@mcp-abap-adt/auth-providers 3.0.0 → 4.1.0

package/dist/validation/assertionValidator.js

@@ -0,0 +1,519 @@
+"use strict";
+/**
+ * The shipped assertion validator: the spec's check table, in order.
+ *
+ * Two properties matter more than any individual check. First, the signature
+ * is resolved to an element and every assertion-level field is read *from that
+ * element* — a document holding a validly signed fragment beside a forged one
+ * is the wrapping attack, and reading the wrong node is how it succeeds.
+ * Second, no two refusals share a distinguishing phrase, so a test cannot pass
+ * for a neighbouring check's reason.
+ *
+ * Three fields live on the Response rather than the assertion: Status,
+ * Response/Issuer and Destination. The signed-Response validator reads them,
+ * because there they are inside the signature. The assertion-only validator
+ * does not read them at all — not weakly. That is safe because a declined
+ * login carries no assertion, so flipping Status buys an attacker nothing they
+ * can sign, and addressing rests on Recipient inside the signed assertion.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSignedAssertionValidator = exports.createSignedResponseValidator = void 0;
+exports.isShippedValidator = isShippedValidator;
+const xmldom_1 = require("@xmldom/xmldom");
+const strictXml_1 = require("../auth/strictXml");
+const AssertionValidationError_1 = require("../errors/AssertionValidationError");
+const documentIds_1 = require("./documentIds");
+const inMemoryReplayStore_1 = require("./inMemoryReplayStore");
+const signedNode_1 = require("./signedNode");
+const xsdDateTime_1 = require("./xsdDateTime");
+const SAML_NS = 'urn:oasis:names:tc:SAML:2.0:assertion';
+const PROTOCOL_NS = 'urn:oasis:names:tc:SAML:2.0:protocol';
+const BEARER = 'urn:oasis:names:tc:SAML:2.0:cm:bearer';
+const SUCCESS = 'urn:oasis:names:tc:SAML:2.0:status:Success';
+const SAML1_NS = 'urn:oasis:names:tc:SAML:1.0:assertion';
+const DSIG_NS = 'http://www.w3.org/2000/09/xmldsig#';
+/**
+ * Everything a later reader might take for the assertion: SAML 2.0's
+ * Assertion and EncryptedAssertion, and SAML 1.x's Assertion.
+ */
+const ASSERTION_SHAPED = [
+    [SAML_NS, 'Assertion'],
+    [SAML_NS, 'EncryptedAssertion'],
+    [SAML1_NS, 'Assertion'],
+];
+/** How a refusal names the element each validator requires to be signed. */
+const REQUIRED_LABEL = {
+    response: 'samlp:Response',
+    assertion: 'saml:Assertion',
+};
+/**
+ * Marks a validator as one of the two shipped here. Module-private and
+ * non-enumerable, so it is neither part of the public surface nor visible to
+ * a consumer spreading or serialising the object.
+ *
+ * It exists for one reason: a shipped validator fails closed without
+ * `expectedIssuer`, so a provider handed one must insist on `idpEntityId` at
+ * construction — otherwise the mistake surfaces only as an `issuer` refusal
+ * after a human has finished a browser login. A custom validator carries no
+ * brand and may establish trust however it likes.
