@wildo-ai/saas-backend-lib 1.0.1

package/src/security/authentications/__tests__/saml-test-fixtures.test.ts

@@ -0,0 +1,433 @@
+/**
+ * SAML Test Fixtures — Reusable test data for unit and adversarial tests
+ *
+ * Provides:
+ * - Valid SAML Response XML templates
+ * - Self-signed test certificates (valid, expired, expiring soon)
+ * - Helper functions for building and signing SAML XML
+ * - Attack payloads for adversarial security tests
+ */
+
+import { createRequire } from 'module';
+import * as path from 'path';
+import * as crypto from 'crypto';
+import * as zlib from 'zlib';
+
+const require = createRequire(import.meta.url);
+
+// ─────────────────────────────────────────────────────────────────
+// Constants
+// ─────────────────────────────────────────────────────────────────
+
+export const TEST_IDP_ENTITY_ID = 'https://idp.test.com/saml';
+export const TEST_SP_ENTITY_ID = 'https://app.test.com/saml/sp/organization/org-123';
+export const TEST_ACS_URL = 'https://app.test.com/auth/saml/acs';
+
+const SAML_NS = 'urn:oasis:names:tc:SAML:2.0:assertion';
+const SAMLP_NS = 'urn:oasis:names:tc:SAML:2.0:protocol';
+const DS_NS = 'http://www.w3.org/2000/09/xmldsig#';
+
+// ─────────────────────────────────────────────────────────────────
+// Pre-generated test certificates (openssl req -x509 -newkey rsa:2048 ...)
+// Valid 1yr, expired, and expiring-soon variants
+// ─────────────────────────────────────────────────────────────────
+
+export interface TestCertPair {
+  certPem: string;
+  privateKeyPem: string;
+}
+
+// Valid 1yr test cert + key (openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=test-idp")
+const VALID_CERT_PEM = `-----BEGIN CERTIFICATE-----
+MIIDBzCCAe+gAwIBAgIUDVyMNOW+mQhqePGBp35+05o88FUwDQYJKoZIhvcNAQEL
+BQAwEzERMA8GA1UEAwwIdGVzdC1pZHAwHhcNMjYwMjIwMDU0ODIxWhcNMjcwMjIw
+MDU0ODIxWjATMREwDwYDVQQDDAh0ZXN0LWlkcDCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAKHClYhGtSAA6xsRAI+b+zujBSPNOOXXp5ftRGPYxRfF3pNe
+NQvtv/jvPzurVpbPJc1q0jjVep5sfZISjNd8rJu4SfXomgcEQZKbjpvrwppnfCYU
+O6je9VXs+OxljCGOuTxjZ6Bd+NN8g8Dt5vtmen2fz4QXd0WyP5lNezEMYBWc/cFq
+1+9Upf7JRSKJ5/Fy2qmMkbRIQmwziP+jNhFJeRcTp3VLfV/nJGbrhjKy49eseTBw
+5Ms38EF/Ya4n9Ko+E/vqtlp2z6KnZpNyIJHAg461BZKnfpDS7N3Ycue8/1rPyeft
+cST/k/NQ3dlzoN2Z+qVxBH0d3f0UqP5JSRWtV6sCAwEAAaNTMFEwHQYDVR0OBBYE
+FEZkBaQsa+Oz/Amo/yzkFCvMgh6JMB8GA1UdIwQYMBaAFEZkBaQsa+Oz/Amo/yzk
+FCvMgh6JMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAHRCPbfw
+mPpatgFnAZw7pagwe/HUoxEabjZ13E5aCvdeJoO7leRTzyOma0TasgdMLSIQRhoy
+J7w+uq+Q4JfwaWvS66XyUhtNl+wyVDCUR+LcHMHhzWDVhuyod5zq8fq3SHCLR0Yq
+R9M7HG19N0OiwFb9gqrPQkp0iNWrQJiMhkMyui9+v+VatShybPjxbOTyoGkOTgpM
+/Tv7vlpvp8vW+c6do1ChAVdjNUkrST8+YYL4UBAMRSDGJcjmfh0gwVssmmcZzZx1
+cdrtolQ1f0Tzm3FRrnGGoJ/ZAPztxTwojE0LD6E00FLkRs+UG3PrMhx60EmjFh31
+uhLguNG9Ts/Gd4A=
+-----END CERTIFICATE-----`;
+
+const VALID_KEY_PEM = `-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQChwpWIRrUgAOsb
+EQCPm/s7owUjzTjl16eX7URj2MUXxd6TXjUL7b/47z87q1aWzyXNatI41XqebH2S
