@voltro/plugin-sso-saml 0.85.0 → 0.86.0

package/dist/index.js

@@ -1,463 +1,230 @@
-import { Effect as e, Schema as t } from "effect";
-import { FetchHttpClient as n, HttpClient as r } from "effect/http";
-import { randomBytes as i } from "node:crypto";
-import { definePlugin as a, pluginInstanceName as o } from "@voltro/protocol";
-import { buildSetCookie as s, readCookie as c, signSession as l } from "@voltro/protocol/session";
-import { id as u, table as d, text as f } from "@voltro/database";
-//#region src/saml.ts
-var p = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/g, ""), m = (e) => {
-	let t = e.signingCert ? `
-    <KeyDescriptor use="signing">
-      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
-        <X509Data><X509Certificate>${h(p(e.signingCert))}</X509Certificate></X509Data>
-      </KeyInfo>
-    </KeyDescriptor>` : "", n = e.sloUrl ? `
-    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="${h(e.sloUrl)}"/>` : "";
-	return `<?xml version="1.0"?>
-<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${h(e.entityId)}">
-  <SPSSODescriptor AuthnRequestsSigned="${e.authnRequestsSigned ? "true" : "false"}" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">${t}${n}
-    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress</NameIDFormat>
-    <AssertionConsumerService index="0" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${h(e.acsUrl)}"/>
-  </SPSSODescriptor>
-</EntityDescriptor>`;
-}, h = (e) => e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;"), g = (e) => {
-	let t = e.attributes ?? {}, n = (...n) => {
-		for (let r of n) {
-			let n = e[r] ?? t[r];
-			if (typeof n == "string" && n.length > 0) return n;
-			if (Array.isArray(n) && typeof n[0] == "string") return n[0];
-		}
-		return null;
-	}, r = String(e.nameID ?? e.nameId ?? n("nameID") ?? "");
-	return {
-		nameId: r,
-		email: n("email", "mail", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress") ?? (r.includes("@") ? r : null),
-		displayName: n("displayName", "name", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", "cn"),
-		attributes: t
-	};
-}, _ = "_voltro_saml_replay", v = d(_, {
-	id: u({ prefix: "samlrq" }),
-	requestId: f().unique(),
-	instant: f(),
-	createdAtMs: f()
-}).index("bySamlRequestId", ["requestId"]), y = [v], b = (e, t) => ({
-	kind: "binary",
-	op: "eq",
-	column: e,
-	value: t
-}), x = (e, t = 6e5) => {
-	let n = async (t) => (await e.query({
-		table: _,
-		predicate: b("requestId", t),
-		order: [{
-			column: "id",
-			direction: "asc"
-		}],
-		take: 1,
-		skip: void 0,
-		projection: void 0
-	}))[0], r = (e, n) => {
-		let r = Number(e.createdAtMs);
-		return Number.isFinite(r) && n - r > t;
-	};
-	return {
-		saveAsync: async (t, n) => {
-			let r = Date.now();
-			try {
-				return await e.insert(_, {
-					requestId: t,
-					instant: n,
-					createdAtMs: String(r)
-				}), {
-					value: n,
-					createdAt: r
-				};
-			} catch {
-				return null;
-			}
-		},
-		getAsync: async (t) => {
-			let i = await n(t);
-			return i ? r(i, Date.now()) ? (await e.delete(_, String(i.id)).catch(() => void 0), null) : String(i.instant) : null;
-		},
-		removeAsync: async (t) => {
-			if (t == null) return null;
-			let r = await n(t);
-			return r ? (await e.delete(_, String(r.id)).catch(() => void 0), t) : null;
