samlesa 2.12.3

package/build/src/binding-redirect.js

@@ -0,0 +1,333 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+* @file binding-redirect.ts
+* @author tngan
+* @desc Binding-level API, declare the functions using Redirect binding
+*/
+const utility_js_1 = __importStar(require("./utility.js"));
+const libsaml_js_1 = __importDefault(require("./libsaml.js"));
+const url = __importStar(require("url"));
+const urn_js_1 = require("./urn.js");
+const binding = urn_js_1.wording.binding;
+const urlParams = urn_js_1.wording.urlParams;
+/**
+* @private
+* @desc Helper of generating URL param/value pair
+* @param  {string} param     key
+* @param  {string} value     value of key
+* @param  {boolean} first    determine whether the param is the starting one in order to add query header '?'
+* @return {string}
+*/
+function pvPair(param, value, first) {
+    return (first === true ? '?' : '&') + param + '=' + value;
+}
+/**
+* @private
+* @desc Refractored part of URL generation for login/logout request
+* @param  {string} type
+* @param  {boolean} isSigned
+* @param  {string} rawSamlRequest
+* @param  {object} entitySetting
+* @return {string}
+*/
+function buildRedirectURL(opts) {
+    const { baseUrl, type, isSigned, context, entitySetting, } = opts;
+    let { relayState = '' } = opts;
+    const noParams = (url.parse(baseUrl).query || []).length === 0;
+    const queryParam = libsaml_js_1.default.getQueryParamByType(type);
+    // In general, this xmlstring is required to do deflate -> base64 -> urlencode
+    const samlRequest = encodeURIComponent(utility_js_1.default.base64Encode(utility_js_1.default.deflateString(context)));
+    if (relayState !== '') {
+        relayState = pvPair(urlParams.relayState, encodeURIComponent(relayState));
+    }
+    if (isSigned) {
+        const sigAlg = pvPair(urlParams.sigAlg, encodeURIComponent(entitySetting.requestSignatureAlgorithm));
+        const octetString = samlRequest + relayState + sigAlg;
+        return baseUrl
+            + pvPair(queryParam, octetString, noParams)
+            + pvPair(urlParams.signature, encodeURIComponent(libsaml_js_1.default.constructMessageSignature(queryParam + '=' + octetString, entitySetting.privateKey, entitySetting.privateKeyPass, undefined, entitySetting.requestSignatureAlgorithm).toString()));
+    }
+    return baseUrl + pvPair(queryParam, samlRequest + relayState, noParams);
+}
+/**
+* @desc Redirect URL for login request
+* @param  {object} entity                       object includes both idp and sp
+* @param  {function} customTagReplacement      used when developers have their own login response template
+* @return {string} redirect URL
+*/
+function loginRequestRedirectURL(entity, customTagReplacement) {
+    const metadata = { idp: entity.idp.entityMeta, sp: entity.sp.entityMeta };
+    const spSetting = entity.sp.entitySetting;
+    let id = '';
+    if (metadata && metadata.idp && metadata.sp) {
+        const base = metadata.idp.getSingleSignOnService(binding.redirect);
+        let rawSamlRequest;
+        if (spSetting.loginRequestTemplate && customTagReplacement) {
+            const info = customTagReplacement(spSetting.loginRequestTemplate);
+            id = (0, utility_js_1.get)(info, 'id', null);
+            rawSamlRequest = (0, utility_js_1.get)(info, 'context', null);
+        }
+        else {
+            const nameIDFormat = spSetting.nameIDFormat;
+            const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+            id = spSetting.generateID();
+            rawSamlRequest = libsaml_js_1.default.replaceTagsByValue(libsaml_js_1.default.defaultLoginRequestTemplate.context, {
+                ID: id,
+                Destination: base,
+                Issuer: metadata.sp.getEntityID(),
+                IssueInstant: new Date().toISOString(),
+                NameIDFormat: selectedNameIDFormat,
+                AssertionConsumerServiceURL: metadata.sp.getAssertionConsumerService(binding.post),
+                EntityID: metadata.sp.getEntityID(),
+                AllowCreate: spSetting.allowCreate,
+            });
+        }
+        return {
+            id,
+            context: buildRedirectURL({
+                context: rawSamlRequest,
+                type: urlParams.samlRequest,
+                isSigned: metadata.sp.isAuthnRequestSigned(),
+                entitySetting: spSetting,
+                baseUrl: base,
+                relayState: spSetting.relayState,
+            }),
+        };
+    }
+    throw new Error('ERR_GENERATE_REDIRECT_LOGIN_REQUEST_MISSING_METADATA');
