@revealui/auth 0.5.0 → 0.5.1

package/dist/server/sso/oidc.js

@@ -0,0 +1,345 @@
+/**
+ * OIDC discovery + id_token validation (GAP-464 Phase 2).
+ *
+ * Security hardlines:
+ * - Never accept id_token without cryptographic signature validation (JWKS / key).
+ * - Validate issuer, audience (client_id), and exp on every token.
+ */
+import { createRemoteJWKSet, jwtVerify, } from 'jose';
+/** Asymmetric algorithms used by enterprise IdPs; `none` is never allowed. */
+const ID_TOKEN_ALGORITHMS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'PS256',
+    'PS384',
+    'PS512',
+    'EdDSA',
+];
+const DISCOVERY_REQUIRED = [
+    'issuer',
+    'authorization_endpoint',
+    'token_endpoint',
+    'jwks_uri',
+];
+/** Strip trailing `/` without regex (CodeQL: avoid poly ReDoS on uncontrolled issuer). */
+function normalizeIssuer(issuer) {
+    let end = issuer.length;
+    while (end > 0 && issuer.charCodeAt(end - 1) === 47 /* '/' */) {
+        end -= 1;
+    }
+    return end === issuer.length ? issuer : issuer.slice(0, end);
+}
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+/**
+ * Fetch and parse an OIDC discovery document (openid-configuration).
+ */
+export async function fetchOidcDiscovery(discoveryUrl, options = {}) {
+    if (!isNonEmptyString(discoveryUrl)) {
+        return {
+            ok: false,
+            reason: 'missing_required_fields',
+            message: 'discoveryUrl is required',
+        };
+    }
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+        response = await fetchImpl(discoveryUrl, {
+            method: 'GET',
+            headers: { Accept: 'application/json' },
+            signal: controller.signal,
+            redirect: 'follow',
+        });
+    }
+    catch (err) {
+        clearTimeout(timer);
+        const message = err instanceof Error ? err.message : 'discovery fetch failed';
+        return { ok: false, reason: 'fetch_failed', message };
+    }
+    clearTimeout(timer);
+    if (!response.ok) {
+        return {
+            ok: false,
+            reason: 'fetch_failed',
+            message: `discovery HTTP ${response.status}`,
+        };
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        return { ok: false, reason: 'invalid_json', message: 'discovery response is not JSON' };
+    }
+    if (!body || typeof body !== 'object') {
+        return { ok: false, reason: 'invalid_json', message: 'discovery response is not an object' };
+    }
+    const record = body;
+    for (const key of DISCOVERY_REQUIRED) {
+        if (!isNonEmptyString(record[key])) {
+            return {
+                ok: false,
+                reason: 'missing_required_fields',
+                message: `discovery document missing ${key}`,
+            };
+        }
+    }
+    const document = {
+        issuer: record.issuer,
+        authorization_endpoint: record.authorization_endpoint,
+        token_endpoint: record.token_endpoint,
+        jwks_uri: record.jwks_uri,
+    };
+    if (isNonEmptyString(record.userinfo_endpoint)) {
+        document.userinfo_endpoint = record.userinfo_endpoint;
+    }
+    if (isNonEmptyString(record.end_session_endpoint)) {
+        document.end_session_endpoint = record.end_session_endpoint;
+    }
+    if (Array.isArray(record.scopes_supported)) {
+        document.scopes_supported = record.scopes_supported.filter((s) => typeof s === 'string');
+    }
+    if (Array.isArray(record.response_types_supported)) {
+        document.response_types_supported = record.response_types_supported.filter((s) => typeof s === 'string');
+    }
+    if (Array.isArray(record.code_challenge_methods_supported)) {
+        document.code_challenge_methods_supported = record.code_challenge_methods_supported.filter((s) => typeof s === 'string');
+    }
+    if (options.expectedIssuer) {
+        if (normalizeIssuer(document.issuer) !== normalizeIssuer(options.expectedIssuer)) {
+            return {
+                ok: false,
+                reason: 'issuer_mismatch',
+                message: `discovery issuer "${document.issuer}" does not match expected "${options.expectedIssuer}"`,
+            };
+        }
+    }
+    return { ok: true, document };
+}
+/**
+ * Build the OIDC authorization redirect URL (code + PKCE S256).