-		}
-	};
-}, S = (e = 6e5) => {
-	let t = /* @__PURE__ */ new Map();
-	return {
-		saveAsync: async (e, n) => {
-			if (t.has(e)) return null;
-			let r = {
-				value: n,
-				createdAt: Date.now()
-			};
-			return t.set(e, r), r;
-		},
-		getAsync: async (n) => {
-			let r = t.get(n);
-			return r ? Date.now() - r.createdAt > e ? (t.delete(n), null) : r.value : null;
-		},
-		removeAsync: async (e) => e == null || !t.has(e) ? null : (t.delete(e), e)
-	};
-}, C = "_voltro_saml_logout", w = d(C, {
-	id: u({ prefix: "samllo" }),
-	sloKey: f().unique(),
-	nameId: f(),
-	nameIdFormat: f(),
-	sessionIndex: f(),
-	createdAtMs: f()
-}).index("bySamlSloKey", ["sloKey"]), T = [w], E = (e, t) => ({
-	kind: "binary",
-	op: "eq",
-	column: e,
-	value: t
-}), D = (e) => ({
-	nameId: String(e.nameId ?? ""),
-	...e.nameIdFormat ? { nameIdFormat: String(e.nameIdFormat) } : {},
-	...e.sessionIndex ? { sessionIndex: String(e.sessionIndex) } : {}
-}), O = (e, t = 6048e5) => {
-	let n = async (t) => (await e.query({
-		table: C,
-		predicate: E("sloKey", t),
-		order: [{
-			column: "id",
-			direction: "asc"
-		}],
-		take: 1,
-		skip: void 0,
-		projection: void 0
-	}))[0], r = (e, n) => {
-		let r = Number(e.createdAtMs);
-		return Number.isFinite(r) && n - r > t;
-	}, i = async (t) => {
-		await e.delete(C, String(t.id)).catch(() => void 0);
-	};
-	return {
-		save: async (t) => {
-			let r = await n(t.sloKey);
-			r && await i(r), await e.insert(C, {
-				sloKey: t.sloKey,
-				nameId: t.nameId,
-				nameIdFormat: t.nameIdFormat ?? "",
-				sessionIndex: t.sessionIndex ?? "",
-				createdAtMs: String(Date.now())
-			});
-		},
-		load: async (e) => {
-			let t = await n(e);
-			return t ? r(t, Date.now()) ? (await i(t), null) : D(t) : null;
-		},
-		remove: async (e) => {
-			let t = await n(e);
-			t && await i(t);
-		}
-	};
-}, k = (e = 6048e5) => {
-	let t = /* @__PURE__ */ new Map();
-	return {
-		save: async (e) => {
-			t.set(e.sloKey, {
-				subject: {
-					nameId: e.nameId,
-					...e.nameIdFormat ? { nameIdFormat: e.nameIdFormat } : {},
-					...e.sessionIndex ? { sessionIndex: e.sessionIndex } : {}
-				},
-				createdAt: Date.now()
-			});
-		},
-		load: async (n) => {
-			let r = t.get(n);
-			return r ? Date.now() - r.createdAt > e ? (t.delete(n), null) : r.subject : null;
-		},
-		remove: async (e) => {
-			t.delete(e);
-		}
-	};
-}, A = class extends t.TaggedError()("SamlMetadataFetchError", {
-	url: t.String,
-	reason: t.String
-}) {}, j = class extends t.TaggedError()("SamlMetadataParseError", {
-	url: t.String,
-	reason: t.String
-}) {}, M = "urn:oasis:names:tc:SAML:2.0:metadata", N = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", P = (e) => e.slice(e.indexOf(":") + 1), F = (e, t) => (RegExp(`\\b${t}\\s*=\\s*"([^"]*)"`).exec(e) ?? RegExp(`\\b${t}\\s*=\\s*'([^']*)'`).exec(e))?.[1], I = (e, t) => {
-	let n = [], r = /<([A-Za-z][\w.:-]*)\b([^>]*)>/g, i;
-	for (; (i = r.exec(e)) !== null;) P(i[1]) === t && n.push(i[0]);
-	return n;
-}, L = (e) => {
-	let t = [], n = /<([A-Za-z][\w.:-]*KeyDescriptor)\b([^>]*)>/g, r;
-	for (; (r = n.exec(e)) !== null;) {
-		if (P(r[1]) !== "KeyDescriptor") continue;
-		let n = RegExp(`</${r[1].replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}>`), i = e.slice(r.index + r[0].length), a = n.exec(i), o = a ? i.slice(0, a.index) : i;