+ */
+const SHIPPED = Symbol('mcp-abap-adt.shippedAssertionValidator');
+function brand(validator) {
+    Object.defineProperty(validator, SHIPPED, {
+        value: true,
+        enumerable: false,
+    });
+    return validator;
+}
+/** Whether this validator came from one of the two shipped factories. */
+function isShippedValidator(validator) {
+    return validator[SHIPPED] === true;
+}
+const createSignedResponseValidator = (options) => brand(createValidator('response', options));
+exports.createSignedResponseValidator = createSignedResponseValidator;
+const createSignedAssertionValidator = (options) => brand(createValidator('assertion', options));
+exports.createSignedAssertionValidator = createSignedAssertionValidator;
+function createValidator(require, options) {
+    const skew = options.clockSkewMs ?? 0;
+    if (!Number.isInteger(skew) || skew < 0) {
+        throw new Error(`clockSkewMs must be a finite non-negative integer, got ${String(options.clockSkewMs)}`);
+    }
+    if (options.idpCertificates.length === 0) {
+        throw new Error('idpCertificates must not be empty: nothing could be verified');
+    }
+    // Normalised and proved here, once, rather than inside verification. Three
+    // reasons, and the last bites hardest: a malformed entry standing first in
+    // the list would abort the rotation loop before a later valid certificate
+    // was tried; a constructor is where this package already refuses a bad
+    // configuration; and a login happens after a human has used a browser, so a
+    // formatting mistake found then wastes their work, not ours.
+    const certificates = options.idpCertificates.map(signedNode_1.toPem);
+    const store = options.replayStore ?? inMemoryReplayStore_1.defaultReplayStore;
+    return {
+        async validate(samlResponse, context) {
+            // 1. Parses, and the document element is a samlp:Response.
+            const xml = Buffer.from(samlResponse, 'base64').toString('utf8');
+            // No DTD, ever. A SAML message has no use for one, and a DOCTYPE is
+            // where parsers diverge — entity expansion, internal subsets — and this
+            // document is parsed twice: by @xmldom/xmldom 0.9 here and by the 0.8
+            // nested inside xml-crypto. Refused before either parse is trusted.
+            if (/<!DOCTYPE/i.test(xml)) {
+                return fail('document', 'the SAMLResponse carries a DOCTYPE declaration, which is never accepted');
+            }
+            let doc;
+            try {
+                doc = (0, strictXml_1.parseStrictXml)(xml);
+            }
+            catch {
+                return fail('document', 'the SAMLResponse did not parse as XML');
+            }
+            const root = doc.documentElement;
+            if (!root)
+                return fail('document', 'the SAMLResponse did not parse as XML');
+            const rootIsResponse = root.localName === 'Response' && root.namespaceURI === PROTOCOL_NS;
+            const rootIsAssertion = root.localName === 'Assertion' && root.namespaceURI === SAML_NS;
+            // A bare Assertion is a document only the assertion-only validator
+            // accepts: the saml2-bearer grant exchanges an Assertion, and 3.0.0
+            // already takes one as Saml2BearerProvider's payload.
+            if (!rootIsResponse && !(require === 'assertion' && rootIsAssertion)) {
+                return fail('document', require === 'assertion'
+                    ? `expected a samlp:Response or a saml:Assertion, got ${(0, signedNode_1.quoteUntrusted)(root.localName ?? '')}`
+                    : `expected the document element to be a samlp:Response, got ${(0, signedNode_1.quoteUntrusted)(root.localName ?? '')}`);
+            }
+            // 1b. Unique IDs, before any reference is resolved.
+            const duplicate = (0, documentIds_1.findDuplicateId)(doc);
+            if (duplicate) {
+                return fail('duplicateId', `the document uses the ID ${(0, signedNode_1.quoteUntrusted)(duplicate)} more than once, so which element is signed is ambiguous`);
+            }
+            // 2 + 3. Verify every signature, then take the element this validator
+            // requires from among those they cover. A response signed at both
+            // levels — as many identity providers send — satisfies either validator.
+            let covered;
+            try {
+                covered = (0, signedNode_1.resolveSignedElements)(xml, doc, certificates);
+            }
+            catch (error) {
+                return fail('signature', error.message);
+            }
+            // 3a. A Response carries exactly one direct-child Assertion, and a
+            // refusal says which way the count failed. Checked once, here, for both
+            // validators: the signed-Response validator reads that assertion, and
+            // the assertion-only validator requires it to be the element signed.
