samlesa 3.3.7 → 3.3.8

package/build/src/extractor.js

@@ -1,6 +1,6 @@
 import { select } from 'xpath';
-import { uniq, last, zipObject, notEmpty } from './utility.js';
-import { getContext } from './api.js';
+import { uniq, last, zipObject, notEmpty } from './utility.js'; // 假设这些工具函数存在
+import { getContext } from './api.js'; // 假设这个API存在
 import camelCase from 'camelcase';
 function buildAbsoluteXPath(paths) {
     if (!paths || paths.length === 0)
@@ -28,14 +28,85 @@ function buildAttributeXPath(attributes) {
     const filters = attributes.map(attribute => `name()='${attribute}'`).join(' or ');
     return `/@*[${filters}]`;
 }
-// ... (其他字段配置如 loginRequestFields 等保持不变，为节省篇幅此处省略，请保留你原有的所有 fields 定义) ...
-// 为了完整性，这里假设你保留了之前所有的 fields 定义 (loginRequestFields, idpMetadataFields 等)
-// 重点修正下方的 spMetadataFields 和 extract 函数
 export const loginRequestFields = [
-    { key: 'request', localPath: ['AuthnRequest'], attributes: ['ID', 'IssueInstant', 'Destination', 'AssertionConsumerServiceURL', 'ProtocolBinding', 'ForceAuthn', 'IsPassive', 'AssertionConsumerServiceIndex', 'AttributeConsumingServiceIndex'] },
-    { key: 'issuer', localPath: ['AuthnRequest', 'Issuer'], attributes: [] },
-    { key: 'nameIDPolicy', localPath: ['AuthnRequest', 'NameIDPolicy'], attributes: ['Format', 'AllowCreate'] },
-    { key: 'authnContextClassRef', localPath: ['AuthnRequest', 'AuthnContextClassRef'], attributes: [] },
+    // --- 1. AuthnRequest 根元素增强 ---
+    {
+        key: 'request',
+        localPath: ['AuthnRequest'],
+        attributes: [
+            'ID',
+            'Version', // [新增] 版本号
+            'IssueInstant',
+            'Destination',
+            'Consent', // [新增] 用户同意状态
+            'AssertionConsumerServiceURL',
+            'ProtocolBinding',
+            'ForceAuthn',
+            'IsPassive',
+            'AssertionConsumerServiceIndex',
+            'AttributeConsumingServiceIndex',
+            'ProviderName' // [新增] SP 显示名称
+        ]
+    },
+    // --- 2. Issuer ---
+    { key: 'issuer', localPath: ['AuthnRequest', 'Issuer'], attributes: [] }, // [增强] 提取 Issuer 的属性
+    // --- 3. NameIDPolicy 增强 ---
+    {
+        key: 'nameIDPolicy',
+        localPath: ['AuthnRequest', 'NameIDPolicy'],
+        attributes: [
+            'Format',
+            'AllowCreate',
+            'SPNameQualifier' // [新增] 关键属性，指定 NameID 的作用域
+        ]
+    },
+    // --- 4. RequestedAuthnContext [全新添加] ---
+    // 提取比较策略
+    {
+        key: 'requestedAuthnContextComparison',
+        localPath: ['AuthnRequest', 'RequestedAuthnContext'],
+        attributes: ['Comparison']
+    },
+    // 提取要求的认证类列表 (listMode 因为可能有多个 ClassRef)
+    {
+        key: 'requestedAuthnContextClasses',
+        localPath: ['AuthnRequest', 'RequestedAuthnContext', 'AuthnContextClassRef'],
+        attributes: [],
+        listMode: true
+    },
+    // 提取认证声明引用 (较少用，但为了完整性)
+    {
+        key: 'requestedAuthnContextDeclRefs',
+        localPath: ['AuthnRequest', 'RequestedAuthnContext', 'AuthnContextDeclRef'],
+        attributes: [],
+        listMode: true
+    },
+    // --- 5. Scoping (用于 IdP 代理场景) [全新添加] ---
+    {
+        key: 'scoping',
+        localPath: ['AuthnRequest', 'Scoping'],
+        attributes: ['ProxyCount']
+    },
+    {
+        key: 'requesterIDs',
+        localPath: ['AuthnRequest', 'Scoping', 'RequesterID'],
+        attributes: [],
+        listMode: true
+    },
+    {
+        key: 'idpListEntries',
+        localPath: ['AuthnRequest', 'Scoping', 'IDPList', 'IDPEntry'],
+        attributes: ['ProviderID', 'Name', 'Loc'],
+        listMode: true
+    },
+    // --- 6. Extensions (捕获自定义扩展) ---
+    {
+        key: 'extensions',
+        localPath: ['AuthnRequest', 'Extensions'],
+        attributes: [],
+        context: true // 获取整个 XML 片段
+    },
+    // --- 7. Signature ---
     { key: 'signature', localPath: ['AuthnRequest', 'Signature'], attributes: [], context: true }
 ];
 export const artifactResolveFields = [
@@ -74,6 +145,201 @@ export const loginResponseFields = assertion => [
     { key: 'oneTimeUse', localPath: ['Assertion', 'Conditions', 'OneTimeUse'], attributes: [], shortcut: assertion },
     { key: 'status', localPath: ['Response', 'Status', 'StatusCode'], attributes: ['Value'] },
 ];
+/*export const loginResponseFieldsFullList: ExtractorFields = [
+  // ==========================================================================
+  // 1. Response 根元素
+  // ==========================================================================
+  {
+    key: 'response',
+    localPath: ['Response'],
+    attributes: [
+      'ID',
+      'Version',
+      'IssueInstant',
+      'Destination',
+      'InResponseTo',
+      'Consent',
+      'RelayState'
+    ]
+  },
+  // ==========================================================================
+  // 2. Status 详细信息
+  // ==========================================================================
+  {
+    key: 'statusTopCode',
+    localPath: ['Response', 'Status', 'StatusCode'],
+    attributes: ['Value']
+  },
+  {
+    key: 'statusSecondCode',
+    localPath: ['Response', 'Status', 'StatusCode', 'StatusCode'],
+    attributes: ['Value']
+  },
+  {
+    key: 'statusMessage',
+    localPath: ['Response', 'Status', 'StatusMessage'],
+    attributes: [],
+    // 提示：如果 StatusMessage 有文本内容但 attributes 为空导致结果为空，
+    // 可能需要解析器支持提取 textContent。如果解析器仅支持属性，此处保持为空，结果可能为空字符串。
+  },
+  {
+    key: 'statusDetail',
+    localPath: ['Response', 'Status', 'StatusDetail'],
+    attributes: [],
