saml-test-server 0.0.0-stage → 1.0.0

package/dist/types/log.d.ts

@@ -0,0 +1,26 @@
+import type { ResolvedOptions } from './options.js';
+export declare const UNDEFINED_VALUE = "None";
+export declare const LOG_LEVELS: readonly ["silent", "error", "info"];
+/**
+ * - `silent`: no output at all
+ * - `error`: only unexpected errors (HTTP 5xx), on stderr
+ * - `info`: banners, requests and SAML messages (default)
+ */
+export type LogLevel = (typeof LOG_LEVELS)[number];
+export declare function isLogLevel(value: unknown): value is LogLevel;
+export interface Logger {
+    /** Informational output (shown at level `info`). */
+    log(message?: string, ...rest: unknown[]): void;
+    /** Errors (shown at levels `error` and `info`). */
+    error(message?: string, ...rest: unknown[]): void;
+}
+export declare function createLogger(level?: LogLevel): Logger;
+/** Pretty prints XML with syntax coloring (used to log SAML responses). */
+export declare function prettyPrintXml(xml: string, indent?: number): string;
+/** Short, single line representation of an option value for logs. */
+export declare function formatOptionValue(key: string, value: unknown): string;
+export declare function describeRecord(record: Record<string, unknown>, indent: number, format?: typeof formatOptionValue): string;
+/** Startup banner describing the effective configuration. */
+export declare function configBanner(options: ResolvedOptions): string;
+/** Banner printed once the server listens. */
+export declare function listeningBanner(baseUrl: string, sloEnabled: boolean): string;