+            const direct = rootIsResponse
+                ? directChildren(root, SAML_NS, 'Assertion')
+                : [];
+            if (rootIsResponse && direct.length === 0) {
+                return fail('signedNode', 'the response carries no direct-child saml:Assertion');
+            }
+            if (direct.length > 1) {
+                return fail('signedNode', `the response carries ${direct.length} direct-child saml:Assertion; exactly one is allowed`);
+            }
+            // 3b. The element this validator requires signed is fixed by the
+            // document's shape, not by which signature happens to come first: the
+            // Response itself, or for the assertion-only validator the bare root
+            // Assertion or the Response's single direct-child Assertion. Taking
+            // "the first covered Assertion" instead would pick a signed assertion
+            // nested in Advice whenever its signature precedes the outer one's —
+            // and a covered element anywhere but here is the wrapping attack.
+            const target = require === 'response' || rootIsAssertion ? root : direct[0];
+            const signed = covered.find((element) => element === target);
+            if (!signed) {
+                return fail('signedNode', `the signature does not cover the ${REQUIRED_LABEL[require]} this validator requires`);
+            }
+            // 3c. Everything below is read from `assertion` and nowhere else: the
+            // bare root Assertion, or the Response's single direct-child one —
+            // either the signed element itself or, when the Response is signed,
+            // inside it.
+            const assertion = rootIsAssertion ? root : direct[0];
+            // 3d. Nothing assertion-shaped outside the one read. Wherever the
+            // signature sits, the payload travels on whole — Saml2PureProvider hands
+            // it to the cookie provider — so an Assertion or EncryptedAssertion in
+            // an unsigned part of it (Extensions, a sibling, a wrapper) is something
+            // a later reader may take for the real one. Nor inside a ds:Signature,
+            // whose subtree an enveloped signature leaves unsigned.
+            const place = placeOfAssertions(doc, assertion);
+            if (place === 'inSignature') {
+                return fail('signedNode', 'the document carries an Assertion or EncryptedAssertion inside a ds:Signature, where no signature covers it');
+            }
+            if (place === 'outside') {
+                return fail('signedNode', 'the document carries an Assertion or EncryptedAssertion, SAML 2.0 or 1.x, outside the one the signature covers');
+            }
+            // 4. Status. Only when the Response is the signed element: otherwise it
+            // lies outside the signature, and checking a field an attacker sets is
+            // worse than not checking it — it reads like verification.
+            if (require === 'response') {
+                const status = requireOne(root, PROTOCOL_NS, 'Status', 'status', 'the response', 'samlp:Status');
+                const code = requireOne(status, PROTOCOL_NS, 'StatusCode', 'status', 'the samlp:Status', 'samlp:StatusCode');
+                const codeValue = code.getAttribute('Value');
+                if (!codeValue) {
+                    return fail('status', 'the samlp:StatusCode carries no Value');
+                }
+                if (codeValue !== SUCCESS) {
+                    return fail('status', `the identity provider declined the login: ${(0, signedNode_1.quoteUntrusted)(codeValue)}`);
+                }
+            }
+            // 4b. The assertion's own ID.
+            const assertionId = (0, documentIds_1.readRequiredId)(assertion);
+            if (!assertionId)
+                return fail('assertionId', 'the assertion carries no ID');
+            // 5. The assertion's Issuer — inside the signature either way, so both
+            // validators check it.
+            const issuer = requireOne(assertion, SAML_NS, 'Issuer', 'issuer', 'the assertion', 'saml:Issuer').textContent ?? '';
+            if (!issuer) {
+                return fail('issuer', "the assertion's saml:Issuer is empty");
+            }
+            // Fail closed: with nothing to compare against, any issuer whose key is
+            // configured would pass, which is not what this validator promises.
+            if (!context.expectedIssuer) {
+                return fail('issuer', 'no expectedIssuer was configured, so the assertion issuer cannot be trusted');
+            }
+            if (issuer !== context.expectedIssuer) {
+                return fail('issuer', `the assertion was issued by ${(0, signedNode_1.quoteUntrusted)(issuer)}, not the trusted issuer`);
+            }
+            // 5b. The cross-check against the Response's Issuer belongs to the
+            // signed-Response validator alone: only there are both inside the
+            // signature.