+}
+/**
+* @desc Redirect URL for login response
+* @param  {object} requestInfo             corresponding request, used to obtain the id
+* @param  {object} entity                      object includes both idp and sp
+* @param  {object} user                         current logged user (e.g. req.user)
+* @param  {String} relayState                the relaystate sent by sp corresponding request
+* @param  {function} customTagReplacement     used when developers have their own login response template
+*/
+function loginResponseRedirectURL(requestInfo, entity, user = {}, relayState, customTagReplacement) {
+    const idpSetting = entity.idp.entitySetting;
+    const spSetting = entity.sp.entitySetting;
+    const metadata = {
+        idp: entity.idp.entityMeta,
+        sp: entity.sp.entityMeta,
+    };
+    let id = idpSetting.generateID();
+    if (metadata && metadata.idp && metadata.sp) {
+        const base = metadata.sp.getAssertionConsumerService(binding.redirect);
+        let rawSamlResponse;
+        //
+        const nameIDFormat = idpSetting.nameIDFormat;
+        const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+        const nowTime = new Date();
+        // Five minutes later : nowtime  + 5 * 60 * 1000 (in milliseconds)
+        const fiveMinutesLaterTime = new Date(nowTime.getTime() + 300_000);
+        const tvalue = {
+            ID: id,
+            AssertionID: idpSetting.generateID(),
+            Destination: base,
+            SubjectRecipient: base,
+            Issuer: metadata.idp.getEntityID(),
+            Audience: metadata.sp.getEntityID(),
+            EntityID: metadata.sp.getEntityID(),
+            IssueInstant: nowTime.toISOString(),
+            AssertionConsumerServiceURL: base,
+            StatusCode: urn_js_1.namespace.statusCode.success,
+            // can be customized
+            ConditionsNotBefore: nowTime.toISOString(),
+            ConditionsNotOnOrAfter: fiveMinutesLaterTime.toISOString(),
+            SubjectConfirmationDataNotOnOrAfter: fiveMinutesLaterTime.toISOString(),
+            NameIDFormat: selectedNameIDFormat,
+            NameID: user.email || '',
+            InResponseTo: (0, utility_js_1.get)(requestInfo, 'extract.request.id', ''),
+            AuthnStatement: '',
+            AttributeStatement: '',
+        };
+        if (idpSetting.loginResponseTemplate && customTagReplacement) {
+            const template = customTagReplacement(idpSetting.loginResponseTemplate.context);
+            id = (0, utility_js_1.get)(template, 'id', null);
+            rawSamlResponse = (0, utility_js_1.get)(template, 'context', null);
+        }
+        else {
+            if (requestInfo !== null) {
+                tvalue.InResponseTo = requestInfo.extract.request.id;
+            }
+            rawSamlResponse = libsaml_js_1.default.replaceTagsByValue(libsaml_js_1.default.defaultLoginResponseTemplate.context, tvalue);
+        }
+        const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm } = idpSetting;
+        const config = {
+            privateKey,
+            privateKeyPass,
+            signatureAlgorithm,
+            signingCert: metadata.idp.getX509Certificate('signing'),
+            isBase64Output: false,
+        };
+        // step: sign assertion ? -> encrypted ? -> sign message ?
+        if (metadata.sp.isWantAssertionsSigned()) {
+            rawSamlResponse = libsaml_js_1.default.constructSAMLSignature({
+                ...config,
+                rawSamlMessage: rawSamlResponse,
+                transformationAlgorithms: spSetting.transformationAlgorithms,
+                referenceTagXPath: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']",
+                signatureConfig: {
+                    prefix: 'ds',
+                    location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']", action: 'after' },
+                },
+            });
+        }
+        // Like in post binding, SAML response is always signed
+        return {
+            id,
+            context: buildRedirectURL({
+                baseUrl: base,
+                type: urlParams.samlResponse,
+                isSigned: true,
+                context: rawSamlResponse,
+                entitySetting: idpSetting,
+                relayState,
+            }),
+        };
+    }
+    throw new Error('ERR_GENERATE_REDIRECT_LOGIN_RESPONSE_MISSING_METADATA');
+}
+/**
+* @desc Redirect URL for logout request
+* @param  {object} user                        current logged user (e.g. req.user)
+* @param  {object} entity                      object includes both idp and sp
