@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19

package/dist/server/sso.js

@@ -1,830 +0,0 @@
-import { Fx } from "@robelest/fx";
-import { sha256 } from "@oslojs/crypto/sha2";
-import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding } from "@oslojs/encoding";
-import { createRemoteJWKSet, customFetch, decodeProtectedHeader, jwtVerify } from "jose";
-import { Constants, IdentityProvider, ServiceProvider, setSchemaValidator } from "@robelest/samlify";
-import { decodeIdToken } from "arctic";
-
-//#region src/server/sso.ts
-const _samlifyPermissiveValidator = { validate: (_xml) => Promise.resolve("OK") };
-function ensureSamlifyValidator() {
-	setSchemaValidator(_samlifyPermissiveValidator);
-}
-/** @internal */
-const SCIM_USER_SCHEMA_ID = "urn:ietf:params:scim:schemas:core:2.0:User";
-/** @internal */
-const SCIM_GROUP_SCHEMA_ID = "urn:ietf:params:scim:schemas:core:2.0:Group";
-/** @internal */
-const ENTERPRISE_OIDC_PROVIDER_PREFIX = "enterprise:oidc:";
-/** @internal */
-const ENTERPRISE_SAML_PROVIDER_PREFIX = "enterprise:saml:";
-const OIDC_JWKS_CACHE = /* @__PURE__ */ new Map();
-/** @internal */
-function normalizeDomain(domain) {
-	return domain.trim().toLowerCase().replace(/^@+/, "");
-}
-/** @internal */
-function enterpriseOidcProviderId(enterpriseId) {
-	return `${ENTERPRISE_OIDC_PROVIDER_PREFIX}${enterpriseId}`;
-}
-/** @internal */
-function enterpriseSamlProviderId(enterpriseId) {
-	return `${ENTERPRISE_SAML_PROVIDER_PREFIX}${enterpriseId}`;
-}
-/** @internal */
-function getEnterpriseSamlUrls(opts) {
-	const root = opts.rootUrl.replace(/\/$/, "");
-	return {
-		metadataUrl: `${root}/api/auth/sso/${opts.source.id}/saml/metadata`,
-		acsUrl: `${root}/api/auth/sso/${opts.source.id}/saml/acs`,
-		sloUrl: `${root}/api/auth/sso/${opts.source.id}/saml/slo`
-	};
-}
-/** @internal */
-function getEnterpriseOidcUrls(opts) {
-	const root = opts.rootUrl.replace(/\/$/, "");
-	return {
-		signInUrl: `${root}/api/auth/sso/${opts.enterpriseId}/oidc/signin`,
-		callbackUrl: `${root}/api/auth/sso/${opts.enterpriseId}/oidc/callback`
-	};
-}
-/** @internal */
-function isEnterpriseSamlSourceActive(source) {
-	return source.status === "active";
-}
-/** @internal */
-function isEnterpriseProviderId(providerId) {
-	return providerId.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX) || providerId.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX);
-}
-const asRecord = (value) => typeof value === "object" && value !== null ? value : null;
-/** @internal */
-const DEFAULT_ENTERPRISE_POLICY = {
-	version: 1,
-	identity: { accountLinking: {
-		oidc: "verifiedEmail",
-		saml: "verifiedEmail"
-	} },
-	provisioning: {
-		scimReuse: { user: "externalId" },
-		jit: {
-			mode: "createUserAndMembership",
-			defaultRoleIds: []
-		},
-		deprovision: { mode: "soft" }
-	}
-};
-/** @internal */
-function normalizeEnterprisePolicy(policy) {
-	const input = asRecord(policy) ?? {};
-	const accountLinking = asRecord((asRecord(input.identity) ?? {}).accountLinking) ?? {};
-	const provisioning = asRecord(input.provisioning) ?? {};
-	const scimReuse = asRecord(provisioning.scimReuse) ?? {};
-	const jit = asRecord(provisioning.jit) ?? {};
-	const deprovision = asRecord(provisioning.deprovision) ?? {};
-	const extend = asRecord(input.extend) ?? void 0;
-	return {
-		version: 1,
-		identity: { accountLinking: {
-			oidc: accountLinking.oidc === "none" ? "none" : DEFAULT_ENTERPRISE_POLICY.identity.accountLinking.oidc,
-			saml: accountLinking.saml === "none" ? "none" : DEFAULT_ENTERPRISE_POLICY.identity.accountLinking.saml
-		} },
-		provisioning: {
-			scimReuse: { user: scimReuse.user === "none" ? "none" : DEFAULT_ENTERPRISE_POLICY.provisioning.scimReuse.user },
-			jit: {
-				mode: jit.mode === "off" || jit.mode === "createUser" || jit.mode === "createUserAndMembership" ? jit.mode : DEFAULT_ENTERPRISE_POLICY.provisioning.jit.mode,
-				defaultRoleIds: Array.isArray(jit.defaultRoleIds) ? Array.from(new Set(jit.defaultRoleIds.filter((value) => typeof value === "string" && value.length > 0))) : typeof jit.defaultRole === "string" && jit.defaultRole.length > 0 ? [jit.defaultRole] : DEFAULT_ENTERPRISE_POLICY.provisioning.jit.defaultRoleIds
-			},