+            if (require === 'response') {
+                // Optional, so none is fine; but two are an ambiguity, and one that is
+                // present must agree — empty included, since empty is not absent.
+                const responseIssuers = directChildren(root, SAML_NS, 'Issuer');
+                if (responseIssuers.length > 1) {
+                    return fail('issuer', 'the response must carry at most one saml:Issuer');
+                }
+                if (responseIssuers.length === 1 &&
+                    (responseIssuers[0].textContent ?? '') !== issuer) {
+                    return fail('issuer', 'the response and the assertion name different issuers');
+                }
+            }
+            // 6, 7, 8. Conditions and their window.
+            const conditions = requireOne(assertion, SAML_NS, 'Conditions', 'conditions', 'the assertion', 'saml:Conditions');
+            const notBeforeRaw = conditions.getAttribute('NotBefore');
+            if (notBeforeRaw) {
+                const notBefore = (0, xsdDateTime_1.parseXsdDateTime)(notBeforeRaw);
+                if (!notBefore) {
+                    return fail('notBefore', `Conditions NotBefore is not a valid xsd:dateTime: ${(0, signedNode_1.quoteUntrusted)(notBeforeRaw)}`);
+                }
+                if (notBefore.getTime() - skew > Date.now()) {
+                    return fail('notBefore', 'the assertion is not valid yet');
+                }
+            }
+            const notOnOrAfterRaw = conditions.getAttribute('NotOnOrAfter');
+            if (!notOnOrAfterRaw) {
+                return fail('notOnOrAfter', 'Conditions carries no NotOnOrAfter, so the assertion states no lifetime');
+            }
+            const conditionsExpiry = (0, xsdDateTime_1.parseXsdDateTime)(notOnOrAfterRaw);
+            if (!conditionsExpiry) {
+                return fail('notOnOrAfter', `Conditions NotOnOrAfter is not a valid xsd:dateTime: ${(0, signedNode_1.quoteUntrusted)(notOnOrAfterRaw)}`);
+            }
+            if (conditionsExpiry.getTime() + skew <= Date.now()) {
+                return fail('notOnOrAfter', 'the assertion has expired');
+            }
+            // 9. Every AudienceRestriction must name us; several Audience inside one
+            // are alternatives.
+            const restrictions = directChildren(conditions, SAML_NS, 'AudienceRestriction');
+            if (restrictions.length === 0) {
+                return fail('audience', 'the assertion restricts no audience');
+            }
+            for (const restriction of restrictions) {
+                const names = directChildren(restriction, SAML_NS, 'Audience').map((a) => a.textContent ?? '');
+                if (names.length === 0) {
+                    return fail('audience', 'an AudienceRestriction names no audience');
+                }
+                if (!names.includes(context.audience)) {
+                    return fail('audience', 'an AudienceRestriction on this assertion does not name us');
+                }
+            }
+            // 10. One bearer confirmation satisfying everything together. It
+            // refuses by itself, naming why each candidate failed.
+            const chosen = chooseBearerConfirmation(assertion, context, skew);
+            // 11. Destination — the signed-Response validator only, for the same
+            // reason as Status. Addressing in the other flow rests on Recipient,
+            // which step 10 required and which sits inside the signed assertion.
+            if (require === 'response') {
+                const destination = root.getAttribute('Destination');
+                if (!destination) {
+                    return fail('destination', 'the response carries no Destination');
+                }
+                if (destination !== context.acsUrl) {
+                    return fail('destination', `the response is addressed to ${(0, signedNode_1.quoteUntrusted)(destination)}, not to us`);
+                }
+            }
+            // Expiry: the earlier of the two windows.
