@voltro/plugin-sso-saml 0.32.0 → 0.34.0

package/dist/index.js

@@ -1,26 +1,26 @@
 import { Effect as e, Schema as t } from "effect";
 import { FetchHttpClient as n, HttpClient as r } from "@effect/platform";
 import { randomBytes as i } from "node:crypto";
-import { definePlugin as a } from "@voltro/protocol";
-import { buildSetCookie as o, readCookie as s, signSession as c } from "@voltro/protocol/session";
-import { id as l, table as u, text as d } from "@voltro/database";
+import { definePlugin as a, pluginInstanceName as o } from "@voltro/protocol";
+import { buildSetCookie as s, readCookie as c, signSession as l } from "@voltro/protocol/session";
+import { id as u, table as d, text as f } from "@voltro/database";
 //#region src/saml.ts
-var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/g, ""), p = (e) => {
+var p = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/g, ""), m = (e) => {
 	let t = e.signingCert ? `
     <KeyDescriptor use="signing">
       <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
-        <X509Data><X509Certificate>${m(f(e.signingCert))}</X509Certificate></X509Data>
+        <X509Data><X509Certificate>${h(p(e.signingCert))}</X509Certificate></X509Data>
       </KeyInfo>
     </KeyDescriptor>` : "", n = e.sloUrl ? `
-    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="${m(e.sloUrl)}"/>` : "";
+    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="${h(e.sloUrl)}"/>` : "";
 	return `<?xml version="1.0"?>
-<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${m(e.entityId)}">
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${h(e.entityId)}">
   <SPSSODescriptor AuthnRequestsSigned="${e.authnRequestsSigned ? "true" : "false"}" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">${t}${n}
     <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress</NameIDFormat>
-    <AssertionConsumerService index="0" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${m(e.acsUrl)}"/>
+    <AssertionConsumerService index="0" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${h(e.acsUrl)}"/>
   </SPSSODescriptor>
 </EntityDescriptor>`;
-}, m = (e) => e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;"), h = (e) => {
+}, h = (e) => e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;"), g = (e) => {
 	let t = e.attributes ?? {}, n = (...n) => {
 		for (let r of n) {
 			let n = e[r] ?? t[r];
@@ -35,20 +35,20 @@ var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/
 		displayName: n("displayName", "name", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", "cn"),
 		attributes: t
 	};
-}, g = "_voltro_saml_replay", _ = u(g, {
-	id: l({ prefix: "samlrq" }),
-	requestId: d().unique(),
-	instant: d(),
-	createdAtMs: d()
-}).index("bySamlRequestId", ["requestId"]), v = [_], y = (e, t) => ({
+}, _ = "_voltro_saml_replay", v = d(_, {
+	id: u({ prefix: "samlrq" }),
+	requestId: f().unique(),
+	instant: f(),
+	createdAtMs: f()
+}).index("bySamlRequestId", ["requestId"]), y = [v], b = (e, t) => ({
 	kind: "binary",
 	op: "eq",
 	column: e,
 	value: t
-}), b = (e, t = 10 * 6e4) => {
+}), x = (e, t = 10 * 6e4) => {
 	let n = async (t) => (await e.query({
-		table: g,
-		predicate: y("requestId", t),
+		table: _,
+		predicate: b("requestId", t),
 		order: [{
 			column: "id",
 			direction: "asc"