+    context: true // 保持返回完整 XML 片段，除非解析器支持递归子字段定义
+  },
+  // ==========================================================================
+  // 3. Assertion 元数据
+  // ==========================================================================
+  {
+    key: 'assertionID',
+    localPath: ['Response', 'Assertion'],
+    attributes: ['ID']
+  },
+  {
+    key: 'assertionVersion',
+    localPath: ['Response', 'Assertion'],
+    attributes: ['Version']
+  },
+  {
+    key: 'assertionIssueInstant',
+    localPath: ['Response', 'Assertion'],
+    attributes: ['IssueInstant']
+  },
+  {
+    key: 'assertionSignature',
+    localPath: ['Response', 'Assertion', 'Signature'],
+    attributes: [],
+    context: true
+  },
+  // ==========================================================================
+  // 4. Conditions
+  // ==========================================================================
+  {
+    key: 'conditions',
+    localPath: ['Response', 'Assertion', 'Conditions'],
+    attributes: ['NotBefore', 'NotOnOrAfter']
+  },
+  {
+    key: 'audiences',
+    localPath: ['Response', 'Assertion', 'Conditions', 'AudienceRestriction', 'Audience'],
+    attributes: [],
+    listMode: true,
+    // 注意：Audience 通常只有文本内容，没有属性。如果解析器只提属性，这里会是空字符串。
+    // 如果解析器支持，它应该自动抓取 textContent。
+  },
+  {
+    key: 'oneTimeUse',
+    localPath: ['Response', 'Assertion', 'Conditions', 'OneTimeUse'],
+    attributes: []
+    // OneTimeUse 通常是一个空标签 <OneTimeUse/>，没有属性。
+  },
+  {
+    key: 'proxyRestriction',
+    localPath: ['Response', 'Assertion', 'Conditions', 'ProxyRestriction'],
+    attributes: ['Count']
+  },
+  {
+    key: 'proxyRestrictionAudiences',
+    localPath: ['Response', 'Assertion', 'Conditions', 'ProxyRestriction', 'Audience'],
+    attributes: [],
+    listMode: true
+  },
+  // ==========================================================================
+  // 5. Subject & NameID
+  // ==========================================================================
+  {
+    key: 'nameID',
+    localPath: ['Response', 'Assertion', 'Subject', 'NameID'],
+    attributes: [
+      'Format',
+      'NameQualifier',
+      'SPNameQualifier',
+      'SPProvidedID'
+    ]
+  },
+  {
+    key: 'subjectConfirmation',
+    localPath: ['Response', 'Assertion', 'Subject', 'SubjectConfirmation', 'SubjectConfirmationData'],
+    attributes: [
+      'Recipient',
+      'InResponseTo',
+      'NotOnOrAfter',
+      'Address',
+      'NotBefore'
+    ]
+  },
+  {
+    key: 'subjectBaseID',
+    localPath: ['Response', 'Assertion', 'Subject', 'BaseID'],
+    attributes: [], // BaseID 主要靠属性，如果这里有文本需求需额外处理
+    context: true
+  },
+  // ==========================================================================
+  // 6. AuthnStatement
+  // ==========================================================================
+  {
+    key: 'sessionIndex',
+    localPath: ['Response', 'Assertion', 'AuthnStatement'],
+    attributes: ['AuthnInstant', 'SessionNotOnOrAfter', 'SessionIndex']
+  },
+  {
+    key: 'authnContextClassRef',
+    localPath: ['Response', 'Assertion', 'AuthnStatement', 'AuthnContext', 'AuthnContextClassRef'],
+    attributes: []
+    // AuthnContextClassRef 通常是文本内容 (urn:...), 没有属性。
+    // 如果解析结果为空，说明解析器未提取文本内容。
+  },
+  {
+    key: 'authnContextDecl',
+    localPath: ['Response', 'Assertion', 'AuthnStatement', 'AuthnContext', 'AuthnContextDecl'],
+    attributes: [],
+    context: true
+  },
+  {
+    key: 'authenticatingAuthorities',
+    localPath: ['Response', 'Assertion', 'AuthnStatement', 'AuthnContext', 'AuthenticatingAuthority'],
+    attributes: [],
+    listMode: true
+    // AuthenticatingAuthority 通常也是文本内容。
+  },
+  // ==========================================================================
+  // 7. AttributeStatement (重点修复区域)
+  // ==========================================================================
+  {
+    key: 'attributes',
+    localPath: ['Response', 'Assertion', 'AttributeStatement', 'Attribute'],
+    index: ['Name'], // 使用 Name 属性作为 Key
+    attributePath: ['AttributeValue'], // 指向值的节点
+    attributes: [],
+    // 【关键修改】：
+    // 很多解析器在 attributePath 层级如果只配置 attributes 数组，会忽略文本内容。
+    // 如果可能，尝试添加一个特殊标记或确保解析器逻辑包含：
+    // if (node has text && no attributes matched) return text;
+    // 如果无法修改解析器内核，且 AttributeValue 只有文本没有属性，
+    // 这里的解析结果可能依然为空。
+    //
+    // 高级技巧：如果解析器支持，可以尝试将 '_' 或 'value' 加入 attributes 数组，
+    // 但这取决于 extractSpToll 的具体实现。
+    // 在此配置中，我们保持标准写法，依赖解析器对 attributePath 的默认文本提取。
+  },
+  {
+    key: 'encryptedAttributes',
+    localPath: ['Response', 'Assertion', 'AttributeStatement', 'EncryptedAttribute'],
+    attributes: [],
+    context: true
+  },
+
+  // ==========================================================================
+  // 9. Response Signature
+  // ==========================================================================
+  {
+    key: 'responseSignature',
+    localPath: ['Response', 'Signature'],
+    attributes: [],
+    context: true
+  }
+];*/
 export const logoutRequestFields = [
     { key: 'request', localPath: ['LogoutRequest'], attributes: ['ID', 'IssueInstant', 'Destination'] },
     { key: 'issuer', localPath: ['LogoutRequest', 'Issuer'], attributes: [] },
@@ -209,26 +475,185 @@ export const idpMetadataFields = [
     }
 ];
 // ============================================================================
-// 修正后的 SP 元数据提取字段配置
+// SAML2 SP 元数据完整字段配置 - 包含所有可选属性
 // ============================================================================
 export const spMetadataFields = [