package/dist/types/options.d.ts

@@ -0,0 +1,111 @@
+import { type IdpConfig } from './default-config.js';
+import { type LogLevel } from './log.js';
+/** Root of the package (works from `src/` and from the built `dist/`). */
+export declare const PACKAGE_ROOT: string;
+/** Special `configFile` value that selects the built-in default user + metadata. */
+export declare const DEFAULT_CONFIG_FILE = "saml-idp/config.js";
+export declare const KEY_CERT_HELP_TEXT = "To generate a key/cert pair for the IdP, run the following command:\n\n  openssl req -x509 -new -newkey rsa:2048 -nodes \\\n    -subj '/C=US/ST=California/L=San Francisco/O=JankyCo/CN=Test Identity Provider' \\\n    -keyout idp-private-key.pem \\\n    -out idp-public-cert.pem -days 7300";
+declare const CRYPT_TYPES: {
+    readonly certificate: RegExp;
+    readonly 'private key': RegExp;
+    readonly 'public key': RegExp;
+};
+type CryptType = keyof typeof CRYPT_TYPES;
+/** Thrown when the options are invalid. The message is meant to be shown to the user. */
+export declare class OptionsError extends Error {
+    constructor(message: string);
+}
+/** A PEM string / Buffer, or the path of a PEM file. */
+export type PemOrPath = string | Buffer;
+/** Options of the IdP. They match the CLI flags of the original `saml-idp`. */
+export interface IdpOptions {
+    /** IdP web server listener host. Default: `localhost`. */
+    host?: string;
+    /** IdP web server listener port (`0` picks a free port). Default: `7000`. */
+    port?: number;
+    /** IdP signature public key certificate (PEM or path). Defaults to the bundled test certificate. */
+    cert?: PemOrPath;
+    /** IdP signature private key (PEM or path). Defaults to the bundled test key. */
+    key?: PemOrPath;
+    /** IdP issuer URI. Default: `urn:example:idp`. */
+    issuer?: string;
+    /** SP Assertion Consumer Service URL. */
+    acsUrl: string;
+    /** SP single logout URL. Enables SLO when set. */
+    sloUrl?: string;
+    /** SP audience URI. */
+    audience: string;
+    /** SP issuer / entity URI. Defaults to the audience. */
+    serviceProviderId?: string;
+    /** Default SAML RelayState. */
+    relayState?: string;
+    /** Ignore the ACS URL of the AuthnRequest. */
+    disableRequestAcsUrl?: boolean;
+    /** Encrypt the assertion with the SP public key. */
+    encryptAssertion?: boolean;
+    /** SP certificate (PEM or path) used for assertion encryption. */
+    encryptionCert?: PemOrPath;
+    /** SP RSA public key (PEM or path). Derived from `encryptionCert` when omitted. */
+    encryptionPublicKey?: PemOrPath;
+    /** Web server TLS private key (PEM or path). */
+    httpsPrivateKey?: PemOrPath;
+    /** Web server TLS certificate (PEM or path). */
+    httpsCert?: PemOrPath;
+    /** Enable the HTTPS listener (requires `httpsPrivateKey` and `httpsCert`). */
+    https?: boolean;
+    /** Sign the SAML Response (the assertion is always signed). Default: `true`. */
+    signResponse?: boolean;
+    /**
+     * Path to a module (`.js`, `.mjs`, `.json`) that exports `{ user, metadata }`.
+     * Ignored when `config` is given.
+     */
+    configFile?: string;
+    /** Inline user profile and attribute metadata (overrides `configFile`). */
+    config?: Partial<IdpConfig>;
+    /** Create a new session for every authn request. Default: `false`. */
+    rollSession?: boolean;
+    /** Authentication Context Class Reference. */
+    authnContextClassRef?: string;
+    /** Authentication Context Declaration (XML or path to an XML file). */
+    authnContextDecl?: string;
+    /**
+     * Verbosity of the logs: `silent` (nothing), `error` (unexpected errors only) or `info`.
+     * Defaults to the `SAML_IDP_LOG_LEVEL` environment variable, then to `info`.
+     */
+    logLevel?: LogLevel;
+    /** @deprecated Use `logLevel: 'silent'`. */
+    silent?: boolean;
+}
+export interface ResolvedOptions {
+    host: string;
+    port: number;
+    cert: string;
+    key: string;
+    issuer: string;
+    acsUrl: string;
+    sloUrl?: string;
+    audience: string;
+    serviceProviderId: string;
+    relayState?: string;
+    disableRequestAcsUrl: boolean;
+    encryptAssertion: boolean;
+    encryptionCert?: string;
+    encryptionPublicKey?: string;
+    httpsPrivateKey?: string;
+    httpsCert?: string;
+    https: boolean;
+    signResponse: boolean;
+    rollSession: boolean;
+    authnContextClassRef?: string;
+    authnContextDecl?: string;
+    logLevel: LogLevel;
+    config: IdpConfig;
+}
+export declare function matchesCertType(value: string, type: CryptType): boolean;
+/** Resolves a file path option, the same way the original `saml-idp` did. */
+export declare function resolveFilePath(filePath: string): string | undefined;
+/** Accepts PEM content or a file path and returns the PEM content. */
+export declare function coerceCertFile(value: PemOrPath, type: CryptType, description: string, helpText?: string): string;
+/** Validates the options, applies defaults and reads certificates / config files. */
+export declare function resolveOptions(options: IdpOptions): Promise<ResolvedOptions>;
+export {};

package/dist/types/profile-mapper.d.ts

@@ -0,0 +1,10 @@
+import type { ClaimMetadata, ProfileMapper } from './vendor/samlp/index.js';
+type User = Record<string, string | undefined>;
+/**
+ * Maps the flat user profile to SAML attributes using the attribute metadata:
+ * each metadata entry is an attribute; multi-value attributes are comma separated.
+ *
+ * `getMetadata` is called on every use so edits to the metadata at runtime are honored.
+ */
+export declare function createSimpleProfileMapper(getMetadata: () => ClaimMetadata[]): ProfileMapper<User>;
+export {};