@@ -64,7 +64,7 @@ var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/
 		saveAsync: async (t, n) => {
 			let r = Date.now();
 			try {
-				return await e.insert(g, {
+				return await e.insert(_, {
 					requestId: t,
 					instant: n,
 					createdAtMs: String(r)
@@ -78,15 +78,15 @@ var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/
 		},
 		getAsync: async (t) => {
 			let i = await n(t);
-			return i ? r(i, Date.now()) ? (await e.delete(g, String(i.id)).catch(() => void 0), null) : String(i.instant) : null;
+			return i ? r(i, Date.now()) ? (await e.delete(_, String(i.id)).catch(() => void 0), null) : String(i.instant) : null;
 		},
 		removeAsync: async (t) => {
 			if (t == null) return null;
 			let r = await n(t);
-			return r ? (await e.delete(g, String(r.id)).catch(() => void 0), t) : null;
+			return r ? (await e.delete(_, String(r.id)).catch(() => void 0), t) : null;
 		}
 	};
-}, x = (e = 10 * 6e4) => {
+}, S = (e = 10 * 6e4) => {
 	let t = /* @__PURE__ */ new Map();
 	return {
 		saveAsync: async (e, n) => {
@@ -103,26 +103,26 @@ var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/
 		},
 		removeAsync: async (e) => e == null || !t.has(e) ? null : (t.delete(e), e)
 	};
-}, S = "_voltro_saml_logout", C = u(S, {
-	id: l({ prefix: "samllo" }),
-	sloKey: d().unique(),
-	nameId: d(),
-	nameIdFormat: d(),
-	sessionIndex: d(),
-	createdAtMs: d()
-}).index("bySamlSloKey", ["sloKey"]), w = [C], T = (e, t) => ({
+}, C = "_voltro_saml_logout", w = d(C, {
+	id: u({ prefix: "samllo" }),
+	sloKey: f().unique(),
+	nameId: f(),
+	nameIdFormat: f(),
+	sessionIndex: f(),
+	createdAtMs: f()
+}).index("bySamlSloKey", ["sloKey"]), T = [w], E = (e, t) => ({
 	kind: "binary",
 	op: "eq",
 	column: e,
 	value: t
-}), E = (e) => ({
+}), D = (e) => ({
 	nameId: String(e.nameId ?? ""),
 	...e.nameIdFormat ? { nameIdFormat: String(e.nameIdFormat) } : {},
 	...e.sessionIndex ? { sessionIndex: String(e.sessionIndex) } : {}
-}), D = (e, t = 10080 * 6e4) => {
+}), O = (e, t = 10080 * 6e4) => {
 	let n = async (t) => (await e.query({
-		table: S,
-		predicate: T("sloKey", t),
+		table: C,
+		predicate: E("sloKey", t),
 		order: [{
 			column: "id",
 			direction: "asc"
@@ -134,12 +134,12 @@ var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/
 		let r = Number(e.createdAtMs);
 		return Number.isFinite(r) && n - r > t;
 	}, i = async (t) => {
-		await e.delete(S, String(t.id)).catch(() => void 0);
+		await e.delete(C, String(t.id)).catch(() => void 0);
 	};
 	return {
 		save: async (t) => {
 			let r = await n(t.sloKey);
-			r && await i(r), await e.insert(S, {
+			r && await i(r), await e.insert(C, {
 				sloKey: t.sloKey,
 				nameId: t.nameId,
 				nameIdFormat: t.nameIdFormat ?? "",
@@ -149,14 +149,14 @@ var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/
 		},
 		load: async (e) => {
 			let t = await n(e);
-			return t ? r(t, Date.now()) ? (await i(t), null) : E(t) : null;
+			return t ? r(t, Date.now()) ? (await i(t), null) : D(t) : null;
 		},
 		remove: async (e) => {
 			let t = await n(e);
 			t && await i(t);
 		}
 	};
-}, O = (e = 10080 * 6e4) => {
+}, k = (e = 10080 * 6e4) => {
 	let t = /* @__PURE__ */ new Map();
 	return {
 		save: async (e) => {
@@ -177,112 +177,116 @@ var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/
