@voltro/plugin-sso-saml 0.1.0

package/dist/index.js

@@ -0,0 +1,443 @@
+import { Effect as e, Schema as t } from "effect";
+import { FetchHttpClient as n, HttpClient as r } from "@effect/platform";
+import { randomBytes as i } from "node:crypto";
+import { definePlugin as a } from "@voltro/protocol";
+import { buildSetCookie as o, readCookie as s, signSession as c } from "@voltro/protocol/session";
+import { id as l, table as u, text as d } from "@voltro/database";
+//#region src/saml.ts
+var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/g, ""), p = (e) => {
+	let t = e.signingCert ? `
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data><X509Certificate>${m(f(e.signingCert))}</X509Certificate></X509Data>
+      </KeyInfo>
+    </KeyDescriptor>` : "", n = e.sloUrl ? `
+    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="${m(e.sloUrl)}"/>` : "";
+	return `<?xml version="1.0"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${m(e.entityId)}">
+  <SPSSODescriptor AuthnRequestsSigned="${e.authnRequestsSigned ? "true" : "false"}" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">${t}${n}
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress</NameIDFormat>
+    <AssertionConsumerService index="0" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${m(e.acsUrl)}"/>
+  </SPSSODescriptor>
+</EntityDescriptor>`;
+}, m = (e) => e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;"), h = (e) => {
+	let t = e.attributes ?? {}, n = (...n) => {
+		for (let r of n) {
+			let n = e[r] ?? t[r];
+			if (typeof n == "string" && n.length > 0) return n;
+			if (Array.isArray(n) && typeof n[0] == "string") return n[0];
+		}
+		return null;
+	}, r = String(e.nameID ?? e.nameId ?? n("nameID") ?? "");
+	return {
+		nameId: r,
+		email: n("email", "mail", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress") ?? (r.includes("@") ? r : null),
+		displayName: n("displayName", "name", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", "cn"),
+		attributes: t
+	};
+}, g = "_voltro_saml_replay", _ = u(g, {
+	id: l({ prefix: "samlrq" }),
+	requestId: d().unique(),
+	instant: d(),
+	createdAtMs: d()
+}).index("bySamlRequestId", ["requestId"]), v = [_], y = (e, t) => ({
+	kind: "binary",
+	op: "eq",
+	column: e,
+	value: t
+}), b = (e, t = 10 * 6e4) => {
+	let n = async (t) => (await e.query({
+		table: g,
+		predicate: y("requestId", t),
+		order: [{
+			column: "id",
+			direction: "asc"
+		}],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	}))[0], r = (e, n) => {
+		let r = Number(e.createdAtMs);
+		return Number.isFinite(r) && n - r > t;
+	};
+	return {
+		saveAsync: async (t, n) => {
+			let r = Date.now();
+			try {
+				return await e.insert(g, {
+					requestId: t,
+					instant: n,
+					createdAtMs: String(r)
+				}), {
+					value: n,
+					createdAt: r
+				};
+			} catch {
+				return null;
+			}
+		},
+		getAsync: async (t) => {
+			let i = await n(t);
+			return i ? r(i, Date.now()) ? (await e.delete(g, String(i.id)).catch(() => void 0), null) : String(i.instant) : null;
+		},
+		removeAsync: async (t) => {
+			if (t == null) return null;
+			let r = await n(t);
+			return r ? (await e.delete(g, String(r.id)).catch(() => void 0), t) : null;
+		}
+	};
+}, x = (e = 10 * 6e4) => {
+	let t = /* @__PURE__ */ new Map();
+	return {
+		saveAsync: async (e, n) => {
+			if (t.has(e)) return null;
+			let r = {
+				value: n,
+				createdAt: Date.now()
+			};
+			return t.set(e, r), r;
+		},
+		getAsync: async (n) => {
+			let r = t.get(n);