+EozXfKybuEn16JoHBEGSm46b68KaZ3wmFDuo3vVV7PjsZYwhjrk8Y2egXfjTfIPA
+7eb7Znp9n8+EF3dFsj+ZTXsxDGAVnP3BatfvVKX+yUUiiefxctqpjJG0SEJsM4j/
+ozYRSXkXE6d1S31f5yRm64YysuPXrHkwcOTLN/BBf2GuJ/SqPhP76rZads+ip2aT
+ciCRwIOOtQWSp36Q0uzd2HLnvP9az8nn7XEk/5PzUN3Zc6DdmfqlcQR9Hd39FKj+
+SUkVrVerAgMBAAECggEACYO8sD7ZzC+cT0PBQNvfu61w5x8HmpFZlMNKfgWpQNGN
+MCWJljwzn1dR5Kxv0+q2962xqXvOZ2oh5V589Ux/30ry4r7TQdgQvqhdYN4jB1pQ
+lZwkDuCfv/WdMKkfxHY01BCpbufdc8cY/YH2JPxtS7KuOJVOw9qNCMiOF0pPOTDM
+/3vba5dYv4uDdUiDUAOAmAcnjjIFtavYfN6AvekZbZtLv/BN2BK0poy9TRHxCRzx
+7rlqy6zFk3LN/XoOA5o88RJOrrBAGdnB6Q7/Wo0CWGo5eygzh+Vl7jTI9tTAxgMM
+kRZhD1rkgvw5i9PxhGMXkDOeLVZ/21z++KJ/YVArGQKBgQDPIL22VxRjTMHtpNH/
+DOc+7I9ULBKA2JVS+dclS4O5D6MYjqjy6nFIDH15Glh6PvLmI/EtO+zovUQKdPCZ
+x+vxFR3rD3J+ajpajL2gQidBtL9WBv2FlTtiuGS6i6Uwrs07uU8djFD6p3zt35bm
+JIyvOTEGtyiCktQVdTgwy0vzSQKBgQDH7XeT7Fd7ReJwjWHNeYP8dmxLcaLt/f4H
+wPPcJfS5TtZ8M7NHkeFw/tA3GeL6WEwa99J2deuA/PktnCRoFth4VCZdUXDjwjyE
+XM0GAJzn1mbxrQA0adOQU5qUtkChrCpoRmWaPcI1sGmXLqMHfj/kMODbE7DaaVI6
+8lneSzq/UwKBgAMxK/tNaEEHg82Xxqy5lC7CEotninl13QdEVm56tXL6rLbKLAxi
+VJCZsK1XHJn1smSdlS/vRn1nvU6z8qlMDXTPsIBY4pjUJkYS+TEpE9XNZU18Ghge
+7qVc1iCR2l/fscYD2xZHfU//mMtJsNenJIvmw7yowfURMjeKcO0/lNIRAoGAOKJv
+Xkr0GSqZ07JpQzCqD+loEhMVyX9K591j9zgVVC0eGz72CU8s4rp8Ny+xGaPLo1QS
+nZYX6Yk/+QijU40tMyD7YTIB3bMXO5OiTJH94LrenJWaWj6kPN1CC+B4/JNty+4t
+N/1It7bKopYGfsfnx3eFKuowDh8JuUMP7CW5dZsCgYBpuvCw07DZa2IkuriFOulA
+nRUtCjUfDsHlzsDpjjicSnj7c38pUt+NOjPG6zUObgzwkhILG/PnzLFycNu1WeNt
+V5HeVPtZBufONYb5yQCz428e1lrFotboYxytSdHr6ECWlY/e0Z8Qpk3xrqNcdspt
+5C9eZvvSLD57pNt0QhhIzQ==
+-----END PRIVATE KEY-----`;
+
+export function getValidTestCert(): TestCertPair {
+  return { certPem: VALID_CERT_PEM, privateKeyPem: VALID_KEY_PEM };
+}
+
+/** Placeholder: returns same cert as valid. Expiry is mocked in tests (validateCertificateExpiry). */
+export function getExpiredTestCert(): TestCertPair {
+  return { certPem: VALID_CERT_PEM, privateKeyPem: VALID_KEY_PEM };
+}
+
+/** Placeholder: returns same cert as valid. Expiry is mocked in tests (validateCertificateExpiry). */
+export function getExpiringSoonTestCert(): TestCertPair {
+  return { certPem: VALID_CERT_PEM, privateKeyPem: VALID_KEY_PEM };
+}
+
+// ─────────────────────────────────────────────────────────────────
+// SAML Response XML Builder
+// ─────────────────────────────────────────────────────────────────
+
+export interface BuildSAMLResponseOverrides {
+  responseId?: string;
+  assertionId?: string;
+  issuer?: string;
+  destination?: string;
+  inResponseTo?: string;
+  /** When true, omit InResponseTo (IdP-initiated flows per SC-9) */
+  omitInResponseTo?: boolean;
+  audience?: string;
+  nameId?: string;
+  nameIdFormat?: string;
+  notBefore?: string;
+  notOnOrAfter?: string;
+  recipient?: string;
+  subjectConfirmationNotOnOrAfter?: string;
+  attributes?: Record<string, string | string[]>;
+  assertionCount?: number;
+  sessionIndex?: string;
+}
+