+* @param  {function} customTagReplacement     used when developers have their own login response template
+* @return {string} redirect URL
+*/
+function logoutRequestRedirectURL(user, entity, relayState, customTagReplacement) {
+    const metadata = { init: entity.init.entityMeta, target: entity.target.entityMeta };
+    const initSetting = entity.init.entitySetting;
+    let id = initSetting.generateID();
+    const nameIDFormat = initSetting.nameIDFormat;
+    const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+    if (metadata && metadata.init && metadata.target) {
+        const base = metadata.target.getSingleLogoutService(binding.redirect);
+        let rawSamlRequest = '';
+        const requiredTags = {
+            ID: id,
+            Destination: base,
+            EntityID: metadata.init.getEntityID(),
+            Issuer: metadata.init.getEntityID(),
+            IssueInstant: new Date().toISOString(),
+            NameIDFormat: selectedNameIDFormat,
+            NameID: user.logoutNameID,
+            SessionIndex: user.sessionIndex,
+        };
+        if (initSetting.logoutRequestTemplate && customTagReplacement) {
+            const info = customTagReplacement(initSetting.logoutRequestTemplate, requiredTags);
+            id = (0, utility_js_1.get)(info, 'id', null);
+            rawSamlRequest = (0, utility_js_1.get)(info, 'context', null);
+        }
+        else {
+            rawSamlRequest = libsaml_js_1.default.replaceTagsByValue(libsaml_js_1.default.defaultLogoutRequestTemplate.context, requiredTags);
+        }
+        return {
+            id,
+            context: buildRedirectURL({
+                context: rawSamlRequest,
+                relayState,
+                type: urlParams.logoutRequest,
+                isSigned: entity.target.entitySetting.wantLogoutRequestSigned,
+                entitySetting: initSetting,
+                baseUrl: base,
+            }),
+        };
+    }
+    throw new Error('ERR_GENERATE_REDIRECT_LOGOUT_REQUEST_MISSING_METADATA');
+}
+/**
+* @desc Redirect URL for logout response
+* @param  {object} requescorresponding request, used to obtain the id
+* @param  {object} entity                      object includes both idp and sp
+* @param  {function} customTagReplacement     used when developers have their own login response template
+*/
+function logoutResponseRedirectURL(requestInfo, entity, relayState, customTagReplacement) {
+    const metadata = {
+        init: entity.init.entityMeta,
+        target: entity.target.entityMeta,
+    };
+    const initSetting = entity.init.entitySetting;
+    let id = initSetting.generateID();
+    if (metadata && metadata.init && metadata.target) {
+        const base = metadata.target.getSingleLogoutService(binding.redirect);
+        let rawSamlResponse;
+        if (initSetting.logoutResponseTemplate && customTagReplacement) {
+            const template = customTagReplacement(initSetting.logoutResponseTemplate);
+            id = (0, utility_js_1.get)(template, 'id', null);
+            rawSamlResponse = (0, utility_js_1.get)(template, 'context', null);
+        }
+        else {
+            const tvalue = {
+                ID: id,
+                Destination: base,
+                Issuer: metadata.init.getEntityID(),
+                EntityID: metadata.init.getEntityID(),
+                IssueInstant: new Date().toISOString(),
+                StatusCode: urn_js_1.namespace.statusCode.success,
+            };
+            if (requestInfo && requestInfo.extract && requestInfo.extract.request) {
+                tvalue.InResponseTo = requestInfo.extract.request.id;
+            }
+            rawSamlResponse = libsaml_js_1.default.replaceTagsByValue(libsaml_js_1.default.defaultLogoutResponseTemplate.context, tvalue);
+        }
+        return {
+            id,
+            context: buildRedirectURL({
+                baseUrl: base,
+                type: urlParams.logoutResponse,
+                isSigned: entity.target.entitySetting.wantLogoutResponseSigned,
+                context: rawSamlResponse,
+                entitySetting: initSetting,
+                relayState,
+            }),
+        };
+    }
+    throw new Error('ERR_GENERATE_REDIRECT_LOGOUT_RESPONSE_MISSING_METADATA');
+}
+const redirectBinding = {
+    loginRequestRedirectURL,
+    loginResponseRedirectURL,
+    logoutRequestRedirectURL,
+    logoutResponseRedirectURL,
+};
+exports.default = redirectBinding;
+//# sourceMappingURL=binding-redirect.js.map

