saml-test-server 0.0.0-stage → 1.0.0

package/dist/types/vendor/samlp/signers.d.ts

@@ -0,0 +1,43 @@
+import { ALGORITHMS } from './constants.js';
+import { type XmlDocument } from './xml.js';
+type SignatureAlgorithmName = keyof typeof ALGORITHMS.SIGNATURE;
+type DigestAlgorithmName = keyof typeof ALGORITHMS.DIGEST;
+export interface SigningOptions {
+    key: string | Buffer;
+    cert: string | Buffer;
+    signatureAlgorithm?: SignatureAlgorithmName;
+    digestAlgorithm?: DigestAlgorithmName;
+    /** XPath of the element to sign (default: `<LogoutRequest>`). */
+    reference?: string;
+}
+export interface ValidationOptions {
+    signingCert?: string | Buffer;
+    thumbprints?: string | string[];
+}
+export declare function getSigAlg(options: {
+    signatureAlgorithm?: SignatureAlgorithmName;
+}): string;
+/** Adds an enveloped signature (placed after `<Issuer>`) to the root element. */
+export declare function signXml(options: SigningOptions, xml: string): string;
+export declare function certToPEM(cert: string | Buffer): string;
+/**
+ * Validates the enveloped signature of the root element of `xml`.
+ *
+ * - If thumbprints are configured, the certificate embedded in `<KeyInfo>` is
+ *   used and its thumbprint must match one of them.
+ * - Otherwise the configured `signingCert` is the only trusted key.
+ *
+ * @returns a list of validation errors (empty when the signature is valid)
+ */
+export declare function validateXmlEmbeddedSignature(xml: XmlDocument, xmlString: string, options: ValidationOptions): string[];
+/** Computes a detached signature (HTTP-Redirect binding) over `content`. */
+export declare function sign(options: {
+    key: string | Buffer;
+    signatureAlgorithm?: SignatureAlgorithmName;
+}, content: string): string;
+/** Verifies a detached signature. `signatureAlgorithm` is the `SigAlg` URI. */
+export declare function isValidContentAndSignature(content: string, signature: string, options: {
+    signingCert: string | Buffer;
+    signatureAlgorithm: string;
+}): boolean;
+export {};

package/dist/types/vendor/samlp/templates.d.ts

@@ -0,0 +1,52 @@
+export interface SamlResponseData {
+    id: string;
+    instant: string;
+    destination?: string;
+    inResponseTo?: string;
+    issuer: string;
+    samlStatusCode: string;
+    samlStatusMessage?: string;
+    /** Raw (already serialized) assertion XML. */
+    assertion?: string;
+}
+export declare function samlResponse(data: SamlResponseData): string;
+export interface LogoutResponseData {
+    id: string;
+    instant: string;
+    destination?: string;
+    inResponseTo?: string;
+    issuer: string;
+    samlStatusCode: string;
+    samlStatusMessage?: string;
+}
+export declare function logoutResponse(data: LogoutResponseData): string;
+export interface LogoutRequestData {
+    ID: string;
+    IssueInstant: string;
+    Issuer: string;
+    Destination?: string;
+    NameID: {
+        value?: string;
+        Format?: string;
+        NameQualifier?: string;
+        SPNameQualifier?: string;
+        SPProvidedID?: string;
+    };
+    SessionIndex?: string;
+}
+export declare function logoutRequest(data: LogoutRequestData): string;
+export interface MetadataData {
+    issuer: string;
+    pem: string;
+    redirectEndpoint: string;
+    postEndpoint: string;
+    logoutEndpoints: {
+        redirect?: string;
+        post?: string;
+    };
+    claimTypes: Array<{
+        id: string;
+        displayName: string;
+    }>;
+}
+export declare function metadata(data: MetadataData): string;

package/dist/types/vendor/samlp/trim-xml.d.ts

@@ -0,0 +1,2 @@
+/** Removes whitespace-only text nodes and re-serializes the document. */
+export declare function trimXml(xml: string): string;

package/dist/types/vendor/samlp/utils.d.ts

@@ -0,0 +1,55 @@
+import { type ElementType } from './constants.js';
+import { type XmlDocument } from './xml.js';
+/** Minimal, framework-agnostic view of an incoming HTTP request. */
+export interface SamlHttpInput {
+    query: Record<string, string | undefined>;
+    body: Record<string, string | undefined>;
+}
+export interface SigningCredentials {
+    cert?: string | Buffer;
+    thumbprints?: string | string[];
+}
+export interface ParseRequestOptions {
+    signingCert?: string | Buffer;
+    thumbprints?: string | string[];
+    relayState?: string;
+    signaturePath?: string;
+    /**
+     * Resolves the credentials used to validate the signature of the incoming
+     * message from its issuer (and for logout requests, session index / NameID).
+     */
+    getCredentials?: (issuer: string | undefined, sessionIndices: string[] | undefined, nameId: string | undefined) => SigningCredentials | undefined | Promise<SigningCredentials | undefined>;
+}
+interface ValidateOptions {
+    signingCert?: string | Buffer;
+    thumbprints?: string | string[];
+    deflate?: boolean;
+    relayState?: string;
+    signaturePath?: string;
+}
+/** Generates a random 20 character hexadecimal identifier. */
+export declare function generateUniqueID(): string;
+/**
+ * Formats the given date in `xs:DateTime` format as per Core SAML "1.3.3 Time Values":
+ * UTC, no time zone component, millisecond precision.
+ */
+export declare function formatXmlDateTime(date: Date): string;
+export declare function generateInstant(): string;
+export declare function appendQueryString(initialUrl: string, query: Record<string, string>): string;
+/**
+ * Decodes (base64, then optionally inflates) and parses a SAML request, and
+ * validates its signature when a signing credential is available.
+ *
+ * @returns the parsed DOM, or `undefined` when there is no SAML message
+ */
+export declare function parseSamlRequest(input: SamlHttpInput, samlRequest: string | undefined, type: ElementType, options?: ParseRequestOptions): Promise<XmlDocument | undefined>;
+/**
+ * Validates the signature of a SAML request/response received through the
+ * HTTP-POST binding (embedded XML signature) or HTTP-Redirect binding
+ * (detached `Signature` / `SigAlg` query parameters).
+ *
+ * @throws when the message is signed with an invalid signature, or unsigned
+ * while a signing certificate is configured.
+ */
+export declare function validateSignature(input: SamlHttpInput, elementType: ElementType, xml: XmlDocument, xmlString: string, options: ValidateOptions): void;
+export {};

