samlesa 3.2.1 → 3.3.0

package/build/src/extractor.js

@@ -3,6 +3,8 @@ import { uniq, last, zipObject, notEmpty } from './utility.js';
 import { getContext } from './api.js';
 import camelCase from 'camelcase';
 function buildAbsoluteXPath(paths) {
+    if (!paths || paths.length === 0)
+        return '';
     return paths.reduce((currentPath, name) => {
         let appendedPath = currentPath;
         const isWildcard = name.startsWith('~');
@@ -10,14 +12,14 @@ function buildAbsoluteXPath(paths) {
             const pathName = name.replace('~', '');
             appendedPath = currentPath + `/*[contains(local-name(), '${pathName}')]`;
         }
-        if (!isWildcard) {
+        else {
             appendedPath = currentPath + `/*[local-name(.)='${name}']`;
         }
         return appendedPath;
     }, '');
 }
 function buildAttributeXPath(attributes) {
-    if (attributes.length === 0) {
+    if (!attributes || attributes.length === 0) {
         return '/text()';
     }
     if (attributes.length === 1) {
@@ -26,355 +28,359 @@ function buildAttributeXPath(attributes) {
     const filters = attributes.map(attribute => `name()='${attribute}'`).join(' or ');
     return `/@*[${filters}]`;
 }
+// ... (其他字段配置如 loginRequestFields 等保持不变，为节省篇幅此处省略，请保留你原有的所有 fields 定义) ...
+// 为了完整性，这里假设你保留了之前所有的 fields 定义 (loginRequestFields, idpMetadataFields 等)
+// 重点修正下方的 spMetadataFields 和 extract 函数
 export const loginRequestFields = [
-    {
-        key: 'request',
-        localPath: ['AuthnRequest'],
-        attributes: ['ID', 'IssueInstant', 'Destination', 'AssertionConsumerServiceURL', 'ProtocolBinding', 'ForceAuthn', 'IsPassive', 'AssertionConsumerServiceIndex', 'AttributeConsumingServiceIndex']
-    },
-    {
-        key: 'issuer',
-        localPath: ['AuthnRequest', 'Issuer'],
-        attributes: []
-    },
-    {
-        key: 'nameIDPolicy',
-        localPath: ['AuthnRequest', 'NameIDPolicy'],
-        attributes: ['Format', 'AllowCreate']
-    },
-    {
-        key: 'authnContextClassRef',
-        localPath: ['AuthnRequest', 'AuthnContextClassRef'],
-        attributes: []
-    },
-    {
-        key: 'signature',
-        localPath: ['AuthnRequest', 'Signature'],
-        attributes: [],
-        context: true
-    }
+    { key: 'request', localPath: ['AuthnRequest'], attributes: ['ID', 'IssueInstant', 'Destination', 'AssertionConsumerServiceURL', 'ProtocolBinding', 'ForceAuthn', 'IsPassive', 'AssertionConsumerServiceIndex', 'AttributeConsumingServiceIndex'] },
+    { key: 'issuer', localPath: ['AuthnRequest', 'Issuer'], attributes: [] },
+    { key: 'nameIDPolicy', localPath: ['AuthnRequest', 'NameIDPolicy'], attributes: ['Format', 'AllowCreate'] },
+    { key: 'authnContextClassRef', localPath: ['AuthnRequest', 'AuthnContextClassRef'], attributes: [] },
+    { key: 'signature', localPath: ['AuthnRequest', 'Signature'], attributes: [], context: true }
 ];
 export const artifactResolveFields = [
-    {
-        key: 'request',
-        localPath: ['ArtifactResolve'],
-        attributes: ['ID', 'IssueInstant', 'Version']
-    },
-    {
-        key: 'issuer', localPath: ['ArtifactResolve', 'Issuer'], attributes: []
-    },
-    {
-        key: 'Artifact', localPath: ['ArtifactResolve', 'Artifact'], attributes: []
-    },
-    {
-        key: 'signature', localPath: ['ArtifactResolve', 'Signature'], attributes: [], context: true
-    },
+    { key: 'request', localPath: ['ArtifactResolve'], attributes: ['ID', 'IssueInstant', 'Version'] },
+    { key: 'issuer', localPath: ['ArtifactResolve', 'Issuer'], attributes: [] },
+    { key: 'Artifact', localPath: ['ArtifactResolve', 'Artifact'], attributes: [] },
+    { key: 'signature', localPath: ['ArtifactResolve', 'Signature'], attributes: [], context: true },
 ];
 export const artifactResponseFields = [
-    {
-        key: 'request',
-        localPath: ['Envelope', 'Body', 'ArtifactResolve'],
-        attributes: ['ID', 'IssueInstant', 'Version']
-    },
-    {
-        key: 'issuer', localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Issuer'], attributes: []
-    },
-    {
-        key: 'Artifact', localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Artifact'], attributes: []
-    },
-    {
-        key: 'signature', localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Signature'], attributes: [], context: true
-    },
+    { key: 'request', localPath: ['Envelope', 'Body', 'ArtifactResolve'], attributes: ['ID', 'IssueInstant', 'Version'] },
+    { key: 'issuer', localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Issuer'], attributes: [] },
+    { key: 'Artifact', localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Artifact'], attributes: [] },
+    { key: 'signature', localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Signature'], attributes: [], context: true },
 ];
-// support two-tiers status code
 export const loginResponseStatusFields = [
-    {
-        key: 'top',
-        localPath: ['Response', 'Status', 'StatusCode'],
-        attributes: ['Value'],
-    },
-    {
-        key: 'second',
-        localPath: ['Response', 'Status', 'StatusCode', 'StatusCode'],
-        attributes: ['Value'],
-    }
+    { key: 'top', localPath: ['Response', 'Status', 'StatusCode'], attributes: ['Value'] },
+    { key: 'second', localPath: ['Response', 'Status', 'StatusCode', 'StatusCode'], attributes: ['Value'] }
 ];
-// support two-tiers status code
 export const loginArtifactResponseStatusFields = [
-    {
-        key: 'top',
-        localPath: ['Envelope', 'Body', 'ArtifactResponse', 'Status', 'StatusCode'],
-        attributes: ['Value'],
-    },
-    {
-        key: 'second',
-        localPath: ['Envelope', 'Body', 'ArtifactResponse', 'Status', 'StatusCode', 'StatusCode'],
-        attributes: ['Value'],
-    }
+    { key: 'top', localPath: ['Envelope', 'Body', 'ArtifactResponse', 'Status', 'StatusCode'], attributes: ['Value'] },
+    { key: 'second', localPath: ['Envelope', 'Body', 'ArtifactResponse', 'Status', 'StatusCode', 'StatusCode'], attributes: ['Value'] }
 ];
-// support two-tiers status code
 export const logoutResponseStatusFields = [
-    {
-        key: 'top',
-        localPath: ['LogoutResponse', 'Status', 'StatusCode'],
-        attributes: ['Value']
-    },
-    {
-        key: 'second',
-        localPath: ['LogoutResponse', 'Status', 'StatusCode', 'StatusCode'],
-        attributes: ['Value'],
-    }
+    { key: 'top', localPath: ['LogoutResponse', 'Status', 'StatusCode'], attributes: ['Value'] },
+    { key: 'second', localPath: ['LogoutResponse', 'Status', 'StatusCode', 'StatusCode'], attributes: ['Value'] }
 ];
 export const loginResponseFields = assertion => [
-    {
-        key: 'conditions',
-        localPath: ['Assertion', 'Conditions'],
-        attributes: ['NotBefore', 'NotOnOrAfter'],
-        shortcut: assertion
+    { key: 'conditions', localPath: ['Assertion', 'Conditions'], attributes: ['NotBefore', 'NotOnOrAfter'], shortcut: assertion },
+    { key: 'response', localPath: ['Response'], attributes: ['ID', 'IssueInstant', 'Destination', 'InResponseTo', 'Version'] },
+    { key: 'audience', localPath: ['Assertion', 'Conditions', 'AudienceRestriction', 'Audience'], attributes: [], shortcut: assertion },
+    { key: 'issuer', localPath: ['Assertion', 'Issuer'], attributes: [], shortcut: assertion },
+    { key: 'nameID', localPath: ['Assertion', 'Subject', 'NameID'], attributes: [], shortcut: assertion },
+    { key: 'sessionIndex', localPath: ['Assertion', 'AuthnStatement'], attributes: ['AuthnInstant', 'SessionNotOnOrAfter', 'SessionIndex'], shortcut: assertion },
+    { key: 'attributes', localPath: ['Assertion', 'AttributeStatement', 'Attribute'], index: ['Name'], attributePath: ['AttributeValue'], attributes: [], shortcut: assertion },