+			return r ? Date.now() - r.createdAt > e ? (t.delete(n), null) : r.value : null;
+		},
+		removeAsync: async (e) => e == null || !t.has(e) ? null : (t.delete(e), e)
+	};
+}, S = "_voltro_saml_logout", C = u(S, {
+	id: l({ prefix: "samllo" }),
+	sloKey: d().unique(),
+	nameId: d(),
+	nameIdFormat: d(),
+	sessionIndex: d(),
+	createdAtMs: d()
+}).index("bySamlSloKey", ["sloKey"]), w = [C], T = (e, t) => ({
+	kind: "binary",
+	op: "eq",
+	column: e,
+	value: t
+}), E = (e) => ({
+	nameId: String(e.nameId ?? ""),
+	...e.nameIdFormat ? { nameIdFormat: String(e.nameIdFormat) } : {},
+	...e.sessionIndex ? { sessionIndex: String(e.sessionIndex) } : {}
+}), D = (e, t = 10080 * 6e4) => {
+	let n = async (t) => (await e.query({
+		table: S,
+		predicate: T("sloKey", t),
+		order: [{
+			column: "id",
+			direction: "asc"
+		}],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	}))[0], r = (e, n) => {
+		let r = Number(e.createdAtMs);
+		return Number.isFinite(r) && n - r > t;
+	}, i = async (t) => {
+		await e.delete(S, String(t.id)).catch(() => void 0);
+	};
+	return {
+		save: async (t) => {
+			let r = await n(t.sloKey);
+			r && await i(r), await e.insert(S, {
+				sloKey: t.sloKey,
+				nameId: t.nameId,
+				nameIdFormat: t.nameIdFormat ?? "",
+				sessionIndex: t.sessionIndex ?? "",
+				createdAtMs: String(Date.now())
+			});
+		},
+		load: async (e) => {
+			let t = await n(e);
+			return t ? r(t, Date.now()) ? (await i(t), null) : E(t) : null;
+		},
+		remove: async (e) => {
+			let t = await n(e);
+			t && await i(t);
+		}
+	};
+}, O = (e = 10080 * 6e4) => {
+	let t = /* @__PURE__ */ new Map();
+	return {
+		save: async (e) => {
+			t.set(e.sloKey, {
+				subject: {
+					nameId: e.nameId,
+					...e.nameIdFormat ? { nameIdFormat: e.nameIdFormat } : {},
+					...e.sessionIndex ? { sessionIndex: e.sessionIndex } : {}
+				},
+				createdAt: Date.now()
+			});
+		},
+		load: async (n) => {
+			let r = t.get(n);
+			return r ? Date.now() - r.createdAt > e ? (t.delete(n), null) : r.subject : null;
+		},
+		remove: async (e) => {
+			t.delete(e);
+		}
+	};
+}, k = class extends t.TaggedError()("SamlMetadataFetchError", {
+	url: t.String,
+	reason: t.String
+}) {}, A = class extends t.TaggedError()("SamlMetadataParseError", {
+	url: t.String,
+	reason: t.String
+}) {}, j = "urn:oasis:names:tc:SAML:2.0:metadata", M = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", N = (e) => e.slice(e.indexOf(":") + 1), P = (e, t) => (RegExp(`\\b${t}\\s*=\\s*"([^"]*)"`).exec(e) ?? RegExp(`\\b${t}\\s*=\\s*'([^']*)'`).exec(e))?.[1], F = (e, t) => {
+	let n = [], r = /<([A-Za-z][\w.:-]*)\b([^>]*)>/g, i;
+	for (; (i = r.exec(e)) !== null;) N(i[1]) === t && n.push(i[0]);
+	return n;
+}, I = (e) => {
+	let t = [], n = /<([A-Za-z][\w.:-]*KeyDescriptor)\b([^>]*)>/g, r;
+	for (; (r = n.exec(e)) !== null;) {
+		if (N(r[1]) !== "KeyDescriptor") continue;
+		let n = RegExp(`</${r[1].replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}>`), i = e.slice(r.index + r[0].length), a = n.exec(i), o = a ? i.slice(0, a.index) : i;
+		t.push({
+			use: P(r[0], "use"),
+			body: o
+		});
+	}
+	return t;
+}, L = (e) => {
+	let t = I(e), n = t.find((e) => e.use === "signing") ?? t.find((e) => e.use === void 0) ?? t[0];
+	if (!n) return;
+	let r = /<[^>]*X509Certificate[^>]*>([\s\S]*?)<\/[^>]*X509Certificate>/.exec(n.body)?.[1]?.replace(/\s+/g, "");
+	return r && r.length > 0 ? r : void 0;
+}, R = (t, n) => e.gen(function* () {
+	if (!t.includes(j) && !/EntityDescriptor/.test(t)) return yield* e.fail(new A({
+		url: n,
+		reason: "not-saml-metadata"
+	}));
