@plumbus/core 0.3.3 → 0.4.0

package/dist/auth/__tests__/oidc-adapter.test.js

@@ -1,232 +0,0 @@
-import { generateKeyPairSync, sign } from 'node:crypto';
-import { describe, expect, it, vi } from 'vitest';
-import { createOidcAdapter } from '../oidc-adapter.js';
-const ISSUER = 'https://auth.example.com';
-const AUDIENCE = 'my-app';
-// Generate a test RSA key pair
-const { publicKey: rsaPublicKey, privateKey: rsaPrivateKey } = generateKeyPairSync('rsa', {
-    modulusLength: 2048,
-});
-const rsaJwk = rsaPublicKey.export({ format: 'jwk' });
-rsaJwk.kid = 'test-rsa-key';
-rsaJwk.use = 'sig';
-rsaJwk.alg = 'RS256';
-// Generate a test EC key pair
-const { publicKey: ecPublicKey, privateKey: ecPrivateKey } = generateKeyPairSync('ec', {
-    namedCurve: 'P-256',
-});
-const ecJwk = ecPublicKey.export({ format: 'jwk' });
-ecJwk.kid = 'test-ec-key';
-ecJwk.use = 'sig';
-ecJwk.alg = 'ES256';
-/** Sign a JWT with the RSA private key. */
-function signRsaJwt(payload, kid = 'test-rsa-key') {
-    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT', kid })).toString('base64url');
-    const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
-    const signature = sign('RSA-SHA256', Buffer.from(`${header}.${body}`), rsaPrivateKey);
-    return `${header}.${body}.${signature.toString('base64url')}`;
-}
-/** Sign a JWT with the EC private key. */
-function signEcJwt(payload, kid = 'test-ec-key') {
-    const header = Buffer.from(JSON.stringify({ alg: 'ES256', typ: 'JWT', kid })).toString('base64url');
-    const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
-    const signature = sign('SHA256', Buffer.from(`${header}.${body}`), ecPrivateKey);
-    return `${header}.${body}.${signature.toString('base64url')}`;
-}
-/** Build a mock fetch that serves discovery + JWKS. */
-function mockFetch(jwksKeys = [rsaJwk, ecJwk]) {
-    return vi.fn(async (input) => {
-        const url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
-        if (url.includes('.well-known/openid-configuration')) {
-            return new Response(JSON.stringify({
-                issuer: ISSUER,
-                jwks_uri: `${ISSUER}/.well-known/jwks.json`,
-            }), { status: 200 });
-        }
-        if (url.includes('jwks.json')) {
-            return new Response(JSON.stringify({ keys: jwksKeys }), { status: 200 });
-        }
-        return new Response('Not Found', { status: 404 });
-    });
-}
-function validPayload(overrides = {}) {
-    return {
-        sub: 'user-42',
-        iss: ISSUER,
-        aud: AUDIENCE,
-        exp: Math.floor(Date.now() / 1000) + 3600,
-        iat: Math.floor(Date.now() / 1000),
-        roles: ['admin'],
-        scope: 'read write',
-        tenant_id: 'tenant-1',
-        ...overrides,
-    };
-}
-describe('createOidcAdapter', () => {
-    it('returns null for missing authorization header', async () => {
-        const adapter = createOidcAdapter({ issuer: ISSUER, audience: AUDIENCE, fetchFn: mockFetch() });
-        expect(await adapter.authenticate(undefined)).toBeNull();
-    });
-    it('returns null for non-Bearer token', async () => {
-        const adapter = createOidcAdapter({ issuer: ISSUER, audience: AUDIENCE, fetchFn: mockFetch() });
-        expect(await adapter.authenticate('Basic abc123')).toBeNull();
-    });
-    it('returns null for malformed JWT', async () => {
-        const adapter = createOidcAdapter({ issuer: ISSUER, audience: AUDIENCE, fetchFn: mockFetch() });
-        expect(await adapter.authenticate('Bearer not-a-jwt')).toBeNull();
-    });
-    it('validates RS256-signed tokens', async () => {
-        const adapter = createOidcAdapter({ issuer: ISSUER, audience: AUDIENCE, fetchFn: mockFetch() });
-        const token = signRsaJwt(validPayload());
-        const result = await adapter.authenticate(`Bearer ${token}`);
-        expect(result).not.toBeNull();
-        expect(result?.userId).toBe('user-42');
-        expect(result?.roles).toEqual(['admin']);
-        expect(result?.scopes).toEqual(['read', 'write']);
-        expect(result?.tenantId).toBe('tenant-1');
-        expect(result?.provider).toBe('oidc');
-    });
-    it('validates ES256-signed tokens', async () => {
-        const adapter = createOidcAdapter({ issuer: ISSUER, audience: AUDIENCE, fetchFn: mockFetch() });
-        const token = signEcJwt(validPayload());
-        const result = await adapter.authenticate(`Bearer ${token}`);