package/build/src/binding-redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-redirect.js","sourceRoot":"","sources":["../../src/binding-redirect.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;EAIE;AACF,2DAA4C;AAC5C,8DAAmC;AAInC,yCAA2B;AAC3B,qCAA8C;AAE9C,MAAM,OAAO,GAAG,gBAAO,CAAC,OAAO,CAAC;AAChC,MAAM,SAAS,GAAG,gBAAO,CAAC,SAAS,CAAC;AAWpC;;;;;;;EAOE;AACF,SAAS,MAAM,CAAC,KAAa,EAAE,KAAa,EAAE,KAAe;IAC3D,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC;AAC5D,CAAC;AACD;;;;;;;;EAQE;AACF,SAAS,gBAAgB,CAAC,IAAyB;IACjD,MAAM,EACJ,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,aAAa,GACd,GAAG,IAAI,CAAC;IACT,IAAI,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,oBAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACrD,8EAA8E;IAC9E,MAAM,WAAW,GAAG,kBAAkB,CAAC,oBAAO,CAAC,YAAY,CAAC,oBAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACrG,MAAM,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;QACtD,OAAO,OAAO;cACV,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;cACzC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAC9C,oBAAO,CAAC,yBAAyB,CAC/B,UAAU,GAAG,GAAG,GAAG,WAAW,EAC9B,aAAa,CAAC,UAAU,EACxB,aAAa,CAAC,cAAc,EAC5B,SAAS,EACT,aAAa,CAAC,yBAAyB,CACxC,CAAC,QAAQ,EAAE,CACb,CACA,CAAC;IACN,CAAC;IACD,OAAO,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,WAAW,GAAG,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC1E,CAAC;AACD;;;;;EAKE;AACF,SAAS,uBAAuB,CAAC,MAA4B,EAAE,oBAA2D;IAExH,MAAM,QAAQ,GAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;IAC/E,MAAM,SAAS,GAAQ,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC;IAC/C,IAAI,EAAE,GAAW,EAAE,CAAC;IAEpB,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,cAAsB,CAAC;QAC3B,IAAI,SAAS,CAAC,oBAAoB,IAAI,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,oBAAoB,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;YAClE,EAAE,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3B,cAAc,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;YAC5C,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAC1F,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;YAC5B,cAAc,GAAG,oBAAO,CAAC,kBAAkB,CAAC,oBAAO,CAAC,2BAA2B,CAAC,OAAO,EAAE;gBACvF,EAAE,EAAE,EAAE;gBACN,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE;gBACjC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACtC,YAAY,EAAE,oBAAoB;gBAClC,2BAA2B,EAAE,QAAQ,CAAC,EAAE,CAAC,2BAA2B,CAAC,OAAO,CAAC,IAAI,CAAC;gBAClF,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE;gBACnC,WAAW,EAAE,SAAS,CAAC,WAAW;aAC5B,CAAC,CAAC;QACZ,CAAC;QACD,OAAO;YACL,EAAE;YACF,OAAO,EAAE,gBAAgB,CAAC;gBACxB,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,SAAS,CAAC,WAAW;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,oBAAoB,EAAE;gBAC5C,aAAa,EAAE,SAAS;gBACxB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,SAAS,CAAC,UAAU;aACjC,CAAC;SACH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;EAOE;AACF,SAAS,wBAAwB,CAAC,WAAgB,EAAE,MAAW,EAAE,OAAY,EAAE,EAAE,UAAmB,EAAE,oBAA2D;IAC/J,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC;IAC1C,MAAM,QAAQ,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU;QAC1B,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,UAAU;KACzB,CAAC;IAEF,IAAI,EAAE,GAAW,UAAU,CAAC,UAAU,EAAE,CAAC;IACzC,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,2BAA2B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,eAAuB,CAAC;QAC5B,EAAE;QACF,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC7C,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QAC1F,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3B,kEAAkE;QAClE,MAAM,oBAAoB,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;QACnE,MAAM,MAAM,GAAQ;YAClB,EAAE,EAAE,EAAE;YACN,WAAW,EAAE,UAAU,CAAC,UAAU,EAAE;YACpC,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE;YAClC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE;YACnC,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE;YACnC,2BAA2B,EAAE,IAAI;YACjC,UAAU,EAAE,kBAAS,CAAC,UAAU,CAAC,OAAO;YACxC,oBAAoB;YACpB,mBAAmB,EAAE,OAAO,CAAC,WAAW,EAAE;YAC1C,sBAAsB,EAAE,oBAAoB,CAAC,WAAW,EAAE;YAC1D,mCAAmC,EAAE,oBAAoB,CAAC,WAAW,EAAE;YACvE,YAAY,EAAE,oBAAoB;YAClC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACxB,YAAY,EAAE,IAAA,gBAAG,EAAC,WAAW,EAAE,oBAAoB,EAAE,EAAE,CAAC;YACxD,cAAc,EAAE,EAAE;YAClB,kBAAkB,EAAE,EAAE;SACvB,CAAC;QAEF,IAAI,UAAU,CAAC,qBAAqB,IAAI,oBAAoB,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAChF,EAAE,GAAG,IAAA,gBAAG,EAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/B,eAAe,GAAG,IAAA,gBAAG,EAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YAEN,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,MAAM,CAAC,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,CAAC;YACD,eAAe,GAAG,oBAAO,CAAC,kBAAkB,CAAC,oBAAO,CAAC,4BAA4B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,GAAG,UAAU,CAAC;QACjG,MAAM,MAAM,GAAG;YACb,UAAU;YACV,cAAc;YACd,kBAAkB;YAClB,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,SAAS,CAAC;YACvD,cAAc,EAAE,KAAK;SACtB,CAAC;QACF,0DAA0D;QAC1D,IAAI,QAAQ,CAAC,EAAE,CAAC,sBAAsB,EAAE,EAAE,CAAC;YACzC,eAAe,GAAG,oBAAO,CAAC,sBAAsB,CAAC;gBAC/C,GAAG,MAAM;gBACT,cAAc,EAAE,eAAe;gBAC/B,wBAAwB,EAAE,SAAS,CAAC,wBAAwB;gBAC5D,iBAAiB,EAAE,2DAA2D;gBAC9E,eAAe,EAAE;oBACf,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,EAAE,SAAS,EAAE,qFAAqF,EAAE,MAAM,EAAE,OAAO,EAAE;iBAChI;aACF,CAAC,CAAC;QACL,CAAC;QAED,uDAAuD;QACvD,OAAO;YACL,EAAE;YACF,OAAO,EAAE,gBAAgB,CAAC;gBACxB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,SAAS,CAAC,YAAY;gBAC5B,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,eAAe;gBACxB,aAAa,EAAE,UAAU;gBACzB,UAAU;aACX,CAAC;SACH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;EAME;AACF,SAAS,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAmB,EAAE,oBAAyE;IAC5I,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACpF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;IAC9C,IAAI,EAAE,GAAW,WAAW,CAAC,UAAU,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC;IAC9C,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAE1F,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,cAAc,GAAW,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG;YACnB,EAAE,EAAE,EAAE;YACN,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;YACrC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;YACnC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,YAAY,EAAE,oBAAoB;YAClC,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,IAAI,WAAW,CAAC,qBAAqB,IAAI,oBAAoB,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;YACnF,EAAE,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3B,cAAc,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,oBAAO,CAAC,kBAAkB,CAAC,oBAAO,CAAC,4BAA4B,CAAC,OAAO,EAAE,YAAmB,CAAC,CAAC;QACjH,CAAC;QACD,OAAO;YACL,EAAE;YACF,OAAO,EAAE,gBAAgB,CAAC;gBACxB,OAAO,EAAE,cAAc;gBACvB,UAAU;gBACV,IAAI,EAAE,SAAS,CAAC,aAAa;gBAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB;gBAC7D,aAAa,EAAE,WAAW;gBAC1B,OAAO,EAAE,IAAI;aACd,CAAC;SACH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3E,CAAC;AACD;;;;;EAKE;AACF,SAAS,yBAAyB,CAAC,WAAgB,EAAE,MAAW,EAAE,UAAmB,EAAE,oBAA2D;IAChJ,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;QAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;KACjC,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;IAC9C,IAAI,EAAE,GAAW,WAAW,CAAC,UAAU,EAAE,CAAC;IAC1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,eAAuB,CAAC;QAC5B,IAAI,WAAW,CAAC,sBAAsB,IAAI,oBAAoB,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;YAC1E,EAAE,GAAG,IAAA,gBAAG,EAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/B,eAAe,GAAG,IAAA,gBAAG,EAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAQ;gBAClB,EAAE,EAAE,EAAE;gBACN,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;gBACnC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;gBACrC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACtC,UAAU,EAAE,kBAAS,CAAC,UAAU,CAAC,OAAO;aACzC,CAAC;YACF,IAAI,WAAW,IAAI,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACtE,MAAM,CAAC,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,CAAC;YACD,eAAe,GAAG,oBAAO,CAAC,kBAAkB,CAAC,oBAAO,CAAC,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtG,CAAC;QACD,OAAO;YACL,EAAE;YACF,OAAO,EAAE,gBAAgB,CAAC;gBACxB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,SAAS,CAAC,cAAc;gBAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,wBAAwB;gBAC9D,OAAO,EAAE,eAAe;gBACxB,aAAa,EAAE,WAAW;gBAC1B,UAAU;aACX,CAAC;SACH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,eAAe,GAAG;IACtB,uBAAuB;IACvB,wBAAwB;IACxB,wBAAwB;IACxB,yBAAyB;CAC1B,CAAC;AAEF,kBAAe,eAAe,CAAC"}

package/build/src/binding-simplesign.js

@@ -0,0 +1,233 @@
+"use strict";
+/**
+* @file binding-simplesign.ts
+* @author Orange
+* @desc Binding-level API, declare the functions using POST SimpleSign binding
+*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const urn_js_1 = require("./urn.js");
+const libsaml_js_1 = __importDefault(require("./libsaml.js"));
+const utility_js_1 = __importStar(require("./utility.js"));
+const binding = urn_js_1.wording.binding;
+const urlParams = urn_js_1.wording.urlParams;
+/**
+* @private
+* @desc Helper of generating URL param/value pair
+* @param  {string} param     key
+* @param  {string} value     value of key
+* @param  {boolean} first    determine whether the param is the starting one in order to add query header '?'