+	let r = F(t, "SingleSignOnService"), i = r.find((e) => P(e, "Binding") === M) ?? r[0], a = i ? P(i, "Location") : void 0;
+	if (!a) return yield* e.fail(new A({
+		url: n,
+		reason: "no-entryPoint"
+	}));
+	let o = L(t);
+	if (!o) return yield* e.fail(new A({
+		url: n,
+		reason: "no-signing-cert"
+	}));
+	let s = F(t, "SingleLogoutService"), c = s.find((e) => P(e, "Binding") === M) ?? s[0], l = c ? P(c, "Location") : void 0, u = F(t, "EntityDescriptor")[0], d = u ? P(u, "entityID") : void 0;
+	return {
+		entryPoint: a,
+		idpCert: o,
+		...l ? { logoutUrl: l } : {},
+		...d ? { issuer: d } : {}
+	};
+}), z = (t) => e.gen(function* () {
+	let n = yield* (yield* r.HttpClient).get(t).pipe(e.mapError(() => new k({
+		url: t,
+		reason: "network"
+	})));
+	if (n.status < 200 || n.status >= 300) return yield* e.fail(new k({
+		url: t,
+		reason: `status ${n.status}`
+	}));
+	let i = yield* n.text.pipe(e.mapError(() => new k({
+		url: t,
+		reason: "body"
+	})));
+	return i.trim() ? yield* R(i, t) : yield* e.fail(new k({
+		url: t,
+		reason: "empty-body"
+	}));
+}), B = (e, t) => typeof e != "string" || e[0] !== "/" || /[-]/.test(e) ? t : e === "/" ? e : e[1] === "/" || e[1] === "\\" ? t : e, V = (e, t, n = "text/plain") => ({
+	status: e,
+	body: t,
+	contentType: n
+}), H = (e, t) => {
+	let n = { location: e };
+	return typeof t == "string" ? n["set-cookie"] = t : Array.isArray(t) && t.length > 0 && (n["set-cookie"] = t.join(", ")), {
+		status: 302,
+		headers: n
+	};
+}, U = ":slo", W = (t) => {
+	if (!t.sessionSecret?.trim()) throw Error("@voltro/plugin-sso-saml: `sessionSecret` must be a non-empty string");
+	if (!t.idp.metadataUrl && (!t.idp.entryPoint || !t.idp.idpCert)) throw Error("@voltro/plugin-sso-saml: provide idp.entryPoint + idp.idpCert, or idp.metadataUrl to load them from the IdP metadata");
+	let r = t.basePath ?? "/saml", l = t.cookieName ?? "voltro:session", u = `${l}${U}`, d = t.sessionTtlSeconds ?? 3600 * 24 * 7, f = t.successRedirect ?? "/", m = t.logoutRedirect ?? "/", g = t.name ? `@voltro/plugin-sso-saml#${t.name}` : "@voltro/plugin-sso-saml", _ = t.idp.metadataRefreshMs ?? 720 * 6e4, y = t.replayProtection, S = typeof y == "object" && y.store === !0, C = typeof y == "object" ? y.ttlMs ?? 10 * 6e4 : 10 * 6e4, T = typeof t.sloStore == "object" && t.sloStore.store === !0, E = S || T, k, A, j, M, N = 0, P, F = () => {
+		if (y) {
+			if (S) {
+				if (!k) throw Error("@voltro/plugin-sso-saml: replayProtection { store: true } but the DataStore is not bound yet");
+				return b(k, C);
+			}
+			return x(C);
+		}
+	}, I = () => {
+		if (P) return P;
+		if (T) {
+			if (!k) throw Error("@voltro/plugin-sso-saml: sloStore { store: true } but the DataStore is not bound yet");
+			P = D(k, d * 1e3);
+		} else P = O(d * 1e3);
+		return P;
+	}, L = async () => {
+		let r = t.idp.metadataUrl;
+		if (r) {
+			let i = _ > 0 && Date.now() - N > _;
+			if (!M || i) {
+				let t = await e.runPromiseExit(z(r).pipe(e.provide(n.layer)));
+				t._tag === "Success" && (M = t.value, N = Date.now());
+			}
+			if (M) return {
+				entryPoint: M.entryPoint,
+				idpCert: M.idpCert,
+				...t.idp.logoutUrl ?? M.logoutUrl ? { logoutUrl: t.idp.logoutUrl ?? M.logoutUrl } : {},
+				...t.idp.issuer ?? M.issuer ? { idpIssuer: t.idp.issuer ?? M.issuer } : {}
+			};
+		}
+		return {
+			entryPoint: t.idp.entryPoint,
+			idpCert: t.idp.idpCert,
+			...t.idp.logoutUrl ? { logoutUrl: t.idp.logoutUrl } : {},
+			...t.idp.issuer ? { idpIssuer: t.idp.issuer } : {}
+		};
+	}, R = (e, n) => ({