 			t.delete(e);
 		}
 	};
-}, k = class extends t.TaggedError()("SamlMetadataFetchError", {
+}, A = class extends t.TaggedError()("SamlMetadataFetchError", {
 	url: t.String,
 	reason: t.String
-}) {}, A = class extends t.TaggedError()("SamlMetadataParseError", {
+}) {}, j = class extends t.TaggedError()("SamlMetadataParseError", {
 	url: t.String,
 	reason: t.String
-}) {}, j = "urn:oasis:names:tc:SAML:2.0:metadata", M = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", N = (e) => e.slice(e.indexOf(":") + 1), P = (e, t) => (RegExp(`\\b${t}\\s*=\\s*"([^"]*)"`).exec(e) ?? RegExp(`\\b${t}\\s*=\\s*'([^']*)'`).exec(e))?.[1], F = (e, t) => {
+}) {}, M = "urn:oasis:names:tc:SAML:2.0:metadata", N = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", P = (e) => e.slice(e.indexOf(":") + 1), F = (e, t) => (RegExp(`\\b${t}\\s*=\\s*"([^"]*)"`).exec(e) ?? RegExp(`\\b${t}\\s*=\\s*'([^']*)'`).exec(e))?.[1], I = (e, t) => {
 	let n = [], r = /<([A-Za-z][\w.:-]*)\b([^>]*)>/g, i;
-	for (; (i = r.exec(e)) !== null;) N(i[1]) === t && n.push(i[0]);
+	for (; (i = r.exec(e)) !== null;) P(i[1]) === t && n.push(i[0]);
 	return n;
-}, I = (e) => {
+}, L = (e) => {
 	let t = [], n = /<([A-Za-z][\w.:-]*KeyDescriptor)\b([^>]*)>/g, r;
 	for (; (r = n.exec(e)) !== null;) {
-		if (N(r[1]) !== "KeyDescriptor") continue;
+		if (P(r[1]) !== "KeyDescriptor") continue;
 		let n = RegExp(`</${r[1].replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}>`), i = e.slice(r.index + r[0].length), a = n.exec(i), o = a ? i.slice(0, a.index) : i;
 		t.push({
-			use: P(r[0], "use"),
+			use: F(r[0], "use"),
 			body: o
 		});
 	}
 	return t;
-}, L = (e) => {
-	let t = I(e), n = t.find((e) => e.use === "signing") ?? t.find((e) => e.use === void 0) ?? t[0];
+}, R = (e) => {
+	let t = L(e), n = t.find((e) => e.use === "signing") ?? t.find((e) => e.use === void 0) ?? t[0];
 	if (!n) return;
 	let r = /<[^>]*X509Certificate[^>]*>([\s\S]*?)<\/[^>]*X509Certificate>/.exec(n.body)?.[1]?.replace(/\s+/g, "");
 	return r && r.length > 0 ? r : void 0;
-}, R = (t, n) => e.gen(function* () {
-	if (!t.includes(j) && !/EntityDescriptor/.test(t)) return yield* e.fail(new A({
+}, z = (t, n) => e.gen(function* () {
+	if (!t.includes(M) && !/EntityDescriptor/.test(t)) return yield* e.fail(new j({
 		url: n,
 		reason: "not-saml-metadata"
 	}));
-	let r = F(t, "SingleSignOnService"), i = r.find((e) => P(e, "Binding") === M) ?? r[0], a = i ? P(i, "Location") : void 0;
-	if (!a) return yield* e.fail(new A({
+	let r = I(t, "SingleSignOnService"), i = r.find((e) => F(e, "Binding") === N) ?? r[0], a = i ? F(i, "Location") : void 0;
+	if (!a) return yield* e.fail(new j({
 		url: n,
 		reason: "no-entryPoint"
 	}));
-	let o = L(t);
-	if (!o) return yield* e.fail(new A({
+	let o = R(t);
+	if (!o) return yield* e.fail(new j({
 		url: n,
 		reason: "no-signing-cert"
 	}));
-	let s = F(t, "SingleLogoutService"), c = s.find((e) => P(e, "Binding") === M) ?? s[0], l = c ? P(c, "Location") : void 0, u = F(t, "EntityDescriptor")[0], d = u ? P(u, "entityID") : void 0;
+	let s = I(t, "SingleLogoutService"), c = s.find((e) => F(e, "Binding") === N) ?? s[0], l = c ? F(c, "Location") : void 0, u = I(t, "EntityDescriptor")[0], d = u ? F(u, "entityID") : void 0;
 	return {
 		entryPoint: a,
 		idpCert: o,
