificates));
+    }
+    return covered;
+}
+/** One signature: verified, exactly one reference, enveloped by its target. */
+function resolveOne(xml, doc, signatureNode, certificates) {
+    let verified = false;
+    for (const certificate of certificates) {
+        // Already normalised and proved at construction, so a throw here really
+        // is a bad signature rather than a formatting mistake.
+        // getCertFromKeyInfo is pinned to "none": a certificate the document
+        // carries in its own KeyInfo is the sender's claim about who signed it,
+        // and xml-crypto prefers it to publicCert when the hook returns one. It
+        // defaults to a no-op in 6.x; stating it keeps a future default from
+        // quietly letting an attacker's embedded certificate verify their own
+        // signature.
+        const verifier = new xml_crypto_1.SignedXml({
+            publicCert: certificate,
+            getCertFromKeyInfo: () => null,
+        });
+        verifier.loadSignature(signatureNode);
+        try {
+            // Returns false for a digest mismatch and throws when the signature
+            // value itself fails. Both mean "not this certificate".
+            if (verifier.checkSignature(xml)) {
+                verified = true;
+                break;
+            }
+        }
+        catch {
+            // Try the next certificate in the rotation list.
+        }
+    }
+    if (!verified) {
+        throw new Error('the signature does not verify against any configured certificate');
+    }
+    // The signature is valid; now find what it actually covers. Exactly one
+    // reference: two would be two candidate answers to "what is signed", the
+    // ambiguity this module exists to remove.
+    const references = signatureNode.getElementsByTagNameNS(DSIG_NS, 'Reference');
+    if (references.length !== 1) {
+        throw new Error(`the signature carries ${references.length} references; exactly one is required`);
+    }
+    const uri = references[0].getAttribute('URI') ?? '';
+    let referenced = null;
+    if (uri === '') {
+        // An empty URI signs the whole document. It must still satisfy the
+        // enveloping rule below — returning early here is exactly how a detached
+        // signature with an empty reference walks straight past that rule.
+        referenced = doc.documentElement;
+    }
+    else if (!uri.startsWith('#')) {
+        throw new Error(`the signature reference is not a same-document URI: ${quoteUntrusted(uri)}`);
+    }
+    else {
+        const id = uri.slice(1);
+        const elements = doc.getElementsByTagName('*');
+        for (let i = 0; i < elements.length; i++) {
+            if (elements[i].getAttribute('ID') === id) {
+                referenced = elements[i];
+                break;
+            }
+        }
+    }
+    if (!referenced) {
+        throw new Error(`the signature references ${quoteUntrusted(uri)}, which is not in the document`);
+    }
+    // The enveloped signature must sit inside the element it references. A
+    // signature moved elsewhere stays cryptographically valid over the bytes it
+    // covers, so the maths alone will not catch it — this comparison is what
+    // does. It is the check @node-saml/node-saml makes, and the one whose
+    // absence made every response @mcp-abap-adt/auth-mocks produced
+    // unacceptable to a real library until it was fixed there.
+    if (signatureNode.parentNode !== referenced) {
+        throw new Error('the signature is not inside the element it references, so it does not envelope it');
+    }
+    return referenced;
+}

package/dist/validation/xsdDateTime.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Parsing an `xsd:dateTime` strictly enough to trust the result.
+ *
+ * `Date.parse` is not this. It normalises `2026-02-30` into 2 March instead of
+ * rejecting it, and it will read a timezone offset no calendar has. Both traps
+ * were found in `@mcp-abap-adt/auth-mocks` and fixed there the same way: match
+ * the lexical shape, then require every component to survive a round trip. The
+ * instant is computed from the components rather than handed back to `Date`,
+ * whose handling of invalid strings is implementation-defined.
+ *
+ * Deliberately not implemented: negative (BCE) years, the `24:00:00`
+ * end-of-day form, and leap seconds. No identity provider in this family emits
+ * them, and pretending to cover them would be worse than saying so.
+ */
+/** Returns the instant, or null when the value is not a valid xsd:dateTime. */
+export declare function parseXsdDateTime(value: string | null | undefined): Date | null;
+//# sourceMappingURL=xsdDateTime.d.ts.map

