saml-test-server 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,19 @@
+The MIT License (MIT)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,135 @@
-# Temporary Holding Version
+# saml-test-server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A simple SAML 2.0 Identity Provider (IdP) to test Service Providers (SPs) in **E2E tests**.
+
+> **Not intended for use with production systems!** The bundled signing key is public.
+
+## Usage
+
+```ts
+import { runServer } from 'saml-test-server';
+
+export default async function globalSetup() {
+  const idp = await runServer({
+    port: 7000,
+    acsUrl: 'http://localhost:3000/auth/saml/callback',
+    sloUrl: 'http://localhost:3000/auth/saml/logout',
+    audience: 'http://localhost:3000/auth/saml/metadata',
+    logLevel: 'silent',
+  });
+
+  // Change the signed-in user at any time, without going through the UI:
+  idp.state.user.userName = 'jane@example.com';
+  idp.state.user.email = 'jane@example.com';
+  // ...and restore the defaults between tests:
+  idp.state.reset();
+
+  return () => idp.close();
+}
+```
+
+Custom claims (the user is merged with the defaults):
+
+```ts
+await runServer({
+  acsUrl,
+  audience,
+  config: {
+    user: { userName: 'jane@example.com', email: 'jane@example.com', userType: 'Admin' },
+    metadata: [
+      { id: 'email', displayName: 'E-Mail Address', optional: false },
+      { id: 'userType', displayName: 'User Type', optional: true, options: ['Admin', 'Editor'] },
+    ],
+  },
+});
+```
+
+`configFile` (a `.js`, `.mjs` or `.json` module exporting `{ user, metadata }`) is also supported.
+
+### In-process (no port)
+
+```ts
+import { createIdp } from 'saml-test-server';
+
+const { app, state } = await createIdp({ acsUrl, audience, logLevel: 'silent' });
+const res = await app.request('/metadata');
+```
+
+### Command line
+
+```shell
+saml-idp --acsUrl {POST URL} --audience {audience}
+saml-idp --acsUrl {POST URL} --sloUrl {POST URL} --audience {audience}
+```
+
+Open `http://localhost:7000` in your browser to start an IdP initiated flow to your SP.
+All flags of the original CLI and their aliases (`--acs`, `--aud`, `--slo`, `--iss`, `--spId`, `--rs`, `--static`,
+`--enc`, `--encCert`, `--encKey`, `--conf`, `--acr`, `--acd`) are supported. Run `saml-idp --help`.
+`HOST` and `PORT` environment variables override `--host` and `--port`.
+
+### Options
+
+Passed as `--<option>` to the CLI or in the options object of `runServer` / `createIdp`.
+
+| Option (* required)    | Description                                                              | Default                                  |
+| ---------------------- | ------------------------------------------------------------------------ | ---------------------------------------- |
+| `host`                 | IdP web server listener host                                             | `localhost`                              |
+| `port`                 | IdP web server listener port (`0` picks a free port)                     | `7000`                                   |
+| `cert`                 | IdP signature public key certificate (PEM or path)                       | bundled test certificate                 |
+| `key`                  | IdP signature private key (PEM or path, PKCS#1 or PKCS#8)                | bundled test key                         |