package/dist/types/session.d.ts

@@ -0,0 +1,36 @@
+import type { MiddlewareHandler } from 'hono';
+import type { LogoutStore } from './vendor/samlp/index.js';
+export declare const SESSION_COOKIE = "idp_sid";
+/** Server-side session of the browser (identified by a signed cookie). */
+export declare class Session {
+    private readonly store;
+    id: string;
+    /** Arbitrary per-session data. */
+    data: Record<string, any>;
+    destroyed: boolean;
+    constructor(id: string, store: SessionStore);
+    /** Destroys the session. The cookie is cleared at the end of the request. */
+    destroy(): void;
+    /** Replaces the session id (and drops the data), like express-session's `regenerate()`. */
+    regenerate(): void;
+}
+/** In-memory session store with a sliding 1 hour TTL. */
+export declare class SessionStore {
+    private readonly entries;
+    create(): Session;
+    get(id: string): Session | undefined;
+    set(session: Session): void;
+    delete(id: string): void;
+    clear(): void;
+}
+export interface SessionVariables {
+    session: Session;
+}
+/** Hono middleware that attaches a `session` to the context (cookie: `idp_sid`). */
+export declare function sessionMiddleware(store: SessionStore, secret: string): MiddlewareHandler<{
+    Variables: SessionVariables;
+}>;
+/** Same session index derivation as the original saml-idp. */
+export declare function getSessionIndex(session: Session): string;
+/** Keeps the state of in-flight Single Logout transactions in the session. */
+export declare function createLogoutStore(session: Session): LogoutStore;

package/dist/types/state.d.ts

@@ -0,0 +1,49 @@
+import type { UserProfile } from './default-config.js';
+import type { ResolvedOptions } from './options.js';
+import type { ClaimMetadata } from './vendor/samlp/index.js';
+import type { DigestAlgorithm, SignatureAlgorithm } from './vendor/saml/sign.js';
+export declare const IDP_PATHS: {
+    readonly SSO: "/saml/sso";
+    readonly SLO: "/saml/slo";
+    readonly METADATA: "/metadata";
+    readonly SIGN_IN: "/signin";
+    readonly SIGN_OUT: "/signout";
+    readonly SETTINGS: "/settings";
+};
+/** IdP settings. They can be changed at runtime from the settings page (or by tests). */
+export interface IdpSettings {
+    issuer: string;
+    serviceProviderId: string;
+    cert: string;
+    key: string;
+    audience: string;
+    recipient: string;
+    destination: string;
+    acsUrl: string;
+    sloUrl?: string;
+    RelayState?: string;
+    allowRequestAcsUrl: boolean;
+    digestAlgorithm: DigestAlgorithm;
+    signatureAlgorithm: SignatureAlgorithm;
+    signResponse: boolean;
+    encryptAssertion: boolean;
+    encryptionCert?: string;
+    encryptionPublicKey?: string;
+    encryptionAlgorithm: string;
+    keyEncryptionAlgorithm: string;
+    lifetimeInSeconds: number;
+    authnContextClassRef?: string;
+    authnContextDecl?: string;
+    includeAttributeNameFormat: boolean;
+}
+/** Mutable state shared by all the requests served by an IdP instance. */
+export interface IdpState {
+    settings: IdpSettings;
+    /** The user that is "signed in". Updated by the sign-in form. */
+    user: UserProfile;
+    /** SAML attributes (claims) the IdP can issue. */
+    metadata: ClaimMetadata[];
+    /** Restores settings, user and metadata to the values the IdP was started with. */
+    reset(): void;
+}
+export declare function createState(options: ResolvedOptions): IdpState;

package/dist/types/vendor/saml/encrypt.d.ts

@@ -0,0 +1,16 @@
+import { type PemInput } from './utils.js';
+export interface EncryptXmlOptions {
+    /** Service Provider certificate (PEM). */
+    encryptionCert: PemInput;
+    /**
+     * Service Provider RSA public key (PEM). Derived from `encryptionCert`
+     * when omitted.
+     */
+    encryptionPublicKey?: PemInput;
+    encryptionAlgorithm?: string;
+    keyEncryptionAlgorithm?: string;
+}
+export declare const DEFAULT_ENCRYPTION_ALGORITHM = "http://www.w3.org/2001/04/xmlenc#aes256-cbc";
+export declare const DEFAULT_KEY_ENCRYPTION_ALGORITHM = "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p";
+/** Encrypts an XML fragment for the given Service Provider (XML Encryption). */
+export declare function encryptXml(xml: string, options: EncryptXmlOptions): Promise<string>;