-		t.push({
-			use: F(r[0], "use"),
-			body: o
-		});
-	}
-	return t;
-}, R = (e) => {
-	let t = L(e), n = t.find((e) => e.use === "signing") ?? t.find((e) => e.use === void 0) ?? t[0];
-	if (!n) return;
-	let r = /<[^>]*X509Certificate[^>]*>([\s\S]*?)<\/[^>]*X509Certificate>/.exec(n.body)?.[1]?.replace(/\s+/g, "");
-	return r && r.length > 0 ? r : void 0;
-}, z = (t, n) => e.gen(function* () {
-	if (!t.includes(M) && !/EntityDescriptor/.test(t)) return yield* e.fail(new j({
-		url: n,
-		reason: "not-saml-metadata"
-	}));
-	let r = I(t, "SingleSignOnService"), i = r.find((e) => F(e, "Binding") === N) ?? r[0], a = i ? F(i, "Location") : void 0;
-	if (!a) return yield* e.fail(new j({
-		url: n,
-		reason: "no-entryPoint"
-	}));
-	let o = R(t);
-	if (!o) return yield* e.fail(new j({
-		url: n,
-		reason: "no-signing-cert"
-	}));
-	let s = I(t, "SingleLogoutService"), c = s.find((e) => F(e, "Binding") === N) ?? s[0], l = c ? F(c, "Location") : void 0, u = I(t, "EntityDescriptor")[0], d = u ? F(u, "entityID") : void 0;
-	return {
-		entryPoint: a,
-		idpCert: o,
-		...l ? { logoutUrl: l } : {},
-		...d ? { issuer: d } : {}
-	};
-}), B = (t) => e.gen(function* () {
-	let n = yield* (yield* r.HttpClient).get(t).pipe(e.mapError(() => new A({
-		url: t,
-		reason: "network"
-	})));
-	if (n.status < 200 || n.status >= 300) return yield* e.fail(new A({
-		url: t,
-		reason: `status ${n.status}`
-	}));
-	let i = yield* n.text.pipe(e.mapError(() => new A({
-		url: t,
-		reason: "body"
-	})));
-	return i.trim() ? yield* z(i, t) : yield* e.fail(new A({
-		url: t,
-		reason: "empty-body"
-	}));
-}), V = (e, t) => typeof e != "string" || e[0] !== "/" || /[\u0000-]/.test(e) ? t : e === "/" ? e : e[1] === "/" || e[1] === "\\" ? t : e, H = (e, t, n = "text/plain") => ({
+import { extractProfile as e, spMetadataXml as t } from "./saml.js";
+import { REPLAY_CACHE_TABLE as n, dataStoreReplayCache as r, memoryReplayCache as i, samlReplayTable as a, samlReplayTables as o } from "./saml-cache.js";
+import { LOGOUT_SESSION_TABLE as s, dataStoreLogoutStore as c, memoryLogoutStore as l, samlLogoutTable as u, samlLogoutTables as d } from "./saml-logout.js";
+import { SamlMetadataFetchError as f, SamlMetadataParseError as p } from "./saml-errors.js";
+import { fetchIdpMetadata as m, parseIdpMetadata as h } from "./saml-metadata.js";
+import { Effect as g } from "effect";
+import { FetchHttpClient as _ } from "effect/http";
+import { randomBytes as v } from "node:crypto";
+import { definePlugin as y, pluginInstanceName as b } from "@voltro/protocol";
+import { buildSetCookie as x, readCookie as S, signSession as C } from "@voltro/protocol/session";
+//#region src/index.ts
+var w = (e, t) => typeof e != "string" || e[0] !== "/" || /[\u0000-]/.test(e) ? t : e === "/" ? e : e[1] === "/" || e[1] === "\\" ? t : e, T = (e, t, n = "text/plain") => ({
 	status: e,
 	body: t,
 	contentType: n
-}), U = (e, t) => {
+}), E = (e, t) => {
 	let n = { location: e };
 	return t !== void 0 && t.length > 0 && (n["set-cookie"] = t), {
 		status: 302,
 		headers: n
 	};
-}, W = ":slo", G = "@voltro/plugin-sso-saml", K = (t) => {
-	if (!t.sessionSecret?.trim()) throw Error("@voltro/plugin-sso-saml: `sessionSecret` must be a non-empty string");