package/dist/validation/xsdDateTime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xsdDateTime.d.ts","sourceRoot":"","sources":["../../src/validation/xsdDateTime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,IAAI,GAAG,IAAI,CAkDb"}

package/dist/validation/xsdDateTime.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * Parsing an `xsd:dateTime` strictly enough to trust the result.
+ *
+ * `Date.parse` is not this. It normalises `2026-02-30` into 2 March instead of
+ * rejecting it, and it will read a timezone offset no calendar has. Both traps
+ * were found in `@mcp-abap-adt/auth-mocks` and fixed there the same way: match
+ * the lexical shape, then require every component to survive a round trip. The
+ * instant is computed from the components rather than handed back to `Date`,
+ * whose handling of invalid strings is implementation-defined.
+ *
+ * Deliberately not implemented: negative (BCE) years, the `24:00:00`
+ * end-of-day form, and leap seconds. No identity provider in this family emits
+ * them, and pretending to cover them would be worse than saying so.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseXsdDateTime = parseXsdDateTime;
+const SHAPE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
+/** Returns the instant, or null when the value is not a valid xsd:dateTime. */
+function parseXsdDateTime(value) {
+    if (!value)
+        return null;
+    const m = SHAPE.exec(value);
+    if (!m)
+        return null;
+    const [, y, mo, d, h, mi, s, fraction, zone] = m;
+    const year = Number(y);
+    const month = Number(mo);
+    const day = Number(d);
+    const hour = Number(h);
+    const minute = Number(mi);
+    const second = Number(s);
+    if (month < 1 || month > 12)
+        return null;
+    if (hour > 23 || minute > 59 || second > 59)
+        return null;
+    // The calendar round trip. Date.UTC rolls 2026-02-30 into 2026-03-02, so a
+    // component that comes back changed means the date does not exist.
+    const utc = new Date(Date.UTC(year, month - 1, day, hour, minute, second));
+    if (utc.getUTCFullYear() !== year ||
+        utc.getUTCMonth() !== month - 1 ||
+        utc.getUTCDate() !== day) {
+        return null;
+    }
+    // Milliseconds from the fraction: pad to 3 digits and truncate extras.
+    // Avoid floating-point multiplication: 0.57 * 1000 = 569.99999….
+    const ms = fraction
+        ? Number(fraction.slice(1).padEnd(3, '0').slice(0, 3))
+        : 0;
+    // Offset in milliseconds. For zone Z it is 0. Otherwise apply the sign.
+    let offsetMs = 0;
+    if (zone !== 'Z') {
+        const offsetHour = Number(zone.slice(1, 3));
+        const offsetMinute = Number(zone.slice(4, 6));
+        // xsd:dateTime bounds the offset at ±14:00, and exactly 14 allows no
+        // minutes. Both halves matter: +15:00 fails the first, +14:01 the second.
+        if (offsetHour > 14 || offsetMinute > 59)
+            return null;
+        if (offsetHour === 14 && offsetMinute !== 0)
+            return null;
+        const sign = zone[0] === '-' ? -1 : 1;
+        offsetMs = sign * (offsetHour * 60 + offsetMinute) * 60_000;
+    }
+    // The instant is UTC time + milliseconds - offset, because local time = UTC + offset.
+    const instant = utc.getTime() + ms - offsetMs;
+    return new Date(instant);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -62,13 +62,14 @@
     "node": "^22 || ^24"
   },
   "dependencies": {
-    "@mcp-abap-adt/interfaces-auth": "^1.2.0",
-    "@mcp-abap-adt/interfaces-auth-sap": "^1.0.0",
+    "@mcp-abap-adt/interfaces-auth": "^2.0.0",
+    "@mcp-abap-adt/interfaces-auth-sap": "^1.0.1",
     "@mcp-abap-adt/interfaces-utils": "^1.1.0",
     "@xmldom/xmldom": "^0.9.12",
     "axios": "^1.13.5",
     "express": "^5.1.0",
-    "open": "^11.0.0"
+    "open": "^11.0.0",
+    "xml-crypto": "^6.1.2"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.3.14",