+export function buildSAMLResponse(overrides: BuildSAMLResponseOverrides = {}): string {
+  const now = new Date();
+  const notBefore = overrides.notBefore ?? new Date(now.getTime() - 60000).toISOString();
+  const notOnOrAfter = overrides.notOnOrAfter ?? new Date(now.getTime() + 300000).toISOString();
+  const responseId = overrides.responseId ?? `_res${crypto.randomUUID().replace(/-/g, '')}`;
+  const assertionId = overrides.assertionId ?? `_ast${crypto.randomUUID().replace(/-/g, '')}`;
+  const issuer = overrides.issuer ?? TEST_IDP_ENTITY_ID;
+  const destination = overrides.destination ?? TEST_ACS_URL;
+  const inResponseTo = overrides.omitInResponseTo ? undefined : (overrides.inResponseTo ?? '_req123');
+  const audience = overrides.audience ?? TEST_SP_ENTITY_ID;
+  const nameId = overrides.nameId ?? 'user@test.com';
+  const nameIdFormat = overrides.nameIdFormat ?? 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress';
+  const recipient = overrides.recipient ?? TEST_ACS_URL;
+  const scdNotOnOrAfter = overrides.subjectConfirmationNotOnOrAfter ?? notOnOrAfter;
+  const sessionIndex = overrides.sessionIndex ?? 'si-123';
+  const attrs = overrides.attributes ?? {
+    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress': 'user@test.com',
+  };
+
+  const assertionCount = overrides.assertionCount ?? 1;
+  const assertions: string[] = [];
+
+  for (let i = 0; i < assertionCount; i++) {
+    const aid = assertionCount > 1 ? `${assertionId}-${i}` : assertionId;
+    const attrXml = Object.entries(attrs)
+      .map(([name, val]) => {
+        const v = Array.isArray(val) ? val[0] : val;
+        return `<saml:Attribute Name="${escapeXml(name)}"><saml:AttributeValue>${escapeXml(v)}</saml:AttributeValue></saml:Attribute>`;
+      })
+      .join('');
+
+    assertions.push(`
+    <saml:Assertion xmlns:saml="${SAML_NS}" ID="${aid}" IssueInstant="${now.toISOString()}" Version="2.0">
+      <saml:Issuer>${escapeXml(issuer)}</saml:Issuer>
+      <saml:Subject>
+        <saml:NameID Format="${escapeXml(nameIdFormat)}">${escapeXml(nameId)}</saml:NameID>
+        <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
+          <saml:SubjectConfirmationData NotOnOrAfter="${scdNotOnOrAfter}" Recipient="${escapeXml(recipient)}"${inResponseTo ? ` InResponseTo="${escapeXml(inResponseTo)}"` : ''}/>
+        </saml:SubjectConfirmation>
+      </saml:Subject>
+      <saml:Conditions NotBefore="${notBefore}" NotOnOrAfter="${notOnOrAfter}">
+        <saml:AudienceRestriction>
+          <saml:Audience>${escapeXml(audience)}</saml:Audience>
+        </saml:AudienceRestriction>
+      </saml:Conditions>
+      <saml:AuthnStatement AuthnInstant="${now.toISOString()}" SessionIndex="${escapeXml(sessionIndex)}">
+        <saml:AuthnContext>
+          <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
+        </saml:AuthnContext>
+      </saml:AuthnStatement>
+      <saml:AttributeStatement>
+        ${attrXml}
+      </saml:AttributeStatement>