 		...l ? { logoutUrl: l } : {},
 		...d ? { issuer: d } : {}
 	};
-}), z = (t) => e.gen(function* () {
-	let n = yield* (yield* r.HttpClient).get(t).pipe(e.mapError(() => new k({
+}), B = (t) => e.gen(function* () {
+	let n = yield* (yield* r.HttpClient).get(t).pipe(e.mapError(() => new A({
 		url: t,
 		reason: "network"
 	})));
-	if (n.status < 200 || n.status >= 300) return yield* e.fail(new k({
+	if (n.status < 200 || n.status >= 300) return yield* e.fail(new A({
 		url: t,
 		reason: `status ${n.status}`
 	}));
-	let i = yield* n.text.pipe(e.mapError(() => new k({
+	let i = yield* n.text.pipe(e.mapError(() => new A({
 		url: t,
 		reason: "body"
 	})));
-	return i.trim() ? yield* R(i, t) : yield* e.fail(new k({
+	return i.trim() ? yield* z(i, t) : yield* e.fail(new A({
 		url: t,
 		reason: "empty-body"
 	}));
-}), B = (e, t) => typeof e != "string" || e[0] !== "/" || /[\u0000-]/.test(e) ? t : e === "/" ? e : e[1] === "/" || e[1] === "\\" ? t : e, V = (e, t, n = "text/plain") => ({
+}), V = (e, t) => typeof e != "string" || e[0] !== "/" || /[\u0000-]/.test(e) ? t : e === "/" ? e : e[1] === "/" || e[1] === "\\" ? t : e, H = (e, t, n = "text/plain") => ({
 	status: e,
 	body: t,
 	contentType: n
-}), H = (e, t) => {
+}), U = (e, t) => {
 	let n = { location: e };
 	return typeof t == "string" ? n["set-cookie"] = t : Array.isArray(t) && t.length > 0 && (n["set-cookie"] = t.join(", ")), {
 		status: 302,
 		headers: n
 	};
-}, U = ":slo", W = (t) => {
+}, W = ":slo", G = "@voltro/plugin-sso-saml", K = (t) => {
 	if (!t.sessionSecret?.trim()) throw Error("@voltro/plugin-sso-saml: `sessionSecret` must be a non-empty string");
 	if (!t.idp.metadataUrl && (!t.idp.entryPoint || !t.idp.idpCert)) throw Error("@voltro/plugin-sso-saml: provide idp.entryPoint + idp.idpCert, or idp.metadataUrl to load them from the IdP metadata");
-	let r = t.basePath ?? "/saml", l = t.cookieName ?? "voltro:session", u = `${l}${U}`, d = t.sessionTtlSeconds ?? 3600 * 24 * 7, f = t.successRedirect ?? "/", m = t.logoutRedirect ?? "/", g = t.name ? `@voltro/plugin-sso-saml#${t.name}` : "@voltro/plugin-sso-saml", _ = t.idp.metadataRefreshMs ?? 720 * 6e4, y = t.replayProtection, S = typeof y == "object" && y.store === !0, C = typeof y == "object" ? y.ttlMs ?? 10 * 6e4 : 10 * 6e4, T = typeof t.sloStore == "object" && t.sloStore.store === !0, E = S || T, k, A, j, M, N = 0, P, F = () => {
-		if (y) {
-			if (S) {
-				if (!k) throw Error("@voltro/plugin-sso-saml: replayProtection { store: true } but the DataStore is not bound yet");
-				return b(k, C);
+	let r = t.basePath ?? "/saml", u = t.cookieName ?? "voltro:session", d = `${u}${W}`, f = t.sessionTtlSeconds ?? 3600 * 24 * 7, p = t.successRedirect ?? "/", h = t.logoutRedirect ?? "/", _ = o({
+		base: G,
+		alias: t.alias,
+		instance: t.name
+	}), v = t.idp.metadataRefreshMs ?? 720 * 6e4, b = t.replayProtection ?? { store: !0 }, C = typeof b == "object" && b.store === !0, w = typeof b == "object" ? b.ttlMs ?? 10 * 6e4 : 10 * 6e4, E = typeof t.sloStore == "object" && t.sloStore.store === !0, D = C || E, A, j, M, N, P, F = 0, I, L = () => {
+		if (b) {
+			if (C) {
+				if (!A) throw Error("@voltro/plugin-sso-saml: replayProtection { store: true } but the DataStore is not bound yet");
+				return x(A, w);
 			}
-			return x(C);
