samlesa 2.17.0 → 2.17.1

package/build/src/libsaml.js

@@ -69,7 +69,18 @@ const libSaml = () => {
         context: `<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><saml2p:ArtifactResolve xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="{ID}" Version="2.0" IssueInstant="{IssueInstant}" Destination="{Destination}"><saml2:Issuer>{Issuer}</saml2:Issuer><saml2p:Artifact>{Art}</saml2p:Artifact></saml2p:ArtifactResolve></SOAP-ENV:Body></SOAP-ENV:Envelope>`,
     };
     const defaultArtAuthnRequestTemplate = {
-        context: `<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Header></SOAP-ENV:Header><samlp:ArtifactResponse xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}" InResponseTo="{InResponseTo}" Version="2.0" IssueInstant="{IssueInstant}"><saml:Issuer>{Issuer}</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>{AuthnRequest}</samlp:ArtifactResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>`,
+        context: `<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Header></SOAP-ENV:Header><SOAP-ENV:Body><samlp:ArtifactResponse xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}" InResponseTo="{InResponseTo}" Version="2.0" IssueInstant="{IssueInstant}"><saml:Issuer>{Issuer}</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>{AuthnRequest}</samlp:ArtifactResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>`,
+    };
+    const defaultSoapResponseFailTemplate = {
+        context: `<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Header></SOAP-ENV:Header>
+<samlp:ArtifactResponse xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 
+xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
+ InResponseTo="{InResponseTo}" Version="2.0" 
+ IssueInstant="{IssueInstant}">
+ <saml:Issuer>{Issuer}</saml:Issuer>
+ <samlp:Status>
+ <samlp:StatusCode Value="{StatusCode}"/>
+ </samlp:Status>{Response}</samlp:ArtifactResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>`,
     };
     /**
      * @desc Default AttributeStatement template
@@ -137,7 +148,6 @@ const libSaml = () => {
         }
         catch (inflateError) {
             // 4. 解压失败，尝试直接解析为未压缩的XML
-            console.log("解压失败---------------------");
             try {
                 const base64Encoded = decodeURIComponent(urlEncodedResponse);
                 xml = atob(base64Encoded);
@@ -211,6 +221,7 @@ const libSaml = () => {
         defaultArtAuthnRequestTemplate,
         defaultArtifactResolveTemplate,
         defaultLoginResponseTemplate,
+        defaultSoapResponseFailTemplate,
         defaultAttributeStatementTemplate,
         defaultAttributeTemplate,
         defaultLogoutRequestTemplate,
@@ -498,55 +509,292 @@ const libSaml = () => {
             return [false, null, false, true]; // return encryptedAssert
             /*   throw new Error('ERR_ZERO_SIGNATURE');*/
         },
-        verifySignatureSoap(xml, opts) {
-            const { dom } = getContext();
+        /*  verifySignatureSoap(xml: string, opts: SignatureVerifierOptions & { isAssertion?: boolean }) {
+            const {dom} = getContext();
             const doc = dom.parseFromString(xml, 'application/xml');
             const docParser = new DOMParser();
-            let selection = [];
+      
+            let selection: any = [];
+      
             if (opts.isAssertion) {
-                // 断言模式下的专用逻辑
-                const assertionSignatureXpath = "./*[local-name()='Signature']";
-                // @ts-expect-error misssing Node properties are not needed
-                const signatureNode = select(assertionSignatureXpath, doc.documentElement);
-                if (signatureNode.length === 0) {
-                    throw new Error('ERR_ASSERTION_SIGNATURE_NOT_FOUND');
-                }
-                selection = selection.concat(signatureNode);
+              // 断言模式下的专用逻辑
+              const assertionSignatureXpath = "./!*[local-name()='Signature']";
+              // @ts-expect-error misssing Node properties are not needed
+              const signatureNode = select(assertionSignatureXpath, doc.documentElement);
+      
+              if (signatureNode.length === 0) {
+                throw new Error('ERR_ASSERTION_SIGNATURE_NOT_FOUND');
+              }
+      
+              selection = selection.concat(signatureNode);
+            } else {
+              // 原始的SOAP响应验证逻辑
+              const messageSignatureXpath =
+                "/!*[local-name()='Envelope']/!*[local-name()='Body']" +
+                "/!*[local-name()='ArtifactResponse']/!*[local-name()='Signature'] | " +
+                "/!*[local-name()='Envelope']/!*[local-name()='Body']" +