+    { key: 'subjectConfirmation', localPath: ['Assertion', 'Subject', 'SubjectConfirmation', 'SubjectConfirmationData'], attributes: ['Recipient', 'InResponseTo', 'NotOnOrAfter'], shortcut: assertion },
+    { key: 'oneTimeUse', localPath: ['Assertion', 'Conditions', 'OneTimeUse'], attributes: [], shortcut: assertion },
+    { key: 'status', localPath: ['Response', 'Status', 'StatusCode'], attributes: ['Value'] },
+];
+export const logoutRequestFields = [
+    { key: 'request', localPath: ['LogoutRequest'], attributes: ['ID', 'IssueInstant', 'Destination'] },
+    { key: 'issuer', localPath: ['LogoutRequest', 'Issuer'], attributes: [] },
+    { key: 'nameID', localPath: ['LogoutRequest', 'NameID'], attributes: [] },
+    { key: 'sessionIndex', localPath: ['LogoutRequest', 'SessionIndex'], attributes: [] },
+    { key: 'signature', localPath: ['LogoutRequest', 'Signature'], attributes: [], context: true }
+];
+export const logoutResponseFields = [
+    { key: 'response', localPath: ['LogoutResponse'], attributes: ['ID', 'Destination', 'InResponseTo'] },
+    { key: 'issuer', localPath: ['LogoutResponse', 'Issuer'], attributes: [] },
+    { key: 'signature', localPath: ['LogoutResponse', 'Signature'], attributes: [], context: true }
+];
+// ============================================================================
+// 增强版：IdP 元数据提取字段配置
+// ============================================================================
+export const idpMetadataFields = [
+    // --- 1. 基础标识 ---
+    {
+        key: 'entityID',
+        localPath: ['EntityDescriptor'],
+        attributes: ['entityID']
     },
     {
-        key: 'response',
-        localPath: ['Response'],
-        attributes: ['ID', 'IssueInstant', 'Destination', 'InResponseTo', 'Version'],
+        // 可选：提取整个 EntityDescriptor 的 validUntil 和 cacheDuration
+        key: 'entityDescriptor',
+        localPath: ['EntityDescriptor'],
+        attributes: ['validUntil', 'cacheDuration']
     },
-    {
-        key: 'audience',
-        localPath: ['Assertion', 'Conditions', 'AudienceRestriction', 'Audience'],
-        attributes: [],
-        shortcut: assertion
+    // --- 2. IDPSSODescriptor 核心属性 ---
+    {
+        key: 'idpSSODescriptor',
+        localPath: ['EntityDescriptor', 'IDPSSODescriptor'],
+        attributes: [
+            'protocolSupportEnumeration',
+            'WantAuthnRequestsSigned', // IdP 是否希望 SP 对请求签名
+            'cacheDuration'
+        ]
     },
-    // {
-    //   key: 'issuer',
-    //   localPath: ['Response', 'Issuer'],
-    //   attributes: []
-    // },
+    // --- 3. 服务端点列表 (Endpoints) ---
     {
-        key: 'issuer',
-        localPath: ['Assertion', 'Issuer'],
-        attributes: [],
-        shortcut: assertion
+        // 单点登录服务 (SSO) - 核心
+        key: 'singleSignOnService',
+        localPath: ['EntityDescriptor', 'IDPSSODescriptor', 'SingleSignOnService'],
+        attributes: ['Binding', 'Location', 'ResponseLocation'], // ResponseLocation 用于某些绑定
+        listMode: true
     },
     {
-        key: 'nameID',
-        localPath: ['Assertion', 'Subject', 'NameID'],
-        attributes: [],
-        shortcut: assertion
+        // 单点注销服务 (SLO)
+        key: 'singleLogoutService',
+        localPath: ['EntityDescriptor', 'IDPSSODescriptor', 'SingleLogoutService'],
+        attributes: ['Binding', 'Location'],
+        listMode: true
     },
     {
-        key: 'sessionIndex',
-        localPath: ['Assertion', 'AuthnStatement'],
-        attributes: ['AuthnInstant', 'SessionNotOnOrAfter', 'SessionIndex'],
-        shortcut: assertion
+        // Artifact 解析服务 (如果使用 Artifact 绑定)
+        key: 'artifactResolutionService',
+        localPath: ['EntityDescriptor', 'IDPSSODescriptor', 'ArtifactResolutionService'],
+        attributes: ['Binding', 'Location', 'index', 'isDefault'],
+        listMode: true
     },
     {
-        key: 'attributes',
-        localPath: ['Assertion', 'AttributeStatement', 'Attribute'],
-        index: ['Name'],
-        attributePath: ['AttributeValue'],
-        attributes: [],
-        shortcut: assertion
+        // ManageNameID 服务
+        key: 'manageNameIDService',
+        localPath: ['EntityDescriptor', 'IDPSSODescriptor', 'ManageNameIDService'],
+        attributes: ['Binding', 'Location'],
+        listMode: true
     },
+    // --- 4. 名称 ID 格式 (NameID Formats) ---
     {
-        key: 'subjectConfirmation',
-        localPath: ['Assertion', 'Subject', 'SubjectConfirmation', 'SubjectConfirmationData'],
-        attributes: ['Recipient', 'InResponseTo', 'NotOnOrAfter'],
-        shortcut: assertion
+        // 提取所有支持的 NameID 格式 (文本内容)
+        key: 'nameIDFormat',
+        localPath: ['EntityDescriptor', 'IDPSSODescriptor', 'NameIDFormat'],
+        attributes: []
+        // 注意：如果 extract 函数未完全支持 text() 的 listMode，这里可能只返回第一个。
+        // 如果需要数组，需确保 extract 逻辑完善，或者此处暂时只取主要的一个。
     },
     {
-        key: 'oneTimeUse',
-        localPath: ['Assertion', 'Conditions', 'OneTimeUse'],
-        attributes: [],
-        shortcut: assertion
+        // 获取主要的 NameID Policy 格式 (如果有显式声明)
+        key: 'nameIDPolicyFormat',
+        localPath: ['EntityDescriptor', 'IDPSSODescriptor', 'NameIDPolicy'],
+        attributes: ['Format']
     },
+    // --- 5. 组织信息 (Organization) ---
     {
-        key: 'status',
-        localPath: ['Response', 'Status', 'StatusCode'],
-        attributes: ['Value']
+        key: 'organizationName',
+        localPath: ['EntityDescriptor', 'Organization', 'OrganizationName'],
+        attributes: [] // 取文本内容
     },
-];
-export const logoutRequestFields = [
     {
-        key: 'request',
-        localPath: ['LogoutRequest'],
-        attributes: ['ID', 'IssueInstant', 'Destination']
+        key: 'organizationDisplayName',
+        localPath: ['EntityDescriptor', 'Organization', 'OrganizationDisplayName'],
+        attributes: []
     },
     {
-        key: 'issuer',
-        localPath: ['LogoutRequest', 'Issuer'],
+        key: 'organizationURL',
+        localPath: ['EntityDescriptor', 'Organization', 'OrganizationURL'],
         attributes: []
     },
+    // --- 6. 联系人信息 (ContactPerson) ---
     {
-        key: 'nameID',
-        localPath: ['LogoutRequest', 'NameID'],
-        attributes: []
+        key: 'contactPerson',
+        localPath: ['EntityDescriptor', 'ContactPerson'],
+        attributes: ['contactType'],
+        listMode: true
+        // 局限：目前只能提取 contactType。如需提取 Email/GivenName，需扩展 extract 逻辑。
     },
+    // --- 7. 证书与密钥信息 (Certificates & Keys) ---
+    // 这些 key 会触发 extract 函数内部的硬编码逻辑，自动查找对应 @use 的证书
+    // 7.1 签名证书 (IdP 用来签名响应/断言)
     {
-        key: 'sessionIndex',
-        localPath: ['LogoutRequest', 'SessionIndex'],
-        attributes: []
+        key: 'signingCert'
+        // localPath 和 attributes 将被内部逻辑忽略
     },
+    // 7.2 加密证书 (IdP 用来加密断言中的敏感信息，如果有)
     {
-        key: 'signature',
-        localPath: ['LogoutRequest', 'Signature'],
-        attributes: [],
-        context: true
-    }
-];
-export const logoutResponseFields = [
+        key: 'encryptCert'
+    },
+    // 7.3 签名密钥名称 (KeyName)
     {
-        key: 'response',
-        localPath: ['LogoutResponse'],
-        attributes: ['ID', 'Destination', 'InResponseTo']
+        key: 'signingKeyName'
     },
+    // 7.4 加密密钥名称 (KeyName)
     {
-        key: 'issuer',
-        localPath: ['LogoutResponse', 'Issuer'],
-        attributes: []
+        key: 'encryptionKeyName'
     },
+    // --- 8. 其他扩展属性 (可选) ---
     {
-        key: 'signature',
-        localPath: ['LogoutResponse', 'Signature'],
-        attributes: [],
-        context: true
+        // 提取 AttributeConsumingService (如果 IdP 声明了它需要的属性)