-        expect(result).not.toBeNull();
-        expect(result?.userId).toBe('user-42');
-        expect(result?.provider).toBe('oidc');
-    });
-    it('rejects expired tokens', async () => {
-        const adapter = createOidcAdapter({ issuer: ISSUER, audience: AUDIENCE, fetchFn: mockFetch() });
-        const token = signRsaJwt(validPayload({ exp: Math.floor(Date.now() / 1000) - 60 }));
-        expect(await adapter.authenticate(`Bearer ${token}`)).toBeNull();
-    });
-    it('rejects tokens with wrong issuer', async () => {
-        const adapter = createOidcAdapter({ issuer: ISSUER, audience: AUDIENCE, fetchFn: mockFetch() });
-        const token = signRsaJwt(validPayload({ iss: 'https://evil.example.com' }));
-        expect(await adapter.authenticate(`Bearer ${token}`)).toBeNull();
-    });
-    it('rejects tokens with wrong audience', async () => {
-        const adapter = createOidcAdapter({ issuer: ISSUER, audience: AUDIENCE, fetchFn: mockFetch() });
-        const token = signRsaJwt(validPayload({ aud: 'wrong-audience' }));
-        expect(await adapter.authenticate(`Bearer ${token}`)).toBeNull();
-    });
-    it('rejects tokens signed with unknown key', async () => {
-        const adapter = createOidcAdapter({
-            issuer: ISSUER,
-            audience: AUDIENCE,
-            fetchFn: mockFetch([]),
-        });
-        const token = signRsaJwt(validPayload());
-        expect(await adapter.authenticate(`Bearer ${token}`)).toBeNull();
-    });
-    it('rejects unsupported algorithms', async () => {
-        const adapter = createOidcAdapter({ issuer: ISSUER, audience: AUDIENCE, fetchFn: mockFetch() });
-        // Forge a token with HS256 alg (not supported by OIDC adapter)
-        const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT', kid: 'test-rsa-key' })).toString('base64url');
-        const body = Buffer.from(JSON.stringify(validPayload())).toString('base64url');
-        const sig = 'fake-signature';
-        expect(await adapter.authenticate(`Bearer ${header}.${body}.${sig}`)).toBeNull();
-    });
-    it('uses explicit jwksUri when provided', async () => {
-        const fetchFn = mockFetch();
-        const adapter = createOidcAdapter({
-            issuer: ISSUER,
-            audience: AUDIENCE,
-            jwksUri: `${ISSUER}/custom/jwks`,
-            fetchFn,
-        });
-        const token = signRsaJwt(validPayload());
-        await adapter.authenticate(`Bearer ${token}`);
-        // Should NOT call discovery endpoint
-        expect(fetchFn).not.toHaveBeenCalledWith(expect.stringContaining('.well-known/openid-configuration'));
-    });
-    it('caches JWKS keys', async () => {
-        const fetchFn = mockFetch();
-        const adapter = createOidcAdapter({
-            issuer: ISSUER,
-            audience: AUDIENCE,
-            jwksUri: `${ISSUER}/.well-known/jwks.json`,
-            fetchFn,
-        });
-        const token1 = signRsaJwt(validPayload());
-        const token2 = signRsaJwt(validPayload({ sub: 'user-99' }));
-        await adapter.authenticate(`Bearer ${token1}`);
-        await adapter.authenticate(`Bearer ${token2}`);
-        // JWKS should be fetched only once (cached)
-        const jwksCalls = fetchFn.mock.calls.filter((call) => String(call[0]).includes('jwks.json'));
-        expect(jwksCalls).toHaveLength(1);
-    });
-    it('refreshes cache on key rotation (unknown kid)', async () => {
-        // Start with empty JWKS (simulates key not yet published)
-        let callCount = 0;
-        const fetchFn = vi.fn(async (input) => {
-            const url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
-            if (url.includes('jwks.json')) {
-                callCount++;
-                // Second call returns the actual key
-                const keys = callCount > 1 ? [rsaJwk] : [];
-                return new Response(JSON.stringify({ keys }), { status: 200 });
-            }
-            return new Response('Not Found', { status: 404 });
-        });
-        const adapter = createOidcAdapter({
-            issuer: ISSUER,
-            audience: AUDIENCE,
-            jwksUri: `${ISSUER}/.well-known/jwks.json`,
-            fetchFn,
-        });
-        const token = signRsaJwt(validPayload());
-        const result = await adapter.authenticate(`Bearer ${token}`);
-        expect(result?.userId).toBe('user-42');