+    </saml:Assertion>`);
+  }
+
+  const responseAttrs = `ID="${responseId}" Version="2.0" IssueInstant="${now.toISOString()}" Destination="${escapeXml(destination)}"${inResponseTo ? ` InResponseTo="${escapeXml(inResponseTo)}"` : ''}`;
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<samlp:Response xmlns:samlp="${SAMLP_NS}" xmlns:saml="${SAML_NS}" ${responseAttrs}>
+  <saml:Issuer>${escapeXml(issuer)}</saml:Issuer>
+  ${assertions.join('')}
+</samlp:Response>`;
+}
+
+function escapeXml(s: string): string {
+  return s
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+}
+
+// ─────────────────────────────────────────────────────────────────
+// SamlifyParsedResponse Builder (for validator unit tests)
+// ─────────────────────────────────────────────────────────────────
+
+import type { SamlifyParsedResponse } from '~wildo-backend-lib/security/authentications/services/auth-methods/saml-assertion-validator.backend.service';
+
+export function buildSamlifyParsedResponse(overrides: BuildSAMLResponseOverrides = {}): SamlifyParsedResponse {
+  const xml = buildSAMLResponse(overrides);
+  const now = new Date();
+  const notBefore = overrides.notBefore ?? new Date(now.getTime() - 60000).toISOString();
+  const notOnOrAfter = overrides.notOnOrAfter ?? new Date(now.getTime() + 300000).toISOString();
+  const assertionId = overrides.assertionId ?? '_ast' + crypto.randomUUID().replace(/-/g, '');
+  const nameId = overrides.nameId ?? 'user@test.com';
+  const attrs = overrides.attributes ?? {
+    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress': 'user@test.com',
+  };
+
+  return {
+    samlContent: xml,
+    extract: {
+      conditions: { notBefore, notOnOrAfter },
+      response: {
+        id: overrides.responseId,
+        destination: overrides.destination ?? TEST_ACS_URL,
+        inResponseTo: overrides.inResponseTo ?? '_req123',
+      },
+      audience: overrides.audience ?? TEST_SP_ENTITY_ID,
+      issuer: overrides.issuer ?? TEST_IDP_ENTITY_ID,
+      nameID: nameId,
+      sessionIndex: overrides.sessionIndex
+        ? { sessionIndex: overrides.sessionIndex, authnInstant: now.toISOString() }
+        : undefined,
+      attributes: attrs,
+    },
+  };
+}
+
+/** Injects SHA-1 SignatureMethod into assertion for SC-1 test */
+export function injectSHA1SignatureMethod(xml: string): string {
+  const sigBlock = `<ds:Signature xmlns:ds="${DS_NS}"><ds:SignedInfo/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/></ds:Signature>`;
+  return xml.replace('</saml:AttributeStatement>', `</saml:AttributeStatement>${sigBlock}`);
+}
+
+/** Injects XSLT Transform for SC-6 test */
+export function injectXSLTTransform(xml: string): string {
+  const sigBlock = `<ds:Signature xmlns:ds="${DS_NS}"><ds:SignedInfo><ds:Reference><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/1999/XSL/Transform"/></ds:Transforms></ds:Reference></ds:SignedInfo></ds:Signature>`;