+			return S(w);
 		}
-	}, I = () => {
-		if (P) return P;
-		if (T) {
-			if (!k) throw Error("@voltro/plugin-sso-saml: sloStore { store: true } but the DataStore is not bound yet");
-			P = D(k, d * 1e3);
-		} else P = O(d * 1e3);
-		return P;
-	}, L = async () => {
+	}, R = () => {
+		if (I) return I;
+		if (E) {
+			if (!A) throw Error("@voltro/plugin-sso-saml: sloStore { store: true } but the DataStore is not bound yet");
+			I = O(A, f * 1e3);
+		} else I = k(f * 1e3);
+		return I;
+	}, z = async () => {
 		let r = t.idp.metadataUrl;
 		if (r) {
-			let i = _ > 0 && Date.now() - N > _;
-			if (!M || i) {
-				let t = await e.runPromiseExit(z(r).pipe(e.provide(n.layer)));
-				t._tag === "Success" && (M = t.value, N = Date.now());
+			let i = v > 0 && Date.now() - F > v;
+			if (!P || i) {
+				let t = await e.runPromiseExit(B(r).pipe(e.provide(n.layer)));
+				t._tag === "Success" && (P = t.value, F = Date.now());
 			}
-			if (M) return {
-				entryPoint: M.entryPoint,
-				idpCert: M.idpCert,
-				...t.idp.logoutUrl ?? M.logoutUrl ? { logoutUrl: t.idp.logoutUrl ?? M.logoutUrl } : {},
-				...t.idp.issuer ?? M.issuer ? { idpIssuer: t.idp.issuer ?? M.issuer } : {}
+			if (P) return {
+				entryPoint: P.entryPoint,
+				idpCert: P.idpCert,
+				...t.idp.logoutUrl ?? P.logoutUrl ? { logoutUrl: t.idp.logoutUrl ?? P.logoutUrl } : {},
+				...t.idp.issuer ?? P.issuer ? { idpIssuer: t.idp.issuer ?? P.issuer } : {}
 			};
 		}
 		return {
@@ -291,7 +295,7 @@ var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/
 			...t.idp.logoutUrl ? { logoutUrl: t.idp.logoutUrl } : {},
 			...t.idp.issuer ? { idpIssuer: t.idp.issuer } : {}
 		};
-	}, R = (e, n) => ({
+	}, K = (e, n) => ({
 		callbackUrl: t.sp.acsUrl,
 		entryPoint: e.entryPoint,
 		issuer: t.sp.entityId,
@@ -299,6 +303,7 @@ var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/
 		...e.idpIssuer ? { idpIssuer: e.idpIssuer } : {},
 		...e.logoutUrl ? { logoutUrl: e.logoutUrl } : {},
 		wantAssertionsSigned: !0,
+		wantAuthnResponseSigned: t.wantAuthnResponseSigned ?? !1,
 		...t.decryptionPvk ? { decryptionPvk: t.decryptionPvk } : {},
 		...t.privateKey ? { privateKey: t.privateKey } : {},
 		...t.signingCert ? { publicCert: t.signingCert } : {},
@@ -306,138 +311,153 @@ var f = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/
 		...n ? {
 			validateInResponseTo: "always",
 			cacheProvider: n,
-			requestIdExpirationPeriodMs: C
+			requestIdExpirationPeriodMs: w
 		} : {}
-	}), W = async () => {
-		let e = !!t.idp.metadataUrl && _ > 0 && Date.now() - N > _;
-		if (A && !e) return A;
-		if (!j) try {
-			let e = await import("@node-saml/node-saml"), t = await L(), n = F();
-			return A = new e.SAML(R(t, n)), A;
+	}), q = async () => {
+		let e = !!t.idp.metadataUrl && v > 0 && Date.now() - F > v;
+		if (j && !e) return j;
+		if (M) return;
+		N = void 0;
+		let n;
+		try {
+			n = await import("@node-saml/node-saml");
 		} catch {
-			j = "SAML SSO requires the optional dependency @node-saml/node-saml — run `pnpm add @node-saml/node-saml`";
+			M = "SAML SSO requires the optional dependency @node-saml/node-saml — run `pnpm add @node-saml/node-saml`";
+			return;
+		}
+		try {
+			let e = await z(), t = L();
+			return j = new n.SAML(K(e, t)), j;
+		} catch (e) {