-    { key: 'entityID', localPath: ['EntityDescriptor'], attributes: ['entityID'] },
-    { key: 'spSSODescriptor', localPath: ['EntityDescriptor', 'SPSSODescriptor'], attributes: ['protocolSupportEnumeration', 'AuthnRequestsSigned', 'WantAssertionsSigned'] },
-    { key: 'assertionConsumerService', localPath: ['EntityDescriptor', 'SPSSODescriptor', 'AssertionConsumerService'], attributes: ['Binding', 'Location', 'index', 'isDefault'], listMode: true },
-    { key: 'singleLogoutService', localPath: ['EntityDescriptor', 'SPSSODescriptor', 'SingleLogoutService'], attributes: ['Binding', 'Location'], listMode: true },
-    { key: 'artifactResolutionService', localPath: ['EntityDescriptor', 'SPSSODescriptor', 'ArtifactResolutionService'], attributes: ['Binding', 'Location', 'index', 'isDefault'], listMode: true },
-    { key: 'manageNameIDService', localPath: ['EntityDescriptor', 'SPSSODescriptor', 'ManageNameIDService'], attributes: ['Binding', 'Location'], listMode: true },
-    { key: 'nameIDFormat', localPath: ['EntityDescriptor', 'SPSSODescriptor', 'NameIDFormat'], attributes: [] },
-    { key: 'organizationName', localPath: ['EntityDescriptor', 'Organization', 'OrganizationName'], attributes: [] },
-    { key: 'organizationDisplayName', localPath: ['EntityDescriptor', 'Organization', 'OrganizationDisplayName'], attributes: [] },
-    { key: 'organizationURL', localPath: ['EntityDescriptor', 'Organization', 'OrganizationURL'], attributes: [] },
-    { key: 'contactPerson', localPath: ['EntityDescriptor', 'ContactPerson'], attributes: ['contactType'], listMode: true },
-    // 特殊字段：触发 extract 内部的硬编码逻辑
-    // localPath 和 attributes 在这里不起作用，仅作为占位符
+    // --- 1. 基础标识 ---
+    {
+        key: 'entityID',
+        localPath: ['EntityDescriptor'],
+        attributes: ['entityID']
+    },
+    {
+        key: 'validUntil',
+        localPath: ['EntityDescriptor'],
+        attributes: ['validUntil']
+    },
+    {
+        key: 'cacheDuration',
+        localPath: ['EntityDescriptor'],
+        attributes: ['cacheDuration']
+    },
+    {
+        key: 'ID',
+        localPath: ['EntityDescriptor'],
+        attributes: ['ID']
+    },
+    {
+        key: 'extensions',
+        localPath: ['EntityDescriptor', 'Extensions'],
+        attributes: [],
+        context: true
+    },
+    // --- 2. SPSSODescriptor 核心属性 ---
+    {
+        key: 'spSSODescriptor',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor'],
+        attributes: [
+            'protocolSupportEnumeration',
+            'AuthnRequestsSigned', // SP 是否会对认证请求签名
+            'WantAssertionsSigned', // SP 是否希望接收签名的断言
+            'cacheDuration',
+            'validUntil',
+            'ID'
+        ]
+    },
+    {
+        key: 'extensions',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'Extensions'],
+        attributes: [],
+        context: true
+    },
+    // --- 3. 服务端点列表 (Endpoints) ---
+    {
+        key: 'assertionConsumerService',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'AssertionConsumerService'],
+        attributes: ['Binding', 'Location', 'index', 'isDefault', 'ResponseLocation'],
+        listMode: true
+    },
+    {
+        key: 'singleLogoutService',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'SingleLogoutService'],
+        attributes: ['Binding', 'Location', 'index', 'isDefault', 'ResponseLocation'],
+        listMode: true
+    },
+    {
+        key: 'artifactResolutionService',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'ArtifactResolutionService'],
+        attributes: ['Binding', 'Location', 'index', 'isDefault'],
+        listMode: true
+    },
+    {
+        key: 'manageNameIDService',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'ManageNameIDService'],
+        attributes: ['Binding', 'Location', 'index', 'isDefault'],
+        listMode: true
+    },
+    {
+        key: 'nameIDMappingService',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'NameIDMappingService'],
+        attributes: ['Binding', 'Location', 'index', 'isDefault'],
+        listMode: true
+    },
+    {
+        key: 'assertionIDRequestService',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'AssertionIDRequestService'],
+        attributes: ['Binding', 'Location', 'index', 'isDefault'],
+        listMode: true
+    },
+    {
+        key: 'attributeService',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'AttributeService'],
+        attributes: ['Binding', 'Location', 'index', 'isDefault'],
+        listMode: true
+    },
+    // --- 4. NameID 格式 ---
+    {
+        key: 'nameIDFormat',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'NameIDFormat'],
+        attributes: [],
+        listMode: true
+    },
+    {
+        key: 'nameIDPolicy',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'NameIDPolicy'],
+        attributes: ['Format', 'AllowCreate']
+    },
+    // --- 5. 属性消费服务 (AttributeConsumingService) ---
+    {
+        key: 'attributeConsumingService',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'AttributeConsumingService'],
+        attributes: ['index', 'isDefault', 'Name', 'NameFormat'],
+        listMode: true
+    },
+    {
+        key: 'serviceName',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'AttributeConsumingService', 'ServiceName'],
+        attributes: [],
+        listMode: true
+    },
+    {
+        key: 'serviceDescription',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'AttributeConsumingService', 'ServiceDescription'],
+        attributes: [],
+        listMode: true