-	if (!t.idp.metadataUrl && (!t.idp.entryPoint || !t.idp.idpCert)) throw Error("@voltro/plugin-sso-saml: provide idp.entryPoint + idp.idpCert, or idp.metadataUrl to load them from the IdP metadata");
-	let r = t.basePath ?? "/saml", u = t.cookieName ?? "voltro:session", d = `${u}${W}`, f = t.sessionTtlSeconds ?? 604800, p = t.successRedirect ?? "/", h = t.logoutRedirect ?? "/", _ = o({
-		base: G,
-		alias: t.alias,
-		instance: t.name
-	}), v = t.idp.metadataRefreshMs ?? 432e5, b = t.replayProtection ?? { store: !0 }, C = typeof b == "object" && b.store === !0, w = typeof b == "object" ? b.ttlMs ?? 6e5 : 6e5, E = typeof t.sloStore == "object" && t.sloStore.store === !0, D = C || E, A, j, M, N, P, F = 0, I, L = () => {
-		if (b) {
-			if (C) {
-				if (!A) throw Error("@voltro/plugin-sso-saml: replayProtection { store: true } but the DataStore is not bound yet");
-				return x(A, w);
+}, D = ":slo", O = "@voltro/plugin-sso-saml", k = (n) => {
+	if (!n.sessionSecret?.trim()) throw Error("@voltro/plugin-sso-saml: `sessionSecret` must be a non-empty string");
+	if (!n.idp.metadataUrl && (!n.idp.entryPoint || !n.idp.idpCert)) throw Error("@voltro/plugin-sso-saml: provide idp.entryPoint + idp.idpCert, or idp.metadataUrl to load them from the IdP metadata");
+	let a = n.basePath ?? "/saml", s = n.cookieName ?? "voltro:session", u = `${s}${D}`, f = n.sessionTtlSeconds ?? 604800, p = n.successRedirect ?? "/", h = n.logoutRedirect ?? "/", k = b({
+		base: O,
+		alias: n.alias,
+		instance: n.name
+	}), A = n.idp.metadataRefreshMs ?? 432e5, j = n.replayProtection ?? { store: !0 }, M = typeof j == "object" && j.store === !0, N = typeof j == "object" ? j.ttlMs ?? 6e5 : 6e5, P = typeof n.sloStore == "object" && n.sloStore.store === !0, F = M || P, I, L, R, z, B, V = 0, H, U = () => {
+		if (j) {
+			if (M) {
+				if (!I) throw Error("@voltro/plugin-sso-saml: replayProtection { store: true } but the DataStore is not bound yet");
+				return r(I, N);
 			}
-			return S(w);
+			return i(N);
 		}
-	}, R = () => {
-		if (I) return I;
-		if (E) {
-			if (!A) throw Error("@voltro/plugin-sso-saml: sloStore { store: true } but the DataStore is not bound yet");
-			I = O(A, f * 1e3);
-		} else I = k(f * 1e3);
-		return I;
-	}, z = async () => {
-		let r = t.idp.metadataUrl;
-		if (r) {
-			let i = v > 0 && Date.now() - F > v;
-			if (!P || i) {
-				let t = await e.runPromiseExit(B(r).pipe(e.provide(n.layer)));
-				t._tag === "Success" && (P = t.value, F = Date.now());
+	}, W = () => {
+		if (H) return H;
+		if (P) {
+			if (!I) throw Error("@voltro/plugin-sso-saml: sloStore { store: true } but the DataStore is not bound yet");
+			H = c(I, f * 1e3);
+		} else H = l(f * 1e3);
+		return H;
+	}, G = async () => {
+		let e = n.idp.metadataUrl;
+		if (e) {
+			let t = A > 0 && Date.now() - V > A;
+			if (!B || t) {
+				let t = await g.runPromiseExit(m(e).pipe(g.provide(_.layer)));
+				t._tag === "Success" && (B = t.value, V = Date.now());
 			}
-			if (P) return {
-				entryPoint: P.entryPoint,
-				idpCert: P.idpCert,
-				...t.idp.logoutUrl ?? P.logoutUrl ? { logoutUrl: t.idp.logoutUrl ?? P.logoutUrl } : {},
-				...t.idp.issuer ?? P.issuer ? { idpIssuer: t.idp.issuer ?? P.issuer } : {}
+			if (B) return {
+				entryPoint: B.entryPoint,
+				idpCert: B.idpCert,
+				...n.idp.logoutUrl ?? B.logoutUrl ? { logoutUrl: n.idp.logoutUrl ?? B.logoutUrl } : {},