-			deprovision: { mode: deprovision.mode === "hard" ? "hard" : DEFAULT_ENTERPRISE_POLICY.provisioning.deprovision.mode }
-		},
-		...extend ? { extend } : {}
-	};
-}
-/** @internal */
-function patchEnterprisePolicy(current, patch) {
-	const base = normalizeEnterprisePolicy(current);
-	return normalizeEnterprisePolicy({
-		...base,
-		...patch,
-		identity: {
-			...base.identity,
-			...patch.identity,
-			accountLinking: {
-				...base.identity.accountLinking,
-				...patch.identity?.accountLinking
-			}
-		},
-		provisioning: {
-			...base.provisioning,
-			...patch.provisioning,
-			scimReuse: {
-				...base.provisioning.scimReuse,
-				...patch.provisioning?.scimReuse
-			},
-			jit: {
-				...base.provisioning.jit,
-				...patch.provisioning?.jit
-			},
-			deprovision: {
-				...base.provisioning.deprovision,
-				...patch.provisioning?.deprovision
-			}
-		},
-		extend: patch.extend === void 0 ? base.extend : {
-			...base.extend,
-			...patch.extend
-		}
-	});
-}
-const getProtocolConfig = (config, protocol) => {
-	const base = asRecord(config);
-	const direct = base?.[protocol];
-	const viaProtocols = asRecord(base?.protocols)?.[protocol];
-	return asRecord(direct) ?? asRecord(viaProtocols) ?? {};
-};
-/** @internal */
-function getOidcConfig(config) {
-	return getProtocolConfig(config, "oidc");
-}
-/** @internal */
-function getPublicOidcConfig(config) {
-	const { clientSecret: _clientSecret, ...publicOidc } = getOidcConfig(config);
-	return publicOidc;
-}
-/** @internal */
-function withOidcSecretState(config, hasClientSecret) {
-	return {
-		...config,
-		hasClientSecret
-	};
-}
-/** @internal */
-function getSamlConfig(config) {
-	return getProtocolConfig(config, "saml");
-}
-/** @internal */
-function upsertProtocolConfig(config, protocol, protocolConfig) {
-	const base = asRecord(config) ?? {};
-	const protocols = asRecord(base.protocols) ?? {};
-	protocols[protocol] = {
-		...asRecord(protocols[protocol]),
-		...protocolConfig
-	};
-	return {
-		...base,
-		protocols
-	};
-}
-/** @internal */
-function createSamlPostBindingResponse(opts) {
-	const fields = [`<input type="hidden" name="${opts.parameter}" value="${opts.value.replace(/"/g, "&quot;")}" />`, opts.relayState ? `<input type="hidden" name="RelayState" value="${opts.relayState.replace(/"/g, "&quot;")}" />` : ""].join("");
-	return new Response(`<!doctype html><html><body><form method="POST" action="${opts.endpoint}">${fields}</form><script>document.forms[0].submit();<\/script></body></html>`, {
-		status: 200,
-		headers: { "Content-Type": "text/html; charset=utf-8" }
-	});
-}
-/** @internal */
-function decodeRelayState(value) {
-	if (!value) return {};
-	try {
-		return JSON.parse(new TextDecoder().decode(decodeBase64urlIgnorePadding(value)));
-	} catch {
-		return {};
-	}
-}
-/** @internal */
-function encodeEnterpriseSamlRelayState(value) {
-	return encodeBase64urlNoPadding(new TextEncoder().encode(JSON.stringify({
-		source: `${value.source.kind}:${value.source.id}`,
-		signature: value.signature,
-		requestId: value.requestId,
-		state: value.state,
-		redirectTo: value.redirectTo
-	})));
-}
-/** @internal */
-function decodeEnterpriseSamlRelayStateOrThrow(value) {
-	if (!value) throw new Error("Missing SAML RelayState.");
-	const decoded = decodeRelayState(value);
-	if (typeof decoded.source !== "string" || typeof decoded.signature !== "string" || typeof decoded.requestId !== "string" || typeof decoded.state !== "string") throw new Error("Invalid SAML RelayState.");
-	const [kind, ...rest] = decoded.source.split(":");
-	const id = rest.join(":");
-	if (kind !== "enterprise" || id.length === 0) throw new Error("Invalid enterprise SAML source.");
-	return {
-		source: {
-			kind,
-			id
-		},
-		signature: decoded.signature,
-		requestId: decoded.requestId,
-		state: decoded.state,
-		redirectTo: typeof decoded.redirectTo === "string" ? decoded.redirectTo : void 0
-	};
-}
-/** @internal */
-async function readRequestBody(request) {
-	const contentType = request.headers.get("Content-Type") ?? "";
-	if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-		const form = await request.formData();
-		const body = {};
-		form.forEach((value, key) => {
-			body[key] = typeof value === "string" ? value : value.name;