+                "/!*[local-name()='ArtifactResponse']/!*[local-name()='Response']/!*[local-name()='Signature']";
+      
+              const assertionSignatureXpath =
+                "/!*[local-name()='Envelope']/!*[local-name()='Body']" +
+                "/!*[local-name()='ArtifactResponse']/!*[local-name()='Response']" +
+                "/!*[local-name()='Assertion']/!*[local-name()='Signature'] | " +
+                "/!*[local-name()='Envelope']/!*[local-name()='Body']" +
+                "/!*[local-name()='ArtifactResponse']/!*[local-name()='Response']" +
+                "/!*[local-name()='EncryptedAssertion']";
+      
+              const wrappingElementsXPath =
+                "/!*[local-name()='Envelope']/!*[local-name()='Body']" +
+                "/!*[local-name()='ArtifactResponse']/!*[local-name()='Response']" +
+                "/!*[local-name()='Assertion']/!*[local-name()='Subject']" +
+                "/!*[local-name()='SubjectConfirmation']" +
+                "/!*[local-name()='SubjectConfirmationData']" +
+                "//!*[local-name()='Assertion' or local-name()='Signature']";
+      
+      // @ts-expect-error misssing Node properties are not needed
+              const messageSignatureNode = select(messageSignatureXpath, doc);
+              // @ts-expect-error misssing Node properties are not needed
+              const assertionSignatureNode = select(assertionSignatureXpath, doc);
+              // @ts-expect-error misssing Node properties are not needed
+              const wrappingElementNode = select(wrappingElementsXPath, doc);
+      
+              // 检测包装攻击
+              if (wrappingElementNode.length !== 0) {
+                throw new Error('ERR_POTENTIAL_WRAPPING_ATTACK');
+              }
+      
+              // 保证响应中至少有一个签名
+              if (messageSignatureNode.length === 0 && assertionSignatureNode.length === 0) {
+                throw new Error('ERR_ZERO_SIGNATURE');
+              }
+      
+              selection = selection.concat(messageSignatureNode, assertionSignatureNode);
             }
-            else {
-                // 原始的SOAP响应验证逻辑
-                const messageSignatureXpath = "/*[local-name()='Envelope']/*[local-name()='Body']" +
-                    "/*[local-name()='ArtifactResponse']/*[local-name()='Signature'] | " +
-                    "/*[local-name()='Envelope']/*[local-name()='Body']" +
-                    "/*[local-name()='ArtifactResponse']/*[local-name()='Response']/*[local-name()='Signature']";
-                const assertionSignatureXpath = "/*[local-name()='Envelope']/*[local-name()='Body']" +
-                    "/*[local-name()='ArtifactResponse']/*[local-name()='Response']" +
-                    "/*[local-name()='Assertion']/*[local-name()='Signature'] | " +
-                    "/*[local-name()='Envelope']/*[local-name()='Body']" +
-                    "/*[local-name()='ArtifactResponse']/*[local-name()='Response']" +
-                    "/*[local-name()='EncryptedAssertion']";
-                const wrappingElementsXPath = "/*[local-name()='Envelope']/*[local-name()='Body']" +
-                    "/*[local-name()='ArtifactResponse']/*[local-name()='Response']" +
-                    "/*[local-name()='Assertion']/*[local-name()='Subject']" +
-                    "/*[local-name()='SubjectConfirmation']" +
-                    "/*[local-name()='SubjectConfirmationData']" +
-                    "//*[local-name()='Assertion' or local-name()='Signature']";
+      
+            for (const signatureNode of selection) {
+              const sig = new SignedXml();
+              let verified = false;
+      
+              sig.signatureAlgorithm = opts.signatureAlgorithm!;
+      
+              if (!opts.keyFile && !opts.metadata) {
+                throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
+              }
+      
+              if (opts.keyFile) {
+                sig.publicCert = fs.readFileSync(opts.keyFile, 'utf-8');
+              }
+      
+              if (opts.metadata) {
+                const certificateNodes = select(".//!*[local-name(.)='X509Certificate']", signatureNode) as any[];
+      
+                // 获取元数据中的证书
+                let metadataCert: any = opts.metadata.getX509Certificate(certUse.signing);
+      
+                // 规范化元数据证书
+                if (Array.isArray(metadataCert)) {
+                  metadataCert = flattenDeep(metadataCert);
+                } else if (typeof metadataCert === 'string') {
+                  metadataCert = [metadataCert];
+                }
+      
+                metadataCert = metadataCert.map(utility.normalizeCerString);
+      
+                // 检查证书可用性