+            const expiresAt = new Date(Math.min(conditionsExpiry.getTime(), chosen.notOnOrAfter.getTime()));
+            // 12. Replay. Retention is NOT expiresAt: it must last for as long as
+            // this validator could accept the assertion again. Conditions bound
+            // that, but so does the LATEST bearer confirmation that can qualify —
+            // with confirmations closing at +120 s and +600 s the session ends at
+            // +120 s, yet at +200 s the second one still qualifies, and an entry
+            // dropped at +120 s would let the same assertion in a second time. The
+            // skew is added on top, since inside it the assertion is still accepted.
+            const retainUntil = new Date(Math.min(conditionsExpiry.getTime(), chosen.latestNotOnOrAfter.getTime()) + skew);
+            const fresh = await store.recordIfUnseen({ issuer, assertionId }, retainUntil);
+            if (!fresh) {
+                return fail('replay', 'this assertion has been presented before');
+            }
+            return {
+                expiresAt,
+                assertionId,
+                issuer,
+                nameId: (() => {
+                    // Subject, then NameID — no `?? assertion` fallback, which would
+                    // read a NameID from outside the Subject when the Subject is absent.
+                    const subject = directChild(assertion, SAML_NS, 'Subject');
+                    return subject
+                        ? (directChild(subject, SAML_NS, 'NameID')?.textContent ??
+                            undefined)
+                        : undefined;
+                })(),
+                raw: samlResponse,
+                // The signed element, not the response: this is what a consumer may
+                // parse without re-deriving what the signature covered.
+                signedXml: new xmldom_1.XMLSerializer().serializeToString(signed),
+            };
+        },
+    };
+}
+function fail(check, message) {
+    throw new AssertionValidationError_1.AssertionValidationError(check, message);
+}
+/**
+ * Direct children with this namespace and local name — **not** descendants.
+ *
+ * `getElementsByTagNameNS` searches the whole subtree, and that is the wrong
+ * tool for a structural path. An assertion with no `Conditions` of its own but
+ * a `Conditions` buried somewhere inside it would answer the descendant search
+ * and satisfy a check it does not meet; the same trick works for `Issuer`,
+ * `Status` and `Subject`. Each segment of a SAML path is therefore walked
+ * explicitly, one level at a time.
+ */
+function directChildren(parent, ns, local) {
+    const out = [];
+    const nodes = parent.childNodes;
+    for (let i = 0; i < nodes.length; i++) {
+        const node = nodes[i];
+        // nodeType 1 is ELEMENT_NODE; the constant is unavailable without the dom
+        // lib, which this project deliberately does not use.
+        if (node.nodeType === 1 &&
+            node.namespaceURI === ns &&
+            node.localName === local) {
+            out.push(node);
+        }
+    }
+    return out;
+}
+/** The single direct child with this name, or null when there is not exactly one. */
+function directChild(parent, ns, local) {
+    const found = directChildren(parent, ns, local);
+    // Not "the first": two siblings sharing a name is an ambiguity, and
+    // resolving it silently in favour of the first is how a forged element comes
+    // to be read in preference to a real one.
+    return found.length === 1 ? found[0] : null;
+}
+/**
+ * The single direct child with this name, or a refusal that says which way
+ * the count failed: absent and more than one are different faults, and a
+ * message that cannot tell them apart sends the reader to the wrong one.
+ */
+function requireOne(parent, ns, local, check, holder, label) {
+    const found = directChildren(parent, ns, local);
+    if (found.length === 0)
+        return fail(check, `${holder} carries no ${label}`);
+    if (found.length > 1) {
+        return fail(check, `${holder} carries ${found.length} ${label}; exactly one is allowed`);
+    }
+    return found[0];
+}
+/**
+ * Walks up from every assertion-shaped element. Reaching the assertion that
+ * was read means it is inside it — unless a ds:Signature came first: an
+ * enveloped signature leaves its own subtree out of the digest, so anything
+ * there is unsigned, however deep inside the signed assertion it sits.