+ */
+export function buildOidcAuthorizationUrl(input) {
+    const url = new URL(input.authorizationEndpoint);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', input.clientId);
+    url.searchParams.set('redirect_uri', input.redirectUri);
+    url.searchParams.set('scope', input.scope ?? 'openid email profile');
+    url.searchParams.set('state', input.state);
+    url.searchParams.set('code_challenge', input.codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    if (input.nonce) {
+        url.searchParams.set('nonce', input.nonce);
+    }
+    return url.toString();
+}
+function mapJoseError(err) {
+    const message = err instanceof Error ? err.message : 'id_token validation failed';
+    const code = err &&
+        typeof err === 'object' &&
+        'code' in err &&
+        typeof err.code === 'string'
+        ? err.code
+        : '';
+    const claim = err &&
+        typeof err === 'object' &&
+        'claim' in err &&
+        typeof err.claim === 'string'
+        ? err.claim
+        : '';
+    // Prefer jose error codes / claim names over message regex (avoids "exp" matching "expected")
+    if (code === 'ERR_JWT_EXPIRED' || claim === 'exp') {
+        return { reason: 'expired', message };
+    }
+    if (code === 'ERR_JWT_CLAIM_VALIDATION_FAILED' || claim) {
+        if (claim === 'iss' || /"iss"/i.test(message)) {
+            return { reason: 'invalid_issuer', message };
+        }
+        if (claim === 'aud' || /"aud"/i.test(message)) {
+            return { reason: 'invalid_audience', message };
+        }
+        if (claim === 'nbf' || /"nbf"/i.test(message)) {
+            return { reason: 'not_yet_valid', message };
+        }
+    }
+    if (code === 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED' ||
+        code === 'ERR_JWS_INVALID' ||
+        /signature verification failed|jws signature/i.test(message)) {
+        return { reason: 'invalid_signature', message };
+    }
+    if (code === 'ERR_JWT_INVALID' || /compact jws|invalid token/i.test(message)) {
+        return { reason: 'malformed', message };
+    }
+    return { reason: 'invalid_signature', message };
+}
+/**
+ * Validate an OIDC id_token: signature (JWKS), issuer, audience, exp.
+ *
+ * Hardline: `jwks` is required. Callers must not pass a no-op key or skip verify.
+ */
+export async function validateOidcIdToken(options) {
+    const { idToken, issuer, clientId, jwks, clockToleranceSeconds = 30 } = options;
+    if (!isNonEmptyString(idToken)) {
+        return { ok: false, reason: 'missing_token', message: 'id_token is required' };
+    }
+    if (jwks == null) {
+        return {
+            ok: false,
+            reason: 'missing_key',
+            message: 'JWKS / verification key is required; unsigned id_tokens are rejected',
+        };
+    }
+    if (!isNonEmptyString(issuer)) {
+        return { ok: false, reason: 'invalid_issuer', message: 'expected issuer is required' };
+    }
+    if (!isNonEmptyString(clientId)) {
+        return { ok: false, reason: 'invalid_audience', message: 'clientId (audience) is required' };
+    }
+    // Prefer asymmetric algorithms used by enterprise IdPs; reject `none`
+    const verifyOptions = {
+        issuer: normalizeIssuer(issuer),
+        audience: clientId,
+        clockTolerance: clockToleranceSeconds,
+        algorithms: ID_TOKEN_ALGORITHMS,
+    };
+    let payload;
+    try {
+        // jose types KeyLike and JWTVerifyGetKey as separate overloads — narrow first
+        let verified;
+        if (typeof jwks === 'function') {
+            verified = await jwtVerify(idToken, jwks, verifyOptions);
+        }
+        else {
+            verified = await jwtVerify(idToken, jwks, verifyOptions);
+        }
+        payload = verified.payload;
+    }
+    catch (err) {
+        return { ok: false, ...mapJoseError(err) };
+    }
+    if (!isNonEmptyString(payload.sub)) {