+| `issuer`               | IdP issuer URI                                                           | `urn:example:idp`                        |
+| `acsUrl` *             | SP Assertion Consumer Service URL                                        |                                          |
+| `sloUrl`               | SP Single Logout URL (enables SLO)                                       |                                          |
+| `audience` *           | SP audience URI                                                          |                                          |
+| `serviceProviderId`    | SP issuer / entity URI                                                   | `audience`                               |
+| `relayState`           | Default RelayState                                                       |                                          |
+| `disableRequestAcsUrl` | Ignore the ACS URL of the AuthnRequest                                   | `false`                                  |
+| `encryptAssertion`     | Encrypt the assertion with the SP public key                             | `false`                                  |
+| `encryptionCert`       | SP certificate (PEM or path) for assertion encryption                    |                                          |
+| `encryptionPublicKey`  | SP RSA public key (PEM or path); derived from `encryptionCert` if absent |                                          |
+| `https`                | Enable the HTTPS listener (needs `httpsPrivateKey` and `httpsCert`)      | `false`                                  |
+| `httpsPrivateKey`      | Web server TLS private key (PEM or path)                                 |                                          |
+| `httpsCert`            | Web server TLS certificate (PEM or path)                                 |                                          |
+| `signResponse`         | Sign the SAML Response (the Assertion is always signed)                  | `true`                                   |
+| `configFile`           | Module exporting `{ user, metadata }`                                    | built-in defaults                        |
+| `config`               | Inline `{ user, metadata }` (library only)                               |                                          |
+| `rollSession`          | New session for every authn request                                      | `false`                                  |
+| `authnContextClassRef` | Authentication Context Class Reference                                   | `...:PasswordProtectedTransport`         |
+| `authnContextDecl`     | Authentication Context Declaration (XML or path to an XML file)          |                                          |
+| `logLevel`             | `silent` (no output), `error` (unexpected errors only) or `info`. Env: `SAML_IDP_LOG_LEVEL` | `info`                                   |
+| `silent`               | Deprecated, same as `logLevel: 'silent'`                                  | `false`                                  |
+
+### Endpoints
+
+| Path                           | Description                                                          |