+ */
+function placeOfAssertions(doc, assertion) {
+    for (const [ns, local] of ASSERTION_SHAPED) {
+        const found = doc.getElementsByTagNameNS(ns, local);
+        for (let i = 0; i < found.length; i++) {
+            let node = found[i];
+            while (node && node !== assertion) {
+                if (node.localName === 'Signature' && node.namespaceURI === DSIG_NS) {
+                    return 'inSignature';
+                }
+                node = node.parentNode;
+            }
+            if (!node)
+                return 'outside';
+        }
+    }
+    return 'within';
+}
+/** How many candidates a bearerConfirmation refusal names before "and N more". */
+const LISTED_CANDIDATES = 5;
+/**
+ * The bearer confirmation this login may rely on, or a refusal naming why
+ * each candidate failed.
+ *
+ * Every part must hold on the **same** element: gathering `InResponseTo` from
+ * one confirmation and `Recipient` from another is how a document satisfies a
+ * check nothing in it actually satisfies. It is existential: one candidate
+ * passing every sub-rule is enough, and every candidate is evaluated, so a
+ * failing one never hides a valid one after it. When several qualify — which
+ * a real identity provider does not produce — the earliest window wins, so
+ * the outcome is a shorter session rather than a longer one.
+ *
+ * `latestNotOnOrAfter` answers a different question: until when could some
+ * confirmation let this assertion in? It is the latest `NotOnOrAfter` among
+ * the confirmations that satisfy every non-temporal part — including one whose
+ * `NotBefore` has not arrived yet, since it qualifies once it does. Replay
+ * retention needs that bound, not the session's; see the caller.
+ */
+function chooseBearerConfirmation(assertion, context, skew) {
+    const subject = requireOne(assertion, SAML_NS, 'Subject', 'bearerConfirmation', 'the assertion', 'saml:Subject');
+    const confirmations = directChildren(subject, SAML_NS, 'SubjectConfirmation');
+    if (confirmations.length === 0) {
+        return fail('bearerConfirmation', 'the saml:Subject holds no SubjectConfirmation');
+    }
+    const now = Date.now();
+    let best = null;
+    let latest = null;
+    const reasons = [];
+    for (const confirmation of confirmations) {
+        const candidate = readConfirmation(confirmation, context);
+        if ('reason' in candidate) {
+            reasons.push(candidate.reason);
+            continue;
+        }
+        const { notOnOrAfter, notBefore } = candidate;
+        // Could qualify at some instant: counts towards how long to remember.
+        if (!latest || notOnOrAfter.getTime() > latest.getTime()) {
+            latest = notOnOrAfter;
+        }
+        // 7, 8. Qualifies now: a candidate for the session's window.
+        if (notOnOrAfter.getTime() + skew <= now) {
+            reasons.push('NotOnOrAfter has passed');
+            continue;
+        }
+        if (notBefore && notBefore.getTime() - skew > now) {
+            reasons.push('NotBefore has not arrived');
+            continue;
+        }
+        if (!best || notOnOrAfter.getTime() < best.getTime())
+            best = notOnOrAfter;
+    }
+    // `latest` is set whenever `best` is: every qualifying confirmation was
+    // counted towards it first. When nothing qualified, every candidate left
+    // exactly one reason, in document order.
+    if (best && latest)
+        return { notOnOrAfter: best, latestNotOnOrAfter: latest };
+    return fail('bearerConfirmation', describeRefusals(reasons));
+}
+/**
+ * Sub-rules 1 to 6, in the spec's fixed order: the first one this candidate
+ * fails, or the window it states. The temporal sub-rules 7 and 8 are the
+ * caller's, since a candidate failing only those still bounds replay
+ * retention.
+ */
+function readConfirmation(confirmation, context) {
+    // 1.
+    if (confirmation.getAttribute('Method') !== BEARER) {
+        return { reason: 'Method is not bearer' };
+    }
+    // 2.