+        return { ok: false, reason: 'missing_sub', message: 'id_token missing sub claim' };
+    }
+    const claims = {
+        sub: payload.sub,
+        payload,
+    };
+    if (typeof payload.email === 'string' && payload.email.length > 0) {
+        claims.email = payload.email;
+    }
+    if (typeof payload.email_verified === 'boolean') {
+        claims.emailVerified = payload.email_verified;
+    }
+    else if (payload.email_verified === 'true') {
+        claims.emailVerified = true;
+    }
+    else if (payload.email_verified === 'false') {
+        claims.emailVerified = false;
+    }
+    if (typeof payload.name === 'string' && payload.name.length > 0) {
+        claims.name = payload.name;
+    }
+    if (typeof payload.preferred_username === 'string' && payload.preferred_username.length > 0) {
+        claims.preferredUsername = payload.preferred_username;
+    }
+    return { ok: true, claims };
+}
+/**
+ * Create a remote JWKS key resolver from a discovery `jwks_uri`.
+ * Thin wrapper so route code does not import jose directly.
+ */
+export function createOidcRemoteJwkSet(jwksUri) {
+    if (!isNonEmptyString(jwksUri)) {
+        throw new Error('jwksUri is required');
+    }
+    return createRemoteJWKSet(new URL(jwksUri));
+}
+/**
+ * Exchange an OIDC authorization code for tokens (PKCE + client_secret).
+ *
+ * POSTs `application/x-www-form-urlencoded`. Rejects responses without `id_token`.
+ * Never logs client_secret or tokens.
+ */
+export async function exchangeOidcCode(input) {
+    const { tokenEndpoint, clientId, clientSecret, code, redirectUri, codeVerifier, fetchImpl = fetch, timeoutMs = 10_000, } = input;
+    if (!(isNonEmptyString(tokenEndpoint) &&
+        isNonEmptyString(clientId) &&
+        isNonEmptyString(clientSecret) &&
+        isNonEmptyString(code) &&
+        isNonEmptyString(redirectUri) &&
+        isNonEmptyString(codeVerifier))) {
+        return {
+            ok: false,
+            reason: 'missing_params',
+            message: 'tokenEndpoint, clientId, clientSecret, code, redirectUri, and codeVerifier are required',
+        };
+    }
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: redirectUri,
+        client_id: clientId,
+        client_secret: clientSecret,
+        code_verifier: codeVerifier,
+    });
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+        response = await fetchImpl(tokenEndpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+            },
+            body,
+            signal: controller.signal,
+            redirect: 'error',
+        });
+    }
+    catch (err) {
+        clearTimeout(timer);
+        const message = err instanceof Error ? err.message : 'token exchange fetch failed';
+        return { ok: false, reason: 'fetch_failed', message };
+    }
+    clearTimeout(timer);
+    if (!response.ok) {
+        return {
+            ok: false,
+            reason: 'fetch_failed',
+            message: `token endpoint HTTP ${response.status}`,
+        };
+    }
+    let parsed;
+    try {
+        parsed = await response.json();
+    }
+    catch {
+        return { ok: false, reason: 'invalid_json', message: 'token response is not JSON' };
+    }
+    if (!parsed || typeof parsed !== 'object') {
+        return { ok: false, reason: 'invalid_json', message: 'token response is not an object' };
+    }
+    const record = parsed;
+    if (!isNonEmptyString(record.id_token)) {
+        return {
+            ok: false,
+            reason: 'missing_id_token',
+            message: 'token response missing id_token',
+        };
+    }
+    const tokens = { id_token: record.id_token };
+    if (isNonEmptyString(record.access_token)) {
+        tokens.access_token = record.access_token;
+    }
+    return { ok: true, tokens };
+}

package/dist/server/sso/roles.d.ts

@@ -0,0 +1,48 @@
+/**
+ * SSO group → role mapping (GAP-464).