+    },
+    {
+        key: 'requestedAttribute',
+        localPath: ['EntityDescriptor', 'SPSSODescriptor', 'AttributeConsumingService', 'RequestedAttribute'],
+        attributes: ['Name', 'NameFormat', 'FriendlyName', 'isRequired'],
+        listMode: true
+    },
+    // --- 6. 证书与密钥信息 ---
     { key: 'signingCert' },
     { key: 'encryptCert' },
     { key: 'signingKeyName' },
-    { key: 'encryptionKeyName' }
+    { key: 'encryptionKeyName' },
+    // --- 7. 组织信息 ---
+    {
+        key: 'organizationName',
+        localPath: ['EntityDescriptor', 'Organization', 'OrganizationName'],
+        attributes: [],
+        listMode: true
+    },
+    {
+        key: 'organizationDisplayName',
+        localPath: ['EntityDescriptor', 'Organization', 'OrganizationDisplayName'],
+        attributes: [],
+        listMode: true
+    },
+    {
+        key: 'organizationURL',
+        localPath: ['EntityDescriptor', 'Organization', 'OrganizationURL'],
+        attributes: [],
+        listMode: true
+    },
+    // --- 8. 联系人信息 ---
+    {
+        key: 'contactPerson',
+        localPath: ['EntityDescriptor', 'ContactPerson'],
+        attributes: ['contactType', 'company', 'givenName', 'surName', 'emailAddress', 'telephoneNumber'],
+        listMode: true
+    },
+    {
+        key: 'additionalMetadataLocation',
+        localPath: ['EntityDescriptor', 'AdditionalMetadataLocation'],
+        attributes: ['namespace'],
+        listMode: true
+    },
+    // --- 9. 其他可选元素 ---
+    {
+        key: 'affiliationDescriptor',
+        localPath: ['EntityDescriptor', 'AffiliationDescriptor'],
+        attributes: ['affiliationOwnerID', 'validUntil', 'cacheDuration', 'ID'],
+        context: true
+    },
+    {
+        key: 'roleDescriptor',
+        localPath: ['EntityDescriptor', 'RoleDescriptor'],
+        attributes: ['protocolSupportEnumeration', 'errorURL', 'cacheDuration', 'validUntil', 'ID'],
+        context: true
+    }
 ];
 export function extract(context, fields) {
     const { dom } = getContext();
@@ -419,9 +844,642 @@ export function extract(context, fields) {
         return result;
     }, {});
 }
+// 按照 SAML 2.0 Response 结构分类字段配置
+// 按照 SAML 2.0 Response 结构分类字段配置，优化聚合
+export const loginResponseFieldsFullList = [
+    // ==========================================================================
+    // 1. Response 根元素
+    // ==========================================================================
+    {
+        key: 'response',
+        localPath: ['Response'],
+        attributes: [
+            'ID',
+            'Version',
+            'IssueInstant',
+            'Destination',
+            'InResponseTo',
+            'Consent',
+            'RelayState'
+        ]
+    },
+    // ==========================================================================
+    // 2. Status 详细信息
+    // ==========================================================================
+    {
+        key: 'status',
+        localPath: ['Response', 'Status'],
+        attributes: [],
+        context: true,
+        group: 'status',
+        parseCallback: (node) => {
+            if (!node)
+                return null;
+            const statusData = {};
+            // 提取顶级状态码
+            const statusCodeNodes = node.getElementsByTagNameNS('*', 'StatusCode');
+            if (statusCodeNodes.length > 0) {
+                statusData.topCode = statusCodeNodes[0].getAttribute('Value') || '';
+                // 检查是否有二级状态码
+                if (statusCodeNodes[0].getElementsByTagNameNS('*', 'StatusCode').length > 0) {
+                    const secondStatusCode = statusCodeNodes[0].getElementsByTagNameNS('*', 'StatusCode')[0];
+                    statusData.secondCode = secondStatusCode.getAttribute('Value') || '';
+                }
+            }
+            // 提取状态消息
+            const statusMessageNodes = node.getElementsByTagNameNS('*', 'StatusMessage');
+            if (statusMessageNodes.length > 0) {
+                statusData.message = statusMessageNodes[0].textContent?.trim() || '';
+            }
+            // 提取状态详情
+            const statusDetailNodes = node.getElementsByTagNameNS('*', 'StatusDetail');
+            if (statusDetailNodes.length > 0) {
+                const detailNode = statusDetailNodes[0];
+                statusData.detail = detailNode.toString();
+                // 解析 StatusDetail 中的子元素
+                const extraInfoNodes = detailNode.getElementsByTagNameNS('*', 'ExtraInfo');
+                if (extraInfoNodes.length > 0) {
+                    const sessionDurationNodes = extraInfoNodes[0].getElementsByTagNameNS('*', 'SessionDuration');
+                    if (sessionDurationNodes.length > 0) {
+                        statusData.sessionDuration = sessionDurationNodes[0].textContent?.trim() || null;
+                    }
+                    const mfaUsedNodes = extraInfoNodes[0].getElementsByTagNameNS('*', 'MFAUsed');
+                    if (mfaUsedNodes.length > 0) {
+                        statusData.mfaUsed = mfaUsedNodes[0].textContent?.trim() || null;
+                    }
+                }
+            }
+            return statusData;
+        }
+    },
+    // ==========================================================================
+    // 3. Assertion 元数据
+    // ==========================================================================
+    {
+        key: 'assertion',
+        localPath: ['Response', 'Assertion'],
+        attributes: [
+            'ID',
+            'Version',