+				...n.idp.issuer ?? B.issuer ? { idpIssuer: n.idp.issuer ?? B.issuer } : {}
 			};
 		}
 		return {
-			entryPoint: t.idp.entryPoint,
-			idpCert: t.idp.idpCert,
-			...t.idp.logoutUrl ? { logoutUrl: t.idp.logoutUrl } : {},
-			...t.idp.issuer ? { idpIssuer: t.idp.issuer } : {}
+			entryPoint: n.idp.entryPoint,
+			idpCert: n.idp.idpCert,
+			...n.idp.logoutUrl ? { logoutUrl: n.idp.logoutUrl } : {},
+			...n.idp.issuer ? { idpIssuer: n.idp.issuer } : {}
 		};
-	}, K = (e, n) => ({
-		callbackUrl: t.sp.acsUrl,
+	}, K = (e, t) => ({
+		callbackUrl: n.sp.acsUrl,
 		entryPoint: e.entryPoint,
-		issuer: t.sp.entityId,
+		issuer: n.sp.entityId,
 		idpCert: e.idpCert,
 		...e.idpIssuer ? { idpIssuer: e.idpIssuer } : {},
 		...e.logoutUrl ? { logoutUrl: e.logoutUrl } : {},
 		wantAssertionsSigned: !0,
-		wantAuthnResponseSigned: t.wantAuthnResponseSigned ?? !1,
-		...t.decryptionPvk ? { decryptionPvk: t.decryptionPvk } : {},
-		...t.privateKey ? { privateKey: t.privateKey } : {},
-		...t.signingCert ? { publicCert: t.signingCert } : {},
-		...t.acceptedClockSkewMs === void 0 ? {} : { acceptedClockSkewMs: t.acceptedClockSkewMs },
-		...n ? {
+		wantAuthnResponseSigned: n.wantAuthnResponseSigned ?? !1,
+		...n.decryptionPvk ? { decryptionPvk: n.decryptionPvk } : {},
+		...n.privateKey ? { privateKey: n.privateKey } : {},
+		...n.signingCert ? { publicCert: n.signingCert } : {},
+		...n.acceptedClockSkewMs === void 0 ? {} : { acceptedClockSkewMs: n.acceptedClockSkewMs },
+		...t ? {
 			validateInResponseTo: "always",
-			cacheProvider: n,
-			requestIdExpirationPeriodMs: w
+			cacheProvider: t,
+			requestIdExpirationPeriodMs: N
 		} : {}
 	}), q = async () => {
-		let e = !!t.idp.metadataUrl && v > 0 && Date.now() - F > v;
-		if (j && !e) return j;
-		if (M) return;
-		N = void 0;
-		let n;
+		let e = !!n.idp.metadataUrl && A > 0 && Date.now() - V > A;
+		if (L && !e) return L;
+		if (R) return;
+		z = void 0;
+		let t;
 		try {
-			n = await import("@node-saml/node-saml");
+			t = await import("@node-saml/node-saml");
 		} catch {
-			M = "SAML SSO requires the optional dependency @node-saml/node-saml — run `pnpm add @node-saml/node-saml`";
+			R = "SAML SSO requires the optional dependency @node-saml/node-saml — run `pnpm add @node-saml/node-saml`";
 			return;
 		}
 		try {
-			let e = await z(), t = L();
-			return j = new n.SAML(K(e, t)), j;
+			let e = await G(), n = U();
+			return L = new t.SAML(K(e, n)), L;
 		} catch (e) {
-			N = `@voltro/plugin-sso-saml: could not construct the SAML instance — ${String(e?.message ?? e)}`;
+			z = `@voltro/plugin-sso-saml: could not construct the SAML instance — ${String(e?.message ?? e)}`;
 			return;
 		}
 	}, J = (() => {
 		try {
-			return new URL(`${r}/slo`, t.sp.acsUrl).toString();
+			return new URL(`${a}/slo`, n.sp.acsUrl).toString();
 		} catch {
 			return;
 		}
 	})(), Y = {
-		...t.sp,
-		authnRequestsSigned: !!t.privateKey,
-		...t.signingCert ? { signingCert: t.signingCert } : {},
+		...n.sp,
+		authnRequestsSigned: !!n.privateKey,
+		...n.signingCert ? { signingCert: n.signingCert } : {},
 		...J ? { sloUrl: J } : {}
-	}, X = (e) => c(e.headers.cookie ?? e.headers.Cookie, d), Z = () => [s(u, "", {
+	}, X = (e) => S(e.headers.cookie ?? e.headers.Cookie, u), Z = () => [x(s, "", {
 		maxAgeSeconds: 0,
