@voltro/plugin-sso-saml 0.85.0 → 0.86.0

package/dist/saml-cache.js

@@ -0,0 +1,73 @@
+import { id as e, table as t, text as n } from "@voltro/database";
+//#region src/saml-cache.ts
+var r = "_voltro_saml_replay", i = t(r, {
+	id: e({ prefix: "samlrq" }),
+	requestId: n().unique(),
+	instant: n(),
+	createdAtMs: n()
+}).index("bySamlRequestId", ["requestId"]), a = [i], o = (e, t) => ({
+	kind: "binary",
+	op: "eq",
+	column: e,
+	value: t
+}), s = (e, t = 6e5) => {
+	let n = async (t) => (await e.query({
+		table: r,
+		predicate: o("requestId", t),
+		order: [{
+			column: "id",
+			direction: "asc"
+		}],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	}))[0], i = (e, n) => {
+		let r = Number(e.createdAtMs);
+		return Number.isFinite(r) && n - r > t;
+	};
+	return {
+		saveAsync: async (t, n) => {
+			let i = Date.now();
+			try {
+				return await e.insert(r, {
+					requestId: t,
+					instant: n,
+					createdAtMs: String(i)
+				}), {
+					value: n,
+					createdAt: i
+				};
+			} catch {
+				return null;
+			}
+		},
+		getAsync: async (t) => {
+			let a = await n(t);
+			return a ? i(a, Date.now()) ? (await e.delete(r, String(a.id)).catch(() => void 0), null) : String(a.instant) : null;
+		},
+		removeAsync: async (t) => {
+			if (t == null) return null;
+			let i = await n(t);
+			return i ? (await e.delete(r, String(i.id)).catch(() => void 0), t) : null;
+		}
+	};
+}, c = (e = 6e5) => {
+	let t = /* @__PURE__ */ new Map();
+	return {
+		saveAsync: async (e, n) => {
+			if (t.has(e)) return null;
+			let r = {
+				value: n,
+				createdAt: Date.now()
+			};
+			return t.set(e, r), r;
+		},
+		getAsync: async (n) => {
+			let r = t.get(n);
+			return r ? Date.now() - r.createdAt > e ? (t.delete(n), null) : r.value : null;
+		},
+		removeAsync: async (e) => e == null || !t.has(e) ? null : (t.delete(e), e)
+	};
+};
+//#endregion
+export { r as REPLAY_CACHE_TABLE, s as dataStoreReplayCache, c as memoryReplayCache, i as samlReplayTable, a as samlReplayTables };

package/dist/saml-errors.js

@@ -0,0 +1,11 @@
+import { Schema as e } from "effect";
+//#region src/saml-errors.ts
+var t = class extends e.TaggedError()("SamlMetadataFetchError", {
+	url: e.String,
+	reason: e.String
+}) {}, n = class extends e.TaggedError()("SamlMetadataParseError", {
+	url: e.String,
+	reason: e.String
+}) {};
+//#endregion
+export { t as SamlMetadataFetchError, n as SamlMetadataParseError };