package/dist/types/vendor/saml/index.d.ts

@@ -0,0 +1,7 @@
+export { createAssertion, buildAssertionDocument, SAML_ASSERTION_NS } from './saml20.js';
+export type { Saml20Options, Attributes, AttributeValue } from './saml20.js';
+export { signXml, SIGNATURE_ALGORITHMS, DIGEST_ALGORITHMS } from './sign.js';
+export type { SignatureAlgorithm, DigestAlgorithm } from './sign.js';
+export { encryptXml } from './encrypt.js';
+export { escapeXml, pemToCert, removeWhitespace, fixPemFormatting } from './utils.js';
+export type { PemInput } from './utils.js';

package/dist/types/vendor/saml/saml20.d.ts

@@ -0,0 +1,47 @@
+import { DOMParser } from '@xmldom/xmldom';
+import { type DigestAlgorithm, type SignatureAlgorithm } from './sign.js';
+import { type PemInput } from './utils.js';
+/** DOM document type produced by `@xmldom/xmldom`. */
+export type XmlDocument = ReturnType<DOMParser['parseFromString']>;
+export declare const SAML_ASSERTION_NS = "urn:oasis:names:tc:SAML:2.0:assertion";
+export type AttributeValue = string | number | boolean | undefined;
+export type Attributes = Record<string, AttributeValue | AttributeValue[]>;
+export interface Saml20Options {
+    uid?: string;
+    issuer?: string;
+    lifetimeInSeconds?: number;
+    audiences?: string | string[];
+    recipient?: string;
+    inResponseTo?: string;
+    attributes?: Attributes;
+    includeAttributeNameFormat?: boolean;
+    typedAttributes?: boolean;
+    sessionIndex?: string;
+    nameIdentifier?: string;
+    nameIdentifierFormat?: string;
+    nameIdentifierNameQualifier?: string;
+    nameIdentifierSPNameQualifier?: string;
+    nameIdentifierSPProvidedID?: string;
+    authnContextClassRef?: string;
+    /** Lets the caller mutate the assertion DOM before it is signed. */
+    transformAssertion?: (doc: XmlDocument) => void;
+    signAssertion?: boolean;
+    key?: PemInput;
+    cert?: PemInput;
+    signatureAlgorithm?: SignatureAlgorithm;
+    digestAlgorithm?: DigestAlgorithm;
+    signatureNamespacePrefix?: string;
+    encryptionCert?: PemInput;
+    encryptionPublicKey?: PemInput;
+    encryptionAlgorithm?: string;
+    keyEncryptionAlgorithm?: string;
+}
+/** Builds the assertion DOM (unsigned, unencrypted). */
+export declare function buildAssertionDocument(options: Saml20Options): XmlDocument;
+/**
+ * Creates a SAML 2.0 assertion.
+ *
+ * The assertion is signed unless `signAssertion === false` and is wrapped in a
+ * `<saml:EncryptedAssertion>` when `encryptionCert` is provided.
+ */
+export declare function createAssertion(options: Saml20Options): Promise<string>;