+  return xml.replace('</saml:AttributeStatement>', `</saml:AttributeStatement>${sigBlock}`);
+}
+
+/** Injects multiple SignedInfo for SC-5 test */
+export function injectMultipleSignedInfo(xml: string): string {
+  const sigBlock = `<ds:Signature xmlns:ds="${DS_NS}"><ds:SignedInfo/><ds:SignedInfo/></ds:Signature>`;
+  return xml.replace('</saml:AttributeStatement>', `</saml:AttributeStatement>${sigBlock}`);
+}
+
+// ─────────────────────────────────────────────────────────────────
+// Mock Builders
+// ─────────────────────────────────────────────────────────────────
+
+import type { SAMLResolvedConnection, SAMLStateMetadata } from '~wildo-backend-lib/security/authentications/models/saml-authentication.backend.schemas';
+
+export function buildMockConnection(overrides: Partial<SAMLResolvedConnection> = {}): SAMLResolvedConnection {
+  const { certPem } = getValidTestCert();
+  return {
+    source: 'saml',
+    connectionType: 'enterprise',
+    providerRef: 'test-idp',
+    displayName: 'Test IdP',
+    organization: {
+      organizationId: 'org-123',
+      connectionId: 'conn-123',
+      scopeType: 'organization',
+      scopeId: 'org-123',
+      autoCreateUsers: true,
+      autoVerifyEmail: true,
+      defaultRole: undefined,
+      roleMapping: undefined,
+      groupMapping: undefined,
+      allowedDomains: [],
+    },
+    idpEntityId: TEST_IDP_ENTITY_ID,
+    ssoUrl: 'https://idp.test.com/sso',
+    sloUrl: undefined,
+    x509Certificates: [certPem],
+    spEntityId: TEST_SP_ENTITY_ID,
+    acsUrl: TEST_ACS_URL,
+    nameIdFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
+    attributeMapping: {
+      email: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
+      firstName: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname',
+      lastName: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname',
+    },
+    allowIdpInitiated: false,
+    allowedClockDrift: 30,
+    signRequests: false,
+    wantAssertionsSigned: true,
+    ...overrides,
+  };
+}
+
+export function buildMockStateMetadata(overrides: Partial<SAMLStateMetadata> = {}): SAMLStateMetadata {
+  return {
+    requestId: '_req123',
+    connectionId: 'conn-123',
+    scopeType: 'organization',
+    scopeId: 'org-123',
+    returnUrl: '/dashboard',
+    initiatedAt: Date.now(),
+    ...overrides,
+  };
+}
+
+// ─────────────────────────────────────────────────────────────────
+// Encoding Helpers
+// ─────────────────────────────────────────────────────────────────
+
+export function base64Encode(xml: string): string {
+  return Buffer.from(xml, 'utf-8').toString('base64');
+}
+
+export function deflateAndEncode(xml: string): string {
+  return Buffer.from(zlib.deflateRawSync(Buffer.from(xml, 'utf-8'))).toString('base64');
+}
+
+/**
+ * Sign a SAML Response by adding an enveloped signature to the Assertion element.
+ * Uses RSA-SHA256 (SC-1). Required for samlify parseLoginResponse when wantAssertionsSigned=true.
