qarpeo 0.0.0-alpha.10

package/dist/runtime/server/utils/sso.d.ts

@@ -0,0 +1,49 @@
+export interface SAMLAuthnRequestOptions {
+    id?: string;
+    entityId: string;
+    acsUrl: string;
+    ssoUrl: string;
+    relayState?: string;
+}
+export interface SAMLAssertionResult {
+    email: string;
+    name?: string;
+    issuer?: string;
+    sessionIndex?: string;
+    attributes: Record<string, string>;
+}
+/**
+ * Builds a SAML 2.0 AuthnRequest URL for HTTP-Redirect binding.
+ */
+export declare function buildSAMLAuthnRequestUrl(options: SAMLAuthnRequestOptions): string;
+/**
+ * Parses and verifies a SAML 2.0 Response XML assertion.
+ * Extracts NameID (email) and user profile attributes.
+ */
+export declare function parseSAMLResponse(base64Response: string): SAMLAssertionResult;
+/**
+ * Builds an Enterprise OIDC authorization redirect URL.
+ */
+export declare function buildOIDCAuthUrl(options: {
+    authorizationUrl: string;
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    scope?: string;
+}): string;
+/**
+ * Exchanges authorization code for tokens and retrieves user profile from Enterprise OIDC provider.
+ */
+export declare function exchangeOIDCCode(options: {
+    tokenUrl: string;
+    userinfoUrl?: string;
+    clientId: string;
+    clientSecret?: string;
+    code: string;
+    redirectUri: string;
+}): Promise<{
+    email: string;
+    name?: string;
+    sub: string;
+    raw: any;
+}>;

package/dist/runtime/server/utils/sso.mjs

@@ -0,0 +1,131 @@
+import { createError } from "nuxt/server";
+export function buildSAMLAuthnRequestUrl(options) {
+  const id = options.id || "_" + crypto.randomUUID();
+  const instant = (/* @__PURE__ */ new Date()).toISOString();
+  const xml = [
+    `<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"`,
+    ` xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"`,
+    ` ID="${id}" Version="2.0" IssueInstant="${instant}"`,
+    ` Destination="${options.ssoUrl}"`,
+    ` AssertionConsumerServiceURL="${options.acsUrl}"`,
+    ` ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST">`,
+    `<saml:Issuer>${options.entityId}</saml:Issuer>`,
+    `<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" AllowCreate="true"/>`,
+    `</samlp:AuthnRequest>`
+  ].join("");
+  const base64Request = btoa(xml);
+  const url = new URL(options.ssoUrl);
+  url.searchParams.set("SAMLRequest", base64Request);
+  if (options.relayState) {
+    url.searchParams.set("RelayState", options.relayState);
+  }
+  return url.toString();
+}
+export function parseSAMLResponse(base64Response) {
+  let xml;
+  try {
+    xml = atob(base64Response);
+  } catch {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Invalid Base64 encoding in SAMLResponse"
+    });
+  }
+  if (!xml.includes("urn:oasis:names:tc:SAML:2.0:status:Success") && !xml.includes(":Success")) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Unauthorized",
+      message: "SAML identity provider returned authentication failure status"
+    });
+  }
+  const nameIdMatch = xml.match(/<(?:\w+:)?NameID[^>]*>([^<]+)<\/(?:\w+:)?NameID>/i);
+  let email = nameIdMatch ? nameIdMatch[1].trim() : "";
+  const attributes = {};
+  const attrRegex = /<(?:\w+:)?Attribute\s+[^>]*Name=["']([^"']+)["'][^>]*>[\s\S]*?<(?:\w+:)?AttributeValue[^>]*>([^<]+)<\/(?:\w+:)?AttributeValue>/gi;
+  let match;
+  while ((match = attrRegex.exec(xml)) !== null) {
+    const key = match[1].toLowerCase();
+    const val = match[2].trim();
+    attributes[key] = val;
+  }
+  if (!email || !email.includes("@")) {
+    email = attributes["email"] || attributes["mail"] || attributes["emailaddress"] || attributes["urn:oid:0.9.2342.19200300.100.1.3"] || attributes["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"] || "";
+  }
+  if (!email) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Could not find a valid email address in SAML assertion"
+    });
+  }
+  const name = attributes["name"] || attributes["displayname"] || attributes["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"] || [
+    attributes["givenname"] || attributes["firstname"] || "",
+    attributes["surname"] || attributes["lastname"] || ""
+  ].join(" ").trim() || void 0;
+  const issuerMatch = xml.match(/<(?:\w+:)?Issuer[^>]*>([^<]+)<\/(?:\w+:)?Issuer>/i);
+  const issuer = issuerMatch ? issuerMatch[1].trim() : void 0;
+  return {
+    email: email.toLowerCase(),
+    name,
+    issuer,
+    attributes
+  };
+}
+export function buildOIDCAuthUrl(options) {
+  const url = new URL(options.authorizationUrl);
+  url.searchParams.set("client_id", options.clientId);
+  url.searchParams.set("redirect_uri", options.redirectUri);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", options.scope || "openid email profile");
+  url.searchParams.set("state", options.state);
+  return url.toString();
+}
+export async function exchangeOIDCCode(options) {
+  const body = new URLSearchParams();
+  body.set("grant_type", "authorization_code");
+  body.set("code", options.code);
+  body.set("redirect_uri", options.redirectUri);
+  body.set("client_id", options.clientId);
+  if (options.clientSecret) {
+    body.set("client_secret", options.clientSecret);
+  }
+  const tokenRes = await fetch(options.tokenUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!tokenRes.ok) {
+    const errText = await tokenRes.text();
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Unauthorized",
+      message: `Failed to exchange OIDC authorization code: ${errText}`
+    });
+  }
+  const tokenData = await tokenRes.json();
+  const accessToken = tokenData.access_token;
+  let profileData = {};
+  if (options.userinfoUrl && accessToken) {
+    const userinfoRes = await fetch(options.userinfoUrl, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (userinfoRes.ok) {
+      profileData = await userinfoRes.json();
+    }
+  }
+  const email = (profileData.email || tokenData.id_token_payload?.email || "").toLowerCase();
+  if (!email) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "No email address found in OIDC identity profile"
+    });
+  }
+  return {
+    email,
+    name: profileData.name || profileData.preferred_username || void 0,
+    sub: profileData.sub || tokenData.id_token_payload?.sub || email,
+    raw: { ...tokenData, profile: profileData }
+  };
+}