+                if (certificateNodes.length === 0 && metadataCert.length === 0) {
+                  throw new Error('NO_SELECTED_CERTIFICATE');
+                }
+      
+                // 响应中有证书节点
+                if (certificateNodes.length !== 0) {
+                  // 安全获取证书数据
+                  let x509CertificateData = '';
+                  if (certificateNodes[0].firstChild) {
+                    x509CertificateData = certificateNodes[0].firstChild.data;
+                  } else if (certificateNodes[0].textContent) {
+                    x509CertificateData = certificateNodes[0].textContent;
+                  }
+      
+                  const x509Certificate = utility.normalizeCerString(x509CertificateData);
+      
+                  // 验证证书匹配
+                  if (
+                    metadataCert.length >= 1 &&
+                    !metadataCert.find(cert => cert.trim() === x509Certificate.trim())
+                  ) {
+                    throw new Error('ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA');
+                  }
+      
+                  sig.publicCert = this.getKeyInfo(x509Certificate).getKey();
+                } else {
+                  // 使用元数据中的第一个证书
+                  sig.publicCert = this.getKeyInfo(metadataCert[0]).getKey();
+                }
+              }
+      
+              // 加载签名
+              sig.loadSignature(signatureNode);
+              // 使用原始 XML 进行验证
+              verified = sig.checkSignature(xml);
+      
+              if (!verified) {
+                throw new Error('ERR_FAILED_TO_VERIFY_SIGNATURE');
+              }
+      
+              // 检查签名引用
+              if (!(sig.getSignedReferences().length >= 1)) {
+                throw new Error('NO_SIGNATURE_REFERENCES');
+              }
+      
+              const signedVerifiedXML = sig.getSignedReferences()[0];
+              const verifiedDoc = docParser.parseFromString(signedVerifiedXML, 'application/xml');
+              const rootNode = verifiedDoc.documentElement;
+      
+      
+              // 断言模式专用返回逻辑
+              if (opts.isAssertion) {
+                if (rootNode?.localName === 'Assertion') {
+                  return [true, rootNode.toString(), false];
+                } else {
+                  throw new Error('ERR_INVALID_ASSERTION_SIGNATURE');
+                }
+              }
+      
+              // 处理已验证的签名
+              // @ts-expect-error misssing Node properties are not needed
+              if (rootNode.localName === 'ArtifactResponse') {
+                // 在 ArtifactResponse 中查找 Response
                 // @ts-expect-error misssing Node properties are not needed
-                const messageSignatureNode = select(messageSignatureXpath, doc);
+                const responseNodes = select(
+                  "./!*[local-name()='Response']",
+                  // @ts-expect-error misssing Node properties are not needed
+                  rootNode
+                ) as Element[];
+      
+                if (responseNodes.length === 0) {
+                  continue;
+                }
+      
+                const responseNode = responseNodes[0];
+      
+                // 在 Response 中查找断言
+                const encryptedAssertions = select(
+                  "./!*[local-name()='EncryptedAssertion']",
+                  responseNode
+                ) as Element[];
+      
+                const assertions = select(
+                  "./!*[local-name()='Assertion']",
+                  responseNode
+                ) as Element[];
+      
+                if (encryptedAssertions.length === 1) {
+                  return [true, encryptedAssertions[0].toString(), true];
+                }
+      
+                if (assertions.length === 1) {
+                  return [true, assertions[0].toString(), false];
+                }
+              }
+              // 直接处理 Response
+      
+              else if (rootNode?.localName === 'Response') {
                 // @ts-expect-error misssing Node properties are not needed
-                const assertionSignatureNode = select(assertionSignatureXpath, doc);
+                const encryptedAssertions = select(
+                  "./!*[local-name()='EncryptedAssertion']",
+                  // @ts-expect-error misssing Node properties are not needed
+                  rootNode
+                ) as Element[];
                 // @ts-expect-error misssing Node properties are not needed
-                const wrappingElementNode = select(wrappingElementsXPath, doc);
-                // 检测包装攻击
-                if (wrappingElementNode.length !== 0) {