+* @return {string}
+*/
+function pvPair(param, value, first) {
+    return (first === true ? '?' : '&') + param + '=' + value;
+}
+/**
+* @private
+* @desc Refactored part of simple signature generation for login/logout request
+* @param  {string} type
+* @param  {string} rawSamlRequest
+* @param  {object} entitySetting
+* @return {string}
+*/
+function buildSimpleSignature(opts) {
+    const { type, context, entitySetting, } = opts;
+    let { relayState = '' } = opts;
+    const queryParam = libsaml_js_1.default.getQueryParamByType(type);
+    if (relayState !== '') {
+        relayState = pvPair(urlParams.relayState, relayState);
+    }
+    const sigAlg = pvPair(urlParams.sigAlg, entitySetting.requestSignatureAlgorithm);
+    const octetString = context + relayState + sigAlg;
+    return libsaml_js_1.default.constructMessageSignature(queryParam + '=' + octetString, entitySetting.privateKey, entitySetting.privateKeyPass, undefined, entitySetting.requestSignatureAlgorithm).toString();
+}
+/**
+* @desc Generate a base64 encoded login request
+* @param  {string} referenceTagXPath           reference uri
+* @param  {object} entity                      object includes both idp and sp
+* @param  {function} customTagReplacement     used when developers have their own login response template
+*/
+function base64LoginRequest(entity, customTagReplacement) {
+    const metadata = { idp: entity.idp.entityMeta, sp: entity.sp.entityMeta };
+    const spSetting = entity.sp.entitySetting;
+    let id = '';
+    if (metadata && metadata.idp && metadata.sp) {
+        const base = metadata.idp.getSingleSignOnService(binding.simpleSign);
+        let rawSamlRequest;
+        if (spSetting.loginRequestTemplate && customTagReplacement) {
+            const info = customTagReplacement(spSetting.loginRequestTemplate.context);
+            id = (0, utility_js_1.get)(info, 'id', null);
+            rawSamlRequest = (0, utility_js_1.get)(info, 'context', null);
+        }
+        else {
+            const nameIDFormat = spSetting.nameIDFormat;
+            const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+            id = spSetting.generateID();
+            rawSamlRequest = libsaml_js_1.default.replaceTagsByValue(libsaml_js_1.default.defaultLoginRequestTemplate.context, {
+                ID: id,
+                Destination: base,
+                Issuer: metadata.sp.getEntityID(),
+                IssueInstant: new Date().toISOString(),
+                AssertionConsumerServiceURL: metadata.sp.getAssertionConsumerService(binding.simpleSign),
+                EntityID: metadata.sp.getEntityID(),
+                AllowCreate: spSetting.allowCreate,
+                NameIDFormat: selectedNameIDFormat
+            });
+        }
+        let simpleSignatureContext = null;
+        if (metadata.idp.isWantAuthnRequestsSigned()) {
+            const simpleSignature = buildSimpleSignature({
+                type: urlParams.samlRequest,
+                context: rawSamlRequest,
+                entitySetting: spSetting,
+                relayState: spSetting.relayState,
+            });
+            simpleSignatureContext = {
+                signature: simpleSignature,
+                sigAlg: spSetting.requestSignatureAlgorithm,
+            };
+        }
+        // No need to embeded XML signature
+        return {
+            id,
+            context: utility_js_1.default.base64Encode(rawSamlRequest),
+            ...simpleSignatureContext,
+        };
+    }
+    throw new Error('ERR_GENERATE_POST_SIMPLESIGN_LOGIN_REQUEST_MISSING_METADATA');
+}
+/**
+* @desc Generate a base64 encoded login response
+* @param  {object} requestInfo                 corresponding request, used to obtain the id
+* @param  {object} entity                      object includes both idp and sp
+* @param  {object} user                        current logged user (e.g. req.user)
+* @param  {string}  relayState               the relay state
+* @param  {function} customTagReplacement     used when developers have their own login response template
+*/
+async function base64LoginResponse(requestInfo = {}, entity, user = {}, relayState, customTagReplacement) {
+    const idpSetting = entity.idp.entitySetting;
+    const spSetting = entity.sp.entitySetting;
+    const id = idpSetting.generateID();
+    const metadata = {
+        idp: entity.idp.entityMeta,
+        sp: entity.sp.entityMeta,
+    };
+    const nameIDFormat = idpSetting.nameIDFormat;
+    const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+    if (metadata && metadata.idp && metadata.sp) {
+        const base = metadata.sp.getAssertionConsumerService(binding.simpleSign);
+        let rawSamlResponse;
+        const nowTime = new Date();
+        // Five minutes later : nowtime  + 5 * 60 * 1000 (in milliseconds)
+        const fiveMinutesLaterTime = new Date(nowTime.getTime() + 300_000);
+        const tvalue = {
+            ID: id,
+            AssertionID: idpSetting.generateID(),
+            Destination: base,
+            Audience: metadata.sp.getEntityID(),
+            EntityID: metadata.sp.getEntityID(),
+            SubjectRecipient: base,
+            Issuer: metadata.idp.getEntityID(),
+            IssueInstant: nowTime.toISOString(),
+            AssertionConsumerServiceURL: base,
+            StatusCode: urn_js_1.StatusCode.Success,
+            // can be customized
+            ConditionsNotBefore: nowTime.toISOString(),
+            ConditionsNotOnOrAfter: fiveMinutesLaterTime.toISOString(),
+            SubjectConfirmationDataNotOnOrAfter: fiveMinutesLaterTime.toISOString(),
+            NameIDFormat: selectedNameIDFormat,
+            NameID: user.email || '',
+            InResponseTo: (0, utility_js_1.get)(requestInfo, 'extract.request.id', ''),
+            AuthnStatement: '',
+            AttributeStatement: '',
+        };
+        if (idpSetting.loginResponseTemplate && customTagReplacement) {
+            const template = customTagReplacement(idpSetting.loginResponseTemplate.context);
+            rawSamlResponse = (0, utility_js_1.get)(template, 'context', null);
+        }
+        else {
+            if (requestInfo !== null) {
+                tvalue.InResponseTo = requestInfo.extract.request.id;
+            }
+            rawSamlResponse = libsaml_js_1.default.replaceTagsByValue(libsaml_js_1.default.defaultLoginResponseTemplate.context, tvalue);
+        }
+        const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm } = idpSetting;
+        const config = {
+            privateKey,
+            privateKeyPass,
+            signatureAlgorithm,
+            signingCert: metadata.idp.getX509Certificate('signing'),
+            isBase64Output: false,
+        };
+        // step: sign assertion ? -> encrypted ? -> sign message ?