-        expect(callCount).toBe(2); // Fetched twice due to cache miss + refresh
-    });
-    it('supports custom claim mapping', async () => {
-        const adapter = createOidcAdapter({
-            issuer: ISSUER,
-            audience: AUDIENCE,
-            fetchFn: mockFetch(),
-            claimMapping: {
-                userId: 'email',
-                roles: 'groups',
-                tenantId: 'org_id',
-            },
-        });
-        const token = signRsaJwt({
-            ...validPayload(),
-            email: 'user@example.com',
-            groups: ['editors'],
-            org_id: 'org-123',
-        });
-        const result = await adapter.authenticate(`Bearer ${token}`);
-        expect(result?.userId).toBe('user@example.com');
-        expect(result?.roles).toEqual(['editors']);
-        expect(result?.tenantId).toBe('org-123');
-    });
-    it('returns null when JWKS fetch fails', async () => {
-        const fetchFn = vi.fn(async () => new Response('Server Error', { status: 500 }));
-        const adapter = createOidcAdapter({
-            issuer: ISSUER,
-            audience: AUDIENCE,
-            jwksUri: `${ISSUER}/.well-known/jwks.json`,
-            fetchFn,
-        });
-        const token = signRsaJwt(validPayload());
-        expect(await adapter.authenticate(`Bearer ${token}`)).toBeNull();
-    });
-    it('returns null when discovery fails', async () => {
-        const fetchFn = vi.fn(async () => new Response('Not Found', { status: 404 }));
-        const adapter = createOidcAdapter({
-            issuer: ISSUER,
-            audience: AUDIENCE,
-            fetchFn,
-        });
-        const token = signRsaJwt(validPayload());
-        expect(await adapter.authenticate(`Bearer ${token}`)).toBeNull();
-    });
-    it('handles multi-value audience', async () => {
-        const adapter = createOidcAdapter({ issuer: ISSUER, audience: AUDIENCE, fetchFn: mockFetch() });
-        const token = signRsaJwt(validPayload({ aud: ['other-app', AUDIENCE] }));
-        const result = await adapter.authenticate(`Bearer ${token}`);
-        expect(result?.userId).toBe('user-42');
-    });
-});
-//# sourceMappingURL=oidc-adapter.test.js.map

package/dist/auth/__tests__/oidc-adapter.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-adapter.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/oidc-adapter.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,MAAM,GAAG,0BAA0B,CAAC;AAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAE1B,+BAA+B;AAC/B,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;IACxF,aAAa,EAAE,IAAI;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA4B,CAAC;AACjF,MAAM,CAAC,GAAG,GAAG,cAAc,CAAC;AAC5B,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;AACnB,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC;AAErB,8BAA8B;AAC9B,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC,IAAI,EAAE;IACrF,UAAU,EAAE,OAAO;CACpB,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA4B,CAAC;AAC/E,KAAK,CAAC,GAAG,GAAG,aAAa,CAAC;AAC1B,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC;AAClB,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC;AAEpB,2CAA2C;AAC3C,SAAS,UAAU,CAAC,OAAgC,EAAE,GAAG,GAAG,cAAc;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CACpF,WAAW,CACZ,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IACtF,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,0CAA0C;AAC1C,SAAS,SAAS,CAAC,OAAgC,EAAE,GAAG,GAAG,aAAa;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CACpF,WAAW,CACZ,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;IACjF,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,uDAAuD;AACvD,SAAS,SAAS,CAAC,WAAsC,CAAC,MAAM,EAAE,KAAK,CAAC;IACtE,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAA6B,EAAE,EAAE;QACnD,MAAM,GAAG,GACP,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAE1F,IAAI,GAAG,CAAC,QAAQ,CAAC,kCAAkC,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,GAAG,MAAM,wBAAwB;aAC5C,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAiB,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,YAAqC,EAAE;IAC3D,OAAO;QACL,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;QACzC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClC,KAAK,EAAE,CAAC,OAAO,CAAC;QAChB,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,UAAU;QACrB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAEhG,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAE7D,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAEhG,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAE7D,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAEhG,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAEhG,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAEhG,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;SACvB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAChG,+DAA+D;QAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CACxB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAClE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,MAAM,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,MAAM,cAAc;YAChC,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACzC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAE9C,qCAAqC;QACrC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,oBAAoB,CACtC,MAAM,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,CAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,MAAM,wBAAwB;YAC1C,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAE5D,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;QAE/C,4CAA4C;QAC5C,MAAM,SAAS,GAAI,OAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAe,EAAE,EAAE,CAC5F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CACtC,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,0DAA0D;QAC1D,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAA6B,EAAE,EAAE;YAC5D,MAAM,GAAG,GACP,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YAC1F,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9B,SAAS,EAAE,CAAC;gBACZ,qCAAqC;gBACrC,MAAM,IAAI,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC,CAAiB,CAAC;QAEnB,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,MAAM,wBAAwB;YAC1C,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAE7D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,4CAA4C;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,SAAS,EAAE;YACpB,YAAY,EAAE;gBACZ,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,QAAQ;aACnB;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,GAAG,YAAY,EAAE;YACjB,KAAK,EAAE,kBAAkB;YACzB,MAAM,EAAE,CAAC,SAAS,CAAC;YACnB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CACnB,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC1C,CAAC;QAElB,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,MAAM,wBAAwB;YAC1C,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAiB,CAAC;QAE9F,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAEhG,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/__tests__/password.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=password.test.d.ts.map

package/dist/auth/__tests__/password.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"password.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/password.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/password.test.js

@@ -1,30 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { hashPassword, verifyPassword } from '../password.js';
-describe('password helpers', () => {
-    it('hashes passwords into salt:hash format', async () => {
-        const hashed = await hashPassword('correct horse battery staple');
-        const parts = hashed.split(':');
-        expect(parts).toHaveLength(2);
-        expect(parts[0]).toHaveLength(32);
-        expect(parts[1]?.length).toBeGreaterThan(0);
-    });
-    it('verifies the original password', async () => {
-        const password = 'correct horse battery staple';
-        const hashed = await hashPassword(password);
-        await expect(verifyPassword(password, hashed)).resolves.toBe(true);
-    });
-    it('rejects an invalid password', async () => {
-        const hashed = await hashPassword('correct horse battery staple');
-        await expect(verifyPassword('wrong password', hashed)).resolves.toBe(false);
-    });
-    it('rejects malformed stored hashes', async () => {
-        await expect(verifyPassword('password', 'not-a-valid-hash')).resolves.toBe(false);
-    });
-    it('supports custom key length options', async () => {
-        const password = 'custom-options-password';
-        const hashed = await hashPassword(password, { keyLength: 32, saltBytes: 8 });
-        await expect(verifyPassword(password, hashed, { keyLength: 32 })).resolves.toBe(true);
-        await expect(verifyPassword(password, hashed)).resolves.toBe(false);
-    });
-});
-//# sourceMappingURL=password.test.js.map