+            'IssueInstant'
+        ]
+    },
+    {
+        key: 'assertionSignature',
+        localPath: ['Response', 'Assertion', 'Signature'],
+        attributes: [],
+        context: true,
+        parseCallback: (node) => {
+            if (!node)
+                return null;
+            const signatureData = {};
+            // 提取签名算法相关信息
+            const signatureMethods = node.getElementsByTagNameNS('*', 'SignatureMethod');
+            if (signatureMethods.length > 0) {
+                signatureData.signatureMethodAlgorithm = signatureMethods[0].getAttribute('Algorithm');
+            }
+            const canonicalizationMethods = node.getElementsByTagNameNS('*', 'CanonicalizationMethod');
+            if (canonicalizationMethods.length > 0) {
+                signatureData.canonicalizationMethodAlgorithm = canonicalizationMethods[0].getAttribute('Algorithm');
+            }
+            const digestMethods = node.getElementsByTagNameNS('*', 'DigestMethod');
+            if (digestMethods.length > 0) {
+                signatureData.digestMethodAlgorithm = digestMethods[0].getAttribute('Algorithm');
+            }
+            const digestValues = node.getElementsByTagNameNS('*', 'DigestValue');
+            if (digestValues.length > 0) {
+                signatureData.digestValue = digestValues[0].textContent?.trim();
+            }
+            const signatureValues = node.getElementsByTagNameNS('*', 'SignatureValue');
+            if (signatureValues.length > 0) {
+                signatureData.signatureValue = signatureValues[0].textContent?.trim();
+            }
+            const certificates = node.getElementsByTagNameNS('*', 'X509Certificate');
+            if (certificates.length > 0) {
+                signatureData.x509Certificate = certificates[0].textContent?.replace(/\s+/g, '');
+            }
+            return signatureData;
+        }
+    },
+    // ==========================================================================
+    // 4. Conditions
+    // ==========================================================================
+    {
+        key: 'conditions',
+        localPath: ['Response', 'Assertion', 'Conditions'],
+        attributes: ['NotBefore', 'NotOnOrAfter'],
+        context: true,
+        group: 'conditions',
+        parseCallback: (node) => {
+            if (!node)
+                return null;
+            const conditionsData = {};
+            // 基本条件
+            conditionsData.notBefore = node.getAttribute('NotBefore');
+            conditionsData.notOnOrAfter = node.getAttribute('NotOnOrAfter');
+            // Audience Restrictions
+            const audienceRestrictions = node.getElementsByTagNameNS('*', 'AudienceRestriction');
+            if (audienceRestrictions.length > 0) {
+                const audiences = [];
+                for (let i = 0; i < audienceRestrictions.length; i++) {
+                    const audienceNodes = audienceRestrictions[i].getElementsByTagNameNS('*', 'Audience');
+                    for (let j = 0; j < audienceNodes.length; j++) {
+                        const audienceValue = audienceNodes[j].textContent?.trim();
+                        if (audienceValue)
+                            audiences.push(audienceValue);
+                    }
+                }
+                conditionsData.audiences = audiences;
+            }
+            // One Time Use
+            const oneTimeUses = node.getElementsByTagNameNS('*', 'OneTimeUse');
+            conditionsData.oneTimeUse = oneTimeUses.length > 0;
+            // Proxy Restriction
+            const proxyRestrictions = node.getElementsByTagNameNS('*', 'ProxyRestriction');
+            if (proxyRestrictions.length > 0) {
+                const proxyRestriction = proxyRestrictions[0];
+                conditionsData.proxyRestriction = proxyRestriction.getAttribute('Count');
+                // Proxy Restriction Audiences
+                const proxyAudiences = [];
+                const proxyAudienceNodes = proxyRestriction.getElementsByTagNameNS('*', 'Audience');
+                for (let i = 0; i < proxyAudienceNodes.length; i++) {
+                    const audienceValue = proxyAudienceNodes[i].textContent?.trim();
+                    if (audienceValue)
+                        proxyAudiences.push(audienceValue);
+                }
+                conditionsData.proxyRestrictionAudiences = proxyAudiences;
+            }
+            return conditionsData;
+        }
+    },
+    // ==========================================================================
+    // 5. Subject & NameID
+    // ==========================================================================
+    {
+        key: 'subject',
+        localPath: ['Response', 'Assertion', 'Subject'],
+        attributes: [],
+        context: true,
+        group: 'subject',
+        parseCallback: (node) => {
+            if (!node)
+                return null;
+            const subjectData = {};
+            // NameID
+            const nameIDNodes = node.getElementsByTagNameNS('*', 'NameID');
+            if (nameIDNodes.length > 0) {
+                const nameIDNode = nameIDNodes[0];
+                subjectData.nameID = {
+                    format: nameIDNode.getAttribute('Format'),
+                    nameQualifier: nameIDNode.getAttribute('NameQualifier'),
+                    spNameQualifier: nameIDNode.getAttribute('SPNameQualifier'),
+                    spProvidedID: nameIDNode.getAttribute('SPProvidedID'),