+| ------------------------------ | -------------------------------------------------------------------- |
+| `/`, `/idp`, `/saml/sso`       | SSO (HTTP-Redirect and HTTP-POST). Shows the sign in form            |
+| `/signin` (POST)               | Mints the SAML Response and POSTs it to the ACS URL                  |
+| `/saml/slo`                    | Single Logout (SP or IdP initiated, HTTP-Redirect and HTTP-POST)     |
+| `/signout`                     | Starts IdP initiated logout (or just ends the session without SLO)   |
+| `/metadata`                    | IdP metadata. `POST` adds an attribute (`attributeName`, `displayName`, ...) |
+| `/settings`                    | Edit the IdP settings at runtime                                     |
+
+Useful element ids for browser tests: `#userName`, `#nameIdFormat`, one input per attribute (`#email`, `#groups`, ...),
+`#btn-sign-in`, `#btn-sign-out`.
+
+## Development
+
+```shell
+npm install
+npm run dev        # Vite dev server (SAML_ACS_URL, SAML_AUDIENCE, SAML_SLO_URL env vars)
+npm test           # Vitest
+npm run typecheck
+npm run build      # dist/index.js, dist/cli.js, dist/types
+```
+
+Generate your own IdP key pair with:
+
+```shell
+openssl req -x509 -new -newkey rsa:2048 -nodes -subj '/C=US/ST=California/L=San Francisco/O=JankyCo/CN=Test Identity Provider' \
+  -keyout idp-private-key.pem -out idp-public-cert.pem -days 7300
+```
+
+## License
+
+MIT, see [LICENSE](./LICENSE). Vendored code keeps its own license in `src/vendor/*/LICENSE`.

package/assets/idp-private-key.pem

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAwa8mlFNNqxFRI+pxuoIb5mdMC6ue7S9Wkgb2XMTGeHXWj8Ea
+bO7uUH7IsdwR3CsoEGal6kME8JjGlVqO+4SFl0oXH8V3LqPmYfeutbQGH/N3foKh
+Q2NtuEfJON4zsU3bIXe72VzK5u687OvcHeBfrojAmVTjr7DNxBWFI6UyTa1dH58g
+pATEWs64r21tfckgFSoi2kj4ecCjDnT0KczXfiy/Dw9MUuRHr8JwyqcN8MrWb33c
+/KgLVj43hf1eSFKYRCgCUAc8jkseu+66MzXee+2hVi8piiPtJyC6aSlY0S9frnYt
+9c6cpiWQHxnJu7GYV8iTN51CtsmzI6F8vTdwwQIDAQABAoIBABoE0YXzeueUN/Y/
+NG/9sonNLqYStBLg3RxY2xezR4Y/Lke5hTdFEba2kXdzPOL62TL61ycVQcCghWzi
+8XpQXzHnvhuCh3Q4iGZ4w3udZ4U7S74vBkLrRH4RBrMhBoi3EMz6LL4SfR9wyuh4
+9uT8k136+QSgJsYfVkUVLwGO26cbepPHH9e7/MatV3iItEs7zZhF6CKYiexhZTte
+y9HTRgkxiAUesSpO7/oXBAB7hTdrFbQOClxcW4peRTS9/834M3PdwE7OCwsznKp3
+EDTsX1IcXojaYTZSb/Ftsc/WOQTOWo8jV7vVMU515zKCF/5YQntWfRwpT8PdABXa
+TdT/OJECgYEA/87wQUT7ACCcdf/ZzBdRGZakRbPI0bGLnj+YKMCwgPMhptUzjJKg
+k2LwkPyya1xB09XI6E6WHadjPgsBPYGpXc+SeKknT3iz7Q283iqn6jMgHq7NyLeY
+Au0AlTGDaSNmDfUaT8luh+EtKIh+UDHtcJ/GZgw8Kr0RsSZG0cS1s3cCgYEAwdRM
+Ir+UvjfO/CWghFMKyRR2RC/m9IJS+uY9eO2dcnGzPqXVDYiqOVRoyOfoI/Lavnei
+n++XG24iSRDQ9fl9Gu7odlP+Or5liIES9Z9Gw9Ov1RUmspGJ/PT9RjSBvRymGHSu
+IePjA5DFEDoaTAxCcdIIrURQz/HnWQYCDFfZ24cCgYEA0nrPLKU5ca1jj6Po7Qjy
+bf+JQuDfB8ryek8RP9bsY+2pbsBWHgA3p43tKx8BH11VvJtXJ+4hjlzAR7h+WMFr
+PgkhF6727Wj/grmfAZ5Pc2CFuTlTkSefKCkiJaAL5GKAAlP+RlATZjJdGdDVPd8W
+42hTsnu2tePDvuMjuk4Ew5kCgYBE/Ccg0ujAjqJXcZjgn6GeEW9KM3ZSnbOk4p8M
+VB2OZtMxv9nFGFflUZp9rrQbX0rlMTUrER3JwHfpY1fLw8D3/gG0Y45/H9aJL88s
+pkSMW+Ifx4hfU5c19YfTHcrzIKgo2hZDr5TTZwoMDXHgkRhw5Bz8de0BJYp+T7oY
+5IeALwKBgQDyYbssjxY2TJYr0Z+mvGNLnmEvuOT5z1Ek0XewQfCsGbC+3TOZ43NS
+kXJHUt26kh/Jh7pZDmiEiRDS1IZSn2ytMqJT233EDn9jrPS0efpqzx8uGlRVROZN
+oSMw69DxVGpBjGfLtlGF1i2TFcBEXD8jqaVSKzoKhXZkuHsP+q3WWg==
+-----END RSA PRIVATE KEY-----

package/assets/idp-public-cert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDPDCCAiQCCQDydJgOlszqbzANBgkqhkiG9w0BAQUFADBgMQswCQYDVQQGEwJV
+UzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEQ
+MA4GA1UEChMHSmFua3lDbzESMBAGA1UEAxMJbG9jYWxob3N0MB4XDTE0MDMxMjE5
+NDYzM1oXDTI3MTExOTE5NDYzM1owYDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNh
+bGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEDAOBgNVBAoTB0phbmt5
+Q28xEjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBAMGvJpRTTasRUSPqcbqCG+ZnTAurnu0vVpIG9lzExnh11o/BGmzu7lB+
+yLHcEdwrKBBmpepDBPCYxpVajvuEhZdKFx/Fdy6j5mH3rrW0Bh/zd36CoUNjbbhH
+yTjeM7FN2yF3u9lcyubuvOzr3B3gX66IwJlU46+wzcQVhSOlMk2tXR+fIKQExFrO
+uK9tbX3JIBUqItpI+HnAow509CnM134svw8PTFLkR6/CcMqnDfDK1m993PyoC1Y+
+N4X9XkhSmEQoAlAHPI5LHrvuujM13nvtoVYvKYoj7ScgumkpWNEvX652LfXOnKYl
+kB8ZybuxmFfIkzedQrbJsyOhfL03cMECAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA
+eHwzqwnzGEkxjzSD47imXaTqtYyETZow7XwBc0ZaFS50qRFJUgKTAmKS1xQBP/qH
+pStsROT35DUxJAE6NY1Kbq3ZbCuhGoSlY0L7VzVT5tpu4EY8+Dq/u2EjRmmhoL7U
+kskvIZ2n1DdERtd+YUMTeqYl9co43csZwDno/IKomeN5qaPc39IZjikJ+nUC6kPF
+Keu/3j9rgHNlRtocI6S1FdtFz9OZMQlpr0JbUt2T3xS/YoQJn6coDmJL5GTiiKM6
+cOe+Ur1VwzS1JEDbSS2TWWhzq8ojLdrotYLGd9JOsoQhElmz+tMfCFQUFLExinPA
+yy7YHlSiVX13QH2XTu/iQQ==
+-----END CERTIFICATE-----

package/dist/cli.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+import { Command, Option, InvalidArgumentError } from "commander";
+import { L as LOG_LEVELS, OptionsError, runServer } from "./index.js";
+import pc from "picocolors";
+const ALIASES = {
+  "--iss": "--issuer",
+  "--acs": "--acsUrl",
+  "--slo": "--sloUrl",
+  "--aud": "--audience",
+  "--spId": "--serviceProviderId",
+  "--rs": "--relayState",
+  "--static": "--disableRequestAcsUrl",
+  "--enc": "--encryptAssertion",
+  "--encCert": "--encryptionCert",
+  "--encKey": "--encryptionPublicKey",
+  "--conf": "--configFile",
+  "--acr": "--authnContextClassRef",
+  "--acd": "--authnContextDecl"
+};
+const BOOLEAN_OPTIONS = [
+  "disableRequestAcsUrl",
+  "encryptAssertion",
+  "https",
+  "signResponse",
+  "rollSession",
+  "silent"
+];
+function normalizeArgv(argv) {
+  return argv.map((arg) => {
+    if (!arg.startsWith("--")) return arg;
+    const [flag, ...rest] = arg.split("=");
+    const value = rest.length ? `=${rest.join("=")}` : "";
+    const canonical = ALIASES[flag] ?? flag;
+    const negated = /^--no-(.+)$/.exec(canonical);
+    if (negated && BOOLEAN_OPTIONS.includes(negated[1]) && !value) {
+      return `--${negated[1]}=false`;
+    }
+    return canonical + value;
+  });
+}
+function parseBoolean(value) {
+  if (["true", "yes", "1"].includes(value.toLowerCase())) return true;
+  if (["false", "no", "0"].includes(value.toLowerCase())) return false;
+  throw new InvalidArgumentError("Expected true or false.");
+}
+function booleanOption(flag, description, defaultValue = false) {
+  return new Option(`${flag} [bool]`, description).argParser(parseBoolean).preset(true).default(defaultValue);
+}
+function buildProgram(onRun) {
+  const program2 = new Command("saml-idp").description(
+    "Simple IdP for SAML 2.0 WebSSO & SLO Profile\n\nLaunches an IdP web server that mints SAML assertions or logout responses for a Service Provider (SP)"
+  ).usage("--acsUrl {url} --audience {uri} [options]").showHelpAfterError().configureHelp({ sortOptions: false }).addHelpText(
+    "after",