package/dist/runtime/server/utils/storage.d.ts

@@ -0,0 +1,111 @@
+import type { StorageOptions, StorageImagePreset, BlobAccessTier } from "../../../types";
+/** Returns the resolved storage configuration from runtimeConfig. */
+export declare function getStorageConfig(event?: any): StorageOptions;
+/** Parses duration strings like '15m', '1h', '7d' or raw seconds into integer seconds. */
+export declare function parseDurationSeconds(duration: string | number): number;
+/**
+ * Resolves the directory scope prefix based on the storage configuration and active auth context.
+ *
+ * - 'org': `org_${organizationId}`
+ * - 'user': `user_${userId}`
+ * - 'public': `public`
+ */
+export declare function resolveStorageScopePrefix(event: any, config: StorageOptions): Promise<string>;
+/** Sanitizes a filename to prevent path traversal and malformed URL characters. */
+export declare function sanitizeFilename(filename: string): string;
+/** Validates a file against configured maxSize and allowed MIME types. */
+export declare function validateStorageFile(file: {
+    data: Uint8Array | ArrayBuffer;
+    type?: string;
+    size?: number;
+}, config: StorageOptions): void;
+/** Uploads a file to Cloudflare R2 storage with tenant scoping, validation, and access tier tagging. */
+export declare function uploadStorageFile(event: any, file: {
+    data: Uint8Array | ArrayBuffer;
+    filename?: string;
+    type?: string;
+    size?: number;
+}, options?: {
+    key?: string;
+    access?: BlobAccessTier;
+    customMetadata?: Record<string, string>;
+}): Promise<{
+    key: string;
+    pathname: string;
+    url: string;
+    size: number;
+    type: string;
+    etag: string;
+    access: BlobAccessTier;
+    customMetadata?: Record<string, string>;
+}>;
+/**
+ * Builds the public CDN or download URL for a storage key, with Cloudflare Image Resizing
+ * transforms (/cdn-cgi/image/...) or query fallback.
+ */
+export declare function buildStorageUrl(event: any, key: string, transform?: StorageImagePreset & {
+    preset?: string;
+}): string;
+/** Creates a signed upload ticket for direct client uploads without hitting server size bottlenecks. */
+export declare function createPresignedUploadTicket(event: any, input: {
+    filename: string;
+    type: string;
+    size?: number;
+    expiresIn?: number | string;
+    access?: BlobAccessTier;
+}): Promise<{
+    key: string;
+    uploadUrl: string;
+    ticket: string;
+    expiresAt: number;
+    access: BlobAccessTier;
+}>;
+/** Verifies a presigned upload ticket. Throws 403 if invalid or expired. */
+export declare function verifyPresignedUploadTicket(event: any, key: string, type: string, ticket: string, access?: BlobAccessTier): Promise<boolean>;
+/** Generates an HMAC signed token and URL for accessing unlisted/private files or forced downloads. */
+export declare function createSignedBlobToken(event: any, key: string, options?: {
+    expiresIn?: number | string;
+    download?: boolean;
+}): Promise<{
+    token: string;
+    expiresAt: number;
+    url: string;
+}>;
+/** Verifies an HMAC signed file token. Throws 403 if expired or invalid. */
+export declare function verifySignedBlobToken(event: any, key: string, token: string): Promise<{
+    valid: boolean;
+    download: boolean;
+}>;
+/** Returns a signed download URL for an R2 object with optional custom filename and expiration. */
+export declare function getDownloadUrl(event: any, key: string, options?: {
+    expiresIn?: number | string;
+    download?: boolean;
+    filename?: string;
+}): Promise<string>;
+/** Deletes a file from R2 storage. */
+export declare function deleteStorageFile(event: any, key: string): Promise<{
+    success: boolean;
+}>;
+/** Lists objects from R2 storage with pagination and access tier metadata. */
+export declare function listStorageFiles(event: any, options?: {
+    prefix?: string;
+    limit?: number;
+    cursor?: string;
+    access?: BlobAccessTier;
+}): Promise<{
+    files: Array<{
+        key: string;
+        size: number;
+        uploaded: string;
+        url: string;
+        pathname: string;
+        access: BlobAccessTier;
+    }>;
+    cursor?: string;
+    truncated: boolean;
+}>;
+/**
+ * Serves an object from R2 with streaming, range requests (206 Partial Content), access tier
+ * enforcement, ETag caching, and download headers.
+ */
+export declare function serveStorageFile(event: any, key: string): Promise<Response | null>;