package/dist/auth/__tests__/password.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"password.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/password.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE9D,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,8BAA8B,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,QAAQ,GAAG,8BAA8B,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE5C,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,8BAA8B,CAAC,CAAC;QAElE,MAAM,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,QAAQ,GAAG,yBAAyB,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAE7E,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/__tests__/saml-adapter.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=saml-adapter.test.d.ts.map

package/dist/auth/__tests__/saml-adapter.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"saml-adapter.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/saml-adapter.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/saml-adapter.test.js

@@ -1,188 +0,0 @@
-import { createSign, generateKeyPairSync } from 'node:crypto';
-import { describe, expect, it } from 'vitest';
-import { createSamlAdapter } from '../saml-adapter.js';
-const IDP_ENTITY_ID = 'https://idp.example.com';
-const SP_ENTITY_ID = 'https://app.example.com';
-// Generate a test RSA key pair for signing assertions
-const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
-const certPem = publicKey.export({ type: 'spki', format: 'pem' });
-// Use SPKI public key format (real certs would be X.509, but crypto.createPublicKey accepts SPKI too)
-const certForAdapter = certPem;
-function futureISO(minutes) {
-    return new Date(Date.now() + minutes * 60 * 1000).toISOString();
-}
-function pastISO(minutes) {
-    return new Date(Date.now() - minutes * 60 * 1000).toISOString();
-}
-/** Build a minimal SAML Response XML with attributes. */
-function buildSamlResponse(opts) {
-    const issuer = opts.issuer ?? IDP_ENTITY_ID;
-    const audience = opts.audience ?? SP_ENTITY_ID;
-    const nameId = opts.nameId ?? 'user@example.com';
-    const notBefore = opts.notBefore ?? pastISO(1);
-    const notOnOrAfter = opts.notOnOrAfter ?? futureISO(10);
-    let attributeStatements = '';
-    if (opts.attributes) {
-        const attrXml = Object.entries(opts.attributes)
-            .map(([name, values]) => {
-            const valXml = values
-                .map((v) => `<saml:AttributeValue>${v}</saml:AttributeValue>`)
-                .join('');
-            return `<saml:Attribute Name="${name}">${valXml}</saml:Attribute>`;
-        })
-            .join('');
-        attributeStatements = `<saml:AttributeStatement>${attrXml}</saml:AttributeStatement>`;
-    }
-    const assertionBody = `<saml:Issuer>${issuer}</saml:Issuer>
-<saml:Conditions NotBefore="${notBefore}" NotOnOrAfter="${notOnOrAfter}">
-<saml:AudienceRestriction><saml:Audience>${audience}</saml:Audience></saml:AudienceRestriction>
-</saml:Conditions>
-<saml:Subject><saml:NameID>${nameId}</saml:NameID></saml:Subject>
-${attributeStatements}`;
-    if (opts.skipSignature) {
-        return `<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
-<saml:Assertion>${assertionBody}</saml:Assertion>
-</samlp:Response>`;
-    }
-    // Sign the assertion content
-    return signSamlResponse(assertionBody);
-}
-/** Sign a SAML response using RSA-SHA256 with enveloped signature. */
-function signSamlResponse(assertionBody) {
-    // Build the SignedInfo referencing the assertion digest
-    const signedInfo = `<ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod>
-<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></ds:SignatureMethod>
-<ds:Reference><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></ds:DigestMethod><ds:DigestValue>placeholder</ds:DigestValue></ds:Reference>
-</ds:SignedInfo>`;
-    const signer = createSign('RSA-SHA256');
-    signer.update(signedInfo);
-    const signatureValue = signer.sign(privateKey, 'base64');
-    const signature = `<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-${signedInfo}
-<ds:SignatureValue>${signatureValue}</ds:SignatureValue>
-</ds:Signature>`;
-    return `<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
-<saml:Assertion>${assertionBody}${signature}</saml:Assertion>
-</samlp:Response>`;
-}
-function toBase64(xml) {
-    return Buffer.from(xml).toString('base64');
-}
-describe('createSamlAdapter', () => {
-    const adapter = createSamlAdapter({
