@mcp-abap-adt/auth-providers 3.0.0 → 4.1.0

package/CHANGELOG.md

@@ -7,6 +7,193 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.1.0] - 2026-09-26
+
+Three refusals get stricter; no export, configuration field or error class
+changes. The README's *Upgrading from 4.0 to 4.1* lists what now fails.
+
+### Changed
+
+- **Every refusal names its rule.** No two rules under one `check` share a
+  message. An element that must appear exactly once says which way it failed
+  — absent, or more than one — for the Response's direct-child `Assertion`,
+  each signature's `ds:Reference`, `Status`, `StatusCode`, the assertion's
+  `Issuer`, `Conditions`, `Subject` and each bearer candidate's
+  `SubjectConfirmationData`. An empty `Issuer`, a `StatusCode` without a
+  `Value`, an `AudienceRestriction` naming no audience, and an absent versus
+  an invalid `Conditions/@NotOnOrAfter` each get their own message. The
+  signed-node refusal names the element the validator requires
+  (`samlp:Response` or `saml:Assertion`). `check` is unchanged for every
+  refusal, and every document 4.0.0 refused is still refused; code matching
+  on message text must match on `check`. The README lists every message
+  the shipped validators produce.
+- **`bearerConfirmation` says why every candidate failed.** Still
+  existential: one confirmation passing every sub-rule is enough, and every
+  candidate is evaluated. A refusal lists each candidate in document order
+  with the first sub-rule it failed, in a fixed order, at most five, then
+  `and N more`. A `Subject` absent or repeated, and a `Subject` holding no
+  `SubjectConfirmation`, have messages of their own.
+- **Every document value a message interpolates is quoted and cut**
+  (`quoteUntrusted`: JSON-quoted, 64 characters at most), including the
+  post-signature `Status` code, issuer and `Destination`, the `Conditions`
+  dates, xml-crypto's own messages about a malformed `Signature`, which embed
+  the offending element, and the parser message in `Saml2BearerProvider`'s
+  bearer conversion.
+
+### Fixed
+
+- A SAML 1.x `Assertion` (`urn:oasis:names:tc:SAML:1.0:assertion`) outside
+  the signed assertion is refused at `signedNode`, as a SAML 2.0 one already
+  was. Before, one in `Extensions` passed either validator.
+- An `Assertion` or `EncryptedAssertion` (SAML 2.0) or a SAML 1.x `Assertion`
+  inside a `ds:Signature` is refused at `signedNode`. An enveloped signature
+  leaves its own subtree out of the digest, so an element in `ds:Object`
+  there is unsigned however deep inside the signed assertion it sits; before,
+  such an element inside the signed assertion's own `ds:Signature` passed
+  either validator, `Saml2BearerProvider`'s default included.
+- `idpInitiated: true` with `authnRequestId` is refused when the provider is
+  constructed — a `ValidationError` with `missingFields: ['idpInitiated']` —
+  not after `authorize()` returns, so before the user has been through the
+  browser.
+- A malformed `Signature` whose `loadSignature` throws something other than
+  an `Error` is refused at `signature` quoting what was thrown. Before, the
+  refusal carried an empty message, and a thrown `null` or `undefined`
+  escaped as a `TypeError` instead of an `AssertionValidationError`.
+
+### Removed
+
+- The `bin` commands `auth-authorization-code` and `auth-client-credentials`
+  (the `bin` field, and `bin` in `files`), and the devDependency `tsx`. They
+  never ran from an npm install: they were `.ts` files with a `tsx` shebang,
+  importing `src/`, which is not published. Not a breaking change for that
+  reason.
+
+### Documentation
+
+- `ValidatedAssertion.nameId` is `undefined` when the `Subject` carries no
+  `NameID` or more than one. `NameID` is surfaced, never refused.
+
+### Development
+
+- `@mcp-abap-adt/interfaces-auth` `^2.0.1`, whose
+  `IAssertionReplayStore.recordIfUnseen` JSDoc now describes the retention this
+  package implements: until the last instant a validator would still accept
+  the assertion, not its expiry.
+- `@mcp-abap-adt/auth-stores` stays a devDependency: three test suites import
+  `AbapServiceKeyStore` from it.
+- The end-to-end SAML suite (`samlValidation.test.ts`) runs about 6× faster,
+  about 41 s down to about 7 s: it starts one mock identity provider per
+  signed element in `beforeAll` and switches variants, instead of one per
+  test, each generating an RSA key. Every test still gets its own replay
+  store.
+- The Keycloak suite trusts only the certificates under `KeyDescriptor
+  use="signing"` in Keycloak's metadata.
+
+## [4.0.0] - 2026-09-25
+
+### Breaking
+
+- **Both SAML providers validate the assertion before trusting it** (#19).
+  Until now the only check was that the payload was a non-empty string, and
+  `Saml2PureProvider` took its session lifetime from a regular expression over
+  the unverified XML. `Saml2BearerProvider` now validates before the token
+  exchange, `Saml2PureProvider` before `cookieProvider`, through twelve checks:
+  document shape, unique IDs, signature, that the signed node is the node read,
+  `Status`, assertion ID, issuer, `Conditions`, `NotBefore`, `NotOnOrAfter`,
+  audience, one bearer subject confirmation (request ID, recipient, window) and
+  `Destination`, then replay. The README's *SAML assertion validation* lists
+  them with what refuses each.
+
+  **The configuration is required.** Supply `idpCertificates` (PEM or bare
+  base64 DER, a list for key rotation) and `idpEntityId`, or an
+  `assertionValidator` of your own; without them the provider's constructor