+    "\nAliases: --iss, --acs, --slo, --aud, --spId, --rs, --static, --enc, --encCert, --encKey, --conf, --acr, --acd\n\nExample:\n  saml-idp --acsUrl http://acme.okta.com/auth/saml20/exampleidp --audience https://www.okta.com/saml2/service-provider/spf5aFRRXFGIMAYXQPNV"
+  );
+  program2.addOption(new Option("--host <host>", "IdP Web Server Listener Host").default("localhost")).addOption(
+    new Option("-p, --port <port>", "IdP Web Server Listener Port").default(7e3).argParser((v) => {
+      const port = Number.parseInt(v, 10);
+      if (Number.isNaN(port) || port < 0 || port > 65535) throw new InvalidArgumentError("Invalid port.");
+      return port;
+    })
+  ).option("--cert <cert>", "IdP Signature PublicKey Certificate (PEM or path) [default: bundled test certificate]").option("--key <key>", "IdP Signature PrivateKey Certificate (PEM or path) [default: bundled test key]").addOption(new Option("--issuer <uri>", "IdP Issuer URI").default("urn:example:idp")).option("--acsUrl <url>", "SP Assertion Consumer URL").option("--sloUrl <url>", "SP Single Logout URL").option("--audience <uri>", "SP Audience URI").option("--serviceProviderId <uri>", "SP Issuer/Entity URI").option("--relayState <state>", "Default SAML RelayState for SAMLResponse").addOption(
+    booleanOption(
+      "--disableRequestAcsUrl",
+      "Disables ability for SP AuthnRequest to specify Assertion Consumer URL"
+    )
+  ).addOption(booleanOption("--encryptAssertion", "Encrypts assertion with SP Public Key")).option("--encryptionCert <cert>", "SP Certificate (pem) for Assertion Encryption").option(
+    "--encryptionPublicKey <key>",
+    "SP RSA Public Key (pem) for Assertion Encryption (derived from the certificate when omitted)"
+  ).option("--httpsPrivateKey <key>", "Web Server TLS/SSL Private Key (pem)").option("--httpsCert <cert>", "Web Server TLS/SSL Certificate (pem)").addOption(booleanOption("--https", "Enables HTTPS Listener (requires httpsPrivateKey and httpsCert)")).addOption(booleanOption("--signResponse", "Enables signing of responses", true)).addOption(
+    new Option("--configFile <path>", "Path to a SAML attribute config file").default("saml-idp/config.js")
+  ).addOption(
+    booleanOption(
+      "--rollSession",
+      "Create a new session for every authn request instead of reusing an existing session"
+    )
+  ).addOption(
+    new Option("--authnContextClassRef <uri>", "Authentication Context Class Reference").default(
+      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
+    )
+  ).option("--authnContextDecl <path>", "Authentication Context Declaration (XML FilePath)").addOption(
+    new Option("--logLevel <level>", "Verbosity of the logs (env: SAML_IDP_LOG_LEVEL)").choices(LOG_LEVELS)
+  ).addOption(booleanOption("--silent", "Disables logging (same as --logLevel silent)")).action(async (opts) => {
+    if (!opts.acsUrl) program2.error("error: required option '--acsUrl <url>' not specified");
+    if (!opts.audience) program2.error("error: required option '--audience <uri>' not specified");
+    try {
+      await onRun({
+        ...opts,
+        host: process.env.HOST ?? opts.host,
+        port: process.env.PORT ? Number.parseInt(process.env.PORT, 10) : opts.port
+      });
+    } catch (error) {
+      if (error instanceof OptionsError) {