package/dist/saml-logout.js

@@ -0,0 +1,79 @@
+import { id as e, table as t, text as n } from "@voltro/database";
+//#region src/saml-logout.ts
+var r = "_voltro_saml_logout", i = t(r, {
+	id: e({ prefix: "samllo" }),
+	sloKey: n().unique(),
+	nameId: n(),
+	nameIdFormat: n(),
+	sessionIndex: n(),
+	createdAtMs: n()
+}).index("bySamlSloKey", ["sloKey"]), a = [i], o = (e, t) => ({
+	kind: "binary",
+	op: "eq",
+	column: e,
+	value: t
+}), s = (e) => ({
+	nameId: String(e.nameId ?? ""),
+	...e.nameIdFormat ? { nameIdFormat: String(e.nameIdFormat) } : {},
+	...e.sessionIndex ? { sessionIndex: String(e.sessionIndex) } : {}
+}), c = (e, t = 6048e5) => {
+	let n = async (t) => (await e.query({
+		table: r,
+		predicate: o("sloKey", t),
+		order: [{
+			column: "id",
+			direction: "asc"
+		}],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	}))[0], i = (e, n) => {
+		let r = Number(e.createdAtMs);
+		return Number.isFinite(r) && n - r > t;
+	}, a = async (t) => {
+		await e.delete(r, String(t.id)).catch(() => void 0);
+	};
+	return {
+		save: async (t) => {
+			let i = await n(t.sloKey);
+			i && await a(i), await e.insert(r, {
+				sloKey: t.sloKey,
+				nameId: t.nameId,
+				nameIdFormat: t.nameIdFormat ?? "",
+				sessionIndex: t.sessionIndex ?? "",
+				createdAtMs: String(Date.now())
+			});
+		},
+		load: async (e) => {
+			let t = await n(e);
+			return t ? i(t, Date.now()) ? (await a(t), null) : s(t) : null;
+		},
+		remove: async (e) => {
+			let t = await n(e);
+			t && await a(t);
+		}
+	};
+}, l = (e = 6048e5) => {
+	let t = /* @__PURE__ */ new Map();
+	return {
+		save: async (e) => {
+			t.set(e.sloKey, {
+				subject: {
+					nameId: e.nameId,
+					...e.nameIdFormat ? { nameIdFormat: e.nameIdFormat } : {},
+					...e.sessionIndex ? { sessionIndex: e.sessionIndex } : {}
+				},
+				createdAt: Date.now()
+			});
+		},
+		load: async (n) => {
+			let r = t.get(n);
+			return r ? Date.now() - r.createdAt > e ? (t.delete(n), null) : r.subject : null;
+		},
+		remove: async (e) => {
+			t.delete(e);
+		}
+	};
+};
+//#endregion
+export { r as LOGOUT_SESSION_TABLE, c as dataStoreLogoutStore, l as memoryLogoutStore, i as samlLogoutTable, a as samlLogoutTables };

package/dist/saml-metadata.js

@@ -0,0 +1,66 @@
+import { SamlMetadataFetchError as e, SamlMetadataParseError as t } from "./saml-errors.js";
+import { Effect as n } from "effect";
+import { HttpClient as r } from "effect/http";
+//#region src/saml-metadata.ts
+var i = "urn:oasis:names:tc:SAML:2.0:metadata", a = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", o = (e) => e.slice(e.indexOf(":") + 1), s = (e, t) => (RegExp(`\\b${t}\\s*=\\s*"([^"]*)"`).exec(e) ?? RegExp(`\\b${t}\\s*=\\s*'([^']*)'`).exec(e))?.[1], c = (e, t) => {
+	let n = [], r = /<([A-Za-z][\w.:-]*)\b([^>]*)>/g, i;
+	for (; (i = r.exec(e)) !== null;) o(i[1]) === t && n.push(i[0]);
+	return n;
+}, l = (e) => {
+	let t = [], n = /<([A-Za-z][\w.:-]*KeyDescriptor)\b([^>]*)>/g, r;
+	for (; (r = n.exec(e)) !== null;) {
+		if (o(r[1]) !== "KeyDescriptor") continue;
+		let n = RegExp(`</${r[1].replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}>`), i = e.slice(r.index + r[0].length), a = n.exec(i), c = a ? i.slice(0, a.index) : i;
+		t.push({
+			use: s(r[0], "use"),
+			body: c
+		});
+	}
+	return t;
+}, u = (e) => {
+	let t = l(e), n = t.find((e) => e.use === "signing") ?? t.find((e) => e.use === void 0) ?? t[0];
+	if (!n) return;
+	let r = /<[^>]*X509Certificate[^>]*>([\s\S]*?)<\/[^>]*X509Certificate>/.exec(n.body)?.[1]?.replace(/\s+/g, "");
+	return r && r.length > 0 ? r : void 0;
+}, d = (e, r) => n.gen(function* () {
+	if (!e.includes(i) && !/EntityDescriptor/.test(e)) return yield* n.fail(new t({
+		url: r,
+		reason: "not-saml-metadata"
+	}));
+	let o = c(e, "SingleSignOnService"), l = o.find((e) => s(e, "Binding") === a) ?? o[0], d = l ? s(l, "Location") : void 0;
+	if (!d) return yield* n.fail(new t({
+		url: r,
+		reason: "no-entryPoint"
+	}));
+	let f = u(e);
+	if (!f) return yield* n.fail(new t({
+		url: r,
+		reason: "no-signing-cert"
+	}));
+	let p = c(e, "SingleLogoutService"), m = p.find((e) => s(e, "Binding") === a) ?? p[0], h = m ? s(m, "Location") : void 0, g = c(e, "EntityDescriptor")[0], _ = g ? s(g, "entityID") : void 0;
+	return {
+		entryPoint: d,
+		idpCert: f,
+		...h ? { logoutUrl: h } : {},
+		..._ ? { issuer: _ } : {}
+	};
+}), f = (t) => n.gen(function* () {
+	let i = yield* (yield* r.HttpClient).get(t).pipe(n.mapError(() => new e({
+		url: t,
+		reason: "network"
+	})));
+	if (i.status < 200 || i.status >= 300) return yield* n.fail(new e({
+		url: t,
+		reason: `status ${i.status}`
+	}));
+	let a = yield* i.text.pipe(n.mapError(() => new e({
+		url: t,
+		reason: "body"
+	})));
+	return a.trim() ? yield* d(a, t) : yield* n.fail(new e({
+		url: t,
+		reason: "empty-body"
+	}));
+});
+//#endregion
+export { f as fetchIdpMetadata, d as parseIdpMetadata };