+        key: 'attributeConsumingService',
+        localPath: ['EntityDescriptor', 'IDPSSODescriptor', 'AttributeConsumingService'],
+        attributes: ['index', 'isDefault'],
+        listMode: true
     }
 ];
+// ============================================================================
+// 修正后的 SP 元数据提取字段配置
+// ============================================================================
+export const spMetadataFields = [
+    { key: 'entityID', localPath: ['EntityDescriptor'], attributes: ['entityID'] },
+    { key: 'spSSODescriptor', localPath: ['EntityDescriptor', 'SPSSODescriptor'], attributes: ['protocolSupportEnumeration', 'AuthnRequestsSigned', 'WantAssertionsSigned'] },
+    { key: 'assertionConsumerService', localPath: ['EntityDescriptor', 'SPSSODescriptor', 'AssertionConsumerService'], attributes: ['Binding', 'Location', 'index', 'isDefault'], listMode: true },
+    { key: 'singleLogoutService', localPath: ['EntityDescriptor', 'SPSSODescriptor', 'SingleLogoutService'], attributes: ['Binding', 'Location'], listMode: true },
+    { key: 'artifactResolutionService', localPath: ['EntityDescriptor', 'SPSSODescriptor', 'ArtifactResolutionService'], attributes: ['Binding', 'Location', 'index', 'isDefault'], listMode: true },
+    { key: 'manageNameIDService', localPath: ['EntityDescriptor', 'SPSSODescriptor', 'ManageNameIDService'], attributes: ['Binding', 'Location'], listMode: true },
+    { key: 'nameIDFormat', localPath: ['EntityDescriptor', 'SPSSODescriptor', 'NameIDFormat'], attributes: [] },
+    { key: 'organizationName', localPath: ['EntityDescriptor', 'Organization', 'OrganizationName'], attributes: [] },
+    { key: 'organizationDisplayName', localPath: ['EntityDescriptor', 'Organization', 'OrganizationDisplayName'], attributes: [] },
+    { key: 'organizationURL', localPath: ['EntityDescriptor', 'Organization', 'OrganizationURL'], attributes: [] },
+    { key: 'contactPerson', localPath: ['EntityDescriptor', 'ContactPerson'], attributes: ['contactType'], listMode: true },
+    // 特殊字段：触发 extract 内部的硬编码逻辑
+    // localPath 和 attributes 在这里不起作用，仅作为占位符
+    { key: 'signingCert' },
+    { key: 'encryptCert' },
+    { key: 'signingKeyName' },
+    { key: 'encryptionKeyName' }
+];
 export function extract(context, fields) {
     const { dom } = getContext();
     const rootDoc = dom.parseFromString(context, 'application/xml');
     return fields.reduce((result, field) => {
-        // get essential fields
         const key = field.key;
-        const localPath = field.localPath;
-        const attributes = field.attributes;
+        // 安全解构，防止 undefined
+        const localPath = field.localPath || [];
+        const attributes = field.attributes || [];
         const isEntire = field.context;
         const shortcut = field.shortcut;
-        // get optional fields
         const index = field.index;
         const attributePath = field.attributePath;
-        // set allowing overriding if there is a shortcut injected
+        const listMode = field.listMode;
         let targetDoc = rootDoc;
-        // if shortcut is used, then replace the doc
-        // it's a design for overriding the doc used during runtime
         if (shortcut) {
             targetDoc = dom.parseFromString(shortcut, 'application/xml');
         }
-        // special case: multiple path
-        /*
-          {
-            key: 'issuer',
-            localPath: [
-              ['Response', 'Issuer'],
-              ['Response', 'Assertion', 'Issuer']
-            ],
-            attributes: []
-          }
-         */
-        if (localPath.every(path => Array.isArray(path))) {
-            const multiXPaths = localPath
-                .map(path => {
-                // not support attribute yet, so ignore it
-                return `${buildAbsoluteXPath(path)}/text()`;
-            })
-                .join(' | ');
+        // ==========================================================================
+        // 【核心修复】特殊处理：证书和 KeyName 提取 (Hardcoded logic)
+        // 不再硬编码 IDPSSODescriptor 或 SPSSODescriptor，而是全局搜索 @use 属性
+        // ==========================================================================
+        if (key === 'signingCert' || key === 'encryptCert' || key === 'signingKeyName' || key === 'encryptionKeyName') {
+            const isSigning = key.startsWith('signing');
+            const useType = isSigning ? 'signing' : 'encryption';
+            const isKeyName = key.endsWith('KeyName');
+            // 通用 XPath：查找任意层级下符合 @use 条件的 KeyDescriptor
+            const kdXPath = `//*[local-name(.)='KeyDescriptor' and @use='${useType}']`;
+            let fullXPath = '';
+            if (isKeyName) {
+                // 提取 KeyName 文本
+                fullXPath = `${kdXPath}/*[local-name(.)='KeyInfo']/*[local-name(.)='KeyName']/text()`;
+            }
+            else {
+                // 提取 X509Certificate 文本
+                fullXPath = `${kdXPath}/*[local-name(.)='KeyInfo']/*[local-name(.)='X509Data']/*[local-name(.)='X509Certificate']/text()`;
+            }
+            try {
+                // @ts-ignore
+                const nodes = select(fullXPath, targetDoc);
+                if (isKeyName) {
+                    const keyNames = nodes.map((n) => n.nodeValue).filter(notEmpty);
+                    return {
+                        ...result,
+                        [key]: keyNames.length > 0 ? keyNames[0] : null
+                    };
+                }
+                else {
+                    const certs = nodes.map((n) => {
+                        const val = n.nodeValue || n.value;
+                        return val ? val.replace(/\r\n|\r|\n/g, '') : null;
+                    }).filter(notEmpty);
+                    return {
+                        ...result,
+                        [key]: certs.length > 0 ? certs[0] : null
+                    };
+                }
+            }
+            catch (e) {
+                console.error(`Error extracting ${key}:`, e);
+                return { ...result, [key]: null };
+            }
+        }
+        // 特殊 case: 多路径 (原有逻辑)
+        if (Array.isArray(localPath) && localPath.length > 0 && Array.isArray(localPath[0])) {
+            const multiXPaths = localPath.map(path => `${buildAbsoluteXPath(path)}/text()`).join(' | ');
+            // @ts-ignore
+            const nodes = select(multiXPaths, targetDoc);
+            return {
+                ...result,
+                [key]: uniq(nodes.map((n) => n.nodeValue).filter(notEmpty))
+            };
+        }
+        // 此时 localPath 必然是 string[]
+        const currentLocalPath = localPath;
+        // 如果 localPath 为空数组（如特殊字段未定义 path），且未命中上面的特殊逻辑，则跳过
+        if (currentLocalPath.length === 0 && !isEntire) {
+            // 对于没有 path 且不是特殊处理的字段，返回 null 或跳过
+            return { ...result, [key]: null };
+        }
+        const baseXPath = buildAbsoluteXPath(currentLocalPath);
+        // --- 新增：列表模式处理 (用于 SSO Service, ACS 等) ---
+        if (listMode && attributes.length > 0) {
+            // @ts-ignore
+            const nodes = select(baseXPath, targetDoc);
+            const resultList = nodes.map((node) => {
+                const attrResult = {};
+                attributes.forEach(attr => {
+                    if (node.getAttribute) {
+                        const val = node.getAttribute(attr);
+                        if (val) {
+                            attrResult[camelCase(attr, { locale: 'en-us' })] = val;
+                        }
+                    }
+                });
+                return attrResult;
+            });
             return {
                 ...result,
-                // @ts-expect-error misssing Node properties are not needed