+		callbackUrl: t.sp.acsUrl,
+		entryPoint: e.entryPoint,
+		issuer: t.sp.entityId,
+		idpCert: e.idpCert,
+		...e.idpIssuer ? { idpIssuer: e.idpIssuer } : {},
+		...e.logoutUrl ? { logoutUrl: e.logoutUrl } : {},
+		wantAssertionsSigned: !0,
+		...t.decryptionPvk ? { decryptionPvk: t.decryptionPvk } : {},
+		...t.privateKey ? { privateKey: t.privateKey } : {},
+		...t.signingCert ? { publicCert: t.signingCert } : {},
+		...t.acceptedClockSkewMs === void 0 ? {} : { acceptedClockSkewMs: t.acceptedClockSkewMs },
+		...n ? {
+			validateInResponseTo: "always",
+			cacheProvider: n,
+			requestIdExpirationPeriodMs: C
+		} : {}
+	}), W = async () => {
+		let e = !!t.idp.metadataUrl && _ > 0 && Date.now() - N > _;
+		if (A && !e) return A;
+		if (!j) try {
+			let e = await import("@node-saml/node-saml"), t = await L(), n = F();
+			return A = new e.SAML(R(t, n)), A;
+		} catch {
+			j = "SAML SSO requires the optional dependency @node-saml/node-saml — run `pnpm add @node-saml/node-saml`";
+			return;
+		}
+	}, G = (() => {
+		try {
+			return new URL(`${r}/slo`, t.sp.acsUrl).toString();
+		} catch {
+			return;
+		}
+	})(), K = {
+		...t.sp,
+		authnRequestsSigned: !!t.privateKey,
+		...t.signingCert ? { signingCert: t.signingCert } : {},
+		...G ? { sloUrl: G } : {}
+	}, q = (e) => s(e.headers.cookie ?? e.headers.Cookie, u), J = () => [o(l, "", {
+		maxAgeSeconds: 0,
+		httpOnly: !0,
+		sameSite: "lax"
+	}), o(u, "", {
+		maxAgeSeconds: 0,
+		httpOnly: !0,
+		sameSite: "lax"
+	})];
+	return a({
+		name: g,
+		description: "SAML 2.0 SSO — SP-initiated login + Single Logout, ACS, metadata.",
+		permissions: E ? ["store:write"] : [],
+		httpRoutes: [{
+			method: "*",
+			path: r,
+			handle: async (e) => {
+				let n = e.path.slice(r.length).replace(/\/+$/, ""), a = e.method.toUpperCase();
+				if (n === "/metadata" && a === "GET") return V(200, p(K), "application/xml");
+				let s = await W();
+				if (!s) return V(500, j ?? "SAML not available");
+				if (n === "/login" && a === "GET") {
+					let t = B(new URLSearchParams(e.query).get("returnTo"), f);
+					return H(await s.getAuthorizeUrlAsync(t, void 0, {}));
+				}
+				if (n === "/acs" && a === "POST") {
+					let n = new URLSearchParams(new TextDecoder().decode(e.rawBody)), r = n.get("SAMLResponse"), a = B(n.get("RelayState"), f);
+					if (!r) return V(400, "missing SAMLResponse");
+					let p;
+					try {
+						({profile: p} = await s.validatePostResponseAsync({ SAMLResponse: r }));
+					} catch (e) {
+						return V(401, `SAML assertion rejected: ${String(e?.message ?? e)}`);
+					}
+					if (!p) return V(401, "no SAML profile");
+					let m = await t.onLogin(h(p));
+					if (!m) return V(403, "login rejected");
+					let g = c(m, t.sessionSecret, { ttlSeconds: d }), _ = o(l, g, {
+						maxAgeSeconds: d,
+						httpOnly: !0,
+						sameSite: "lax"
+					}), v = String(p.nameID ?? p.nameId ?? ""), y = [_];
+					if (v) {
+						let e = i(24).toString("base64url");
+						await I().save({
+							sloKey: e,
+							nameId: v,
+							...p.nameIDFormat ? { nameIdFormat: String(p.nameIDFormat) } : {},
+							...p.sessionIndex ? { sessionIndex: String(p.sessionIndex) } : {}
+						}), y.push(o(u, e, {
+							maxAgeSeconds: d,
+							httpOnly: !0,
+							sameSite: "lax"
+						}));
+					}
+					return H(a, y);
+				}
+				if (n === "/logout" && a === "GET") {
+					let t = B(new URLSearchParams(e.query).get("returnTo"), m), n = q(e), r = n ? await I().load(n) : null;
+					if (!r) return H(t, J());
+					let i = {
+						nameID: r.nameId,