+                    value: nameIDNode.textContent?.trim() || ''
+                };
+            }
+            // Subject Confirmation
+            const subjectConfirmations = node.getElementsByTagNameNS('*', 'SubjectConfirmation');
+            if (subjectConfirmations.length > 0) {
+                const confirmationData = {};
+                const confirmationDataNodes = subjectConfirmations[0].getElementsByTagNameNS('*', 'SubjectConfirmationData');
+                if (confirmationDataNodes.length > 0) {
+                    const dataNode = confirmationDataNodes[0];
+                    confirmationData.recipient = dataNode.getAttribute('Recipient');
+                    confirmationData.inResponseTo = dataNode.getAttribute('InResponseTo');
+                    confirmationData.notOnOrAfter = dataNode.getAttribute('NotOnOrAfter');
+                    confirmationData.address = dataNode.getAttribute('Address');
+                    confirmationData.notBefore = dataNode.getAttribute('NotBefore');
+                }
+                subjectData.subjectConfirmation = confirmationData;
+            }
+            // BaseID
+            const baseIDNodes = node.getElementsByTagNameNS('*', 'BaseID');
+            if (baseIDNodes.length > 0) {
+                const baseIDNode = baseIDNodes[0];
+                subjectData.baseID = {
+                    nameQualifier: baseIDNode.getAttribute('NameQualifier'),
+                    spNameQualifier: baseIDNode.getAttribute('SPNameQualifier'),
+                    value: baseIDNode.textContent?.trim() || baseIDNode.toString()
+                };
+            }
+            return subjectData;
+        }
+    },
+    // ==========================================================================
+    // 6. AuthnStatement
+    // ==========================================================================
+    {
+        key: 'authnStatement',
+        localPath: ['Response', 'Assertion', 'AuthnStatement'],
+        attributes: ['AuthnInstant', 'SessionNotOnOrAfter', 'SessionIndex'],
+        context: true,
+        group: 'authnStatement',
+        parseCallback: (node) => {
+            if (!node)
+                return null;
+            const authnData = {};
+            // 基本认证信息
+            authnData.authnInstant = node.getAttribute('AuthnInstant');
+            authnData.sessionNotOnOrAfter = node.getAttribute('SessionNotOnOrAfter');
+            authnData.sessionIndex = node.getAttribute('SessionIndex');
+            // 认证上下文
+            const authnContextNodes = node.getElementsByTagNameNS('*', 'AuthnContext');
+            if (authnContextNodes.length > 0) {
+                const authnContextNode = authnContextNodes[0];
+                // 认证上下文类引用
+                const classRefNodes = authnContextNode.getElementsByTagNameNS('*', 'AuthnContextClassRef');
+                if (classRefNodes.length > 0) {
+                    authnData.authnContextClassRef = classRefNodes[0].textContent?.trim() || '';
+                }
+                // 认证上下文声明
+                const declNodes = authnContextNode.getElementsByTagNameNS('*', 'AuthnContextDecl');
+                if (declNodes.length > 0) {
+                    const declNode = declNodes[0];
+                    authnData.authnContextDecl = {
+                        method: declNode.getElementsByTagNameNS('*', 'Method')[0]?.textContent?.trim() || '',
+                        strength: declNode.getElementsByTagNameNS('*', 'Strength')[0]?.textContent?.trim() || ''
+                    };
+                }
+                // 认证机构
+                const authorityNodes = authnContextNode.getElementsByTagNameNS('*', 'AuthenticatingAuthority');
+                if (authorityNodes.length > 0) {
+                    authnData.authenticatingAuthorities = [];
+                    for (let i = 0; i < authorityNodes.length; i++) {
+                        const authorityValue = authorityNodes[i].textContent?.trim();
+                        if (authorityValue) {
+                            authnData.authenticatingAuthorities.push(authorityValue);
+                        }
+                    }
+                }
+            }
+            return authnData;
+        }
+    },
+    // ==========================================================================
+    // 7. AttributeStatement
+    // ==========================================================================
+    {
+        key: 'attributeStatement',
+        localPath: ['Response', 'Assertion', 'AttributeStatement'],
+        attributes: [],
+        context: true,
+        group: 'attributeStatement',
+        parseCallback: (node) => {
+            if (!node)
+                return null;
+            const attributeData = {
+                attributes: {},
+                encryptedAttributes: null
+            };
+            // 提取普通属性
+            const attributeNodes = node.getElementsByTagNameNS('*', 'Attribute');
+            for (let i = 0; i < attributeNodes.length; i++) {
+                const attrNode = attributeNodes[i];
+                const name = attrNode.getAttribute('Name') || attrNode.getAttribute('FriendlyName');
+                if (!name)
+                    continue;
+                const values = [];
+                const valueNodes = attrNode.getElementsByTagNameNS('*', 'AttributeValue');
+                for (let j = 0; j < valueNodes.length; j++) {
+                    const value = valueNodes[j].textContent?.trim();
+                    if (value)