+        if (metadata.sp.isWantAssertionsSigned()) {
+            rawSamlResponse = libsaml_js_1.default.constructSAMLSignature({
+                ...config,
+                rawSamlMessage: rawSamlResponse,
+                transformationAlgorithms: spSetting.transformationAlgorithms,
+                referenceTagXPath: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']",
+                signatureConfig: {
+                    prefix: 'ds',
+                    location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']", action: 'after' },
+                },
+            });
+        }
+        // SAML response must be signed sign message first, then encrypt
+        let simpleSignature = '';
+        // like in post and redirect bindings, login response is always signed.
+        simpleSignature = buildSimpleSignature({
+            type: urlParams.samlResponse,
+            context: rawSamlResponse,
+            entitySetting: idpSetting,
+            relayState: relayState,
+        });
+        return Promise.resolve({
+            id,
+            context: utility_js_1.default.base64Encode(rawSamlResponse),
+            signature: simpleSignature,
+            sigAlg: idpSetting.requestSignatureAlgorithm,
+        });
+    }
+    throw new Error('ERR_GENERATE_POST_SIMPLESIGN_LOGIN_RESPONSE_MISSING_METADATA');
+}
+const simpleSignBinding = {
+    base64LoginRequest,
+    base64LoginResponse,
+};
+exports.default = simpleSignBinding;
+//# sourceMappingURL=binding-simplesign.js.map

package/build/src/binding-simplesign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-simplesign.js","sourceRoot":"","sources":["../../src/binding-simplesign.ts"],"names":[],"mappings":";AAAA;;;;EAIE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEF,qCAA+C;AAE/C,8DAAmC;AACnC,2DAA4C;AAE5C,MAAM,OAAO,GAAG,gBAAO,CAAC,OAAO,CAAC;AAChC,MAAM,SAAS,GAAG,gBAAO,CAAC,SAAS,CAAC;AAgBpC;;;;;;;EAOE;AACF,SAAS,MAAM,CAAC,KAAa,EAAE,KAAa,EAAE,KAAe;IAC3D,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC;AAC5D,CAAC;AACD;;;;;;;EAOE;AACF,SAAS,oBAAoB,CAAC,IAA2B;IACvD,MAAM,EACJ,IAAI,EACJ,OAAO,EACP,aAAa,GACd,GAAG,IAAI,CAAC;IACT,IAAI,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,UAAU,GAAG,oBAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAErD,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACjF,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IAClD,OAAO,oBAAO,CAAC,yBAAyB,CACtC,UAAU,GAAG,GAAG,GAAG,WAAW,EAC9B,aAAa,CAAC,UAAU,EACxB,aAAa,CAAC,cAAc,EAC5B,SAAS,EACT,aAAa,CAAC,yBAAyB,CACxC,CAAC,QAAQ,EAAE,CAAC;AACf,CAAC;AAED;;;;;EAKE;AACF,SAAS,kBAAkB,CAAC,MAAW,EAAE,oBAA2D;IAClG,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC;IAC1C,IAAI,EAAE,GAAW,EAAE,CAAC;IAEpB,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,cAAsB,CAAC;QAC3B,IAAI,SAAS,CAAC,oBAAoB,IAAI,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,oBAAoB,CAAC,SAAS,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC1E,EAAE,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3B,cAAc,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;YAC5C,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAC1F,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;YAC5B,cAAc,GAAG,oBAAO,CAAC,kBAAkB,CAAC,oBAAO,CAAC,2BAA2B,CAAC,OAAO,EAAE;gBACvF,EAAE,EAAE,EAAE;gBACN,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE;gBACjC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACtC,2BAA2B,EAAE,QAAQ,CAAC,EAAE,CAAC,2BAA2B,CAAC,OAAO,