+        console.error(pc.red(error.message));
+        process.exit(1);
+      }
+      throw error;
+    }
+  });
+  return program2;
+}
+const program = buildProgram(async (options) => {
+  await runServer(options);
+});
+await program.parseAsync(normalizeArgv(process.argv.slice(2)), { from: "user" });
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sources":["../src/cli-program.ts","../src/cli.ts"],"sourcesContent":["import { Command, InvalidArgumentError, Option } from 'commander';\nimport { LOG_LEVELS } from './log.js';\nimport pc from 'picocolors';\nimport { OptionsError, type IdpOptions } from './options.js';\n\n/** Long option aliases of the original `saml-idp` CLI. */\nexport const ALIASES: Record<string, string> = {\n  '--iss': '--issuer',\n  '--acs': '--acsUrl',\n  '--slo': '--sloUrl',\n  '--aud': '--audience',\n  '--spId': '--serviceProviderId',\n  '--rs': '--relayState',\n  '--static': '--disableRequestAcsUrl',\n  '--enc': '--encryptAssertion',\n  '--encCert': '--encryptionCert',\n  '--encKey': '--encryptionPublicKey',\n  '--conf': '--configFile',\n  '--acr': '--authnContextClassRef',\n  '--acd': '--authnContextDecl',\n};\n\nconst BOOLEAN_OPTIONS = [\n  'disableRequestAcsUrl',\n  'encryptAssertion',\n  'https',\n  'signResponse',\n  'rollSession',\n  'silent',\n];\n\n/**\n * Expands the aliases (`--acs` => `--acsUrl`) and the `--no-<flag>` form of boolean\n * flags (`--no-signResponse` => `--signResponse=false`).\n */\nexport function normalizeArgv(argv: string[]): string[] {\n  return argv.map((arg) => {\n    if (!arg.startsWith('--')) return arg;\n    const [flag, ...rest] = arg.split('=');\n    const value = rest.length ? `=${rest.join('=')}` : '';\n    const canonical = ALIASES[flag] ?? flag;\n    const negated = /^--no-(.+)$/.exec(canonical);\n    if (negated && BOOLEAN_OPTIONS.includes(negated[1]) && !value) {\n      return `--${negated[1]}=false`;\n    }\n    return canonical + value;\n  });\n}\n\nfunction parseBoolean(value: string): boolean {\n  if (['true', 'yes', '1'].includes(value.toLowerCase())) return true;\n  if (['false', 'no', '0'].includes(value.toLowerCase())) return false;\n  throw new InvalidArgumentError('Expected true or false.');\n}\n\nfunction booleanOption(flag: string, description: string, defaultValue = false): Option {\n  return new Option(`${flag} [bool]`, description)\n    .argParser(parseBoolean)\n    .preset(true)\n    .default(defaultValue);\n}\n\nexport function buildProgram(onRun: (options: IdpOptions) => Promise<void>): Command {\n  const program = new Command('saml-idp')\n    .description(\n      'Simple IdP for SAML 2.0 WebSSO & SLO Profile\\n\\n' +\n        'Launches an IdP web server that mints SAML assertions or logout responses for a Service Provider (SP)',\n    )\n    .usage('--acsUrl {url} --audience {uri} [options]')\n    .showHelpAfterError()\n    .configureHelp({ sortOptions: false })\n    .addHelpText(\n      'after',\n      '\\nAliases: --iss, --acs, --slo, --aud, --spId, --rs, --static, --enc, --encCert, --encKey, --conf, --acr, --acd\\n' +\n        '\\nExample:\\n  saml-idp --acsUrl http://acme.okta.com/auth/saml20/exampleidp ' +\n        '--audience https://www.okta.com/saml2/service-provider/spf5aFRRXFGIMAYXQPNV',\n    );\n\n  program\n    .addOption(new Option('--host <host>', 'IdP Web Server Listener Host').default('localhost'))\n    .addOption(\n      new Option('-p, --port <port>', 'IdP Web Server Listener Port')\n        .default(7000)\n        .argParser((v) => {\n          const port = Number.parseInt(v, 10);\n          if (Number.isNaN(port) || port < 0 || port > 65535) throw new InvalidArgumentError('Invalid port.');\n          return port;\n        }),\n    )\n    .option('--cert <cert>', 'IdP Signature PublicKey Certificate (PEM or path) [default: bundled test certificate]')\n    .option('--key <key>', 'IdP Signature PrivateKey Certificate (PEM or path) [default: bundled test key]')\n    .addOption(new Option('--issuer <uri>', 'IdP Issuer URI').default('urn:example:idp'))\n    .option('--acsUrl <url>', 'SP Assertion Consumer URL')\n    .option('--sloUrl <url>', 'SP Single Logout URL')\n    .option('--audience <uri>', 'SP Audience URI')\n    .option('--serviceProviderId <uri>', 'SP Issuer/Entity URI')\n    .option('--relayState <state>', 'Default SAML RelayState for SAMLResponse')\n    .addOption(\n      booleanOption(\n        '--disableRequestAcsUrl',\n        'Disables ability for SP AuthnRequest to specify Assertion Consumer URL',\n      ),\n    )\n    .addOption(booleanOption('--encryptAssertion', 'Encrypts assertion with SP Public Key'))\n    .option('--encryptionCert <cert>', 'SP Certificate (pem) for Assertion Encryption')\n    .option(\n      '--encryptionPublicKey <key>',\n      'SP RSA Public Key (pem) for Assertion Encryption (derived from the certificate when omitted)',\n    )\n    .option('--httpsPrivateKey <key>', 'Web Server TLS/SSL Private Key (pem)')\n    .option('--httpsCert <cert>', 'Web Server TLS/SSL Certificate (pem)')\n    .addOption(booleanOption('--https', 'Enables HTTPS Listener (requires httpsPrivateKey and httpsCert)'))\n    .addOption(booleanOption('--signResponse', 'Enables signing of responses', true))\n    .addOption(\n      new Option('--configFile <path>', 'Path to a SAML attribute config file').default('saml-idp/config.js'),\n    )\n    .addOption(\n      booleanOption(\n        '--rollSession',\n        'Create a new session for every authn request instead of reusing an existing session',\n      ),\n    )\n    .addOption(\n      new Option('--authnContextClassRef <uri>', 'Authentication Context Class Reference').default(\n        'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',\n      ),\n    )\n    .option('--authnContextDecl <path>', 'Authentication Context Declaration (XML FilePath)')\n    .addOption(\n      new Option('--logLevel <level>', 'Verbosity of the logs (env: SAML_IDP_LOG_LEVEL)').choices(LOG_LEVELS),\n    )\n    .addOption(booleanOption('--silent', 'Disables logging (same as --logLevel silent)'))\n    .action(async (opts: IdpOptions) => {\n      if (!opts.acsUrl) program.error(\"error: required option '--acsUrl <url>' not specified\");\n      if (!opts.audience) program.error(\"error: required option '--audience <uri>' not specified\");\n      try {\n        await onRun({\n          ...opts,\n          host: process.env.HOST ?? opts.host,\n          port: process.env.PORT ? Number.parseInt(process.env.PORT, 10) : opts.port,\n        });\n      } catch (error) {\n        if (error instanceof OptionsError) {\n          console.error(pc.red(error.message));\n          process.exit(1);\n        }\n        throw error;\n      }\n    });\n\n  return program;\n}\n","#!