package/dist/saml.js

@@ -0,0 +1,34 @@
+//#region src/saml.ts
+var e = (e) => e.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/g, ""), t = (t) => {
+	let r = t.signingCert ? `
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data><X509Certificate>${n(e(t.signingCert))}</X509Certificate></X509Data>
+      </KeyInfo>
+    </KeyDescriptor>` : "", i = t.sloUrl ? `
+    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="${n(t.sloUrl)}"/>` : "";
+	return `<?xml version="1.0"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${n(t.entityId)}">
+  <SPSSODescriptor AuthnRequestsSigned="${t.authnRequestsSigned ? "true" : "false"}" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">${r}${i}
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress</NameIDFormat>
+    <AssertionConsumerService index="0" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${n(t.acsUrl)}"/>
+  </SPSSODescriptor>
+</EntityDescriptor>`;
+}, n = (e) => e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;"), r = (e) => {
+	let t = e.attributes ?? {}, n = (...n) => {
+		for (let r of n) {
+			let n = e[r] ?? t[r];
+			if (typeof n == "string" && n.length > 0) return n;
+			if (Array.isArray(n) && typeof n[0] == "string") return n[0];
+		}
+		return null;
+	}, r = String(e.nameID ?? e.nameId ?? n("nameID") ?? "");
+	return {
+		nameId: r,
+		email: n("email", "mail", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress") ?? (r.includes("@") ? r : null),
+		displayName: n("displayName", "name", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", "cn"),
+		attributes: t
+	};
+};
+//#endregion
+export { r as extractProfile, t as spMetadataXml };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-sso-saml",
-  "version": "0.85.0",
+  "version": "0.86.0",
   "description": "Enterprise SAML 2.0 SSO — SP-initiated login, ACS assertion consumer, and SP metadata. Signature verification via @node-saml/node-saml (optional, lazy); the framework integration (routes, session minting, attribute mapping) is built in.",
   "keywords": [
     "voltro",
@@ -33,8 +33,8 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.85.0",
-    "@voltro/protocol": "0.85.0"
+    "@voltro/database": "0.86.0",
+    "@voltro/protocol": "0.86.0"
   },
   "optionalDependencies": {
     "@node-saml/node-saml": "^5.1.0"