 		httpOnly: !0,
 		sameSite: "lax"
-	}), s(d, "", {
+	}), x(u, "", {
 		maxAgeSeconds: 0,
 		httpOnly: !0,
 		sameSite: "lax"
 	})];
-	return a({
-		name: _,
-		baseName: G,
+	return y({
+		name: k,
+		baseName: O,
 		description: "SAML 2.0 SSO — SP-initiated login + Single Logout, ACS, metadata.",
-		permissions: D ? ["store:write"] : [],
+		permissions: F ? ["store:write"] : [],
 		httpRoutes: [{
 			method: "*",
-			path: r,
+			path: a,
 			originGuard: "exempt",
-			handle: async (e) => {
-				let n = e.path.slice(r.length).replace(/\/+$/, ""), a = e.method.toUpperCase();
-				if (n === "/metadata" && a === "GET") return H(200, m(Y), "application/xml");
-				let o = await q();
-				if (!o) return H(500, M ?? N ?? "SAML not available");
-				if (n === "/login" && a === "GET") {
-					let t = V(new URLSearchParams(e.query).get("returnTo"), p);
-					return U(await o.getAuthorizeUrlAsync(t, void 0, {}));
+			handle: async (r) => {
+				let i = r.path.slice(a.length).replace(/\/+$/, ""), o = r.method.toUpperCase();
+				if (i === "/metadata" && o === "GET") return T(200, t(Y), "application/xml");
+				let c = await q();
+				if (!c) return T(500, R ?? z ?? "SAML not available");
+				if (i === "/login" && o === "GET") {
+					let e = w(new URLSearchParams(r.query).get("returnTo"), p);
+					return E(await c.getAuthorizeUrlAsync(e, void 0, {}));
 				}
-				if (n === "/acs" && a === "POST") {
-					let n = new URLSearchParams(new TextDecoder().decode(e.rawBody)), r = n.get("SAMLResponse"), a = V(n.get("RelayState"), p);
-					if (!r) return H(400, "missing SAMLResponse");
-					let c;
+				if (i === "/acs" && o === "POST") {
+					let t = new URLSearchParams(new TextDecoder().decode(r.rawBody)), i = t.get("SAMLResponse"), a = w(t.get("RelayState"), p);
+					if (!i) return T(400, "missing SAMLResponse");
+					let o;
 					try {
-						({profile: c} = await o.validatePostResponseAsync({ SAMLResponse: r }));
+						({profile: o} = await c.validatePostResponseAsync({ SAMLResponse: i }));
 					} catch (e) {
-						return H(401, `SAML assertion rejected: ${String(e?.message ?? e)}`);
+						return T(401, `SAML assertion rejected: ${String(e?.message ?? e)}`);
 					}
-					if (!c) return H(401, "no SAML profile");
-					let m = await t.onLogin(g(c));
-					if (!m) return H(403, "login rejected");
-					let h = l(m, t.sessionSecret, { ttlSeconds: f }), _ = s(u, h, {
+					if (!o) return T(401, "no SAML profile");
+					let l = await n.onLogin(e(o));
+					if (!l) return T(403, "login rejected");
+					let d = C(l, n.sessionSecret, { ttlSeconds: f }), m = x(s, d, {
 						maxAgeSeconds: f,
 						httpOnly: !0,
 						sameSite: "lax"
-					}), v = String(c.nameID ?? c.nameId ?? ""), y = [_];
-					if (v) {
-						let e = i(24).toString("base64url");
-						await R().save({
+					}), h = String(o.nameID ?? o.nameId ?? ""), g = [m];
+					if (h) {
+						let e = v(24).toString("base64url");
+						await W().save({
 							sloKey: e,
-							nameId: v,
-							...c.nameIDFormat ? { nameIdFormat: String(c.nameIDFormat) } : {},
-							...c.sessionIndex ? { sessionIndex: String(c.sessionIndex) } : {}
-						}), y.push(s(d, e, {
+							nameId: h,
+							...o.nameIDFormat ? { nameIdFormat: String(o.nameIDFormat) } : {},
+							...o.sessionIndex ? { sessionIndex: String(o.sessionIndex) } : {}