-                [key]: uniq(select(multiXPaths, targetDoc).map((n) => n.nodeValue).filter(notEmpty))
+                [key]: resultList
             };
         }
-        // eo special case: multiple path
-        const baseXPath = buildAbsoluteXPath(localPath);
         const attributeXPath = buildAttributeXPath(attributes);
-        // special case: get attributes where some are in child, some are in parent
-        /*
-          {
-            key: 'attributes',
-            localPath: ['Response', 'Assertion', 'AttributeStatement', 'Attribute'],
-            index: ['Name'],
-            attributePath: ['AttributeValue'],
-            attributes: []
-          }
-        */
+        // 特殊 case: 属性聚合 (原有逻辑 - Attributes with index)
         if (index && attributePath) {
-            // find the index in localpath
             const indexPath = buildAttributeXPath(index);
             const fullLocalXPath = `${baseXPath}${indexPath}`;
-            // @ts-expect-error misssing Node properties are not needed
+            // @ts-ignore
             const parentNodes = select(baseXPath, targetDoc);
-            // [uid, mail, edupersonaffiliation], ready for aggregate
-            // @ts-expect-error misssing Node properties are not needed
+            // @ts-ignore
             const parentAttributes = select(fullLocalXPath, targetDoc).map((n) => n.value);
-            // [attribute, attributevalue]
-            const childXPath = buildAbsoluteXPath([last(localPath)].concat(attributePath));
+            const childXPath = buildAbsoluteXPath([last(currentLocalPath)].concat(attributePath));
             const childAttributeXPath = buildAttributeXPath(attributes);
             const fullChildXPath = `${childXPath}${childAttributeXPath}`;
-            // [ 'test', 'test@example.com', [ 'users', 'examplerole1' ] ]
-            const childAttributes = parentNodes.map(node => {
+            const childAttributes = parentNodes.map((node) => {
                 const nodeDoc = dom.parseFromString(node.toString(), 'application/xml');
                 if (attributes.length === 0) {
                     // @ts-ignore
                     const childValues = select(fullChildXPath, nodeDoc).map((n) => n.nodeValue);
-                    if (childValues.length === 1) {
-                        return childValues[0];
-                    }
-                    return childValues;
+                    return childValues.length === 1 ? childValues[0] : childValues;
                 }
                 if (attributes.length > 0) {
                     // @ts-ignore
                     const childValues = select(fullChildXPath, nodeDoc).map((n) => n.value);
-                    if (childValues.length === 1) {
-                        return childValues[0];
-                    }
-                    return childValues;
+                    return childValues.length === 1 ? childValues[0] : childValues;
                 }
                 return null;
             });
-            // aggregation
             const obj = zipObject(parentAttributes, childAttributes, false);
-            return {
-                ...result,
-                [key]: obj
-            };
+            return { ...result, [key]: obj };
         }
-        // case: fetch entire content, only allow one existence
-        /*
-          {
-            key: 'signature',
-            localPath: ['AuthnRequest', 'Signature'],
-            attributes: [],
-            context: true
-          }
-        */
+        // 特殊 case: 获取整个节点内容 (原有逻辑)
         if (isEntire) {
-            // @ts-expect-error misssing Node properties are not needed
+            // @ts-ignore
             const node = select(baseXPath, targetDoc);
             let value = null;
             if (node.length === 1) {
                 value = node[0].toString();
             }
             if (node.length > 1) {
-                value = node.map(n => n.toString());
+                value = node.map((n) => n.toString());
             }
-            return {
-                ...result,
-                [key]: value
-            };
+            return { ...result, [key]: value };
         }
-        // case: multiple attribute
-        /*
-          {
-            key: 'nameIDPolicy',
-            localPath: ['AuthnRequest', 'NameIDPolicy'],
-            attributes: ['Format', 'AllowCreate']
-          }
-        */
-        if (attributes.length > 1) {
+        // 特殊 case: 多属性对象 (原有逻辑，非 listMode)
+        if (attributes.length > 1 && !listMode) {
             // @ts-ignore
-            const baseNode = select(baseXPath, targetDoc).map(n => n.toString());
-            const childXPath = `${buildAbsoluteXPath([last(localPath)])}${attributeXPath}`;
-            const attributeValues = baseNode.map((node) => {
+            const baseNode = select(baseXPath, targetDoc).map((n) => n.toString());
+            const childXPath = `${buildAbsoluteXPath([last(currentLocalPath)])}${attributeXPath}`;
+            const attributeValues = baseNode.map((nodeStr) => {
                 // @ts-ignore
-                const nodeDoc = dom.parseFromString(node, 'application/xml');
+                const nodeDoc = dom.parseFromString(nodeStr, 'application/xml');
                 // @ts-ignore
                 const values = select(childXPath, nodeDoc).reduce((r, n) => {
                     r[camelCase(n.name, { locale: 'en-us' })] = n.value;
@@ -387,49 +393,35 @@ export function extract(context, fields) {
                 [key]: attributeValues.length === 1 ? attributeValues[0] : attributeValues
             };
         }
-        // case: single attribute
-        /*
-          {
-            key: 'statusCode',
-            localPath: ['Response', 'Status', 'StatusCode'],
-            attributes: ['Value'],
-          }
-        */
-        if (attributes.length === 1) {
+        // 特殊 case: 单个属性 (原有逻辑)
+        if (attributes.length === 1 && !listMode) {
             const fullPath = `${baseXPath}${attributeXPath}`;
             // @ts-ignore
             const attributeValues = select(fullPath, targetDoc).map((n) => n.value);
-            return {
-                ...result,
-                [key]: attributeValues[0]
-            };
+            return { ...result, [key]: attributeValues[0] };
         }
-        // case: zero attribute
-        /*
-          {
-            key: 'issuer',
-            localPath: ['AuthnRequest', 'Issuer'],
-            attributes: []
-          }
-        */
-        if (attributes.length === 0) {
+        // 特殊 case: 无属性/文本内容 (原有逻辑)
+        if (attributes.length === 0 && !listMode) {
             let attributeValue = null;
-            // @ts-expect-error misssing Node properties are not needed
+            // @ts-ignore
             const node = select(baseXPath, targetDoc);
             if (node.length === 1) {
                 const fullPath = `string(${baseXPath}${attributeXPath})`;
-                // @ts-expect-error misssing Node properties are not needed
+                // @ts-ignore
                 attributeValue = select(fullPath, targetDoc);
             }
             if (node.length > 1) {
                 attributeValue = node.filter((n) => n.firstChild)
-                    .map((n) => n.firstChild.nodeValue);
+                    .map((n) => n.firstChild?.nodeValue);
             }
-            return {
-                ...result,
-                [key]: attributeValue
-            };
+            return { ...result, [key]: attributeValue };
         }
         return result;
     }, {});
 }
+export function extractIdp(context) {
+    return extract(context, idpMetadataFields);
+}
+export function extractSp(context) {
+    return extract(context, spMetadataFields);
+}