-		});
-		return body;
-	}
-	return {};
-}
-/** @internal */
-async function readEnterpriseSamlHttpRequest(request) {
-	const url = new URL(request.url);
-	const body = await readRequestBody(request);
-	return {
-		url,
-		body,
-		query: Object.fromEntries(url.searchParams),
-		binding: request.method === "GET" ? "redirect" : body.SAMLResponse || body.SAMLRequest ? "post" : "redirect",
-		relayState: body.RelayState ?? url.searchParams.get("RelayState") ?? void 0,
-		hasSamlRequest: Boolean(body.SAMLRequest ?? url.searchParams.get("SAMLRequest")),
-		hasSamlResponse: Boolean(body.SAMLResponse ?? url.searchParams.get("SAMLResponse"))
-	};
-}
-async function discoverOidcConfiguration(config) {
-	const discoveryUrl = typeof config.discoveryUrl === "string" ? config.discoveryUrl : typeof config.issuer === "string" ? `${config.issuer.replace(/\/$/, "")}/.well-known/openid-configuration` : null;
-	if (!discoveryUrl) throw new Error("Enterprise OIDC requires an issuer or discoveryUrl.");
-	const oidcFetch = createEnterpriseOidcFetch(config, config.issuer);
-	return await Fx.run(Fx.defer(() => Fx.from({
-		ok: async () => {
-			const response = await oidcFetch(discoveryUrl);
-			if (!response.ok) throw new Error(`Failed to discover OIDC configuration: ${response.status}`);
-			const discovery = await response.json();
-			if (typeof discovery.issuer !== "string" || typeof discovery.authorization_endpoint !== "string" || typeof discovery.token_endpoint !== "string" || typeof discovery.jwks_uri !== "string") throw new Error("OIDC discovery document is missing required fields.");
-			return discovery;
-		},
-		err: (error) => error instanceof Error ? error : new Error(String(error))
-	})).pipe(Fx.timeout(1e4), Fx.retry(Fx.retry.compose(Fx.retry.jittered(Fx.retry.exponential(200)), Fx.retry.recurs(2))), Fx.recover((error) => Fx.fail(error instanceof Error ? error : new Error(String(error))))));
-}
-function createEnterpriseOidcFetch(config, discoveredIssuer) {
-	const runtimeOrigin = typeof config.discoveryUrl === "string" ? new URL(config.discoveryUrl).origin : void 0;
-	const externalHost = typeof config.issuer === "string" ? new URL(config.issuer).host : typeof discoveredIssuer === "string" ? new URL(discoveredIssuer).host : void 0;
-	return async (input, init) => {
-		const url = new URL(typeof input === "string" ? input : input.toString());
-		const rewrittenUrl = runtimeOrigin !== void 0 && url.origin !== runtimeOrigin ? new URL(`${runtimeOrigin}${url.pathname}${url.search}`) : url;
-		const headers = new Headers(init?.headers);
-		if (runtimeOrigin !== void 0 && externalHost !== void 0) headers.set("host", externalHost);
-		return await fetch(rewrittenUrl, {
-			...init,
-			headers
-		});
-	};
-}
-function getOidcJwks(url, fetchImpl) {
-	const cacheKey = fetchImpl ? `${url}::custom` : url;
-	let jwks = OIDC_JWKS_CACHE.get(cacheKey);
-	if (!jwks) {
-		jwks = fetchImpl ? createRemoteJWKSet(new URL(url), { [customFetch]: fetchImpl }) : createRemoteJWKSet(new URL(url));
-		OIDC_JWKS_CACHE.set(cacheKey, jwks);
-	}
-	return jwks;
-}
-function userInfoProfileFx(opts) {
-	return Fx.from({
-		ok: async () => {
-			const response = await (opts.fetchImpl ?? fetch)(opts.endpoint, { headers: { Authorization: `Bearer ${opts.accessToken}` } });
-			if (!response.ok) throw new Error(`OIDC userinfo request failed: ${response.status}`);
-			return await response.json();
-		},
-		err: (error) => ({
-			kind: "transport",
-			error
-		})
-	}).pipe(Fx.chain((userInfo) => {
-		const userInfoSubject = typeof userInfo.sub === "string" ? userInfo.sub : void 0;
-		const tokenSubject = typeof opts.verifiedClaims.sub === "string" ? opts.verifiedClaims.sub : void 0;
-		return userInfoSubject !== void 0 && tokenSubject !== void 0 && userInfoSubject !== tokenSubject ? Fx.fail({ kind: "subject-mismatch" }) : Fx.succeed({
-			id: userInfoSubject ?? (typeof opts.verifiedClaims.sub === "string" ? opts.verifiedClaims.sub : void 0) ?? crypto.randomUUID(),
-			email: typeof userInfo.email === "string" ? userInfo.email : opts.verifiedProfile.email,
-			emailVerified: typeof userInfo.email_verified === "boolean" ? userInfo.email_verified : opts.verifiedProfile.emailVerified,