+                        values.push(value);
+                }
+                attributeData.attributes[name] = values;
+            }
+            // 提取加密属性
+            const encryptedAttrNodes = node.getElementsByTagNameNS('*', 'EncryptedAttribute');
+            if (encryptedAttrNodes.length > 0) {
+                const encryptedAttrNode = encryptedAttrNodes[0];
+                const encryptionMethods = encryptedAttrNode.getElementsByTagNameNS('*', 'EncryptionMethod');
+                const cipherValues = encryptedAttrNode.getElementsByTagNameNS('*', 'CipherValue');
+                attributeData.encryptedAttributes = {
+                    encryptionMethodAlgorithm: encryptionMethods.length > 0 ?
+                        encryptionMethods[0].getAttribute('Algorithm') : null,
+                    cipherValue: cipherValues.length > 0 ?
+                        cipherValues[0].textContent?.trim() : null
+                };
+            }
+            return attributeData;
+        }
+    },
+    // ==========================================================================
+    // 8. Response Signature
+    // ==========================================================================
+    {
+        key: 'responseSignature',
+        localPath: ['Response', 'Signature'],
+        attributes: [],
+        context: true,
+        parseCallback: (node) => {
+            if (!node)
+                return null;
+            const signatureData = {};
+            // 提取签名算法相关信息
+            const signatureMethods = node.getElementsByTagNameNS('*', 'SignatureMethod');
+            if (signatureMethods.length > 0) {
+                signatureData.signatureMethodAlgorithm = signatureMethods[0].getAttribute('Algorithm');
+            }
+            const canonicalizationMethods = node.getElementsByTagNameNS('*', 'CanonicalizationMethod');
+            if (canonicalizationMethods.length > 0) {
+                signatureData.canonicalizationMethodAlgorithm = canonicalizationMethods[0].getAttribute('Algorithm');
+            }
+            const digestMethods = node.getElementsByTagNameNS('*', 'DigestMethod');
+            if (digestMethods.length > 0) {
+                signatureData.digestMethodAlgorithm = digestMethods[0].getAttribute('Algorithm');
+            }
+            const digestValues = node.getElementsByTagNameNS('*', 'DigestValue');
+            if (digestValues.length > 0) {
+                signatureData.digestValue = digestValues[0].textContent?.trim();
+            }
+            const signatureValues = node.getElementsByTagNameNS('*', 'SignatureValue');
+            if (signatureValues.length > 0) {
+                signatureData.signatureValue = signatureValues[0].textContent?.trim();
+            }
+            const certificates = node.getElementsByTagNameNS('*', 'X509Certificate');
+            if (certificates.length > 0) {
+                signatureData.x509Certificate = certificates[0].textContent?.replace(/\s+/g, '');
+            }
+            return signatureData;
+        }
+    }
+];
+/**
+ * 核心提取函数 - 优化版
+ */
+export function extractSpToll(context, fields) {
+    const { dom } = getContext();
+    if (!context || typeof context !== 'string' || context.trim() === '') {
+        return {};
+    }
+    let rootDoc;
+    try {
+        rootDoc = dom.parseFromString(context, 'application/xml');
+    }
+    catch (e) {
+        console.error('Failed to parse XML context:', e);
+        return {};
+    }
+    if (rootDoc.getElementsByTagName('parsererror').length > 0) {
+        console.error('XML Parse Error detected in context');
+        return {};
+    }
+    return fields.reduce((result, field) => {
+        const key = field.key;
+        const localPath = field.localPath || [];
+        const attributes = field.attributes || [];
+        const isEntire = field.context;
+        const shortcut = field.shortcut;
+        const index = field.index;
+        const attributePath = field.attributePath;
+        const listMode = field.listMode;
+        const parseCallback = field.parseCallback;
+        let targetDoc = rootDoc;
+        if (shortcut) {
+            try {
+                targetDoc = dom.parseFromString(shortcut, 'application/xml');
+            }
+            catch (e) {
+                return result;
+            }
+        }
+        // 特殊处理：证书和 KeyName
+        if (key === 'signingCert' || key === 'encryptCert' || key === 'signingKeyName' || key === 'encryptionKeyName') {
+            const isSigning = key.startsWith('signing');
+            const useType = isSigning ? 'signing' : 'encryption';
+            const isKeyName = key.endsWith('KeyName');
+            const kdXPath = `//*[local-name(.)='KeyDescriptor' and @use='${useType}']`;
+            let fullXPath = '';
+            if (isKeyName) {
+                fullXPath = `${kdXPath}/*[local-name(.)='KeyInfo']/*[local-name(.)='KeyName']/text()`;
+            }
+            else {
+                fullXPath = `${kdXPath}/*[local-name(.)='KeyInfo']/*[local-name(.)='X509Data']/*[local-name(.)='X509Certificate']/text()`;
+            }
+            try {
+                // @ts-ignore
+                const nodes = select(fullXPath, targetDoc);
+                if (isKeyName) {
+                    const keyNames = nodes.map((n) => n.nodeValue).filter(notEmpty);
+                    return { ...result, [key]: keyNames.length > 0 ? keyNames[0] : null };
+                }
+                else {
+                    const certs = nodes.map((n) => {