+						...r.nameIdFormat ? { nameIDFormat: r.nameIdFormat } : {},
+						...r.sessionIndex ? { sessionIndex: r.sessionIndex } : {}
+					}, a;
+					try {
+						a = await s.getLogoutUrlAsync(i, t, {});
+					} catch (e) {
+						return V(500, `SAML logout request failed: ${String(e?.message ?? e)}`);
+					}
+					return n && await I().remove(n), H(a, J());
+				}
+				if (n === "/slo" && (a === "GET" || a === "POST")) {
+					let t = a === "GET" ? e.query : new TextDecoder().decode(e.rawBody), n = new URLSearchParams(t), r = {};
+					for (let [e, t] of n) r[e] = t;
+					let i = B(n.get("RelayState"), m), o;
+					try {
+						o = await s.validateRedirectAsync(r, t);
+					} catch (e) {
+						return V(401, `SAML logout rejected: ${String(e?.message ?? e)}`);
+					}
+					if (n.has("SAMLResponse")) return H(i, J());
+					let c = q(e);
+					c && await I().remove(c);
+					try {
+						return H(await s.getLogoutResponseUrlAsync(o.profile ?? {}, i, {}, !0), J());
+					} catch {
+						return H(i, J());
+					}
+				}
+				return V(404, "unknown SAML endpoint");
+			}
+		}],
+		...E ? { extendSchema: { tables: [...S ? v : [], ...T ? w : []] } } : {},
+		bindDataStore: (e) => {
+			k = e;
+		},
+		onActivate: (n) => e.sync(() => {
+			n.logger.info("saml sso active", {
+				basePath: r,
+				entityId: t.sp.entityId,
+				idpSource: t.idp.metadataUrl ? "metadata-url" : "static",
+				replayProtection: y ? S ? "store" : "memory" : "off",
+				sloStore: T ? "store" : "memory",
+				requestSigning: t.privateKey ? "on" : "off",
+				encryptedAssertions: t.decryptionPvk ? "on" : "off"
+			}), y && !S && n.logger.warn("saml sso: replayProtection uses an IN-PROCESS cache — correct for ONE replica only. Under >1 replica a login and its ACS can land on different processes (InResponseTo fails) and a cross-replica replay is not caught. Use replayProtection: { store: true } in production."), T || n.logger.warn("saml sso: SLO state uses an IN-PROCESS store — correct for ONE replica only. Under >1 replica a login and its logout can land on different processes. Use sloStore: { store: true } in production.");
+		})
+	});
+};
+//#endregion
+export { S as LOGOUT_SESSION_TABLE, g as REPLAY_CACHE_TABLE, k as SamlMetadataFetchError, A as SamlMetadataParseError, D as dataStoreLogoutStore, b as dataStoreReplayCache, h as extractProfile, z as fetchIdpMetadata, O as memoryLogoutStore, x as memoryReplayCache, R as parseIdpMetadata, C as samlLogoutTable, w as samlLogoutTables, _ as samlReplayTable, v as samlReplayTables, W as samlSsoPlugin, p as spMetadataXml };

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@voltro/plugin-sso-saml",
+  "version": "0.1.0",
+  "description": "Enterprise SAML 2.0 SSO — SP-initiated login, ACS assertion consumer, and SP metadata. Signature verification via @node-saml/node-saml (optional, lazy); the framework integration (routes, session minting, attribute mapping) is built in.",
+  "keywords": [
+    "voltro",
+    "typescript",
+    "framework"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://voltro.dev",
+  "bugs": {
+    "email": "support@voltro.dev"
+  },
+  "author": {
+    "name": "Voltro UG",
+    "url": "https://voltro.dev"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "dependencies": {
+    "@effect/platform": "^0.96.2",
+    "@voltro/database": "0.1.0",
+    "@voltro/protocol": "0.1.0"
+  },
+  "optionalDependencies": {
+    "@node-saml/node-saml": "^5.0.0"
+  },
+  "peerDependencies": {
+    "effect": "^3.21.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}