+ *
+ * @param xml - Unsigned SAML Response XML from buildSAMLResponse()
+ * @param assertionId - ID of the Assertion element (e.g. from overrides.assertionId)
+ * @param privateKeyPem - PEM-encoded RSA private key (must match cert in connection)
+ * @returns Signed XML string
+ */
+export function signXML(xml: string, assertionId: string, privateKeyPem: string): string {
+  // xml-crypto is a dependency of samlify; resolve via samlify's node_modules
+  const samlifyDir = path.dirname(require.resolve('samlify'));
+  const xmlCryptoPath = require.resolve('xml-crypto', { paths: [path.join(samlifyDir, '..')] });
+  const { SignedXml } = require(xmlCryptoPath);
+  const sig = new SignedXml({ privateKey: privateKeyPem });
+  // xml-crypto 6.x requires explicit xpath (uri alone yields empty xpath → XPath parse error)
+  const xpath = `//*[local-name()='Assertion' and @ID='${assertionId}']`;
+  sig.addReference({
+    xpath,
+    uri: `#${assertionId}`,
+    digestAlgorithm: 'http://www.w3.org/2001/04/xmlenc#sha256',
+    transforms: [
+      'http://www.w3.org/2000/09/xmldsig#enveloped-signature',
+      'http://www.w3.org/2001/10/xml-exc-c14n#',
+    ],
+  });
+  sig.canonicalizationAlgorithm = 'http://www.w3.org/2001/10/xml-exc-c14n#';
+  sig.signatureAlgorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256';
+  sig.computeSignature(xml);
+  return sig.getSignedXml();
+}
+
+/**
+ * Build a signed SAML Response for integration tests.
+ * Uses buildSAMLResponse + signXML with the test certificate.
+ */
+export function buildSignedSAMLResponse(
+  overrides: BuildSAMLResponseOverrides = {},
+  certPair?: TestCertPair,
+): string {
+  const pair = certPair ?? getValidTestCert();
+  const assertionId = overrides.assertionId ?? `_ast${crypto.randomUUID().replace(/-/g, '')}`;
+  const xml = buildSAMLResponse({ ...overrides, assertionId });
+  return signXML(xml, assertionId, pair.privateKeyPem);
+}
+
+// ─────────────────────────────────────────────────────────────────
+// Attack Payloads (for adversarial tests)
+// ─────────────────────────────────────────────────────────────────
+
+export const ATTACK_PAYLOADS = {
+  /** XXE — attempt to read /etc/passwd */
+  XXE: `<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><samlp:Response xmlns:samlp="${SAMLP_NS}"><saml:Issuer>test</saml:Issuer><saml:Assertion ID="x">&xxe;</saml:Assertion></samlp:Response>`,
+
+  /** Billion laughs — nested entity expansion DoS */
+  BILLION_LAUGHS: `<?xml version="1.0"?><!DOCTYPE lolz [<!ENTITY lol "lol"><!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"><!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">]><samlp:Response xmlns:samlp="${SAMLP_NS}"><saml:Issuer>&lol3;</saml:Issuer></samlp:Response>`,
+
+  /** NameID with embedded comment injection */
+  NAMEID_COMMENT_INJECTION: 'admin<!-- -->@evil.com',
+
+  /** Response with multiple assertions */
+  MULTIPLE_ASSERTIONS: () => buildSAMLResponse({ assertionCount: 2 }),
+
+  /** Response with zero assertions */
+  ZERO_ASSERTIONS: `<?xml version="1.0"?><samlp:Response xmlns:samlp="${SAMLP_NS}" xmlns:saml="${SAML_NS}" ID="_r1" Version="2.0"><saml:Issuer>${TEST_IDP_ENTITY_ID}</saml:Issuer></samlp:Response>`,
+
+  /** Wrong Destination */