CAAC,UAAU,CAAC;gBACxF,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE;gBACnC,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,YAAY,EAAE,oBAAoB;aAC5B,CAAC,CAAC;QACZ,CAAC;QAED,IAAI,sBAAsB,GAAS,IAAI,CAAC;QACxC,IAAI,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAE,CAAC;YAC3C,MAAM,eAAe,GAAG,oBAAoB,CAAC;gBACzC,IAAI,EAAE,SAAS,CAAC,WAAW;gBAC3B,OAAO,EAAE,cAAc;gBACvB,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,SAAS,CAAC,UAAU;aACnC,CAAC,CAAC;YAEH,sBAAsB,GAAG;gBACvB,SAAS,EAAE,eAAe;gBAC1B,MAAM,EAAE,SAAS,CAAC,yBAAyB;aAC5C,CAAC;QACN,CAAC;QACD,mCAAmC;QACnC,OAAO;YACL,EAAE;YACF,OAAO,EAAE,oBAAO,CAAC,YAAY,CAAC,cAAc,CAAC;YAC7C,GAAG,sBAAsB;SAC1B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;AACjF,CAAC;AACD;;;;;;;EAOE;AACF,KAAK,UAAU,mBAAmB,CAAC,cAAmB,EAAE,EAAE,MAAW,EAAE,OAAY,EAAE,EAAE,UAAmB,EAAE,oBAA2D;IACrK,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC;IAC1C,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU;QAC1B,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,UAAU;KACzB,CAAC;IACF,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC7C,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1F,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,2BAA2B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,eAAuB,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3B,kEAAkE;QAClE,MAAM,oBAAoB,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAE,CAAC;QACpE,MAAM,MAAM,GAAQ;YAClB,EAAE,EAAE,EAAE;YACN,WAAW,EAAE,UAAU,CAAC,UAAU,EAAE;YACpC,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE;YACnC,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE;YAClC,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE;YACnC,2BAA2B,EAAE,IAAI;YACjC,UAAU,EAAE,mBAAU,CAAC,OAAO;YAC9B,oBAAoB;YACpB,mBAAmB,EAAE,OAAO,CAAC,WAAW,EAAE;YAC1C,sBAAsB,EAAE,oBAAoB,CAAC,WAAW,EAAE;YAC1D,mCAAmC,EAAE,oBAAoB,CAAC,WAAW,EAAE;YACvE,YAAY,EAAE,oBAAoB;YAClC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACxB,YAAY,EAAE,IAAA,gBAAG,EAAC,WAAW,EAAE,oBAAoB,EAAE,EAAE,CAAC;YACxD,cAAc,EAAE,EAAE;YAClB,kBAAkB,EAAE,EAAE;SACvB,CAAC;QACF,IAAI,UAAU,CAAC,qBAAqB,IAAI,oBAAoB,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAChF,eAAe,GAAG,IAAA,gBAAG,EAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,MAAM,CAAC,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,CAAC;YACD,eAAe,GAAG,oBAAO,CAAC,kBAAkB,CAAC,oBAAO,CAAC,4BAA4B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,GAAG,UAAU,CAAC;QACjG,MAAM,MAAM,GAAG;YACb,UAAU;YACV,cAAc;YACd,kBAAkB;YAClB,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,SAAS,CAAC;YACvD,cAAc,EAAE,KAAK;SACtB,CAAC;QACF,0DAA0D;QAC1D,IAAI,QAAQ,CAAC,EAAE,CAAC,sBAAsB,EAAE,EAAE,CAAC;YACzC,eAAe,GAAG,oBAAO,CAAC,sBAAsB,CAAC;gBAC/C,GAAG,MAAM;gBACT,cAAc,EAAE,eAAe;gBAC/B,wBAAwB,EAAE,SAAS,CAAC,wBAAwB;gBAC5D,iBAAiB,EAAE,2DAA2D;gBAC9E,eAAe,EAAE;oBACf,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,EAAE,SAAS,EAAE,qFAAqF,EAAE,MAAM,EAAE,OAAO,EAAE;iBAChI;aACF,CAAC,CAAC;QACL,CAAC;QAED,gEAAgE;QAChE,IAAI,eAAe,GAAW,EAAE,CAAC;QACjC,uEAAuE;QACvE,eAAe,GAAG,oBAAoB,CAAC;YACnC,IAAI,EAAE,SAAS,CAAC,YAAY;YAC5B,OAAO,EAAE,eAAe;YACxB,aAAa,EAAE,UAAU;YACzB,UAAU,EAAE,UAAU;SACzB,CAAE,CAAC;QAEJ,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,EAAE;YACF,OAAO,EAAE,oBAAO,CAAC,YAAY,CAAC,eAAe,CAAC;YAC9C,SAAS,EAAE,eAAe;YAC1B,MAAM,EAAE,UAAU,CAAC,yBAAyB;SAC7C,CAAC,CAAC;IAEL,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,iBAAiB,GAAG;IACtB,kBAAkB;IAClB,mBAAmB;CACpB,CAAC;AAEJ,kBAAe,iBAAiB,CAAC"}