-			name: typeof userInfo.name === "string" ? userInfo.name : opts.verifiedProfile.name,
-			image: typeof userInfo.picture === "string" ? userInfo.picture : opts.verifiedProfile.image
-		});
-	}), Fx.recover((failure) => {
-		if (failure.kind === "transport") return Fx.succeed(null);
-		return Fx.fail(/* @__PURE__ */ new Error("OIDC userinfo subject does not match ID token subject."));
-	}));
-}
-/** @internal */
-async function createEnterpriseOidcProvider(config, redirectUri) {
-	const discovery = await discoverOidcConfiguration(config);
-	const expectedIssuer = String(config.issuer ?? discovery.issuer).replace(/\/$/, "");
-	const discoveredIssuer = String(discovery.issuer).replace(/\/$/, "");
-	const strictIssuer = config.strictIssuer === true;
-	if (typeof config.issuer === "string" && expectedIssuer !== discoveredIssuer) {
-		if (strictIssuer) throw new Error(`Configured OIDC issuer mismatch. configured=${expectedIssuer} discovery=${discoveredIssuer}`);
-		console.warn("Configured OIDC issuer differs from discovery issuer; accepting both for token verification.", {
-			configuredIssuer: expectedIssuer,
-			discoveryIssuer: discoveredIssuer
-		});
-	}
-	const authorizationEndpoint = discovery.authorization_endpoint;
-	const tokenEndpoint = discovery.token_endpoint;
-	const jwksUri = String(config.jwksUri ?? discovery.jwks_uri);
-	const supportedIdTokenSigningAlgs = Array.isArray(discovery.id_token_signing_alg_values_supported) ? discovery.id_token_signing_alg_values_supported.filter((value) => typeof value === "string") : [];
-	const userinfoEndpoint = discovery.userinfo_endpoint ?? void 0;
-	const oidcFetch = createEnterpriseOidcFetch(config, discovery.issuer);
-	const scopes = Array.isArray(config.scopes) ? config.scopes.filter((value) => typeof value === "string") : [
-		"openid",
-		"profile",
-		"email"
-	];
-	const expectedAudience = config.audience ?? String(config.clientId);
-	const getIssuerCandidates = (issuer) => {
-		const candidates = [issuer];
-		if (issuer.startsWith("https://")) candidates.push(`http://${issuer.slice(8)}`);
-		else if (issuer.startsWith("http://")) candidates.push(`https://${issuer.slice(7)}`);
-		return candidates;
-	};
-	const expectedIssuers = strictIssuer ? [expectedIssuer] : Array.from(new Set([...getIssuerCandidates(expectedIssuer), ...getIssuerCandidates(discoveredIssuer)]));
-	const jwks = getOidcJwks(jwksUri, oidcFetch);
-	let verifiedClaims = null;
-	let verifiedProfile = null;
-	const normalizeProfile = (claims) => ({
-		id: typeof claims.sub === "string" ? claims.sub : crypto.randomUUID(),
-		email: typeof claims.email === "string" ? claims.email : void 0,
-		emailVerified: typeof claims.email_verified === "boolean" ? claims.email_verified : void 0,
-		name: typeof claims.name === "string" ? claims.name : void 0,
-		image: typeof claims.picture === "string" ? claims.picture : void 0
-	});
-	return {
-		provider: {
-			createAuthorizationURL(state, codeVerifier, requestedScopes) {
-				const url = new URL(authorizationEndpoint);
-				url.searchParams.set("response_type", "code");
-				url.searchParams.set("client_id", String(config.clientId));
-				url.searchParams.set("redirect_uri", redirectUri);
-				url.searchParams.set("scope", (requestedScopes.length > 0 ? requestedScopes : scopes).join(" "));
-				url.searchParams.set("state", state);
-				url.searchParams.set("code_challenge_method", "S256");
-				url.searchParams.set("code_challenge", encodeBase64urlNoPadding(sha256(new TextEncoder().encode(codeVerifier))));
-				const authorizationParams = typeof config.authorizationParams === "object" && config.authorizationParams !== null ? config.authorizationParams : {};
-				for (const [key, value] of Object.entries(authorizationParams)) if (typeof value === "string") url.searchParams.set(key, value);
-				return url;
-			},
-			async validateAuthorizationCode(code, codeVerifier) {
-				const body = new URLSearchParams({
-					grant_type: "authorization_code",
-					code,
-					redirect_uri: redirectUri,
-					client_id: String(config.clientId)
-				});
-				if (typeof config.clientSecret === "string") body.set("client_secret", config.clientSecret);
-				if (codeVerifier) body.set("code_verifier", codeVerifier);