package/build/src/libsaml.js

@@ -17,7 +17,7 @@ import xmlEscape from 'xml-escape';
 import * as fs from 'fs';
 import { DOMParser } from '@xmldom/xmldom';
 const signatureAlgorithms = algorithms.signature;
-const digestAlgorithms = algorithms.digest;
+const digestAlgorithms = algorithms.signatureToDigestMap;
 const certUse = wording.certUse;
 const urlParams = wording.urlParams;
 const libSaml = () => {
@@ -328,7 +328,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
          * @return {string} base64 encoded string
          */
         constructSAMLSignature(opts) {
-            const { rawSamlMessage, referenceTagXPath, privateKey, privateKeyPass, signatureAlgorithm = signatureAlgorithms.RSA_SHA512, transformationAlgorithms = [
+            const { rawSamlMessage, referenceTagXPath, privateKey, privateKeyPass, signatureAlgorithm = signatureAlgorithms.RSA_SHA256, transformationAlgorithms = [
                 'http://www.w3.org/2000/09/xmldsig#enveloped-signature',
                 'http://www.w3.org/2001/10/xml-exc-c14n#',
             ], signingCert, signatureConfig, isBase64Output = true, isMessageSigned = false, } = opts;
@@ -926,7 +926,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
               verifier.update(octetString);
               const isValid = verifier.verify(utility.getPublicKeyPemFromCertificate(signCert), Buffer.isBuffer(signature) ? signature : Buffer.from(signature, 'base64'));
               return isValid
-
+    
             },*/
         /**
          * @desc Verifies message signature
@@ -994,9 +994,11 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                         pem: Buffer.from(`-----BEGIN CERTIFICATE-----${targetEntityMetadata.getX509Certificate(certUse.encrypt)}-----END CERTIFICATE-----`),
                         encryptionAlgorithm: sourceEntitySetting.dataEncryptionAlgorithm,
                         keyEncryptionAlgorithm: sourceEntitySetting.keyEncryptionAlgorithm,
-                        keyEncryptionDigest: sourceEntitySetting.keyEncryptionDigest ?? 'sha256', //default sha256
+                        keyEncryptionDigest: sourceEntitySetting.keyEncryptionDigest ?? 'sha1', //default sha256
                         keyEncryptionMgf1: sourceEntitySetting.keyEncryptionMgf1 ?? 'sha256',
-                        disallowEncryptionWithInsecureAlgorithm: true,
+                        disallowEncryptionWithInsecureAlgorithm: sourceEntitySetting.disallowEncryptionWithInsecureAlgorithm, // 禁止使用rsa-1_5  tripledes-cbc
+                        disallowInsecureEncryption: sourceEntitySetting.disallowInsecureEncryption, //禁aes cbc系列加密算法
+                        disallowInsecureHash: sourceEntitySetting.disallowInsecureHash, //禁止使用不安全的签名hash算法，不包括mgf1
                         warnInsecureAlgorithm: true
                     }, (err, res) => {
                         if (err) {
@@ -1017,49 +1019,6 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 }
             });
         },
-        /**
-         * @desc Decrypt the assertion section in Response
-         * @param  {string} type             only accept SAMLResponse to proceed decryption
-         * @param  {Entity} here             this entity
-         * @param  {Entity} from             from the entity where the message is sent
-         * @param {string} entireXML         response in xml string format
-         * @return {function} a promise to get back the entire xml with decrypted assertion
-         */
-        decryptAssertion(here, entireXML) {
-            return new Promise((resolve, reject) => {
-                // Implement decryption first then check the signature
-                if (!entireXML) {
-                    return reject(new Error('ERR_UNDEFINED_ASSERTION'));
-                }
-                // Perform encryption depends on the setting of where the message is sent, default is false
-                const hereSetting = here.entitySetting;
-                const { dom } = getContext();
-                const doc = dom.parseFromString(entireXML, 'application/xml');
-                // @ts-expect-error misssing Node properties are not needed
-                const encryptedAssertions = select("/*[contains(local-name(), 'Response')]/*[local-name(.)='EncryptedAssertion']", doc);
-                if (!Array.isArray(encryptedAssertions) || encryptedAssertions.length === 0) {
-                    throw new Error('ERR_UNDEFINED_ENCRYPTED_ASSERTION');
-                }
-                if (encryptedAssertions.length > 1) {
-                    throw new Error('ERR_MULTIPLE_ASSERTION');
-                }
-                const encAssertionNode = encryptedAssertions[0];
-                return xmlenc.decrypt(encAssertionNode.toString(), {
-                    key: utility.readPrivateKey(hereSetting.encPrivateKey, hereSetting.encPrivateKeyPass),
-                }, (err, res) => {
-                    if (err) {
-                        return reject(new Error('ERR_EXCEPTION_OF_ASSERTION_DECRYPTION'));
-                    }
-                    if (!res) {
-                        return reject(new Error('ERR_UNDEFINED_ENCRYPTED_ASSERTION'));
-                    }
-                    const rawAssertionDoc = dom.parseFromString(res, 'application/xml');
-                    // @ts-ignore
-                    doc.documentElement.replaceChild(rawAssertionDoc.documentElement, encAssertionNode);
-                    return resolve([doc.toString(), res]);
-                });
-            });
-        },
         /**
          * 同步版本的断言解密函数
          */
@@ -1084,6 +1043,10 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             // 使用同步方式处理解密
             xmlenc.decrypt(encAssertionNode.toString(), {
                 key: utility.readPrivateKey(hereSetting.encPrivateKey, hereSetting.encPrivateKeyPass),
+                /*        disallowInsecureEncryption:hereSetting.disallowInsecureEncryption,//开启会禁止解密使用aes cbc系列加密算法的xml
+                        disallowDecryptionWithInsecureAlgorithm: hereSetting.disallowDecryptionWithInsecureAlgorithm,//开启会禁止解密使用rsa-1_5 tripledes-cbc加密算法的xml
+                        disallowInsecureHash: hereSetting.disallowInsecureHash,//开启会禁止解密使用 hsa1系列 hash算法的xml*/
+                warnInsecureAlgorithm: true,
             }, (err, res) => {
                 if (err) {
                     throw new Error(err.message);
@@ -1178,6 +1141,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
          * @returns [解密后的完整 SOAP XML, 解密后的断言 XML]
          */
         async decryptAssertionSoap(self, entireXML) {
+            let hereSetting = self.entitySetting;
             const { dom } = getContext();
             try {
                 // 1. 解析 XML
@@ -1200,7 +1164,12 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 const privateKey = utility.readPrivateKey(self.entitySetting.encPrivateKey, self.entitySetting.encPrivateKeyPass);
                 // 4. 解密断言
                 const decryptedAssertion = await new Promise((resolve, reject) => {
-                    xmlenc.decrypt(encAssertionNode.toString(), { key: privateKey }, (err, result) => {
+                    xmlenc.decrypt(encAssertionNode.toString(), { key: privateKey,
+                        disallowInsecureEncryption: hereSetting.disallowInsecureEncryption, //开启会禁止解密使用aes cbc系列加密算法的xml
+                        disallowDecryptionWithInsecureAlgorithm: hereSetting.disallowDecryptionWithInsecureAlgorithm, //开启会禁止解密使用rsa-1_5 tripledes-cbc加密算法的xml
+                        disallowInsecureHash: hereSetting.disallowInsecureHash, //开启会禁止解密使用 hsa1系列 hash算法的xml
+                        warnInsecureAlgorithm: true,
+                    }, (err, result) => {
                         if (err) {
                             return reject(err);
                         }