-                    throw new Error('ERR_POTENTIAL_WRAPPING_ATTACK');
+                const assertions = select(
+                  "./!*[local-name()='Assertion']",
+                  // @ts-expect-error misssing Node properties are not needed
+                  rootNode
+                ) as Element[];
+      
+                if (encryptedAssertions.length === 1) {
+                  return [true, encryptedAssertions[0].toString(), true];
                 }
-                // 保证响应中至少有一个签名
-                if (messageSignatureNode.length === 0 && assertionSignatureNode.length === 0) {
-                    throw new Error('ERR_ZERO_SIGNATURE');
+      
+                if (assertions.length === 1) {
+                  return [true, assertions[0].toString(), false];
                 }
-                selection = selection.concat(messageSignatureNode, assertionSignatureNode);
+              }
+              // 直接处理 Assertion
+              else if (rootNode?.localName === 'Assertion') {
+                return [true, rootNode.toString(), false];
+              }
+              // 直接处理 EncryptedAssertion
+              else if (rootNode?.localName === 'EncryptedAssertion') {
+                return [true, rootNode.toString(), true];
+              } else {
+      
+                console.warn("未知的根节点类型:", rootNode?.localName);
+              }
             }
+      
+            throw new Error('ERR_ZERO_SIGNATURE');
+          },*/
+        verifySignatureSoap(xml, opts) {
+            const { dom } = getContext();
+            const doc = dom.parseFromString(xml, 'application/xml');
+            const docParser = new DOMParser();
+            // 为 SOAP 消息定义 XPath
+            const artifactResolveXpath = "/*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='ArtifactResolve']";
+            const artifactResponseXpath = "/*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='ArtifactResponse']";
+            // 检测 ArtifactResolve 或 ArtifactResponse 的存在
+            // @ts-expect-error
+            const artifactResolveNodes = select(artifactResolveXpath, doc);
+            // @ts-expect-error
+            const artifactResponseNodes = select(artifactResponseXpath, doc);
+            // 根据消息类型选择合适的 XPath
+            let basePath = "";
+            if (artifactResolveNodes.length > 0) {
+                basePath = "/*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='ArtifactResolve']";
+            }
+            else if (artifactResponseNodes.length > 0) {
+                basePath = "/*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='ArtifactResponse']";
+            }
+            else {
+                throw new Error('ERR_UNSUPPORTED_SOAP_MESSAGE_TYPE');
+            }
+            // 基于 SOAP 结构重新定义 XPath
+            const messageSignatureXpath = `${basePath}/*[local-name(.)='Signature']`;
+            const assertionSignatureXpath = `${basePath}/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Signature']`;
+            const wrappingElementsXPath = `${basePath}/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Subject']/*[local-name(.)='SubjectConfirmation']/*[local-name(.)='SubjectConfirmationData']//*[local-name(.)='Assertion' or local-name(.)='Signature']`;
+            const encryptedAssertionsXpath = `${basePath}/*[local-name(.)='Response']/*[local-name(.)='EncryptedAssertion']`;
+            // 包装攻击检测
+            // @ts-expect-error
+            const wrappingElementNode = select(wrappingElementsXPath, doc);
+            if (wrappingElementNode.length !== 0) {
+                throw new Error('ERR_POTENTIAL_WRAPPING_ATTACK');
+            }
+            // @ts-expect-error
+            const encryptedAssertions = select(encryptedAssertionsXpath, doc);
+            // @ts-expect-error
+            const messageSignatureNode = select(messageSignatureXpath, doc);
+            // @ts-expect-error
+            const assertionSignatureNode = select(assertionSignatureXpath, doc);
+            let selection = [];
+            if (messageSignatureNode.length > 0) {
+                selection = selection.concat(messageSignatureNode);
+            }
+            if (assertionSignatureNode.length > 0) {
+                selection = selection.concat(assertionSignatureNode);
+            }
+            // 处理加密断言的情况
+            if (selection.length === 0) {
+                if (encryptedAssertions.length > 0) {
+                    if (encryptedAssertions.length > 1) {
+                        throw new Error('ERR_MULTIPLE_ASSERTION');
+                    }
+                    return [false, null, true, true];
+                }
+            }
+            if (selection.length === 0) {