-				const response = await oidcFetch(tokenEndpoint, {
-					method: "POST",
-					headers: { "Content-Type": "application/x-www-form-urlencoded" },
-					body
-				});
-				if (!response.ok) throw new Error(`OIDC token exchange failed: ${response.status}`);
-				const data = await response.json();
-				return {
-					data,
-					idToken() {
-						if (typeof data.id_token !== "string") throw new Error("OIDC response is missing id_token.");
-						return data.id_token;
-					},
-					accessToken() {
-						if (typeof data.access_token !== "string") throw new Error("OIDC response is missing access_token.");
-						return data.access_token;
-					}
-				};
-			}
-		},
-		oauthConfig: {
-			scopes,
-			nonce: true,
-			validateTokens: async (tokens, ctx) => {
-				const verified = await Fx.run(Fx.gen(function* () {
-					yield* Fx.guard(ctx.nonce === void 0, Fx.fail(/* @__PURE__ */ new Error("OIDC nonce is required.")));
-					const idToken = tokens.idToken();
-					const tokenAlg = decodeProtectedHeader(idToken).alg;
-					const useSymmetricValidation = typeof tokenAlg === "string" && (tokenAlg === "HS256" || tokenAlg === "HS384" || tokenAlg === "HS512") && supportedIdTokenSigningAlgs.includes(tokenAlg);
-					const verificationOptions = {
-						audience: expectedAudience,
-						requiredClaims: [
-							"iss",
-							"sub",
-							"aud",
-							"exp",
-							"iat"
-						],
-						clockTolerance: config.clockToleranceSeconds ?? 10
-					};
-					const payload = (yield* Fx.from({
-						ok: () => useSymmetricValidation ? jwtVerify(idToken, (() => {
-							if (typeof config.clientSecret !== "string") throw new Error("OIDC provider uses symmetric ID token signatures but clientSecret is missing.");
-							return new TextEncoder().encode(config.clientSecret);
-						})(), verificationOptions) : jwtVerify(idToken, jwks, verificationOptions),
-						err: (error) => error instanceof Error ? error : new Error(String(error))
-					})).payload;
-					const tokenIssuerRaw = typeof payload.iss === "string" ? payload.iss : void 0;
-					const tokenIssuer = typeof tokenIssuerRaw === "string" ? tokenIssuerRaw.replace(/\/$/, "") : void 0;
-					yield* Fx.guard(!tokenIssuer || !expectedIssuers.includes(tokenIssuer), Fx.fail(/* @__PURE__ */ new Error(`OIDC token issuer mismatch. Received: ${tokenIssuer ?? "<missing>"}. Expected one of: ${expectedIssuers.join(", ")}`)));
-					yield* Fx.guard(payload.nonce !== ctx.nonce, Fx.fail(/* @__PURE__ */ new Error("OIDC nonce mismatch.")));
-					yield* Fx.guard(Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp !== String(config.clientId), Fx.fail(/* @__PURE__ */ new Error("OIDC authorized party does not match client ID.")));
-					return payload;
-				}));
-				verifiedClaims = verified;
-				verifiedProfile = normalizeProfile(verified);
-			},
-			accountLinking: config.accountLinking,
-			profile: async (tokens) => {
-				if (verifiedProfile === null || verifiedClaims === null) {
-					const claims = decodeIdToken(tokens.idToken());
-					verifiedClaims = claims;
-					verifiedProfile = normalizeProfile(claims);
-				}
-				if (userinfoEndpoint && typeof tokens.accessToken === "function") {
-					const userInfoProfile = await Fx.run(userInfoProfileFx({
-						endpoint: userinfoEndpoint,
-						accessToken: tokens.accessToken(),
-						verifiedClaims,
-						verifiedProfile,
-						fetchImpl: oidcFetch
-					}));
-					if (userInfoProfile !== null) return userInfoProfile;
-				}
-				return verifiedProfile;
-			}
-		}
-	};
-}
-/** @internal */
-function createSyntheticOAuthMaterializedConfig(providerId, options) {
-	return {
-		id: providerId,
-		type: "oauth",
-		provider: null,
-		scopes: [],
-		accountLinking: options?.accountLinking ?? "verifiedEmail"
-	};
-}
-/** @internal */
-function parseSamlIdpMetadata(metadata) {
-	const entityMeta = IdentityProvider({ metadata }).entityMeta;
-	const normalizeService = (value) => {
-		return typeof value === "string" && value.length > 0 ? value : void 0;
-	};
-	return {
-		issuer: entityMeta.getEntityID(),
-		sso: {
-			redirect: normalizeService(entityMeta.getSingleSignOnService("redirect")),
-			post: normalizeService(entityMeta.getSingleSignOnService("post"))
-		},
-		slo: {