package/build/src/urn.js

@@ -139,35 +139,98 @@ const messageConfigurations = {
     },
 };
 const algorithms = {
+    // 1. 签名算法定义 (SignatureMethod)
     signature: {
+        // ❌ 原文错误修正：ECDSA 不能用 rsa-sha256 的 URI
+        ECDSA_SHA256: 'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha256',
+        ECDSA_SHA384: 'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha384',
+        ECDSA_SHA512: 'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha512',
+        DSA_SHA1: 'http://www.w3.org/2000/09/xmldsig#dsa-sha1',
         RSA_SHA1: 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
-        RSA_SHA256: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
+        RSA_SHA224: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha224',
+        RSA_SHA256: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256', // 推荐
+        RSA_SHA384: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384',
         RSA_SHA512: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512',
+        // XML Signature 1.1 PSS 填充 (更安全)
+        RSA_PSS_SHA256: 'http://www.w3.org/2007/05/xmldsig-more#rsa-pss-sha256',
+        // EdDSA (Ed25519)
+        EDDSA_ED25519: 'http://www.w3.org/2007/05/xmldsig-more#eddsa-ed25519'
+    },
+    // 2. 摘要算法定义 (DigestMethod)
+    // 注意：这里直接使用标准推荐的 URI，SHA-2xx 系列推荐使用 xmlenc 命名空间
+    digest: {
+        SHA1: 'http://www.w3.org/2000/09/xmldsig#sha1',
+        SHA224: 'http://www.w3.org/2001/04/xmldsig-more#sha224', // 较少见，有时也用 xmlenc 但 xmldsig-more 更准确对应
+        SHA256: 'http://www.w3.org/2001/04/xmlenc#sha256', // ✅ 标准推荐
+        SHA384: 'http://www.w3.org/2001/04/xmlenc#sha384', // ✅ 标准推荐
+        SHA512: 'http://www.w3.org/2001/04/xmlenc#sha512' // ✅ 标准推荐
+    },
+    // 3. 映射关系表：给定一个签名算法 URI，它应该配合哪个摘要算法 URI？
+    // 这修复了你原代码中 digest 字段作为 "Map" 的意图
+    signatureToDigestMap: {
+        'http://www.w3.org/2000/09/xmldsig#rsa-sha1': 'http://www.w3.org/2000/09/xmldsig#sha1',
+        'http://www.w3.org/2000/09/xmldsig#dsa-sha1': 'http://www.w3.org/2000/09/xmldsig#sha1',
+        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha224': 'http://www.w3.org/2001/04/xmldsig-more#sha224',
+        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256': 'http://www.w3.org/2001/04/xmlenc#sha256',
+        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384': 'http://www.w3.org/2001/04/xmlenc#sha384',
+        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512': 'http://www.w3.org/2001/04/xmlenc#sha512',
+        'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha256': 'http://www.w3.org/2001/04/xmlenc#sha256',
+        'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha384': 'http://www.w3.org/2001/04/xmlenc#sha384',
+        'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha512': 'http://www.w3.org/2001/04/xmlenc#sha512',
+        'http://www.w3.org/2007/05/xmldsig-more#rsa-pss-sha256': 'http://www.w3.org/2001/04/xmlenc#sha256',
+        // EdDSA 比较特殊，它内部硬编码了 SHA-512，但在 XML 结构中如果需要显式声明 DigestMethod，通常指向 SHA-512
+        'http://www.w3.org/2007/05/xmldsig-more#eddsa-ed25519': 'http://www.w3.org/2001/04/xmlenc#sha512'
     },
     encryption: {
         data: {
-            AES_128: 'http://www.w3.org/2001/04/xmlenc#aes128-cbc',
-            AES_256: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc',
+            // --- CBC 模式 (XML Enc 1.0 - 兼容性最好) ---
+            AES_128_CBC: 'http://www.w3.org/2001/04/xmlenc#aes128-cbc',
+            AES_192_CBC: 'http://www.w3.org/2001/04/xmlenc#aes192-cbc',
+            AES_256_CBC: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc',
+            // --- GCM 模式 (XML Enc 1.1 - 推荐，提供完整性保护) ---
+            AES_128_GCM: 'http://www.w3.org/2009/xmlenc11#aes128-gcm',
+            AES_192_GCM: 'http://www.w3.org/2009/xmlenc11#aes192-gcm',
             AES_256_GCM: 'http://www.w3.org/2009/xmlenc11#aes256-gcm',
-            TRI_DEC: 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc',
-            AES_128_GCM: 'http://www.w3.org/2009/xmlenc11#aes128-gcm'
+            // --- CTR 模式 (XML Enc 1.1) ---
+            AES_128_CTR: 'http://www.w3.org/2009/xmlenc11#aes128-ctr',
+            AES_192_CTR: 'http://www.w3.org/2009/xmlenc11#aes192-ctr',
+            AES_256_CTR: 'http://www.w3.org/2009/xmlenc11#aes256-ctr',
+            // --- 旧算法 (不推荐，仅用于遗留系统) ---
+            TRIPLE_DES: 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc'
         },
+        /**
+         * 密钥加密算法 (用于加密生成的 AES 会话密钥)
+         * 这里包含了 RSA-OAEP 和 AES Key Wrap
+         */
         key: {
+            // --- RSA OAEP (推荐) ---
+            // 默认使用 SHA-1 的 OAEP (XML Enc 1.0)
             RSA_OAEP_MGF1P: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
+            // XML Enc 1.1 的通用 OAEP (通常配合 DigestMethod 参数使用 SHA-256)
+            RSA_OAEP: 'http://www.w3.org/2009/xmlenc11#rsa-oaep',
+            // --- RSA PKCS#1 v1.5 (旧标准，不推荐，但广泛存在) ---
             RSA_1_5: 'http://www.w3.org/2001/04/xmlenc#rsa-1_5',
+            // --- AES Key Wrap (用于对称密钥加密对称密钥的场景) ---
+            AES_128_KW: 'http://www.w3.org/2001/04/xmlenc#kw-aes128',
+            AES_192_KW: 'http://www.w3.org/2001/04/xmlenc#kw-aes192',
+            AES_256_KW: 'http://www.w3.org/2001/04/xmlenc#kw-aes256',
+            // --- AES GCM Key Wrap (XML Enc 1.1) ---
+            AES_128_GCM_KW: 'http://www.w3.org/2009/xmlenc11#aes128-gcmkw',
+            AES_192_GCM_KW: 'http://www.w3.org/2009/xmlenc11#aes192-gcmkw',
+            AES_256_GCM_KW: 'http://www.w3.org/2009/xmlenc11#aes256-gcmkw',
         },
     },
-    digest: {
-        'http://www.w3.org/2000/09/xmldsig#rsa-sha1': 'http://www.w3.org/2000/09/xmldsig#sha1',
-        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256': 'http://www.w3.org/2001/04/xmlenc#sha256',
-        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384': 'http://www.w3.org/2001/04/xmlenc#sha384',
-        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512': 'http://www.w3.org/2001/04/xmlenc#sha512', // support hashing algorithm sha512 in xml-crypto after 0.8.0
-        'http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1': 'http://www.w3.org/2001/04/xmlenc#sha256',
-        'http://www.w3.org/2007/05/xmldsig-more#sha384-rsa-MGF1': 'http://www.w3.org/2001/04/xmlenc#sha384',
-        'http://www.w3.org/2007/05/xmldsig-more#sha512-rsa-MGF1': 'http://www.w3.org/2001/04/xmlenc#sha512', // support hashing algorithm sha512 in xml-crypto after 0.8.0
-        'http://www.w3.org/2007/05/xmldsig-more#eddsa-ed25519': 'http://www.w3.org/2001/04/xmlenc#sha512'
-    },
 };
+// 使用示例：
+// 如果你选择了 RSA_SHA256 签名
+const selectedSigAlg = algorithms.signature.RSA_SHA256;
+// 自动获取对应的摘要算法
+const requiredDigestAlg = algorithms.signatureToDigestMap[selectedSigAlg];
+console.log(`Signature: ${selectedSigAlg}`);
+console.log(`Required Digest: ${requiredDigestAlg}`);
+// 输出:
+// Signature: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
+// Required Digest: http://www.w3.org/2001/04/xmlenc#sha256
 export var ParserType;
 (function (ParserType) {
     ParserType["SAMLRequest"] = "SAMLRequest";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "samlesa",
-  "version": "3.2.1",
+  "version": "3.3.0",
   "description": "High-level API for Single Sign On (SAML 2.0) baseed on samlify ",
   "main": "build/index.js",
   "keywords": [
@@ -55,7 +55,7 @@
     "xml": "^1.0.1",
     "xml-crypto-next": "^7.0.0",
     "xml-crypto": "^6.1.2",
-    "xml-encryption-next": "^4.5.0",
+    "xml-encryption-next": "^4.6.0",
     "xml-escape": "^1.1.0",
     "xml2js": "^0.6.2",
     "xmllint-wasm": "^5.1.0",