+  throws a `ValidationError` naming what is missing. A shipped validator
+  supplied as `assertionValidator` still needs `idpEntityId`, and its absence
+  fails at construction too; only a custom validator does without.
+  `spEntityId` becomes the `Audience` the assertion must name.
+
+  **Request IDs.** `InResponseTo` must answer the AuthnRequest the package
+  minted, or `authnRequestId` when the package did not build the request — a
+  pre-built `authorizationUrl`, or a strategy that returns a payload without
+  calling `buildAuthorizationUrl`. `idpInitiated: true` declares that no request
+  was sent, so the assertion must carry no `InResponseTo`; it gives up the
+  login-CSRF defence of a request ID, and is never inferred.
+  `Saml2BearerProvider` against UAA or XSUAA needs it, since both refuse an
+  assertion carrying `InResponseTo`. Having neither an ID nor the declaration,
+  or combining the declaration with an ID, raises a `ValidationError`. With
+  `idpInitiated` and no `authorizationUrl`, a strategy that calls
+  `buildAuthorizationUrl` is refused inside the builder, before any URL is
+  produced — so before a browser opens.
+
+  **Status, by validator.** Under `createSignedResponseValidator` —
+  `Saml2PureProvider`'s default — an identity provider returning a
+  non-`Success` status is now refused, where it was accepted before.
+  `Saml2BearerProvider`'s default, `createSignedAssertionValidator`, does not
+  read `Status`, so a bearer consumer sees no change there: a declining identity
+  provider mints no signed assertion, and the login fails for want of one.
+
+  **Migrating:** see *Migrating from 3.x to 4.0* in the README — add the trust
+  configuration, check `spEntityId`, and for `Saml2BearerProvider` against UAA
+  or XSUAA add `idpInitiated: true` with a strategy that never calls
+  `buildAuthorizationUrl`.
+- **`parseSamlNotOnOrAfter` is removed.** `Saml2PureProvider`'s `expiresAt` is
+  now the validated assertion's expiry — the earlier of `Conditions/@NotOnOrAfter`
+  and the accepted bearer confirmation's — read from the verified document.
+- **`buildSamlAuthorizationUrl` returns `{ url, requestId? }`**, since the
+  minted ID must survive to validation, and **`getSamlAssertion` returns
+  `Promise<SamlAssertionResult>`** (payload, request ID, ACS) instead of
+  `Promise<string>`. None of these, nor `parseSamlNotOnOrAfter`, was exported
+  from the package root; only a deep import of `dist/auth/saml2Auth` or
+  `dist/providers/saml2Utils` is affected.
+- **`@mcp-abap-adt/interfaces-auth` `^2.0.0`** (was `^1.2.0`), where
+  `AssertionContext.expectedInResponseTo` is optional — a breaking change for
+  implementers of `IAssertionValidator`, which must refuse an assertion
+  carrying `InResponseTo` when it is absent.
+
+### Added
+
+- **`createSignedResponseValidator`** and **`createSignedAssertionValidator`**,
+  sharing `ShippedValidatorOptions` (`idpCertificates`, `clockSkewMs`,
+  `replayStore`). The first requires the signature to cover the `Response` and
+  performs all twelve checks; the second accepts a signature over the
+  `Assertion` — bare, or inside a Response — and does not read `Status`,
+  `Response/Issuer` or `Destination` at all. `Saml2PureProvider` defaults to the
+  first, `Saml2BearerProvider` to the second; `assertionValidator` replaces
+  either.
+- **Replay detection**: `defaultReplayStore`, a process-wide in-memory store
+  shared by every default validator, keyed by `{issuer, assertionId}` and
+  retained until the earlier of `Conditions/@NotOnOrAfter` and the latest
+  `NotOnOrAfter` of a bearer confirmation that answers the request and names
+  the ACS, plus `clockSkewMs` — as long as the assertion could still be
+  accepted, which can outlast `expiresAt`; `createInMemoryReplayStore()` for
+  an isolated one; `assertionReplayStore` on the providers for a shared store
+  across processes.
+- **`clockSkewMs`**, default `0`.
+- Any XML parse fault — including one `@xmldom/xmldom` would otherwise repair,
+  such as an undeclared entity — is a refusal at `document`, and the parser
+  never writes to the console; the bearer conversion (`toBearerAssertion`)
+  parses the same way.
+- The validators refuse a payload carrying a `<!DOCTYPE` declaration, never
+  take a signing certificate from the document's own `KeyInfo`, and accept
+  RSA-SHA1 signatures and SHA-1 digests, as `xml-crypto` does by default; a
+  consumer wanting to refuse SHA-1 wraps a shipped validator in its own.
+- **`AssertionValidationError`**, with `check: AssertionCheck` naming the check
+  that refused the assertion, and code `ASSERTION_VALIDATION_ERROR`.
+- `xml-crypto` becomes a runtime dependency, for signature verification.
+
+### Development
+
+- Both validators run end to end in `npm test`, through `Saml2PureProvider`
+  and a real callback, against responses from `@mcp-abap-adt/auth-mocks` (the
+  devDependency and its range are unchanged). Every corruption variant is refused at the
+  check it targets, except `statusFailure` and `wrongDestination`, which the
+  assertion-only validator accepts — both halves asserted.
+- The provider stand's SAML suites run every login through the provider's
+  validation, including Keycloak's real responses, signed at both levels; the
+  live XSUAA suite does the same with its per-run identity provider, and now
+  refuses the `InResponseTo` case itself, before XSUAA sees it.
+- `@mcp-abap-adt/interfaces-auth-sap` `^1.0.1`.
+
 ## [3.0.0] - 2026-09-24
 
 ### Added