+			N = `@voltro/plugin-sso-saml: could not construct the SAML instance — ${String(e?.message ?? e)}`;
 			return;
 		}
-	}, G = (() => {
+	}, J = (() => {
 		try {
 			return new URL(`${r}/slo`, t.sp.acsUrl).toString();
 		} catch {
 			return;
 		}
-	})(), K = {
+	})(), Y = {
 		...t.sp,
 		authnRequestsSigned: !!t.privateKey,
 		...t.signingCert ? { signingCert: t.signingCert } : {},
-		...G ? { sloUrl: G } : {}
-	}, q = (e) => s(e.headers.cookie ?? e.headers.Cookie, u), J = () => [o(l, "", {
+		...J ? { sloUrl: J } : {}
+	}, X = (e) => c(e.headers.cookie ?? e.headers.Cookie, d), Z = () => [s(u, "", {
 		maxAgeSeconds: 0,
 		httpOnly: !0,
 		sameSite: "lax"
-	}), o(u, "", {
+	}), s(d, "", {
 		maxAgeSeconds: 0,
 		httpOnly: !0,
 		sameSite: "lax"
 	})];
 	return a({
-		name: g,
+		name: _,
+		baseName: G,
 		description: "SAML 2.0 SSO — SP-initiated login + Single Logout, ACS, metadata.",
-		permissions: E ? ["store:write"] : [],
+		permissions: D ? ["store:write"] : [],
 		httpRoutes: [{
 			method: "*",
 			path: r,
+			originGuard: "exempt",
 			handle: async (e) => {
 				let n = e.path.slice(r.length).replace(/\/+$/, ""), a = e.method.toUpperCase();
-				if (n === "/metadata" && a === "GET") return V(200, p(K), "application/xml");
-				let s = await W();
-				if (!s) return V(500, j ?? "SAML not available");
+				if (n === "/metadata" && a === "GET") return H(200, m(Y), "application/xml");
+				let o = await q();
+				if (!o) return H(500, M ?? N ?? "SAML not available");
 				if (n === "/login" && a === "GET") {
-					let t = B(new URLSearchParams(e.query).get("returnTo"), f);
-					return H(await s.getAuthorizeUrlAsync(t, void 0, {}));
+					let t = V(new URLSearchParams(e.query).get("returnTo"), p);
+					return U(await o.getAuthorizeUrlAsync(t, void 0, {}));
 				}
 				if (n === "/acs" && a === "POST") {
-					let n = new URLSearchParams(new TextDecoder().decode(e.rawBody)), r = n.get("SAMLResponse"), a = B(n.get("RelayState"), f);
-					if (!r) return V(400, "missing SAMLResponse");
-					let p;
+					let n = new URLSearchParams(new TextDecoder().decode(e.rawBody)), r = n.get("SAMLResponse"), a = V(n.get("RelayState"), p);
+					if (!r) return H(400, "missing SAMLResponse");
+					let c;
 					try {
-						({profile: p} = await s.validatePostResponseAsync({ SAMLResponse: r }));
+						({profile: c} = await o.validatePostResponseAsync({ SAMLResponse: r }));
 					} catch (e) {
-						return V(401, `SAML assertion rejected: ${String(e?.message ?? e)}`);
+						return H(401, `SAML assertion rejected: ${String(e?.message ?? e)}`);
 					}
-					if (!p) return V(401, "no SAML profile");
-					let m = await t.onLogin(h(p));
-					if (!m) return V(403, "login rejected");
-					let g = c(m, t.sessionSecret, { ttlSeconds: d }), _ = o(l, g, {
-						maxAgeSeconds: d,
+					if (!c) return H(401, "no SAML profile");
+					let m = await t.onLogin(g(c));
+					if (!m) return H(403, "login rejected");
+					let h = l(m, t.sessionSecret, { ttlSeconds: f }), _ = s(u, h, {
+						maxAgeSeconds: f,
 						httpOnly: !0,
 						sameSite: "lax"
-					}), v = String(p.nameID ?? p.nameId ?? ""), y = [_];
+					}), v = String(c.nameID ?? c.nameId ?? ""), y = [_];
 					if (v) {
 						let e = i(24).toString("base64url");
-						await I().save({
+						await R().save({