-			redirect: normalizeService(entityMeta.getSingleLogoutService("redirect")),
-			post: normalizeService(entityMeta.getSingleLogoutService("post"))
-		},
-		signingCert: entityMeta.getX509Certificate("signing"),
-		encryptionCert: entityMeta.getX509Certificate("encrypt"),
-		nameIdFormats: (() => {
-			const nameIdFormat = entityMeta.getNameIDFormat();
-			return Array.isArray(nameIdFormat) ? nameIdFormat : [];
-		})(),
-		wantsSignedAuthnRequests: entityMeta.isWantAuthnRequestsSigned()
-	};
-}
-/** @internal */
-function createServiceProviderMetadata(opts) {
-	const binding = Constants.namespace.binding;
-	return ServiceProvider({
-		entityID: opts.entityId,
-		authnRequestsSigned: opts.authnRequestsSigned ?? false,
-		privateKey: opts.privateKey,
-		privateKeyPass: opts.privateKeyPass,
-		signingCert: opts.signingCert,
-		encryptCert: opts.encryptCert,
-		encPrivateKey: opts.encPrivateKey,
-		encPrivateKeyPass: opts.encPrivateKeyPass,
-		assertionConsumerService: [{
-			Binding: binding.post,
-			Location: opts.acsUrl
-		}],
-		singleLogoutService: opts.sloUrl ? [{
-			Binding: binding.redirect,
-			Location: opts.sloUrl
-		}, {
-			Binding: binding.post,
-			Location: opts.sloUrl
-		}] : void 0
-	}).getMetadata();
-}
-/** @internal */
-function createEnterpriseSamlMetadataXml(opts) {
-	return createServiceProviderMetadata(getSamlServiceProviderOptions({
-		rootUrl: opts.rootUrl,
-		source: opts.source,
-		config: opts.config
-	}));
-}
-/** @internal */
-function getSamlServiceProviderOptions(opts) {
-	const saml = getSamlConfig(opts.config);
-	const sp = asRecord(saml.sp) ?? {};
-	const urls = getEnterpriseSamlUrls({
-		rootUrl: opts.rootUrl,
-		source: opts.source
-	});
-	return {
-		entityId: opts.overrides?.entityId ?? sp.entityId ?? urls.metadataUrl,
-		acsUrl: opts.overrides?.acsUrl ?? sp.acsUrl ?? urls.acsUrl,
-		sloUrl: opts.overrides?.sloUrl ?? sp.sloUrl ?? urls.sloUrl,
-		relayState: opts.relayState,
-		authnRequestsSigned: saml.signAuthnRequests,
-		signingCert: sp.signingCert,
-		encryptCert: sp.encryptCert,
-		privateKey: sp.privateKey,
-		privateKeyPass: sp.privateKeyPass,
-		encPrivateKey: sp.encPrivateKey,
-		encPrivateKeyPass: sp.encPrivateKeyPass
-	};
-}
-/** @internal */
-function createSamlServiceProvider(opts) {
-	const binding = Constants.namespace.binding;
-	return ServiceProvider({
-		entityID: opts.entityId,
-		relayState: opts.relayState ?? "",
-		authnRequestsSigned: opts.authnRequestsSigned ?? false,
-		privateKey: opts.privateKey,
-		privateKeyPass: opts.privateKeyPass,
-		signingCert: opts.signingCert,
-		encryptCert: opts.encryptCert,
-		encPrivateKey: opts.encPrivateKey,
-		encPrivateKeyPass: opts.encPrivateKeyPass,
-		assertionConsumerService: [{
-			Binding: binding.post,
-			Location: opts.acsUrl
-		}],
-		singleLogoutService: opts.sloUrl ? [{
-			Binding: binding.redirect,
-			Location: opts.sloUrl
-		}, {
-			Binding: binding.post,
-			Location: opts.sloUrl
-		}] : void 0
-	});
-}
-/** @internal */
-function createEnterpriseSamlRuntime(opts) {
-	const saml = getSamlConfig(opts.config);
-	const spOptions = getSamlServiceProviderOptions({
-		rootUrl: opts.rootUrl,
-		source: opts.source,
-		config: opts.config,
-		relayState: opts.relayState,
-		overrides: opts.overrides
-	});
-	if (typeof saml.idp?.metadataXml !== "string") throw new Error("SAML IdP metadata is missing.");
-	return {
-		saml,
-		sp: createSamlServiceProvider(spOptions),
-		idp: IdentityProvider({ metadata: saml.idp.metadataXml }),
-		urls: getEnterpriseSamlUrls({
-			rootUrl: opts.rootUrl,
-			source: opts.source
-		})
-	};
-}
-/** @internal */
-function createEnterpriseSamlSignInRequest(opts) {
-	const runtime = createEnterpriseSamlRuntime({
-		rootUrl: opts.rootUrl,
-		source: opts.source,
-		config: opts.config
-	});
-	const binding = runtime.saml.idp.sso?.redirect ? "redirect" : "post";
-	const loginRequest = runtime.sp.createLoginRequest(runtime.idp, binding);
-	const relayState = encodeEnterpriseSamlRelayState({
-		source: opts.source,
-		signature: opts.signature,
-		requestId: loginRequest.id,
-		state: opts.state,
-		redirectTo: opts.redirectTo
-	});
-	return {
-		requestId: loginRequest.id,
-		binding,
-		relayState,
-		redirectUrl: binding === "redirect" ? (() => {