package/dist/types/vendor/saml/sign.d.ts

@@ -0,0 +1,30 @@
+import { type PemInput } from './utils.js';
+export declare const SIGNATURE_ALGORITHMS: {
+    readonly 'rsa-sha256': "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";
+    readonly 'rsa-sha1': "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
+};
+export declare const DIGEST_ALGORITHMS: {
+    readonly sha256: "http://www.w3.org/2001/04/xmlenc#sha256";
+    readonly sha1: "http://www.w3.org/2000/09/xmldsig#sha1";
+};
+export type SignatureAlgorithm = keyof typeof SIGNATURE_ALGORITHMS;
+export type DigestAlgorithm = keyof typeof DIGEST_ALGORITHMS;
+export declare const ENVELOPED_SIGNATURE = "http://www.w3.org/2000/09/xmldsig#enveloped-signature";
+export declare const EXC_C14N = "http://www.w3.org/2001/10/xml-exc-c14n#";
+export interface SignXmlOptions {
+    key: PemInput;
+    cert: PemInput;
+    signatureAlgorithm?: SignatureAlgorithm;
+    digestAlgorithm?: DigestAlgorithm;
+    /** Namespace prefix of the generated `<Signature>` element (default: none). */
+    signatureNamespacePrefix?: string;
+    /** XPath of the element that the signature is placed after. */
+    xpathToNodeBeforeSignature: string;
+    /** XPath of the element to sign. */
+    xpathToSign: string;
+    signatureIdAttribute?: string;
+}
+/** Signs an XML string with an enveloped, exclusive-c14n XML signature. */
+export declare function signXml(xml: string, options: SignXmlOptions): string;
+/** Serializes without signing (strategy used when `signAssertion` is false). */
+export declare function unsigned(xml: string): string;

package/dist/types/vendor/saml/utils.d.ts

@@ -0,0 +1,18 @@
+export type PemInput = string | Buffer;
+/** Strips the PEM armor from a certificate and returns the base64 body on a single line. */
+export declare function pemToCert(pem: PemInput): string | null;
+/** Returns a random alphanumeric identifier of the given length. */
+export declare function uid(len: number): string;
+export declare function removeWhitespace(xml: string): string;
+/**
+ * Standardizes PEM content to match the spec (best effort).
+ * The original value is returned unmodified if the content is not PEM.
+ */
+export declare function fixPemFormatting(pem: PemInput): PemInput;
+/**
+ * Formats a date as an `xs:dateTime` in UTC with millisecond precision
+ * (`YYYY-MM-DDTHH:mm:ss.SSSZ`).
+ */
+export declare function formatInstant(date: Date): string;
+/** Escapes a string for use in XML text or double-quoted attribute values. */
+export declare function escapeXml(value: unknown): string;