 							sloKey: e,
 							nameId: v,
-							...p.nameIDFormat ? { nameIdFormat: String(p.nameIDFormat) } : {},
-							...p.sessionIndex ? { sessionIndex: String(p.sessionIndex) } : {}
-						}), y.push(o(u, e, {
-							maxAgeSeconds: d,
+							...c.nameIDFormat ? { nameIdFormat: String(c.nameIDFormat) } : {},
+							...c.sessionIndex ? { sessionIndex: String(c.sessionIndex) } : {}
+						}), y.push(s(d, e, {
+							maxAgeSeconds: f,
 							httpOnly: !0,
 							sameSite: "lax"
 						}));
 					}
-					return H(a, y);
+					return U(a, y);
 				}
 				if (n === "/logout" && a === "GET") {
-					let t = B(new URLSearchParams(e.query).get("returnTo"), m), n = q(e), r = n ? await I().load(n) : null;
-					if (!r) return H(t, J());
+					let t = V(new URLSearchParams(e.query).get("returnTo"), h), n = X(e), r = n ? await R().load(n) : null;
+					if (!r) return U(t, Z());
 					let i = {
 						nameID: r.nameId,
 						...r.nameIdFormat ? { nameIDFormat: r.nameIdFormat } : {},
 						...r.sessionIndex ? { sessionIndex: r.sessionIndex } : {}
 					}, a;
 					try {
-						a = await s.getLogoutUrlAsync(i, t, {});
+						a = await o.getLogoutUrlAsync(i, t, {});
 					} catch (e) {
-						return V(500, `SAML logout request failed: ${String(e?.message ?? e)}`);
+						return H(500, `SAML logout request failed: ${String(e?.message ?? e)}`);
 					}
-					return n && await I().remove(n), H(a, J());
+					return n && await R().remove(n), U(a, Z());
 				}
 				if (n === "/slo" && (a === "GET" || a === "POST")) {
 					let t = a === "GET" ? e.query : new TextDecoder().decode(e.rawBody), n = new URLSearchParams(t), r = {};
 					for (let [e, t] of n) r[e] = t;
-					let i = B(n.get("RelayState"), m), o;
+					let i = V(n.get("RelayState"), h);
+					if (!n.has("Signature")) return H(401, "SAML logout rejected: the logout message is not signed");
+					let s;
 					try {
-						o = await s.validateRedirectAsync(r, t);
+						s = await o.validateRedirectAsync(r, t);
 					} catch (e) {
-						return V(401, `SAML logout rejected: ${String(e?.message ?? e)}`);
+						return H(401, `SAML logout rejected: ${String(e?.message ?? e)}`);
 					}
-					if (n.has("SAMLResponse")) return H(i, J());
-					let c = q(e);
-					c && await I().remove(c);
+					if (n.has("SAMLResponse")) return U(i, Z());
+					let c = X(e);
+					c && await R().remove(c);
 					try {
-						return H(await s.getLogoutResponseUrlAsync(o.profile ?? {}, i, {}, !0), J());
+						return U(await o.getLogoutResponseUrlAsync(s.profile ?? {}, i, {}, !0), Z());
 					} catch {
-						return H(i, J());
+						return U(i, Z());
 					}
 				}
-				return V(404, "unknown SAML endpoint");
+				return H(404, "unknown SAML endpoint");
 			}
 		}],
-		...E ? { extendSchema: { tables: [...S ? v : [], ...T ? w : []] } } : {},
+		...D ? { extendSchema: { tables: [...C ? y : [], ...E ? T : []] } } : {},
 		bindDataStore: (e) => {
-			k = e;
+			A = e;
 		},
 		onActivate: (n) => e.sync(() => {
 			n.logger.info("saml sso active", {
 				basePath: r,
 				entityId: t.sp.entityId,
 				idpSource: t.idp.metadataUrl ? "metadata-url" : "static",
-				replayProtection: y ? S ? "store" : "memory" : "off",
-				sloStore: T ? "store" : "memory",
+				replayProtection: b ? C ? "store" : "memory" : "off",