package/types/src/extractor.d.ts

@@ -1,53 +1,27 @@
 interface ExtractorField {
     key: string;
-    localPath: string[] | string[][];
-    attributes: string[];
+    localPath?: string[] | string[][];
+    attributes?: string[];
     index?: string[];
     attributePath?: string[];
     context?: boolean;
+    listMode?: boolean;
+    shortcut?: string;
 }
 export type ExtractorFields = ExtractorField[];
 export declare const loginRequestFields: ExtractorFields;
-export declare const artifactResolveFields: ({
-    key: string;
-    localPath: string[];
-    attributes: string[];
-    context?: undefined;
-} | {
-    key: string;
-    localPath: string[];
-    attributes: never[];
-    context: boolean;
-})[];
-export declare const artifactResponseFields: ({
-    key: string;
-    localPath: string[];
-    attributes: string[];
-    context?: undefined;
-} | {
-    key: string;
-    localPath: string[];
-    attributes: never[];
-    context: boolean;
-})[];
-export declare const loginResponseStatusFields: {
-    key: string;
-    localPath: string[];
-    attributes: string[];
-}[];
-export declare const loginArtifactResponseStatusFields: {
-    key: string;
-    localPath: string[];
-    attributes: string[];
-}[];
-export declare const logoutResponseStatusFields: {
-    key: string;
-    localPath: string[];
-    attributes: string[];
-}[];
+export declare const artifactResolveFields: ExtractorFields;
+export declare const artifactResponseFields: ExtractorFields;
+export declare const loginResponseStatusFields: ExtractorFields;
+export declare const loginArtifactResponseStatusFields: ExtractorFields;
+export declare const logoutResponseStatusFields: ExtractorFields;
 export declare const loginResponseFields: ((assertion: any) => ExtractorFields);
 export declare const logoutRequestFields: ExtractorFields;
 export declare const logoutResponseFields: ExtractorFields;
-export declare function extract(context: string, fields: any): any;
+export declare const idpMetadataFields: ExtractorFields;
+export declare const spMetadataFields: ExtractorFields;
+export declare function extract(context: string, fields: ExtractorFields): any;
+export declare function extractIdp(context: string): any;
+export declare function extractSp(context: string): any;
 export {};
 //# sourceMappingURL=extractor.d.ts.map

package/types/src/extractor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractor.d.ts","sourceRoot":"","sources":["../../src/extractor.ts"],"names":[],"mappings":"AAKA,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,cAAc,EAAE,CAAC;AA4B/C,eAAO,MAAM,kBAAkB,EAAE,eA2BhC,CAAC;AACF,eAAO,MAAM,qBAAqB;;;;;;;;;;IAiBjC,CAAC;AACF,eAAO,MAAM,sBAAsB;;;;;;;;;;IAiBlC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;GAWrC,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;GAW7C,CAAC;AAGF,eAAO,MAAM,0BAA0B;;;;GAWtC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,KAAK,eAAe,CAkErE,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,eA2BjC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,eAiBlC,CAAC;AAEF,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,KAAA,OA6M9C"}
+{"version":3,"file":"extractor.d.ts","sourceRoot":"","sources":["../../src/extractor.ts"],"names":[],"mappings":"AAMA,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,cAAc,EAAE,CAAC;AAgC/C,eAAO,MAAM,kBAAkB,EAAE,eAMhC,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,eAKnC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,eAKpC,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,eAGvC,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,eAG/C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,eAGxC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,KAAK,eAAe,CAWrE,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,eAMjC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,eAIlC,CAAC;AAKF,eAAO,MAAM,iBAAiB,EAAE,eAiI/B,CAAC;AAQF,eAAO,MAAM,gBAAgB,EAAE,eAmB9B,CAAC;AAEF,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,OAiN/D;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,OAEzC;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,OAExC"}

package/types/src/libsaml.d.ts

@@ -257,15 +257,6 @@ declare const _default: {
      * @return {Promise} a promise to resolve the finalized xml
      */
     encryptAssertion(sourceEntity: any, targetEntity: any, xml?: string): Promise<string>;
-    /**
-     * @desc Decrypt the assertion section in Response
-     * @param  {string} type             only accept SAMLResponse to proceed decryption
-     * @param  {Entity} here             this entity
-     * @param  {Entity} from             from the entity where the message is sent
-     * @param {string} entireXML         response in xml string format
-     * @return {function} a promise to get back the entire xml with decrypted assertion
-     */
-    decryptAssertion(here: any, entireXML: string): Promise<[string, any]>;
     /**
      * 同步版本的断言解密函数
      */

package/types/src/libsaml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"libsaml.d.ts","sourceRoot":"","sources":["../../src/libsaml.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,eAAe,CAAC;AAerD;;;;GAIG;AAGH,MAAM,WAAW,oBAAoB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACrC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gCAAgC;IAC7C,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACtC,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;CAC1D;AAED,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;CACnE;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;CAC1D;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;CAC7D;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;CAC9D;AAED,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB;CAC/D;AAED,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE9C,MAAM,WAAW,YAAY;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC7B,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,KAAK,KAAA,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IACvD,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAAC,UAAU,EAAE,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,0BAA0B,KAAK,MAAM,CAAC;IAC1K,sBAAsB,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,MAAM,CAAC;IAC/D,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjF,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAE5I,sBAAsB,EAAE,CAAC,QAAQ,KAAA,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACzH,UAAU,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IACrE,gBAAgB,EAAE,CAAC,YAAY,KAAA,EAAE,YAAY,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,gBAAgB,EAAE,CAAC,IAAI,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAEtE,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACpD,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAEnD,gBAAgB,EAAE,GAAG,CAAC;IACtB,2BAA2B,EAAE,oBAAoB,CAAC;IAClD,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,iCAAiC,EAAE,0BAA0B,CAAC;IAC9D,wBAAwB,EAAE,iBAAiB,CAAC;IAC5C,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,6BAA6B,EAAE,sBAAsB,CAAC;CACzD;;6CAgO8C,OAAO,KAAG,MAAM;gCAxNxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA8BkB,MAAM;;;;IAuO7D;;;;;OAKG;+BACwB,MAAM,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAS9E;;;;;;OAMG;IACH,eAAe;6CAC0B,GAAG,EAAE,GAAG,MAAM;IA0CvD;;;OAGG;iCAC0B;QACzB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,WAAW,EAAE,GAAG,CAAC;QACjB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,GAAG,CAAC;QACpB,wBAAwB,CAAC,EAAG,MAAM,EAAE,GAAG,SAAS,CAAC;QACjD,iBAAiB,EAAE,MAAM,CAAC;QAC1B,eAAe,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KACvF,GAAE,MAAM;2CAkD8B,MAAM,mBAAmB,MAAM;;;;;;;;;;;;;IAoCtE;;;;;;OAMG;yBAEsB,MAAM,QAAQ,wBAAwB,QAAQ,GAAG;;;;;;;;;;;;;;6BA4WjD,MAAM,QAAQ,wBAAwB;IAoK/D;;;;;OAKG;0BACmB,MAAM,cAAc,MAAM,GAAG,MAAM,GAAG,YAAY;IAsBxE;;;;;;;;OAQG;2CAEc,MAAM,OACd,MAAM,eACE,MAAM,aACR,OAAO,qBACC,MAAM;IA8B7B;;;;;;;OAOG;uDAGc,MAAM,aACR,MAAM,GAAG,MAAM,oBACR,MAAM;IAO5B;;;;OAIG;gCACyB,MAAM,oBAAmB,GAAG;;;;IAWxD;;;;;;OAMG;iEAEgD,MAAM;IAsDzD;;;;;;;OAOG;2CAC+B,MAAM;IAoCxC;;OAEG;IACH;;OAEG;+CACmC,MAAM,SAAS,wBAAwB;;;;;;IAsH7E;;;;;OAKG;+BAC8B,GAAG,aAAa,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAuEnF;;OAEG;sBACqB,MAAM,SAAQ,OAAO;;AA8BrD,wBAAyB"}
+{"version":3,"file":"libsaml.d.ts","sourceRoot":"","sources":["../../src/libsaml.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,eAAe,CAAC;AAerD;;;;GAIG;AAGH,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACtC,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;CACxD;AAED,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;CACnE;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;CAC1D;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;CAC7D;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;CAC9D;AAED,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB;CAC/D;AAED,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE9C,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,KAAK,KAAA,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IACvD,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAAC,UAAU,EAAE,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,0BAA0B,KAAK,MAAM,CAAC;IAC1K,sBAAsB,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,MAAM,CAAC;IAC/D,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjF,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAE5I,sBAAsB,EAAE,CAAC,QAAQ,KAAA,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACzH,UAAU,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IACrE,gBAAgB,EAAE,CAAC,YAAY,KAAA,EAAE,YAAY,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,gBAAgB,EAAE,CAAC,IAAI,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAEtE,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACpD,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAEnD,gBAAgB,EAAE,GAAG,CAAC;IACtB,2BAA2B,EAAE,oBAAoB,CAAC;IAClD,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,iCAAiC,EAAE,0BAA0B,CAAC;IAC9D,wBAAwB,EAAE,iBAAiB,CAAC;IAC5C,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,6BAA6B,EAAE,sBAAsB,CAAC;CACvD;;6CAgO4C,OAAO,KAAG,MAAM;gCAxNxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA8BkB,MAAM;;;;IAuO/D;;;;;OAKG;+BACwB,MAAM,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAS9E;;;;;;OAMG;IACH,eAAe;6CAC0B,GAAG,EAAE,GAAG,MAAM;IA0CvD;;;OAGG;iCAC0B;QAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,WAAW,EAAE,GAAG,CAAC;QACjB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,GAAG,CAAC;QACpB,wBAAwB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAChD,iBAAiB,EAAE,MAAM,CAAC;QAC1B,eAAe,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KACrF,GAAG,MAAM;2CAkD6B,MAAM,mBAAmB,MAAM;;;;;;;;;;;;;IAmCtE;;;;;;OAMG;yBAEwB,MAAM,QAAQ,wBAAwB,QAAQ,GAAG;;;;;;;;;;;;;;6BA4WnD,MAAM,QAAQ,wBAAwB;IAuK/D;;;;;OAKG;0BACmB,MAAM,cAAc,MAAM,GAAG,MAAM,GAAG,YAAY;IAsBxE;;;;;;;;OAQG;2CAEY,MAAM,OACd,MAAM,eACE,MAAM,aACR,OAAO,qBACC,MAAM;IA8B3B;;;;;;;OAOG;uDAGY,MAAM,aACR,MAAM,GAAG,MAAM,oBACR,MAAM;IAO1B;;;;OAIG;gCACyB,MAAM,oBAAmB,GAAG;;;;IAWxD;;;;;;OAMG;iEAEgD,MAAM;IA0DzD;;OAEG;IACH;;OAEG;+CACmC,MAAM,SAAS,wBAAwB;;;;;;IA2H7E;;;;;OAKG;+BAC8B,GAAG,aAAa,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA8EnF;;OAEG;sBACqB,MAAM,SAAQ,OAAO;;AA8BjD,wBAAyB"}