+                throw new Error('ERR_ZERO_SIGNATURE');
+            }
+            // 尝试所有签名节点
             for (const signatureNode of selection) {
                 const sig = new SignedXml();
                 let verified = false;
@@ -555,13 +803,12 @@ const libSaml = () => {
                     throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
                 }
                 if (opts.keyFile) {
-                    sig.publicCert = fs.readFileSync(opts.keyFile, 'utf-8');
+                    sig.publicCert = fs.readFileSync(opts.keyFile);
                 }
                 if (opts.metadata) {
-                    const certificateNodes = select(".//*[local-name(.)='X509Certificate']", signatureNode);
-                    // 获取元数据中的证书
+                    const certificateNode = select(".//*[local-name(.)='X509Certificate']", signatureNode);
+                    // 证书处理逻辑
                     let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                    // 规范化元数据证书
                     if (Array.isArray(metadataCert)) {
                         metadataCert = flattenDeep(metadataCert);
                     }
@@ -569,108 +816,59 @@ const libSaml = () => {
                         metadataCert = [metadataCert];
                     }
                     metadataCert = metadataCert.map(utility.normalizeCerString);
-                    // 检查证书可用性
-                    if (certificateNodes.length === 0 && metadataCert.length === 0) {
+                    // 没有证书的情况
+                    if (certificateNode.length === 0 && metadataCert.length === 0) {
                         throw new Error('NO_SELECTED_CERTIFICATE');
                     }
-                    // 响应中有证书节点
-                    if (certificateNodes.length !== 0) {
-                        // 安全获取证书数据
-                        let x509CertificateData = '';
-                        if (certificateNodes[0].firstChild) {
-                            x509CertificateData = certificateNodes[0].firstChild.data;
-                        }
-                        else if (certificateNodes[0].textContent) {
-                            x509CertificateData = certificateNodes[0].textContent;
-                        }
+                    if (certificateNode.length !== 0) {
+                        const x509CertificateData = certificateNode[0].firstChild.data;
                         const x509Certificate = utility.normalizeCerString(x509CertificateData);
-                        // 验证证书匹配
-                        if (metadataCert.length >= 1 &&
-                            !metadataCert.find(cert => cert.trim() === x509Certificate.trim())) {
+                        if (metadataCert.length >= 1 && !metadataCert.includes(x509Certificate)) {
                             throw new Error('ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA');
                         }
                         sig.publicCert = this.getKeyInfo(x509Certificate).getKey();
                     }
                     else {
-                        // 使用元数据中的第一个证书
                         sig.publicCert = this.getKeyInfo(metadataCert[0]).getKey();
                     }
                 }
-                // 加载签名
                 sig.loadSignature(signatureNode);
-                // 使用原始 XML 进行验证
-                verified = sig.checkSignature(xml);
+                verified = sig.checkSignature(xml); // 使用原始XML验证
                 if (!verified) {
                     throw new Error('ERR_FAILED_TO_VERIFY_SIGNATURE');
                 }
-                // 检查签名引用
-                if (!(sig.getSignedReferences().length >= 1)) {
+                if (sig.getSignedReferences().length < 1) {
                     throw new Error('NO_SIGNATURE_REFERENCES');
                 }
                 const signedVerifiedXML = sig.getSignedReferences()[0];
-                const verifiedDoc = docParser.parseFromString(signedVerifiedXML, 'application/xml');
-                const rootNode = verifiedDoc.documentElement;
-                // 断言模式专用返回逻辑
-                if (opts.isAssertion) {
-                    if (rootNode?.localName === 'Assertion') {
-                        return [true, rootNode.toString(), false];
-                    }
-                    else {
-                        throw new Error('ERR_INVALID_ASSERTION_SIGNATURE');
-                    }
-                }
-                // 处理已验证的签名
-                // @ts-expect-error misssing Node properties are not needed
-                if (rootNode.localName === 'ArtifactResponse') {
-                    // 在 ArtifactResponse 中查找 Response
-                    // @ts-expect-error misssing Node properties are not needed