+    const data = directChildren(confirmation, SAML_NS, 'SubjectConfirmationData');
+    if (data.length === 0) {
+        return { reason: 'carries no SubjectConfirmationData' };
+    }
+    if (data.length > 1) {
+        return {
+            reason: `carries ${data.length} SubjectConfirmationData; exactly one is allowed`,
+        };
+    }
+    const only = data[0];
+    // 3. Option B: an expected ID must be matched exactly; no expected ID — an
+    // IdP-initiated login — means the attribute must not be there at all.
+    if (context.expectedInResponseTo === undefined) {
+        if (only.hasAttribute('InResponseTo')) {
+            return {
+                reason: 'InResponseTo is present, but this login sent no request',
+            };
+        }
+    }
+    else if (only.getAttribute('InResponseTo') !== context.expectedInResponseTo) {
+        return { reason: 'InResponseTo does not answer our request' };
+    }
+    // 4.
+    if (only.getAttribute('Recipient') !== context.acsUrl) {
+        return { reason: 'Recipient is not the ACS' };
+    }
+    // 5.
+    const notOnOrAfterRaw = only.getAttribute('NotOnOrAfter');
+    if (!notOnOrAfterRaw) {
+        return { reason: 'SubjectConfirmationData has no NotOnOrAfter' };
+    }
+    const notOnOrAfter = (0, xsdDateTime_1.parseXsdDateTime)(notOnOrAfterRaw);
+    if (!notOnOrAfter) {
+        return {
+            reason: 'SubjectConfirmationData NotOnOrAfter is not a valid xsd:dateTime',
+        };
+    }
+    // 6.
+    const notBeforeRaw = only.getAttribute('NotBefore');
+    const notBefore = notBeforeRaw ? (0, xsdDateTime_1.parseXsdDateTime)(notBeforeRaw) : null;
+    if (notBeforeRaw && !notBefore) {
+        return {
+            reason: 'SubjectConfirmationData NotBefore is not a valid xsd:dateTime',
+        };
+    }
+    return { notOnOrAfter, notBefore };
+}
+/**
+ * `no bearer confirmation qualifies: #1 …; #2 …`, naming at most
+ * LISTED_CANDIDATES candidates so the message stays bounded however many the
+ * document carries.
+ */
+function describeRefusals(reasons) {
+    const listed = reasons
+        .slice(0, LISTED_CANDIDATES)
+        .map((reason, index) => `#${index + 1} ${reason}`);
+    const more = reasons.length - listed.length;
+    return `no bearer confirmation qualifies: ${listed.join('; ')}${more > 0 ? `; and ${more} more` : ''}`;
+}

package/dist/validation/documentIds.d.ts

@@ -0,0 +1,15 @@
+import type { Document, Element } from '@xmldom/xmldom';
+/**
+ * The `ID` rules, which run before any signature reference is resolved.
+ *
+ * XML-DSig resolves its reference by `ID`. Two elements sharing one make
+ * "which element is signed" a question the parser answers rather than the
+ * specification, and that ambiguity is the classic lever for signature
+ * wrapping. So uniqueness is established first, across the whole document —
+ * not only across the two elements this validator happens to read.
+ */
+/** The first ID value appearing more than once, or null when all are unique. */
+export declare function findDuplicateId(doc: Document): string | null;
+/** The element's ID, or null when it is absent or empty. */
+export declare function readRequiredId(element: Element): string | null;
+//# sourceMappingURL=documentIds.d.ts.map

package/dist/validation/documentIds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentIds.d.ts","sourceRoot":"","sources":["../../src/validation/documentIds.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAExD;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAU5D;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAG9D"}

package/dist/validation/documentIds.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findDuplicateId = findDuplicateId;
+exports.readRequiredId = readRequiredId;
+/**
+ * The `ID` rules, which run before any signature reference is resolved.
+ *
+ * XML-DSig resolves its reference by `ID`. Two elements sharing one make
+ * "which element is signed" a question the parser answers rather than the
+ * specification, and that ambiguity is the classic lever for signature
+ * wrapping. So uniqueness is established first, across the whole document —
+ * not only across the two elements this validator happens to read.