+ *
+ * Security hardlines:
+ * - Map only via explicit group_role_map hits.
+ * - Empty mapped set + require_group_match → reject.
+ * - Never grant `admin` from an unmapped group (unmapped groups are ignored).
+ * - When no map hits and require_group_match is false → default_role.
+ */
+export interface MapSsoGroupsInput {
+    /** Raw IdP claims (id_token payload or SAML attribute bag) */
+    claims: Record<string, unknown>;
+    /** Claim key that holds group membership (default on providers: `groups`) */
+    groupClaim: string;
+    /** IdP group name → RevealUI role */
+    groupRoleMap: Record<string, string>;
+    /** Used when no groups map and requireGroupMatch is false */
+    defaultRole: string;
+    /** When true, login fails unless at least one group maps to a role */
+    requireGroupMatch: boolean;
+}
+export type MapSsoGroupsFailureReason = 'require_group_match' | 'invalid_default_role';
+export type MapSsoGroupsResult = {
+    ok: true;
+    role: string;
+    /** Groups present on the token that hit group_role_map */
+    matchedGroups: string[];
+    /** All groups extracted from the claim (mapped + unmapped) */
+    groups: string[];
+} | {
+    ok: false;
+    reason: MapSsoGroupsFailureReason;
+    message: string;
+    groups: string[];
+};
+/**
+ * Extract a string array of groups from a claim value.
+ * Accepts string[], a single string, or a space/comma-separated string.
+ */
+export declare function extractGroupsFromClaim(claims: Record<string, unknown>, groupClaim: string): string[];
+/**
+ * Resolve a single RevealUI role from IdP groups + provider mapping config.
+ *
+ * Unmapped groups never contribute a role (including never implying admin).
+ * Only explicit map values and the configured default_role assign roles.
+ */
+export declare function mapSsoGroupsToRole(input: MapSsoGroupsInput): MapSsoGroupsResult;
+//# sourceMappingURL=roles.d.ts.map

package/dist/server/sso/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../src/server/sso/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,yBAAyB,GAAG,qBAAqB,GAAG,sBAAsB,CAAC;AAEvF,MAAM,MAAM,kBAAkB,GAC1B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,yBAAyB,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAWN;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,UAAU,EAAE,MAAM,GACjB,MAAM,EAAE,CAyBV;AAgBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAiD/E"}

package/dist/server/sso/roles.js

@@ -0,0 +1,109 @@
+/**
+ * SSO group → role mapping (GAP-464).
+ *
+ * Security hardlines:
+ * - Map only via explicit group_role_map hits.
+ * - Empty mapped set + require_group_match → reject.
+ * - Never grant `admin` from an unmapped group (unmapped groups are ignored).
+ * - When no map hits and require_group_match is false → default_role.
+ */
+/** Privilege rank for resolving multiple mapped roles (higher wins). */
+const ROLE_RANK = {
+    viewer: 1,
+    member: 2,
+    editor: 3,
+    admin: 4,
+    owner: 5,
+};
+/**
+ * Extract a string array of groups from a claim value.
+ * Accepts string[], a single string, or a space/comma-separated string.
+ */
+export function extractGroupsFromClaim(claims, groupClaim) {
+    const raw = claims[groupClaim];
+    if (raw == null)
+        return [];
+    if (Array.isArray(raw)) {
+        return raw
+            .filter((g) => typeof g === 'string' && g.length > 0)
+            .map((g) => g.trim())
+            .filter((g) => g.length > 0);
+    }
+    if (typeof raw === 'string') {
+        const trimmed = raw.trim();
+        if (!trimmed)
+            return [];
+        // Single group name, or space/comma-separated list from some IdPs
+        if (trimmed.includes(',') || trimmed.includes(' ')) {
+            return trimmed
+                .split(/[,\s]+/)
+                .map((g) => g.trim())
+                .filter((g) => g.length > 0);
+        }
+        return [trimmed];
+    }
+    return [];
+}
+function pickHighestRole(roles) {
+    let best = roles[0];
+    let bestRank = ROLE_RANK[best] ?? 0;
+    for (let i = 1; i < roles.length; i++) {
+        const role = roles[i];
+        const rank = ROLE_RANK[role] ?? 0;
+        if (rank > bestRank) {
+            best = role;
+            bestRank = rank;
+        }
+    }
+    return best;
+}
+/**
+ * Resolve a single RevealUI role from IdP groups + provider mapping config.