-                    const responseNodes = select("./*[local-name()='Response']", 
-                    // @ts-expect-error misssing Node properties are not needed
-                    rootNode);
-                    if (responseNodes.length === 0) {
-                        continue;
-                    }
-                    const responseNode = responseNodes[0];
-                    // 在 Response 中查找断言
-                    const encryptedAssertions = select("./*[local-name()='EncryptedAssertion']", responseNode);
-                    const assertions = select("./*[local-name()='Assertion']", responseNode);
-                    if (encryptedAssertions.length === 1) {
-                        return [true, encryptedAssertions[0].toString(), true];
-                    }
-                    if (assertions.length === 1) {
-                        return [true, assertions[0].toString(), false];
-                    }
-                }
-                // 直接处理 Response
-                else if (rootNode?.localName === 'Response') {
-                    // @ts-expect-error misssing Node properties are not needed
-                    const encryptedAssertions = select("./*[local-name()='EncryptedAssertion']", 
-                    // @ts-expect-error misssing Node properties are not needed
-                    rootNode);
-                    // @ts-expect-error misssing Node properties are not needed
-                    const assertions = select("./*[local-name()='Assertion']", 
-                    // @ts-expect-error misssing Node properties are not needed
-                    rootNode);
-                    if (encryptedAssertions.length === 1) {
-                        return [true, encryptedAssertions[0].toString(), true];
-                    }
-                    if (assertions.length === 1) {
-                        return [true, assertions[0].toString(), false];
-                    }
-                }
-                // 直接处理 Assertion
-                else if (rootNode?.localName === 'Assertion') {
-                    return [true, rootNode.toString(), false];
-                }
-                // 直接处理 EncryptedAssertion
-                else if (rootNode?.localName === 'EncryptedAssertion') {
-                    return [true, rootNode.toString(), true];
-                }
-                else {
-                    console.warn("未知的根节点类型:", rootNode?.localName);
+                const rootNode = docParser.parseFromString(signedVerifiedXML, 'application/xml').documentElement;
+                // 处理签名的内容
+                switch (rootNode?.localName) {
+                    case 'Response':
+                        // @ts-expect-error
+                        const encryptedAssert = select("./*[local-name()='EncryptedAssertion']", rootNode);
+                        // @ts-expect-error
+                        const assertions = select("./*[local-name()='Assertion']", rootNode);
+                        if (encryptedAssert.length === 1) {
+                            return [true, encryptedAssert[0].toString(), true, false];
+                        }
+                        if (assertions.length === 1) {
+                            return [true, assertions[0].toString(), false, false];
+                        }
+                        return [true, null, false, true]; // 签名验证成功但未找到断言
+                    case 'Assertion':
+                        return [true, rootNode.toString(), false, false];
+                    case 'EncryptedAssertion':
+                        return [true, rootNode.toString(), true, false];
+                    case 'ArtifactResolve':
+                    case 'ArtifactResponse':
+                        // 提取SOAP消息内部的实际内容
+                        return [true, rootNode.toString(), false, false];
+                    default:
+                        return [true, null, false, true]; // 签名验证成功但未找到可识别的内容
                 }
             }
-            throw new Error('ERR_ZERO_SIGNATURE');
+            return [false, null, encryptedAssertions.length > 0, false];
         },
         /**
          * @desc Helper function to create the key section in metadata (abstraction for signing and encrypt use)

package/build/src/libsamlSoap.js

@@ -0,0 +1,115 @@
+import { getContext } from "./api.js";
+import { select } from "xpath";
+import { SignedXml } from "xml-crypto";
+import fs from "fs";
+import utility, { flattenDeep } from "./utility.js";
+import libsaml from "./libsaml.js";
+import { wording } from "./urn.js";
+import { DOMParser } from '@xmldom/xmldom';
+const certUse = wording.certUse;
+const docParser = new DOMParser();