+						}), g.push(x(u, e, {
 							maxAgeSeconds: f,
 							httpOnly: !0,
 							sameSite: "lax"
 						}));
 					}
-					return U(a, y);
+					return E(a, g);
 				}
-				if (n === "/logout" && a === "GET") {
-					let t = V(new URLSearchParams(e.query).get("returnTo"), h), n = X(e), r = n ? await R().load(n) : null;
-					if (!r) return U(t, Z());
+				if (i === "/logout" && o === "GET") {
+					let e = w(new URLSearchParams(r.query).get("returnTo"), h), t = X(r), n = t ? await W().load(t) : null;
+					if (!n) return E(e, Z());
 					let i = {
-						nameID: r.nameId,
-						...r.nameIdFormat ? { nameIDFormat: r.nameIdFormat } : {},
-						...r.sessionIndex ? { sessionIndex: r.sessionIndex } : {}
+						nameID: n.nameId,
+						...n.nameIdFormat ? { nameIDFormat: n.nameIdFormat } : {},
+						...n.sessionIndex ? { sessionIndex: n.sessionIndex } : {}
 					}, a;
 					try {
-						a = await o.getLogoutUrlAsync(i, t, {});
+						a = await c.getLogoutUrlAsync(i, e, {});
 					} catch (e) {
-						return H(500, `SAML logout request failed: ${String(e?.message ?? e)}`);
+						return T(500, `SAML logout request failed: ${String(e?.message ?? e)}`);
 					}
-					return n && await R().remove(n), U(a, Z());
+					return t && await W().remove(t), E(a, Z());
 				}
-				if (n === "/slo" && (a === "GET" || a === "POST")) {
-					let t = a === "GET" ? e.query : new TextDecoder().decode(e.rawBody), n = new URLSearchParams(t), r = {};
-					for (let [e, t] of n) r[e] = t;
-					let i = V(n.get("RelayState"), h);
-					if (!n.has("Signature")) return H(401, "SAML logout rejected: the logout message is not signed");
-					let s;
+				if (i === "/slo" && (o === "GET" || o === "POST")) {
+					let e = o === "GET" ? r.query : new TextDecoder().decode(r.rawBody), t = new URLSearchParams(e), n = {};
+					for (let [e, r] of t) n[e] = r;
+					let i = w(t.get("RelayState"), h);
+					if (!t.has("Signature")) return T(401, "SAML logout rejected: the logout message is not signed");
+					let a;
 					try {
-						s = await o.validateRedirectAsync(r, t);
+						a = await c.validateRedirectAsync(n, e);
 					} catch (e) {
-						return H(401, `SAML logout rejected: ${String(e?.message ?? e)}`);
+						return T(401, `SAML logout rejected: ${String(e?.message ?? e)}`);
 					}
-					if (n.has("SAMLResponse")) return U(i, Z());
-					let c = X(e);
-					c && await R().remove(c);
+					if (t.has("SAMLResponse")) return E(i, Z());
+					let s = X(r);
+					s && await W().remove(s);
 					try {
-						return U(await o.getLogoutResponseUrlAsync(s.profile ?? {}, i, {}, !0), Z());
+						return E(await c.getLogoutResponseUrlAsync(a.profile ?? {}, i, {}, !0), Z());
 					} catch {
-						return U(i, Z());
+						return E(i, Z());
 					}
 				}
-				return H(404, "unknown SAML endpoint");
+				return T(404, "unknown SAML endpoint");
 			}
 		}],
-		...D ? { extendSchema: { tables: [...C ? y : [], ...E ? T : []] } } : {},
+		...F ? { extendSchema: { tables: [...M ? o : [], ...P ? d : []] } } : {},
 		bindDataStore: (e) => {
-			A = e;
+			I = e;
 		},
-		onActivate: (n) => e.sync(() => {
-			n.logger.info("saml sso active", {
-				basePath: r,
-				entityId: t.sp.entityId,
-				idpSource: t.idp.metadataUrl ? "metadata-url" : "static",
-				replayProtection: b ? C ? "store" : "memory" : "off",