+ */
+/** The first ID value appearing more than once, or null when all are unique. */
+function findDuplicateId(doc) {
+    const seen = new Set();
+    const elements = doc.getElementsByTagName('*');
+    for (let i = 0; i < elements.length; i++) {
+        const id = elements[i].getAttribute('ID');
+        if (!id)
+            continue;
+        if (seen.has(id))
+            return id;
+        seen.add(id);
+    }
+    return null;
+}
+/** The element's ID, or null when it is absent or empty. */
+function readRequiredId(element) {
+    const id = element.getAttribute('ID');
+    return id ? id : null;
+}

package/dist/validation/inMemoryReplayStore.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Remembering assertions so a replay is refused.
+ *
+ * In memory, and therefore per process. That is honest rather than sufficient:
+ * a deployment running several processes needs a shared store, which is why
+ * the interface exists at all. What this must not be is per provider instance —
+ * a store an attacker escapes by causing a second provider to be constructed
+ * is no store.
+ *
+ * Pruning is lazy, on access, so nothing here holds a timer and nothing needs
+ * disposing.
+ */
+import type { IAssertionReplayStore } from '@mcp-abap-adt/interfaces-auth';
+/** A store of its own, for a test or a consumer wanting isolation. */
+export declare function createInMemoryReplayStore(): IAssertionReplayStore;
+/**
+ * The store the shipped validator uses when the consumer supplies none.
+ *
+ * Module-level, so every default validator in the process shares it.
+ */
+export declare const defaultReplayStore: IAssertionReplayStore;
+//# sourceMappingURL=inMemoryReplayStore.d.ts.map

package/dist/validation/inMemoryReplayStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inMemoryReplayStore.d.ts","sourceRoot":"","sources":["../../src/validation/inMemoryReplayStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAEV,qBAAqB,EACtB,MAAM,+BAA+B,CAAC;AAOvC,sEAAsE;AACtE,wBAAgB,yBAAyB,IAAI,qBAAqB,CAuBjE;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,qBACJ,CAAC"}

package/dist/validation/inMemoryReplayStore.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * Remembering assertions so a replay is refused.
+ *
+ * In memory, and therefore per process. That is honest rather than sufficient:
+ * a deployment running several processes needs a shared store, which is why
+ * the interface exists at all. What this must not be is per provider instance —
+ * a store an attacker escapes by causing a second provider to be constructed
+ * is no store.
+ *
+ * Pruning is lazy, on access, so nothing here holds a timer and nothing needs
+ * disposing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultReplayStore = void 0;
+exports.createInMemoryReplayStore = createInMemoryReplayStore;
+const compositeKey = (key) => 
+// The issuer is length-prefixed so that two different pairs cannot collide
+// by putting the separator inside an identifier.
+`${key.issuer.length}:${key.issuer}:${key.assertionId}`;
+/** A store of its own, for a test or a consumer wanting isolation. */
+function createInMemoryReplayStore() {
+    const seen = new Map();
+    return {
+        async recordIfUnseen(key, retainUntil) {
+            const now = Date.now();
+            // Lazy prune: drop everything whose retention has passed, so the map
+            // cannot grow without bound and no timer is needed.
+            for (const [existing, until] of seen) {
+                if (until <= now)
+                    seen.delete(existing);
+            }
+            const composite = compositeKey(key);
+            if (seen.has(composite))
+                return false;
+            // Nothing awaits between the check and the write, so this is atomic
+            // against other callers on the same event loop. A shared-store
+            // implementation must achieve the same with a conditional write.
+            seen.set(composite, retainUntil.getTime());
+            return true;
+        },
+    };
+}
+/**
+ * The store the shipped validator uses when the consumer supplies none.
+ *
+ * Module-level, so every default validator in the process shares it.
+ */
+exports.defaultReplayStore = createInMemoryReplayStore();