-			const redirectUrl = new URL(loginRequest.context);
-			redirectUrl.searchParams.set("RelayState", relayState);
-			return redirectUrl.toString();
-		})() : void 0,
-		post: binding === "post" ? {
-			endpoint: loginRequest.entityEndpoint,
-			value: loginRequest.context
-		} : void 0
-	};
-}
-/** @internal */
-async function parseEnterpriseSamlLoginResponse(opts) {
-	ensureSamlifyValidator();
-	const httpRequest = await readEnterpriseSamlHttpRequest(opts.request);
-	const runtime = createEnterpriseSamlRuntime({
-		rootUrl: opts.rootUrl,
-		source: opts.source,
-		config: opts.config
-	});
-	const parsed = await runtime.sp.parseLoginResponse(runtime.idp, httpRequest.binding, {
-		query: httpRequest.query,
-		body: httpRequest.body
-	});
-	warnDeprecatedSamlAlgorithms(parsed);
-	return {
-		...httpRequest,
-		runtime,
-		parsed,
-		relayState: decodeEnterpriseSamlRelayStateOrThrow(httpRequest.relayState ?? null)
-	};
-}
-const DEPRECATED_SAML_ALGORITHMS = new Set([
-	"http://www.w3.org/2000/09/xmldsig#rsa-sha1",
-	"http://www.w3.org/2000/09/xmldsig#dsa-sha1",
-	"http://www.w3.org/2000/09/xmldsig#sha1",
-	"http://www.w3.org/2001/04/xmlenc#rsa-1_5",
-	"http://www.w3.org/2001/04/xmlenc#tripledes-cbc"
-]);
-/**
-* Warn when the SAML response uses deprecated cryptographic algorithms
-* (SHA-1, RSA 1.5, 3DES). These are still accepted for compatibility
-* but should be flagged.
-*/
-function warnDeprecatedSamlAlgorithms(parsed) {
-	try {
-		const sigAlg = parsed?.extract?.signature?.signatureAlgorithm ?? parsed?.extract?.response?.signatureAlgorithm;
-		const digestAlg = parsed?.extract?.signature?.digestAlgorithm;
-		if (sigAlg && DEPRECATED_SAML_ALGORITHMS.has(sigAlg)) console.warn(`[convex-auth] SAML response uses deprecated signature algorithm: ${sigAlg}. Consider upgrading your IdP to use RSA-SHA256 or stronger.`);
-		if (digestAlg && DEPRECATED_SAML_ALGORITHMS.has(digestAlg)) console.warn(`[convex-auth] SAML response uses deprecated digest algorithm: ${digestAlg}. Consider upgrading your IdP to use SHA-256 or stronger.`);
-	} catch {}
-}
-/** @internal */
-function validateEnterpriseSamlLoginRelayState(opts) {
-	if (opts.relayState.source.kind !== opts.source.kind || opts.relayState.source.id !== opts.source.id || opts.relayState.requestId !== opts.inResponseTo) throw new Error("SAML RelayState did not match the pending login request.");
-}
-/** @internal */
-async function parseEnterpriseSamlLogoutMessage(opts) {
-	ensureSamlifyValidator();
-	const httpRequest = await readEnterpriseSamlHttpRequest(opts.request);
-	const runtime = createEnterpriseSamlRuntime({
-		rootUrl: opts.rootUrl,
-		source: opts.source,
-		config: opts.config,
-		relayState: httpRequest.relayState
-	});
-	const parsedRequest = httpRequest.hasSamlRequest ? await runtime.sp.parseLogoutRequest(runtime.idp, httpRequest.binding, {
-		query: httpRequest.query,
-		body: httpRequest.body
-	}) : void 0;
-	return {
-		...httpRequest,
-		runtime,
-		parsedRequest
-	};
-}
-/** @internal */
-async function createEnterpriseOidcRuntime(opts) {
-	const providerId = enterpriseOidcProviderId(opts.enterpriseId);
-	const urls = getEnterpriseOidcUrls({
-		rootUrl: opts.rootUrl,
-		enterpriseId: opts.enterpriseId
-	});
-	const { provider, oauthConfig } = await createEnterpriseOidcProvider(opts.oidc, urls.callbackUrl);
-	return {
-		oidc: opts.oidc,
-		providerId,
-		provider,
-		oauthConfig,
-		...urls
-	};
-}
-/** @internal */
-function profileFromSamlExtract(extract, mapping) {
-	const attributes = typeof extract?.attributes === "object" && extract.attributes !== null ? extract.attributes : {};
-	const resolveFirst = (...keys) => {
-		for (const key of keys) {
-			if (!key) continue;
-			const attribute = attributes[key];
-			const value = Array.isArray(attribute) ? attribute[0] : attribute;
-			if (value !== void 0) return value;
-		}
-	};
-	const fieldResolvers = {
-		email: () => resolveFirst(mapping?.email),
-		name: () => resolveFirst(mapping?.name) ?? ([resolveFirst(mapping?.firstName), resolveFirst(mapping?.lastName)].filter(Boolean).join(" ") || void 0),
-		subject: () => resolveFirst(mapping?.subject) ?? extract?.nameID
-	};
-	const subject = fieldResolvers.subject();