+async function verifyAndDecryptSoapMessage(xml, opts) {
+    const { dom } = getContext();
+    const doc = dom.parseFromString(xml, 'application/xml');
+    const docParser = new DOMParser();
+    let type = '';
+    // 为 SOAP 消息定义 XPath
+    const artifactResolveXpath = "/*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='ArtifactResolve']";
+    const artifactResponseXpath = "/*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='ArtifactResponse']";
+    // 检测 ArtifactResolve 或 ArtifactResponse 的存在
+    // @ts-expect-error
+    const artifactResolveNodes = select(artifactResolveXpath, doc);
+    // @ts-expect-error
+    const artifactResponseNodes = select(artifactResponseXpath, doc);
+    // 根据消息类型选择合适的 XPath
+    let basePath = "";
+    if (artifactResolveNodes?.length > 0) {
+        type = 'artifactResolve';
+        basePath = "/*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='ArtifactResolve']";
+    }
+    else if (artifactResponseNodes?.length > 0) {
+        type = 'artifactResponse';
+        basePath = "/*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='ArtifactResponse']";
+    }
+    else {
+        throw new Error('ERR_UNSUPPORTED_SOAP_MESSAGE_TYPE');
+    }
+    // 基于 SOAP 结构重新定义 XPath
+    const messageSignatureXpath = `${basePath}/*[local-name(.)='Signature']`;
+    // @ts-expect-error
+    const messageSignatureNode = select(messageSignatureXpath, doc);
+    let selection = [];
+    if (messageSignatureNode?.length > 0) {
+        selection = selection.concat(messageSignatureNode);
+    }
+    if (selection.length === 0) {
+        throw new Error('ERR_ZERO_SIGNATURE');
+    }
+    return verifySignature(xml, selection, opts);
+}
+function verifySignature(xml, selection, opts) {
+    // 尝试所有签名节点
+    for (const signatureNode of selection) {
+        const sig = new SignedXml();
+        let verified = false;
+        sig.signatureAlgorithm = opts.signatureAlgorithm;
+        if (!opts.keyFile && !opts.metadata) {
+            throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
+        }
+        if (opts.keyFile) {
+            sig.publicCert = fs.readFileSync(opts.keyFile);
+        }
+        if (opts.metadata) {
+            const certificateNode = select(".//*[local-name(.)='X509Certificate']", signatureNode);
+            // 证书处理逻辑
+            let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
+            if (Array.isArray(metadataCert)) {
+                metadataCert = flattenDeep(metadataCert);
+            }
+            else if (typeof metadataCert === 'string') {
+                metadataCert = [metadataCert];
+            }
+            metadataCert = metadataCert.map(utility.normalizeCerString);
+            // 没有证书的情况
+            if (certificateNode.length === 0 && metadataCert.length === 0) {
+                throw new Error('NO_SELECTED_CERTIFICATE');
+            }
+            if (certificateNode.length !== 0) {
+                const x509CertificateData = certificateNode[0].firstChild.data;
+                const x509Certificate = utility.normalizeCerString(x509CertificateData);
+                if (metadataCert.length >= 1 && !metadataCert.includes(x509Certificate)) {
+                    throw new Error('ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA');
+                }
+                sig.publicCert = libsaml.getKeyInfo(x509Certificate).getKey();
+            }
+            else {
+                sig.publicCert = libsaml.getKeyInfo(metadataCert[0]).getKey();
+            }
+        }
+        sig.loadSignature(signatureNode);
+        verified = sig.checkSignature(xml); // 使用原始XML验证
+        if (!verified) {
+            throw new Error('ERR_FAILED_TO_VERIFY_SIGNATURE');
+        }
+        if (sig.getSignedReferences().length < 1) {
+            throw new Error('NO_SIGNATURE_REFERENCES');
+        }
+        const signedVerifiedXML = sig.getSignedReferences()[0];
+        const rootNode = docParser.parseFromString(signedVerifiedXML, 'application/xml').documentElement;
+        // 处理签名的内容
+        switch (rootNode?.localName) {
+            case 'ArtifactResolve':
+                return [true, rootNode.toString(), false, false];
+            case 'ArtifactResponse':
+                // @ts-expect-error
+                const Response = select("/*[local-name()='ArtifactResponse']/*[local-name()='Response']", rootNode);
+                return [true, Response?.[0].toString(), false, false]; // 签名验证成功但未找到断言
+            default:
+                return [true, null, false, true]; // 签名验证成功但未找到可识别的内容
+        }
+    }
+    return [false, null, false, true];
+}
+export default {
+    verifyAndDecryptSoapMessage
+};