-        idpCertificate: certForAdapter,
-        issuer: IDP_ENTITY_ID,
-        audience: SP_ENTITY_ID,
-    });
-    describe('processSamlResponse', () => {
-        it('validates a signed SAML response and extracts identity', () => {
-            const xml = buildSamlResponse({
-                nameId: 'user-42@example.com',
-                attributes: {
-                    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress': [
-                        'user-42@example.com',
-                    ],
-                    'http://schemas.microsoft.com/ws/2008/06/identity/claims/role': ['admin', 'user'],
-                },
-            });
-            const result = adapter.processSamlResponse(toBase64(xml));
-            expect(result).not.toBeNull();
-            expect(result?.nameId).toBe('user-42@example.com');
-            expect(result?.roles).toEqual(['admin', 'user']);
-            expect(result?.provider).toBe('saml');
-        });
-        it('rejects response with wrong issuer', () => {
-            const xml = buildSamlResponse({ issuer: 'https://evil.example.com' });
-            expect(adapter.processSamlResponse(toBase64(xml))).toBeNull();
-        });
-        it('rejects response with wrong audience', () => {
-            const xml = buildSamlResponse({ audience: 'https://other-app.example.com' });
-            expect(adapter.processSamlResponse(toBase64(xml))).toBeNull();
-        });
-        it('rejects unsigned responses', () => {
-            const xml = buildSamlResponse({ skipSignature: true });
-            expect(adapter.processSamlResponse(toBase64(xml))).toBeNull();
-        });
-        it('rejects expired conditions', () => {
-            const xml = buildSamlResponse({
-                notBefore: pastISO(30),
-                notOnOrAfter: pastISO(20),
-            });
-            expect(adapter.processSamlResponse(toBase64(xml))).toBeNull();
-        });
-        it('extracts NameID as default userId', () => {
-            const xml = buildSamlResponse({ nameId: 'default-user-id' });
-            const result = adapter.processSamlResponse(toBase64(xml));
-            expect(result?.userId).toBe('default-user-id');
-            expect(result?.nameId).toBe('default-user-id');
-        });
-        it('prefers userId from attributes over NameID', () => {
-            const xml = buildSamlResponse({
-                nameId: 'nameid-value',
-                attributes: {
-                    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier': ['attr-user-id'],
-                },
-            });
-            const result = adapter.processSamlResponse(toBase64(xml));
-            expect(result?.userId).toBe('attr-user-id');
-        });
-        it('extracts tenantId from attributes', () => {
-            const xml = buildSamlResponse({
-                attributes: {
-                    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/tenantid': ['tenant-abc'],
-                },
-            });
-            const result = adapter.processSamlResponse(toBase64(xml));
-            expect(result?.tenantId).toBe('tenant-abc');
-        });
-        it('returns null for invalid base64', () => {
-            expect(adapter.processSamlResponse('not-valid-base64!!!')).toBeNull();
-        });
-    });
-    describe('authenticate (Bearer mode)', () => {
-        it('returns null for missing header', async () => {
-            expect(await adapter.authenticate(undefined)).toBeNull();
-        });
-        it('returns null for non-Bearer header', async () => {
-            expect(await adapter.authenticate('Basic abc123')).toBeNull();
-        });
-        it('validates a Bearer token containing base64-encoded SAML assertion', async () => {
-            const xml = buildSamlResponse({ nameId: 'bearer-user' });
-            const encoded = toBase64(xml);
-            const result = await adapter.authenticate(`Bearer ${encoded}`);
-            expect(result?.userId).toBe('bearer-user');
-            expect(result?.provider).toBe('saml');
-        });
-        it('returns null for Bearer token without SAML content', async () => {
-            const encoded = Buffer.from('not xml').toString('base64');
-            expect(await adapter.authenticate(`Bearer ${encoded}`)).toBeNull();
-        });
-    });
-    describe('custom attribute mapping', () => {
-        it('maps attributes using custom configuration', () => {