package/dist/types/vendor/samlp/auth.d.ts

@@ -0,0 +1,87 @@
+import { type Saml20Options } from '../saml/saml20.js';
+import type { DigestAlgorithm, SignatureAlgorithm } from '../saml/sign.js';
+import { removeHeaders } from './encoders.js';
+import { type ProfileMapper } from './profile-mapper.js';
+import { type ParseRequestOptions, type SamlHttpInput } from './utils.js';
+import { type XmlDocument } from './xml.js';
+/** Error that carries the HTTP status the caller should answer with. */
+export declare class SamlpError extends Error {
+    status: number;
+    context?: unknown;
+    constructor(message: string, status?: number, context?: unknown);
+}
+export interface ResponseOptions extends Omit<Saml20Options, 'attributes' | 'audiences' | 'nameIdentifier'> {
+    issuer: string;
+    cert: string | Buffer;
+    key: string | Buffer;
+    audience?: string;
+    destination?: string;
+    signResponse?: boolean;
+    signAssertion?: boolean;
+    signatureAlgorithm?: SignatureAlgorithm;
+    digestAlgorithm?: DigestAlgorithm;
+    signatureNamespacePrefix?: string;
+    profileMapper?: ProfileMapper;
+    nameIdentifierProbes?: string[];
+    samlStatusCode?: string;
+    samlStatusMessage?: string;
+}
+export interface AuthOptions extends ResponseOptions, ParseRequestOptions {
+    RelayState?: string;
+    /** Resolves where the SAMLResponse is posted to. */
+    getPostURL: (audience: string | undefined, authnRequest: XmlDocument | undefined) => string | undefined | Promise<string | undefined>;
+}
+export interface PostForm {
+    /** Form action (Assertion Consumer Service URL). */
+    url: string;
+    /** `SAMLResponse` or `SAMLRequest`. */
+    field: 'SAMLResponse' | 'SAMLRequest';
+    /** Base64 value of the SAML message. */
+    value: string;
+    relayState: string;
+}
+export interface AuthResult extends PostForm {
+    /** The XML of the (signed) SAML Response. */
+    xml: string;
+    /** Options that were effective for this response. */
+    options: AuthOptions & {
+        postUrl: string;
+        audience?: string;
+    };
+}
+export declare function buildSamlResponse(options: ResponseOptions & {
+    samlAssertion?: string;
+    inResponseTo?: string;
+}): string;
+/** Maps `user` to claims, builds + signs (+ encrypts) the assertion and wraps it in a Response. */
+export declare function createSamlResponse(samlConfig: ResponseOptions, user: unknown): Promise<string>;
+/**
+ * Handles an SP-initiated or IdP-initiated SSO request for an authenticated user:
+ * parses the optional AuthnRequest, then mints a SAML Response for `user`.
+ */
+export declare function authenticate(input: SamlHttpInput, options: AuthOptions, user: unknown): Promise<AuthResult>;
+export interface AuthnRequestData {
+    id?: string;
+    issuer?: string;
+    subject?: string;
+    destination?: string;
+    assertionConsumerServiceURL?: string;
+    forceAuthn?: string;
+    requestedAuthnContext?: {
+        authnContextClassRef: string;
+    };
+}
+/** Parses an incoming `AuthnRequest`. Returns `undefined` when the request carries none. */
+export declare function parseRequest(input: SamlHttpInput, options?: ParseRequestOptions): Promise<AuthnRequestData | undefined>;
+export interface ErrorResponseOptions extends ResponseOptions {
+    RelayState?: string;
+    error?: {
+        code?: string;
+        description?: string;
+    };
+    postUrl: string;
+    inResponseTo?: string;
+}
+/** Builds a (signed) error Response to be posted back to the SP. */
+export declare function createErrorResponse(options: ErrorResponseOptions): PostForm;
+export { removeHeaders };

package/dist/types/vendor/samlp/constants.d.ts

@@ -0,0 +1,30 @@
+export declare const BINDINGS: {
+    readonly HTTP_POST: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+    readonly HTTP_REDIRECT: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
+};
+export declare const STATUS: {
+    readonly SUCCESS: "urn:oasis:names:tc:SAML:2.0:status:Success";
+    readonly PARTIAL_LOGOUT: "urn:oasis:names:tc:SAML:2.0:status:PartialLogout";
+    readonly RESPONDER: "urn:oasis:names:tc:SAML:2.0:status:Responder";
+};
+export type ElementType = 'LOGOUT_REQUEST' | 'LOGOUT_RESPONSE' | 'RESPONSE' | 'AUTHN_REQUEST';
+export interface ElementDescriptor {
+    PROP: 'SAMLRequest' | 'SAMLResponse';
+    SIGNATURE_VALIDATION_PATH?: string;
+    SIGNATURE_LOCATION_PATH?: string;
+    ISSUER_PATH?: string;
+    SESSION_INDEX_PATH?: string;
+    NAME_ID?: string;
+    AUTHN_CONTEXT_CLASS_REF_PATH?: string;
+}
+export declare const ELEMENTS: Record<ElementType, ElementDescriptor>;
+export declare const ALGORITHMS: {
+    readonly SIGNATURE: {
+        readonly 'rsa-sha256': "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";
+        readonly 'rsa-sha1': "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
+    };
+    readonly DIGEST: {
+        readonly sha256: "http://www.w3.org/2001/04/xmlenc#sha256";
+        readonly sha1: "http://www.w3.org/2000/09/xmldsig#sha1";
+    };
+};