+  WRONG_DESTINATION: (base: string) => base.replace(TEST_ACS_URL, 'https://evil.com/acs'),
+
+  /** Wrong Audience */
+  WRONG_AUDIENCE: (base: string) =>
+    base.replace(`<saml:Audience>${TEST_SP_ENTITY_ID}</saml:Audience>`, '<saml:Audience>https://evil.com/sp</saml:Audience>'),
+};
+
+// ─────────────────────────────────────────────────────────────────
+// IdP Metadata (for metadata service tests)
+// ─────────────────────────────────────────────────────────────────
+
+/** Extract raw base64 from PEM for use in metadata X509Certificate */
+function certToBase64(pem: string): string {
+  return pem
+    .replace(/-----BEGIN CERTIFICATE-----/, '')
+    .replace(/-----END CERTIFICATE-----/, '')
+    .replace(/\s/g, '');
+}
+
+/** Minimal valid IdP metadata XML that samlify can parse (matches samlify docs format) */
+export function buildIdPMetadataXml(overrides?: { entityId?: string; ssoUrl?: string; certPem?: string }): string {
+  const entityId = overrides?.entityId ?? TEST_IDP_ENTITY_ID;
+  const ssoUrl = overrides?.ssoUrl ?? 'https://idp.test.com/saml/sso';
+  const cert = overrides?.certPem ?? VALID_CERT_PEM;
+  const certB64 = certToBase64(cert);
+
+  return `<?xml version="1.0"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${entityId}">
+  <IDPSSODescriptor xmlns:ds="http://www.w3.org/2000/09/xmldsig#" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <KeyDescriptor use="signing">
+      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <ds:X509Data>
+          <ds:X509Certificate>${certB64}</ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </KeyDescriptor>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="${ssoUrl}"/>
+    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${ssoUrl}"/>
+  </IDPSSODescriptor>
+</EntityDescriptor>`;
+}

package/src/security/authentications/__tests__/saml-test-parser.test.ts

@@ -0,0 +1,117 @@
+/**
+ * Test-only SAML Response Parser — bypasses samlify XSD (no Java)
+ *
+ * Parses base64 SAML Response with @xmldom/xmldom. Used in integration tests
+ * where samlify's @authenio/xsd-schema-validator would fail (Java dependency).
+ * Production never uses this; SAMLResponseParserOverride is only bound in tests.
+ */
+
+import { DOMParser } from '@xmldom/xmldom';
+import type { SAMLResolvedConnection } from '~wildo-backend-lib/security/authentications/models/saml-authentication.backend.schemas';
+import type { SamlifyParsedResponse } from '~wildo-backend-lib/security/authentications/services/auth-methods/saml-assertion-validator.backend.service';
+import type { SAMLResponseParserOverride } from '~wildo-backend-lib/security/authentications/services/auth-methods/saml-authentication.backend.service';
+
+const SAML_NS = 'urn:oasis:names:tc:SAML:2.0:assertion';
+const SAMLP_NS = 'urn:oasis:names:tc:SAML:2.0:protocol';
+
+function getText(el: Element | null): string {
+  if (!el) return '';
+  const text = el.firstChild?.nodeValue ?? '';
+  return text.trim();
+}
+
+function getAttr(el: Element | null, name: string): string {
+  if (!el) return '';
+  return el.getAttribute(name) ?? '';
+}
+
+/**
+ * Parse base64 SAML Response and return SamlifyParsedResponse shape.
+ * Uses DOM parsing only — no XSD validation, no signature verification.