-            const customAdapter = createSamlAdapter({
-                idpCertificate: certForAdapter,
-                issuer: IDP_ENTITY_ID,
-                audience: SP_ENTITY_ID,
-                attributeMapping: {
-                    userId: 'custom_user_id',
-                    roles: 'custom_roles',
-                    tenantId: 'custom_org',
-                },
-            });
-            const xml = buildSamlResponse({
-                attributes: {
-                    custom_user_id: ['custom-42'],
-                    custom_roles: ['editor'],
-                    custom_org: ['org-99'],
-                },
-            });
-            const result = customAdapter.processSamlResponse(toBase64(xml));
-            expect(result?.userId).toBe('custom-42');
-            expect(result?.roles).toEqual(['editor']);
-            expect(result?.tenantId).toBe('org-99');
-        });
-    });
-});
-//# sourceMappingURL=saml-adapter.test.js.map

package/dist/auth/__tests__/saml-adapter.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"saml-adapter.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/saml-adapter.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAE/C,sDAAsD;AACtD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;AACtF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;AAE5E,sGAAsG;AACtG,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAClE,CAAC;AAED,yDAAyD;AACzD,SAAS,iBAAiB,CAAC,IAQ1B;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;IAExD,IAAI,mBAAmB,GAAG,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM;iBAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,wBAAwB,CAAC;iBAC7D,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,yBAAyB,IAAI,KAAK,MAAM,mBAAmB,CAAC;QACrE,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,mBAAmB,GAAG,4BAA4B,OAAO,4BAA4B,CAAC;IACxF,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,MAAM;8BAChB,SAAS,mBAAmB,YAAY;2CAC3B,QAAQ;;6BAEtB,MAAM;EACjC,mBAAmB,EAAE,CAAC;IAEtB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,OAAO;kBACO,aAAa;kBACb,CAAC;IACjB,CAAC;IAED,6BAA6B;IAC7B,OAAO,gBAAgB,CAAC,aAAa,CAAC,CAAC;AACzC,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,aAAqB;IAC7C,wDAAwD;IACxD,MAAM,UAAU,GAAG;;;;iBAIJ,CAAC;IAEhB,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1B,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEzD,MAAM,SAAS,GAAG;EAClB,UAAU;qBACS,cAAc;gBACnB,CAAC;IAEf,OAAO;kBACS,aAAa,GAAG,SAAS;kBACzB,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,cAAc,EAAE,cAAc;QAC9B,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,GAAG,GAAG,iBAAiB,CAAC;gBAC5B,MAAM,EAAE,qBAAqB;gBAC7B,UAAU,EAAE;oBACV,oEAAoE,EAAE;wBACpE,qBAAqB;qBACtB;oBACD,8DAA8D,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;iBAClF;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACtE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC7E,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,GAAG,GAAG,iBAAiB,CAAC;gBAC5B,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtB,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;aAC1B,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC/C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,GAAG,GAAG,iBAAiB,CAAC;gBAC5B,MAAM,EAAE,cAAc;gBACtB,UAAU,EAAE;oBACV,sEAAsE,EAAE,CAAC,cAAc,CAAC;iBACzF;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,GAAG,GAAG,iBAAiB,CAAC;gBAC5B,UAAU,EAAE;oBACV,gEAAgE,EAAE,CAAC,YAAY,CAAC;iBACjF;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;YACjF,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;YAC/D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACxC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,aAAa,GAAG,iBAAiB,CAAC;gBACtC,cAAc,EAAE,cAAc;gBAC9B,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,YAAY;gBACtB,gBAAgB,EAAE;oBAChB,MAAM,EAAE,gBAAgB;oBACxB,KAAK,EAAE,cAAc;oBACrB,QAAQ,EAAE,YAAY;iBACvB;aACF,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,iBAAiB,CAAC;gBAC5B,UAAU,EAAE;oBACV,cAAc,EAAE,CAAC,WAAW,CAAC;oBAC7B,YAAY,EAAE,CAAC,QAAQ,CAAC;oBACxB,UAAU,EAAE,CAAC,QAAQ,CAAC;iBACvB;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,aAAa,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/__tests__/scim.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=scim.test.d.ts.map

package/dist/auth/__tests__/scim.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scim.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/scim.test.ts"],"names":[],"mappings":""}