package/dist/types/vendor/samlp/xml.d.ts

@@ -0,0 +1,7 @@
+import { DOMParser } from '@xmldom/xmldom';
+/** DOM node/document types produced by `@xmldom/xmldom`. */
+export type XmlDocument = ReturnType<DOMParser['parseFromString']>;
+export type XmlNode = NonNullable<XmlDocument['documentElement']>;
+export declare function parseXml(xml: string): XmlDocument;
+/** Evaluates an XPath expression and always returns an array of nodes. */
+export declare function selectNodes(expression: string, node: unknown): XmlNode[];

package/dist/types/views/AutoPostForm.d.ts

@@ -0,0 +1,12 @@
+import type { FC } from 'hono/jsx';
+export interface AutoPostFormProps {
+    /** Form action (ACS / SLO URL of the Service Provider). */
+    url: string;
+    /** Name of the hidden field carrying the SAML message. */
+    field: string;
+    /** Base64 encoded SAML message. */
+    value: string;
+    relayState?: string;
+}
+/** Page that immediately POSTs a SAML message to the Service Provider (HTTP-POST binding). */
+export declare const AutoPostForm: FC<AutoPostFormProps>;

package/dist/types/views/ErrorPage.d.ts

@@ -0,0 +1,8 @@
+import type { FC } from 'hono/jsx';
+export interface ErrorPageProps {
+    message: string;
+    status?: number;
+    stack?: string;
+    issuer?: string;
+}
+export declare const ErrorPage: FC<ErrorPageProps>;

package/dist/types/views/Layout.d.ts

@@ -0,0 +1,4 @@
+import type { FC, PropsWithChildren } from 'hono/jsx';
+export declare const Layout: FC<PropsWithChildren<{
+    issuer?: string;
+}>>;

package/dist/types/views/SettingsPage.d.ts

@@ -0,0 +1,5 @@
+import type { FC } from 'hono/jsx';
+import type { IdpSettings } from '../state.js';
+export declare const SettingsPage: FC<{
+    idp: IdpSettings;
+}>;

package/dist/types/views/UserPage.d.ts

@@ -0,0 +1,20 @@
+import type { FC } from 'hono/jsx';
+import type { UserProfile } from '../default-config.js';
+import { type IdpSettings } from '../state.js';
+import type { ClaimMetadata } from '../vendor/samlp/index.js';
+export interface AuthnRequestInfo {
+    relayState?: string;
+    id?: string;
+    issuer?: string;
+    destination?: string;
+    acsUrl?: string;
+    forceAuthn?: boolean;
+}
+export interface UserPageProps {
+    user: UserProfile;
+    sessionIndex?: string;
+    metadata: ClaimMetadata[];
+    authnRequest?: AuthnRequestInfo;
+    idp: IdpSettings;
+}
+export declare const UserPage: FC<UserPageProps>;

package/dist/types/views/index.d.ts

@@ -0,0 +1,5 @@
+export { AutoPostForm } from './AutoPostForm.js';
+export { ErrorPage } from './ErrorPage.js';
+export { SettingsPage } from './SettingsPage.js';
+export { UserPage } from './UserPage.js';
+export type { AuthnRequestInfo } from './UserPage.js';

package/package.json

@@ -1,6 +1,60 @@
 {
   "name": "saml-test-server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Test SAML 2.0 Identity Provider (IdP) for E2E tests",
+  "private": false,
+  "type": "module",
+  "license": "MIT",
+  "keywords": [
+    "saml",
+    "idp",
+    "e2e",
+    "hono"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "saml-idp": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "assets",
+    "LICENSE*"
+  ],
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build && tsc -p tsconfig.build.json",
+    "prepare": "npm run build",
+    "typecheck": "tsc --noEmit",
+    "start": "node dist/cli.js",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@hono/node-server": "^1.19.0",
+    "@xmldom/xmldom": "^0.9.8",
+    "commander": "^14.0.0",
+    "hono": "^4.9.0",
+    "picocolors": "^1.1.1",
+    "xml-crypto": "^6.1.2",
+    "xml-encryption": "^3.1.0",
+    "xml-formatter": "^3.6.6",
+    "xml-name-validator": "^5.0.0",
+    "xpath": "^0.0.34"
+  },
+  "devDependencies": {
+    "@hono/vite-dev-server": "^0.20.0",
+    "@types/node": "^22.0.0",
+    "typescript": "^5.9.0",
+    "vite": "^7.0.0",
+    "vitest": "^5.0.4"
+  }
+}