+ *
+ * Unmapped groups never contribute a role (including never implying admin).
+ * Only explicit map values and the configured default_role assign roles.
+ */
+export function mapSsoGroupsToRole(input) {
+    const { claims, groupClaim, groupRoleMap, defaultRole, requireGroupMatch } = input;
+    if (!defaultRole || typeof defaultRole !== 'string') {
+        return {
+            ok: false,
+            reason: 'invalid_default_role',
+            message: 'default_role must be a non-empty string',
+            groups: [],
+        };
+    }
+    const groups = extractGroupsFromClaim(claims, groupClaim);
+    const matchedGroups = [];
+    const mappedRoles = [];
+    for (const group of groups) {
+        const mapped = groupRoleMap[group];
+        if (typeof mapped === 'string' && mapped.length > 0) {
+            matchedGroups.push(group);
+            mappedRoles.push(mapped);
+        }
+        // Unmapped groups intentionally ignored — never grant admin (or any role) from them
+    }
+    if (mappedRoles.length > 0) {
+        return {
+            ok: true,
+            role: pickHighestRole(mappedRoles),
+            matchedGroups,
+            groups,
+        };
+    }
+    if (requireGroupMatch) {
+        return {
+            ok: false,
+            reason: 'require_group_match',
+            message: 'No IdP groups matched group_role_map and require_group_match is enabled',
+            groups,
+        };
+    }
+    return {
+        ok: true,
+        role: defaultRole,
+        matchedGroups: [],
+        groups,
+    };
+}

package/dist/server/sso/saml.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Enterprise SAML 2.0 SP helpers (GAP-464 Phase 3).
+ *
+ * Wraps @node-saml/node-saml so HTTP routes get typed ok/err results matching
+ * the OIDC pure layer. Hardlines:
+ * - Never accept a Response without IdP certificate material (signature path).
+ * - SP-initiated AuthnRequest only for MVP (IdP-initiated is a follow-up).
+ * - InResponseTo checked when present (replay resistance).
+ */
+import { type Profile } from '@node-saml/node-saml';
+export interface SamlSpConfig {
+    /** Service Provider entity ID (audience) */
+    spEntityId: string;
+    /** ACS callback URL (POST) */
+    callbackUrl: string;
+    /** IdP SingleSignOnService HTTP-Redirect or HTTP-POST location */
+    entryPoint: string;
+    /**
+     * IdP signing certificate PEM (CERTIFICATE or PUBLIC KEY).
+     * REQUIRED for validation — unsigned responses are rejected.