-	if (subject === void 0) throw new Error("SAML profile is missing a subject. Configure `attributeMapping.subject` or ensure the assertion includes a NameID.");
-	const email = fieldResolvers.email();
-	const name = fieldResolvers.name();
-	return {
-		id: subject,
-		email,
-		emailVerified: typeof email === "string" ? true : void 0,
-		name,
-		samlAttributes: attributes,
-		samlSessionIndex: extract?.sessionIndex?.SessionIndex
-	};
-}
-/** @internal */
-function parseScimPath(pathname) {
-	const [api, auth, sso, enterpriseId, protocol, version, ...rest] = pathname.split("/").filter(Boolean);
-	if (api !== "api" || auth !== "auth" || sso !== "sso" || !enterpriseId || enterpriseId === "setup" || protocol !== "scim" || version !== "v2") return {
-		enterpriseId: "",
-		resource: "",
-		resourceId: void 0
-	};
-	return {
-		enterpriseId,
-		resource: rest[0] ?? "",
-		resourceId: rest[1]
-	};
-}
-/** @internal */
-function parseScimListRequest(url) {
-	const startIndex = Math.max(1, Number(url.searchParams.get("startIndex") ?? "1"));
-	const count = Math.min(100, Math.max(1, Number(url.searchParams.get("count") ?? "100")));
-	const filterParam = url.searchParams.get("filter");
-	return {
-		startIndex,
-		count,
-		filter: filterParam ? (() => {
-			const match = filterParam.match(/^([A-Za-z0-9_.]+)\s+eq\s+"([^"]+)"$/);
-			if (!match) throw new Error("Unsupported SCIM filter.");
-			return {
-				attribute: match[1],
-				value: match[2]
-			};
-		})() : void 0
-	};
-}
-/** @internal */
-function scimJson(data, status = 200, headers) {
-	const responseHeaders = new Headers({ "Content-Type": "application/scim+json" });
-	if (headers) new Headers(headers).forEach((value, key) => {
-		responseHeaders.set(key, value);
-	});
-	return new Response(JSON.stringify(data), {
-		status,
-		headers: responseHeaders
-	});
-}
-/** @internal */
-function scimError(status, scimType, detail) {
-	return scimJson({
-		schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
-		status: String(status),
-		scimType,
-		detail
-	}, status);
-}
-/** @internal */
-function serializeScimUser(args) {
-	return {
-		schemas: [SCIM_USER_SCHEMA_ID],
-		id: args.id,
-		externalId: args.externalId,
-		meta: {
-			resourceType: "User",
-			location: args.location
-		},
-		userName: args.user.email ?? args.user.phone ?? args.user.name ?? args.id,
-		active: args.active ?? true,
-		name: args.user.name !== void 0 ? { formatted: args.user.name } : void 0,
-		emails: typeof args.user.email === "string" ? [{
-			value: args.user.email,
-			primary: true
-		}] : void 0,
-		phoneNumbers: typeof args.user.phone === "string" ? [{
-			value: args.user.phone,
-			primary: true
-		}] : void 0,
-		displayName: args.user.name
-	};
-}
-/** @internal */
-function serializeScimGroup(args) {
-	return {
-		schemas: [SCIM_GROUP_SCHEMA_ID],
-		id: args.id,
-		externalId: args.externalId,
-		meta: {
-			resourceType: "Group",
-			location: args.location
-		},
-		displayName: args.group.name ?? args.id,
-		members: args.members ?? []
-	};
-}
-
-//#endregion
-export { DEFAULT_ENTERPRISE_POLICY, ENTERPRISE_OIDC_PROVIDER_PREFIX, ENTERPRISE_SAML_PROVIDER_PREFIX, SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID, createEnterpriseOidcProvider, createEnterpriseOidcRuntime, createEnterpriseSamlMetadataXml, createEnterpriseSamlRuntime, createEnterpriseSamlSignInRequest, createSamlPostBindingResponse, createSamlServiceProvider, createServiceProviderMetadata, createSyntheticOAuthMaterializedConfig, decodeEnterpriseSamlRelayStateOrThrow, decodeRelayState, encodeEnterpriseSamlRelayState, enterpriseOidcProviderId, enterpriseSamlProviderId, getEnterpriseOidcUrls, getEnterpriseSamlUrls, getOidcConfig, getPublicOidcConfig, getSamlConfig, getSamlServiceProviderOptions, isEnterpriseProviderId, isEnterpriseSamlSourceActive, normalizeDomain, normalizeEnterprisePolicy, parseEnterpriseSamlLoginResponse, parseEnterpriseSamlLogoutMessage, parseSamlIdpMetadata, parseScimListRequest, parseScimPath, patchEnterprisePolicy, profileFromSamlExtract, readEnterpriseSamlHttpRequest, readRequestBody, scimError, scimJson, serializeScimGroup, serializeScimUser, upsertProtocolConfig, validateEnterpriseSamlLoginRelayState, withOidcSecretState };
-//# sourceMappingURL=sso.js.map