+				sloStore: E ? "store" : "memory",
 				requestSigning: t.privateKey ? "on" : "off",
-				encryptedAssertions: t.decryptionPvk ? "on" : "off"
-			}), y && !S && n.logger.warn("saml sso: replayProtection uses an IN-PROCESS cache — correct for ONE replica only. Under >1 replica a login and its ACS can land on different processes (InResponseTo fails) and a cross-replica replay is not caught. Use replayProtection: { store: true } in production."), T || n.logger.warn("saml sso: SLO state uses an IN-PROCESS store — correct for ONE replica only. Under >1 replica a login and its logout can land on different processes. Use sloStore: { store: true } in production.");
+				encryptedAssertions: t.decryptionPvk ? "on" : "off",
+				wantAssertionsSigned: "required",
+				wantAuthnResponseSigned: t.wantAuthnResponseSigned ?? !1 ? "required" : "optional"
+			}), b && !C && n.logger.warn("saml sso: replayProtection uses an IN-PROCESS cache — correct for ONE replica only. Under >1 replica a login and its ACS can land on different processes (InResponseTo fails) and a cross-replica replay is not caught. Use replayProtection: { store: true } in production."), b || n.logger.warn("saml sso: replayProtection is OFF — a captured SAMLResponse can be replayed for as long as its assertion is valid. This also ENABLES IdP-initiated SSO (the app-tile flow), which is the only reason to turn it off. If you did not mean to accept unsolicited responses, remove `replayProtection: false`."), E || n.logger.warn("saml sso: SLO state uses an IN-PROCESS store — correct for ONE replica only. Under >1 replica a login and its logout can land on different processes. Use sloStore: { store: true } in production.");
 		})
 	});
 };
 //#endregion
-export { S as LOGOUT_SESSION_TABLE, g as REPLAY_CACHE_TABLE, k as SamlMetadataFetchError, A as SamlMetadataParseError, D as dataStoreLogoutStore, b as dataStoreReplayCache, h as extractProfile, z as fetchIdpMetadata, O as memoryLogoutStore, x as memoryReplayCache, R as parseIdpMetadata, C as samlLogoutTable, w as samlLogoutTables, _ as samlReplayTable, v as samlReplayTables, W as samlSsoPlugin, p as spMetadataXml };
+export { C as LOGOUT_SESSION_TABLE, _ as REPLAY_CACHE_TABLE, A as SamlMetadataFetchError, j as SamlMetadataParseError, O as dataStoreLogoutStore, x as dataStoreReplayCache, g as extractProfile, B as fetchIdpMetadata, k as memoryLogoutStore, S as memoryReplayCache, z as parseIdpMetadata, w as samlLogoutTable, T as samlLogoutTables, v as samlReplayTable, y as samlReplayTables, K as samlSsoPlugin, m as spMetadataXml };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-sso-saml",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Enterprise SAML 2.0 SSO — SP-initiated login, ACS assertion consumer, and SP metadata. Signature verification via @node-saml/node-saml (optional, lazy); the framework integration (routes, session minting, attribute mapping) is built in.",
   "keywords": [
     "voltro",
@@ -22,7 +22,8 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -33,8 +34,8 @@
   },
   "dependencies": {
     "@effect/platform": "^0.97.0",
-    "@voltro/database": "0.32.0",
-    "@voltro/protocol": "0.32.0"
+    "@voltro/database": "0.34.0",
+    "@voltro/protocol": "0.34.0"
   },
   "optionalDependencies": {
     "@node-saml/node-saml": "^5.0.0"