+     */
+    idpCertPem: string;
+    /** Optional SP signing private key PEM (signed AuthnRequest) */
+    spPrivateKeyPem?: string;
+    /** Optional SP public cert PEM (metadata + request signing) */
+    spPublicCertPem?: string;
+    /** Clock skew for NotOnOrAfter (ms, default 5 minutes) */
+    acceptedClockSkewMs?: number;
+}
+export type ParseIdpMetadataFailureReason = 'missing_xml' | 'missing_entity_id' | 'missing_sso_url' | 'missing_cert';
+export type ParseIdpMetadataResult = {
+    ok: true;
+    entityId: string;
+    entryPoint: string;
+    idpCertPem: string;
+} | {
+    ok: false;
+    reason: ParseIdpMetadataFailureReason;
+    message: string;
+};
+export type BuildSamlAuthorizeUrlFailureReason = 'missing_config' | 'missing_cert' | 'build_failed';
+export type BuildSamlAuthorizeUrlResult = {
+    ok: true;
+    url: string;
+} | {
+    ok: false;
+    reason: BuildSamlAuthorizeUrlFailureReason;
+    message: string;
+};
+export type ValidateSamlResponseFailureReason = 'missing_response' | 'missing_cert' | 'invalid_signature' | 'expired' | 'audience_mismatch' | 'replay' | 'missing_name_id' | 'logged_out' | 'validation_failed';
+export interface ValidatedSamlAssertion {
+    /** NameID value (maps to SSO subject) */
+    subject: string;
+    email?: string;
+    name?: string;
+    /** Attribute bag for group mapping (keys as claim names) */
+    attributes: Record<string, unknown>;
+    /** Full node-saml profile for advanced callers */
+    profile: Profile;
+}
+export type ValidateSamlResponseResult = {
+    ok: true;
+    assertion: ValidatedSamlAssertion;
+} | {
+    ok: false;
+    reason: ValidateSamlResponseFailureReason;
+    message: string;
+};
+/**
+ * Normalize a certificate string to PEM CERTIFICATE block if bare base64.
+ */
+export declare function normalizeIdpCertPem(cert: string): string;
+/**
+ * Parse IdP metadata XML for entityID, SSO entry point, and signing cert.
+ * Uses linear string scans (no authored regex) for CodeQL / no-regex hardline.
+ */
+export declare function parseIdpMetadataXml(xml: string): ParseIdpMetadataResult;
+/**
+ * Generate SP metadata XML for customer IdP configuration.
+ */
+export declare function buildSamlSpMetadata(config: SamlSpConfig): string;
+/**
+ * Build SP-initiated AuthnRequest redirect URL (HTTP-Redirect binding).
+ * `relayState` should be the signed SSO state token (CSRF + account binding).
+ */
+export declare function buildSamlAuthorizeUrl(config: SamlSpConfig, relayState: string): Promise<BuildSamlAuthorizeUrlResult>;
+/**
+ * Validate a SAMLResponse from HTTP-POST binding.
+ * Requires IdP cert; rejects unsigned / bad-signature responses.
+ */
+export declare function validateSamlPostResponse(config: SamlSpConfig, samlResponseBase64: string): Promise<ValidateSamlResponseResult>;
+/**
+ * Fetch and parse IdP metadata from a URL (test-connection + seed entryPoint/cert).
+ */
+export declare function fetchIdpMetadata(metadataUrl: string, options?: {
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<ParseIdpMetadataResult>;
+//# sourceMappingURL=saml.d.ts.map

package/dist/server/sso/saml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml.d.ts","sourceRoot":"","sources":["../../../src/server/sso/saml.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,KAAK,OAAO,EAA8B,MAAM,sBAAsB,CAAC;AAMhF,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,6BAA6B,GACrC,aAAa,GACb,mBAAmB,GACnB,iBAAiB,GACjB,cAAc,CAAC;AAEnB,MAAM,MAAM,sBAAsB,GAC9B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,6BAA6B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,kCAAkC,GAAG,gBAAgB,GAAG,cAAc,GAAG,cAAc,CAAC;AAEpG,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kCAAkC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,MAAM,MAAM,iCAAiC,GACzC,kBAAkB,GAClB,cAAc,GACd,mBAAmB,GACnB,SAAS,GACT,mBAAmB,GACnB,QAAQ,GACR,iBAAiB,GACjB,YAAY,GACZ,mBAAmB,CAAC;AAExB,MAAM,WAAW,sBAAsB;IACrC,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,sBAAsB,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iCAAiC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAU9E;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiBxD;AAuFD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAwCvE;AAiCD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAUhE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,2BAA2B,CAAC,CAkCtC;AAwED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,YAAY,EACpB,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAmDrC;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAAC,sBAAsB,CAAC,CA8BjC"}