-				sloStore: E ? "store" : "memory",
-				requestSigning: t.privateKey ? "on" : "off",
-				encryptedAssertions: t.decryptionPvk ? "on" : "off",
+		onActivate: (e) => g.sync(() => {
+			e.logger.info("saml sso active", {
+				basePath: a,
+				entityId: n.sp.entityId,
+				idpSource: n.idp.metadataUrl ? "metadata-url" : "static",
+				replayProtection: j ? M ? "store" : "memory" : "off",
+				sloStore: P ? "store" : "memory",
+				requestSigning: n.privateKey ? "on" : "off",
+				encryptedAssertions: n.decryptionPvk ? "on" : "off",
 				wantAssertionsSigned: "required",
-				wantAuthnResponseSigned: t.wantAuthnResponseSigned ?? !1 ? "required" : "optional"
-			}), b && !C && n.logger.warn("saml sso: replayProtection uses an IN-PROCESS cache — correct for ONE replica only. Under >1 replica a login and its ACS can land on different processes (InResponseTo fails) and a cross-replica replay is not caught. Use replayProtection: { store: true } in production."), b || n.logger.warn("saml sso: replayProtection is OFF — a captured SAMLResponse can be replayed for as long as its assertion is valid. This also ENABLES IdP-initiated SSO (the app-tile flow), which is the only reason to turn it off. If you did not mean to accept unsolicited responses, remove `replayProtection: false`."), E || n.logger.warn("saml sso: SLO state uses an IN-PROCESS store — correct for ONE replica only. Under >1 replica a login and its logout can land on different processes. Use sloStore: { store: true } in production.");
+				wantAuthnResponseSigned: n.wantAuthnResponseSigned ?? !1 ? "required" : "optional"
+			}), j && !M && e.logger.warn("saml sso: replayProtection uses an IN-PROCESS cache — correct for ONE replica only. Under >1 replica a login and its ACS can land on different processes (InResponseTo fails) and a cross-replica replay is not caught. Use replayProtection: { store: true } in production."), j || e.logger.warn("saml sso: replayProtection is OFF — a captured SAMLResponse can be replayed for as long as its assertion is valid. This also ENABLES IdP-initiated SSO (the app-tile flow), which is the only reason to turn it off. If you did not mean to accept unsolicited responses, remove `replayProtection: false`."), P || e.logger.warn("saml sso: SLO state uses an IN-PROCESS store — correct for ONE replica only. Under >1 replica a login and its logout can land on different processes. Use sloStore: { store: true } in production.");
 		})
 	});
 };
 //#endregion
-export { C as LOGOUT_SESSION_TABLE, _ as REPLAY_CACHE_TABLE, A as SamlMetadataFetchError, j as SamlMetadataParseError, O as dataStoreLogoutStore, x as dataStoreReplayCache, g as extractProfile, B as fetchIdpMetadata, k as memoryLogoutStore, S as memoryReplayCache, z as parseIdpMetadata, w as samlLogoutTable, T as samlLogoutTables, v as samlReplayTable, y as samlReplayTables, K as samlSsoPlugin, m as spMetadataXml };
+export { s as LOGOUT_SESSION_TABLE, n as REPLAY_CACHE_TABLE, f as SamlMetadataFetchError, p as SamlMetadataParseError, c as dataStoreLogoutStore, r as dataStoreReplayCache, e as extractProfile, m as fetchIdpMetadata, l as memoryLogoutStore, i as memoryReplayCache, h as parseIdpMetadata, u as samlLogoutTable, d as samlLogoutTables, a as samlReplayTable, o as samlReplayTables, k as samlSsoPlugin, t as spMetadataXml };