package/dist/types/vendor/samlp/encoders.d.ts

@@ -0,0 +1,5 @@
+/** Returns the base64 body of the first PEM block (no armor, no line breaks). */
+export declare function removeHeaders(cert: string | Buffer): string | null;
+/** SHA-1 thumbprint (upper-case hex) of a base64 DER certificate. */
+export declare function calculateThumbprint(base64Cert: string): string;
+export declare function thumbprint(pem: string | Buffer): string;

package/dist/types/vendor/samlp/index.d.ts

@@ -0,0 +1,14 @@
+export { authenticate, buildSamlResponse, createErrorResponse, createSamlResponse, parseRequest, SamlpError, } from './auth.js';
+export type { AuthnRequestData, AuthOptions, AuthResult, ErrorResponseOptions, PostForm, ResponseOptions, } from './auth.js';
+export { logout, createLogoutError } from './logout.js';
+export type { LogoutErrorOptions, LogoutOptions, LogoutResult, LogoutState, LogoutStore } from './logout.js';
+export { buildMetadata } from './metadata.js';
+export type { MetadataOptions } from './metadata.js';
+export { SessionParticipants } from './session-participants.js';
+export type { SessionParticipant } from './session-participants.js';
+export { passportProfileMapper } from './profile-mapper.js';
+export type { ClaimMetadata, NameIdentifier, ProfileMapper } from './profile-mapper.js';
+export { BINDINGS, STATUS } from './constants.js';
+export { thumbprint, removeHeaders } from './encoders.js';
+export type { SamlHttpInput, ParseRequestOptions } from './utils.js';
+export type { Attributes, AttributeValue } from '../saml/saml20.js';

package/dist/types/vendor/samlp/logout.d.ts

@@ -0,0 +1,66 @@
+import type { DigestAlgorithm, SignatureAlgorithm } from '../saml/sign.js';
+import { type PostForm } from './auth.js';
+import { SessionParticipants } from './session-participants.js';
+import { type SamlHttpInput } from './utils.js';
+export type LogoutState = Record<string, any>;
+/** Persists the state of an in-flight logout transaction (keyed by an opaque handle). */
+export interface LogoutStore {
+    /** Stores the state and returns its handle (used as `RelayState`). */
+    save(state: LogoutState): string;
+    load(handle: string | undefined, options?: {
+        destroy?: boolean;
+    }): LogoutState | undefined;
+    update(handle: string, state: LogoutState): void;
+}
+export interface LogoutOptions {
+    issuer: string;
+    cert: string | Buffer;
+    key: string | Buffer;
+    digestAlgorithm?: DigestAlgorithm;
+    signatureAlgorithm?: SignatureAlgorithm;
+    sessionParticipants: SessionParticipants;
+    store: LogoutStore;
+    /** Called once all participants are logged out. */
+    clearIdPSession?: () => void | Promise<void>;
+    /** Fallback SP logout URL. */
+    destination?: string;
+    protocolBinding?: string;
+    /** Deflate + detached signature (HTTP-Redirect binding). */
+    deflate?: boolean;
+    samlStatusMessage?: string;
+}
+export type LogoutResult = ({
+    type: 'post';
+} & PostForm) | {
+    type: 'redirect';
+    url: string;
+}
+/** IdP-initiated flow finished: reply with an empty 200. */
+ | {
+    type: 'done';
+};
+/**
+ * Handles the three legs of the SAML Single Logout profile:
+ * - SP-initiated: an incoming `SAMLRequest` (LogoutRequest)
+ * - in-flight: an incoming `SAMLResponse` (LogoutResponse) from a participant
+ * - IdP-initiated: neither, starts the logout of all session participants
+ */
+export declare function logout(input: SamlHttpInput, options: LogoutOptions): Promise<LogoutResult>;
+export interface LogoutErrorOptions {
+    issuer: string;
+    cert: string | Buffer;
+    key: string | Buffer;
+    destination?: string;
+    inResponseTo?: string;
+    relayState?: string;
+    error?: {
+        code?: string;
+        description?: string;
+    };
+    digestAlgorithm?: DigestAlgorithm;
+    signatureAlgorithm?: SignatureAlgorithm;
+    protocolBinding?: string;
+    deflate?: boolean;
+}
+/** Builds a signed `LogoutResponse` carrying an error status. */
+export declare function createLogoutError(input: SamlHttpInput, options: LogoutErrorOptions): Promise<LogoutResult>;