+ */
+export function parseSAMLResponseForTests(samlResponseBase64: string): SamlifyParsedResponse {
+  const xml = Buffer.from(samlResponseBase64, 'base64').toString('utf-8');
+  const doc = new DOMParser().parseFromString(xml, 'text/xml');
+
+  const response = doc.getElementsByTagNameNS(SAMLP_NS, 'Response')[0] ?? doc.getElementsByTagName('samlp:Response')[0];
+  if (!response) {
+    throw new Error('SAML Response: missing Response element');
+  }
+
+  const assertion = doc.getElementsByTagNameNS(SAML_NS, 'Assertion')[0] ?? doc.getElementsByTagName('saml:Assertion')[0];
+  if (!assertion) {
+    throw new Error('SAML Response: missing Assertion element');
+  }
+
+  const issuer = doc.getElementsByTagNameNS(SAML_NS, 'Issuer')[0] ?? doc.getElementsByTagName('saml:Issuer')[0];
+  const nameIdEl = assertion.getElementsByTagNameNS(SAML_NS, 'NameID')[0] ?? assertion.getElementsByTagName('saml:NameID')[0];
+  const conditions = assertion.getElementsByTagNameNS(SAML_NS, 'Conditions')[0] ?? assertion.getElementsByTagName('saml:Conditions')[0];
+  const audienceRestriction = assertion.getElementsByTagNameNS(SAML_NS, 'AudienceRestriction')[0] ?? assertion.getElementsByTagName('saml:AudienceRestriction')[0];
+  const audience = audienceRestriction?.getElementsByTagNameNS(SAML_NS, 'Audience')[0] ?? audienceRestriction?.getElementsByTagName('saml:Audience')[0];
+  const subjectConfirmationData = assertion.getElementsByTagNameNS(SAML_NS, 'SubjectConfirmationData')[0] ?? assertion.getElementsByTagName('saml:SubjectConfirmationData')[0];
+  const authnStatement = assertion.getElementsByTagNameNS(SAML_NS, 'AuthnStatement')[0] ?? assertion.getElementsByTagName('saml:AuthnStatement')[0];
+  const attributeStatement = assertion.getElementsByTagNameNS(SAML_NS, 'AttributeStatement')[0] ?? assertion.getElementsByTagName('saml:AttributeStatement')[0];
+
+  const attrs: Record<string, string | string[]> = {};
+  if (attributeStatement) {
+    const attrNodes = attributeStatement.getElementsByTagNameNS(SAML_NS, 'Attribute');
+    for (let i = 0; i < attrNodes.length; i++) {
+      const attr = attrNodes[i];
+      const name = attr.getAttribute('Name') ?? '';
+      const values = attr.getElementsByTagNameNS(SAML_NS, 'AttributeValue');
+      if (values.length === 1) {
+        attrs[name] = getText(values[0]);
+      } else if (values.length > 1) {
+        attrs[name] = Array.from(values).map((v) => getText(v));
+      } else if (name) {
+        attrs[name] = '';
+      }
+    }
+  }
+
+  const sessionIndex = authnStatement ? getAttr(authnStatement, 'SessionIndex') : undefined;
+
+  return {
+    samlContent: xml,
+    extract: {
+      conditions: conditions
+        ? {
+            notBefore: getAttr(conditions, 'NotBefore') || undefined,
+            notOnOrAfter: getAttr(conditions, 'NotOnOrAfter') || undefined,
+          }
+        : undefined,
+      response: {
+        id: getAttr(response, 'ID') || undefined,
+        issueInstant: getAttr(response, 'IssueInstant') || undefined,
+        destination: getAttr(response, 'Destination') || undefined,
+        inResponseTo: getAttr(response, 'InResponseTo') || getAttr(subjectConfirmationData, 'InResponseTo') || undefined,
+      },
+      audience: audience ? getText(audience) : undefined,
+      issuer: issuer ? getText(issuer) : undefined,
+      nameID: nameIdEl ? getText(nameIdEl) : undefined,
+      sessionIndex: sessionIndex
+        ? {
+            authnInstant: authnStatement ? getAttr(authnStatement, 'AuthnInstant') : undefined,
+            sessionIndex,
+          }
+        : undefined,
+      attributes: Object.keys(attrs).length > 0 ? attrs : undefined,
+    },
+  };
+}
+
+/**
+ * Creates a SAMLResponseParserOverride for integration tests.
+ * Uses parseSAMLResponseForTests (xmldom, no XSD) and returns validatingCertIndex: 0.
+ */
+export function createTestSAMLResponseParser(): SAMLResponseParserOverride {
+  return {
+    async parse(
+      _connection: SAMLResolvedConnection,
+      samlResponse: string,
+    ): Promise<SamlifyParsedResponse & { validatingCertIndex: number }> {
+      const parsed = parseSAMLResponseForTests(samlResponse);
+      return { ...parsed, validatingCertIndex: 0 };
+    },
+  };
+}