package/types/src/urn.d.ts

@@ -133,33 +133,67 @@ declare const messageConfigurations: {
 };
 declare const algorithms: {
     signature: {
+        ECDSA_SHA256: string;
+        ECDSA_SHA384: string;
+        ECDSA_SHA512: string;
+        DSA_SHA1: string;
         RSA_SHA1: string;
+        RSA_SHA224: string;
         RSA_SHA256: string;
+        RSA_SHA384: string;
         RSA_SHA512: string;
+        RSA_PSS_SHA256: string;
+        EDDSA_ED25519: string;
+    };
+    digest: {
+        SHA1: string;
+        SHA224: string;
+        SHA256: string;
+        SHA384: string;
+        SHA512: string;
+    };
+    signatureToDigestMap: {
+        'http://www.w3.org/2000/09/xmldsig#rsa-sha1': string;
+        'http://www.w3.org/2000/09/xmldsig#dsa-sha1': string;
+        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha224': string;
+        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256': string;
+        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384': string;
+        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512': string;
+        'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha256': string;
+        'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha384': string;
+        'http://www.w3.org/2007/05/xmldsig-more#ecdsa-sha512': string;
+        'http://www.w3.org/2007/05/xmldsig-more#rsa-pss-sha256': string;
+        'http://www.w3.org/2007/05/xmldsig-more#eddsa-ed25519': string;
     };
     encryption: {
         data: {
-            AES_128: string;
-            AES_256: string;
-            AES_256_GCM: string;
-            TRI_DEC: string;
+            AES_128_CBC: string;
+            AES_192_CBC: string;
+            AES_256_CBC: string;
             AES_128_GCM: string;
+            AES_192_GCM: string;
+            AES_256_GCM: string;
+            AES_128_CTR: string;
+            AES_192_CTR: string;
+            AES_256_CTR: string;
+            TRIPLE_DES: string;
         };
+        /**
+         * 密钥加密算法 (用于加密生成的 AES 会话密钥)
+         * 这里包含了 RSA-OAEP 和 AES Key Wrap
+         */
         key: {
             RSA_OAEP_MGF1P: string;
+            RSA_OAEP: string;
             RSA_1_5: string;
+            AES_128_KW: string;
+            AES_192_KW: string;
+            AES_256_KW: string;
+            AES_128_GCM_KW: string;
+            AES_192_GCM_KW: string;
+            AES_256_GCM_KW: string;
         };
     };
-    digest: {
-        'http://www.w3.org/2000/09/xmldsig#rsa-sha1': string;
-        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256': string;
-        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384': string;
-        'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512': string;
-        'http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1': string;
-        'http://www.w3.org/2007/05/xmldsig-more#sha384-rsa-MGF1': string;
-        'http://www.w3.org/2007/05/xmldsig-more#sha512-rsa-MGF1': string;
-        'http://www.w3.org/2007/05/xmldsig-more#eddsa-ed25519': string;
-    };
 };
 export declare enum ParserType {
     SAMLRequest = "SAMLRequest",

package/types/src/urn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"urn.d.ts","sourceRoot":"","sources":["../../src/urn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oBAAY,gBAAgB;IACxB,QAAQ,uDAAuD;IAC/D,IAAI,mDAAmD;IACvD,UAAU,8DAA8D;IACxE,QAAQ,uDAAuD;CAClE;AAED,oBAAY,qBAAqB;IAC7B,GAAG,sBAAsB;IACzB,GAAG,sBAAsB;CAC5B;AAED,oBAAY,UAAU;IAElB,OAAO,+CAA+C;IACtD,SAAS,iDAAiD;IAC1D,SAAS,iDAAiD;IAC1D,eAAe,uDAAuD;IAEtE,UAAU,mDAAmD;IAC7D,sBAAsB,8DAA8D;IACpF,mBAAmB,2DAA2D;IAC9E,cAAc,sDAAsD;IACpE,cAAc,sDAAsD;IACpE,SAAS,iDAAiD;IAC1D,cAAc,sDAAsD;IACpE,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,wBAAwB,gEAAgE;IACxF,qBAAqB,6DAA6D;IAClF,oBAAoB,4DAA4D;IAChF,qBAAqB,6DAA6D;IAClF,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;IAC5E,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;CAC/E;AAED,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwDd,CAAC;AAEF,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BT,CAAC;AAEF,QAAA,MAAM,qBAAqB;;;;;CAK1B,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCf,CAAC;AAEF,oBAAY,UAAU;IAClB,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;CACpC;AAED,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;CAyBZ,CAAC;AAIF,QAAA,MAAM,aAAa;;;;CAIlB,CAAC;AAEF,OAAO,EAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAC,CAAC"}
+{"version":3,"file":"urn.d.ts","sourceRoot":"","sources":["../../src/urn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oBAAY,gBAAgB;IAC1B,QAAQ,uDAAuD;IAC/D,IAAI,mDAAmD;IACvD,UAAU,8DAA8D;IACxE,QAAQ,uDAAuD;CAChE;AAED,oBAAY,qBAAqB;IAC/B,GAAG,sBAAsB;IACzB,GAAG,sBAAsB;CAC1B;AAED,oBAAY,UAAU;IAEpB,OAAO,+CAA+C;IACtD,SAAS,iDAAiD;IAC1D,SAAS,iDAAiD;IAC1D,eAAe,uDAAuD;IAEtE,UAAU,mDAAmD;IAC7D,sBAAsB,8DAA8D;IACpF,mBAAmB,2DAA2D;IAC9E,cAAc,sDAAsD;IACpE,cAAc,sDAAsD;IACpE,SAAS,iDAAiD;IAC1D,cAAc,sDAAsD;IACpE,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,aAAa,qDAAqD;IAClE,kBAAkB,0DAA0D;IAC5E,wBAAwB,gEAAgE;IACxF,qBAAqB,6DAA6D;IAClF,oBAAoB,4DAA4D;IAChF,qBAAqB,6DAA6D;IAClF,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;IAC5E,gBAAgB,wDAAwD;IACxE,kBAAkB,0DAA0D;CAC7E;AAED,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwDd,CAAC;AAEF,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BT,CAAC;AAEF,QAAA,MAAM,qBAAqB;;;;;CAK1B,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2EZ;;;WAGG;;;;;;;;;;;;;CAwBN,CAAC;AAcF,oBAAY,UAAU;IACpB,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;CAClC;AAED,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;CAyBZ,CAAC;AAIF,QAAA,MAAM,aAAa;;;;CAIlB,CAAC;AAEF,OAAO,EAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAC,CAAC"}