/usr/bin/env node\nimport { buildProgram, normalizeArgv } from './cli-program.js';\nimport { runServer } from './index.js';\n\nconst program = buildProgram(async (options) => {\n  await runServer(options);\n});\n\nawait program.parseAsync(normalizeArgv(process.argv.slice(2)), { from: 'user' });\n"],"names":["program"],"mappings":";;;;AAMO,MAAM,UAAkC;AAAA,EAC7C,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,SAAS;AAAA,EACT,SAAS;AACX;AAEA,MAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,SAAS,cAAc,MAA0B;AACtD,SAAO,KAAK,IAAI,CAAC,QAAQ;AACvB,QAAI,CAAC,IAAI,WAAW,IAAI,EAAG,QAAO;AAClC,UAAM,CAAC,MAAM,GAAG,IAAI,IAAI,IAAI,MAAM,GAAG;AACrC,UAAM,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG,CAAC,KAAK;AACnD,UAAM,YAAY,QAAQ,IAAI,KAAK;AACnC,UAAM,UAAU,cAAc,KAAK,SAAS;AAC5C,QAAI,WAAW,gBAAgB,SAAS,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO;AAC7D,aAAO,KAAK,QAAQ,CAAC,CAAC;AAAA,IACxB;AACA,WAAO,YAAY;AAAA,EACrB,CAAC;AACH;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI,CAAC,QAAQ,OAAO,GAAG,EAAE,SAAS,MAAM,aAAa,EAAG,QAAO;AAC/D,MAAI,CAAC,SAAS,MAAM,GAAG,EAAE,SAAS,MAAM,aAAa,EAAG,QAAO;AAC/D,QAAM,IAAI,qBAAqB,yBAAyB;AAC1D;AAEA,SAAS,cAAc,MAAc,aAAqB,eAAe,OAAe;AACtF,SAAO,IAAI,OAAO,GAAG,IAAI,WAAW,WAAW,EAC5C,UAAU,YAAY,EACtB,OAAO,IAAI,EACX,QAAQ,YAAY;AACzB;AAEO,SAAS,aAAa,OAAwD;AACnF,QAAMA,WAAU,IAAI,QAAQ,UAAU,EACnC;AAAA,IACC;AAAA,EAAA,EAGD,MAAM,2CAA2C,EACjD,mBAAA,EACA,cAAc,EAAE,aAAa,MAAA,CAAO,EACpC;AAAA,IACC;AAAA,IACA;AAAA,EAAA;AAKJ,EAAAA,SACG,UAAU,IAAI,OAAO,iBAAiB,8BAA8B,EAAE,QAAQ,WAAW,CAAC,EAC1F;AAAA,IACC,IAAI,OAAO,qBAAqB,8BAA8B,EAC3D,QAAQ,GAAI,EACZ,UAAU,CAAC,MAAM;AAChB,YAAM,OAAO,OAAO,SAAS,GAAG,EAAE;AAClC,UAAI,OAAO,MAAM,IAAI,KAAK,OAAO,KAAK,OAAO,MAAO,OAAM,IAAI,qBAAqB,eAAe;AAClG,aAAO;AAAA,IACT,CAAC;AAAA,EAAA,EAEJ,OAAO,iBAAiB,uFAAuF,EAC/G,OAAO,eAAe,gFAAgF,EACtG,UAAU,IAAI,OAAO,kBAAkB,gBAAgB,EAAE,QAAQ,iBAAiB,CAAC,EACnF,OAAO,kBAAkB,2BAA2B,EACpD,OAAO,kBAAkB,sBAAsB,EAC/C,OAAO,oBAAoB,iBAAiB,EAC5C,OAAO,6BAA6B,sBAAsB,EAC1D,OAAO,wBAAwB,0CAA0C,EACzE;AAAA,IACC;AAAA,MACE;AAAA,MACA;AAAA,IAAA;AAAA,EACF,EAED,UAAU,cAAc,sBAAsB,uCAAuC,CAAC,EACtF,OAAO,2BAA2B,+CAA+C,EACjF;AAAA,IACC;AAAA,IACA;AAAA,EAAA,EAED,OAAO,2BAA2B,sCAAsC,EACxE,OAAO,sBAAsB,sCAAsC,EACnE,UAAU,cAAc,WAAW,iEAAiE,CAAC,EACrG,UAAU,cAAc,kBAAkB,gCAAgC,IAAI,CAAC,EAC/E;AAAA,IACC,IAAI,OAAO,uBAAuB,sCAAsC,EAAE,QAAQ,oBAAoB;AAAA,EAAA,EAEvG;AAAA,IACC;AAAA,MACE;AAAA,MACA;AAAA,IAAA;AAAA,EACF,EAED;AAAA,IACC,IAAI,OAAO,gCAAgC,wCAAwC,EAAE;AAAA,MACnF;AAAA,IAAA;AAAA,EACF,EAED,OAAO,6BAA6B,mDAAmD,EACvF;AAAA,IACC,IAAI,OAAO,sBAAsB,iDAAiD,EAAE,QAAQ,UAAU;AAAA,EAAA,EAEvG,UAAU,cAAc,YAAY,8CAA8C,CAAC,EACnF,OAAO,OAAO,SAAqB;AAClC,QAAI,CAAC,KAAK,OAAQ,CAAAA,SAAQ,MAAM,uDAAuD;AACvF,QAAI,CAAC,KAAK,SAAU,CAAAA,SAAQ,MAAM,yDAAyD;AAC3F,QAAI;AACF,YAAM,MAAM;AAAA,QACV,GAAG;AAAA,QACH,MAAM,QAAQ,IAAI,QAAQ,KAAK;AAAA,QAC/B,MAAM,QAAQ,IAAI,OAAO,OAAO,SAAS,QAAQ,IAAI,MAAM,EAAE,IAAI,KAAK;AAAA,MAAA,CACvE;AAAA,IACH,SAAS,OAAO;AACd,UAAI,iBAAiB,cAAc;AACjC,gBAAQ,MAAM,GAAG,IAAI,MAAM,OAAO,CAAC;AACnC,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA,YAAM;AAAA,IACR;AAAA,EACF,CAAC;AAEH,SAAOA;AACT;ACnJA,MAAM,UAAU,aAAa,OAAO,YAAY;AAC9C,QAAM,UAAU,OAAO;AACzB,CAAC;AAED,MAAM,QAAQ,WAAW,cAAc,QAAQ,KAAK,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,OAAA,CAAQ;"}