package/dist/types/vendor/samlp/metadata.d.ts

@@ -0,0 +1,22 @@
+import { type ProfileMapper } from './profile-mapper.js';
+export interface MetadataOptions {
+    issuer: string;
+    cert: string | Buffer;
+    /** Defaults to the Passport profile mapper. */
+    profileMapper?: ProfileMapper;
+    /** Path of the HTTP-Redirect SingleSignOnService (appended to the origin). */
+    redirectEndpointPath?: string;
+    /** Path of the HTTP-POST SingleSignOnService (appended to the origin). */
+    postEndpointPath?: string;
+    /** Paths of the SingleLogoutService endpoints. */
+    logoutEndpointPaths?: {
+        redirect?: string;
+        post?: string;
+    };
+}
+/**
+ * Builds the IdP SAML metadata document.
+ *
+ * @param origin scheme + host the IdP is reachable at, e.g. `https://idp.example.com`
+ */
+export declare function buildMetadata(options: MetadataOptions, origin: string): string;

package/dist/types/vendor/samlp/profile-mapper.d.ts

@@ -0,0 +1,38 @@
+import type { Attributes } from '../saml/saml20.js';
+export interface ClaimMetadata {
+    id: string;
+    optional?: boolean;
+    displayName: string;
+    description?: string;
+    multiValue?: boolean;
+    options?: string[];
+}
+export interface NameIdentifier {
+    nameIdentifier?: string;
+    nameIdentifierFormat?: string;
+    nameIdentifierNameQualifier?: string;
+    nameIdentifierSPNameQualifier?: string;
+    nameIdentifierSPProvidedID?: string;
+}
+/** Maps an application user profile to SAML claims and a NameID. */
+export interface ProfileMapper<TUser = any> {
+    /** Claims advertised in the IdP metadata. */
+    metadata: ClaimMetadata[];
+    getClaims(user: TUser): Attributes | undefined;
+    getNameIdentifier(user: TUser): NameIdentifier;
+}
+interface PassportUser {
+    id?: string;
+    emails?: Array<{
+        value?: string;
+    }>;
+    displayName?: string;
+    name?: {
+        givenName?: string;
+        familyName?: string;
+    };
+    [key: string]: unknown;
+}
+/** Default mapper: maps a Passport.js user profile to WS-Federation style claims. */
+export declare const passportProfileMapper: ProfileMapper<PassportUser>;
+export {};

package/dist/types/vendor/samlp/session-participants.d.ts

@@ -0,0 +1,22 @@
+export interface SessionParticipant {
+    serviceProviderId?: string;
+    sessionIndex?: string;
+    nameId?: string;
+    nameIdFormat?: string;
+    serviceProviderLogoutURL?: string;
+    /** Certificate used to validate signed messages from the participant. */
+    cert?: string | Buffer;
+    thumbprint?: string;
+}
+/** In-memory list of the Service Providers that take part in a user's session. */
+export declare class SessionParticipants {
+    private participants;
+    constructor(sessions?: SessionParticipant[]);
+    /** Finds a participant by issuer (optional), session index and NameID. */
+    get(issuer: string | undefined, sessionIndices: string | string[] | undefined, nameId: string | undefined): SessionParticipant | undefined;
+    hasElements(): boolean;
+    /** Returns the first participant without removing it. */
+    getFirst(): SessionParticipant | undefined;
+    /** Removes and returns the matching participant (if any). */
+    remove(issuer: string | undefined, sessionIndex: string | undefined, nameId: string | undefined): SessionParticipant | null;
+}