+                        const val = n.nodeValue || n.value;
+                        return val ? val.replace(/\r\n|\r|\n|\s/g, '') : null;
+                    }).filter(notEmpty);
+                    return { ...result, [key]: certs.length > 0 ? certs[0] : null };
+                }
+            }
+            catch (e) {
+                return { ...result, [key]: null };
+            }
+        }
+        // 多路径处理
+        if (Array.isArray(localPath) && localPath.length > 0 && Array.isArray(localPath[0])) {
+            const multiXPaths = localPath.map(path => `${buildAbsoluteXPath(path)}/text()`).join(' | ');
+            try {
+                // @ts-ignore
+                const nodes = select(multiXPaths, targetDoc);
+                return { ...result, [key]: uniq(nodes.map((n) => n.nodeValue).filter(notEmpty)) };
+            }
+            catch (e) {
+                return { ...result, [key]: [] };
+            }
+        }
+        const currentLocalPath = localPath;
+        if (currentLocalPath.length === 0 && !isEntire) {
+            return { ...result, [key]: null };
+        }
+        const baseXPath = buildAbsoluteXPath(currentLocalPath);
+        // 列表模式处理
+        if (listMode) {
+            try {
+                // @ts-ignore
+                const nodes = select(baseXPath, targetDoc);
+                if (parseCallback) {
+                    // 使用自定义回调函数处理列表
+                    return { ...result, [key]: parseCallback(nodes) };
+                }
+                // 通用列表处理
+                const resultList = nodes.map((node) => {
+                    if (attributes.length > 0) {
+                        const attrResult = {};
+                        attributes.forEach(attr => {
+                            if (node.getAttribute) {
+                                const val = node.getAttribute(attr);
+                                if (val !== null && val !== undefined) {
+                                    attrResult[camelCase(attr, { locale: 'en-us' })] = val;
+                                }
+                            }
+                        });
+                        return attrResult;
+                    }
+                    else {
+                        // 当没有属性时，获取文本内容
+                        let text = node.textContent;
+                        if (!text && node.firstChild)
+                            text = node.firstChild.nodeValue;
+                        const trimmed = text ? text.trim() : '';
+                        return trimmed;
+                    }
+                });
+                return { ...result, [key]: resultList };
+            }
+            catch (e) {
+                console.error(`Error extracting list ${key}:`, e);
+                return { ...result, [key]: [] };
+            }
+        }
+        // 属性聚合 (Index + AttributePath)
+        if (index && attributePath) {
+            try {
+                const indexPath = buildAttributeXPath(index);
+                const fullLocalXPath = `${baseXPath}${indexPath}`;
+                // @ts-ignore
+                const parentNodes = select(baseXPath, targetDoc);
+                // @ts-ignore
+                const parentAttributes = select(fullLocalXPath, targetDoc).map((n) => n.value);
+                const childXPath = buildAbsoluteXPath([last(currentLocalPath)].concat(attributePath));
+                const childAttributeXPath = buildAttributeXPath(attributes);
+                const fullChildXPath = `${childXPath}${childAttributeXPath}`;
+                const childAttributes = parentNodes.map((node) => {
+                    try {
+                        const nodeStr = node.toString();
+                        if (!nodeStr)
+                            return null;
+                        const nodeDoc = dom.parseFromString(nodeStr, 'application/xml');
+                        if (attributes.length === 0) {
+                            // @ts-ignore
+                            const childValues = select(fullChildXPath, nodeDoc).map((n) => n.nodeValue);
+                            return childValues.length === 1 ? childValues[0] : childValues;
+                        }
+                        if (attributes.length > 0) {
+                            // @ts-ignore
+                            const childValues = select(fullChildXPath, nodeDoc).map((n) => n.value);
+                            return childValues.length === 1 ? childValues[0] : childValues;
+                        }
+                        return null;
+                    }
+                    catch (e) {
+                        return null;
+                    }
+                });
+                const obj = zipObject(parentAttributes, childAttributes, false);
+                return { ...result, [key]: obj };
+            }
+            catch (e) {
+                return { ...result, [key]: {} };
+            }
+        }
+        // 获取整个节点 (Context)
+        if (isEntire) {
+            try {
+                // @ts-ignore
+                const node = select(baseXPath, targetDoc);
+                let value = null;
+                if (node.length === 1) {
+                    value = node[0].toString();
+                    // 如果有自定义解析回调，使用它
+                    if (parseCallback) {
+                        const parsedValue = parseCallback(node[0]);
+                        return { ...result, [key]: parsedValue };
+                    }
+                }
+                if (node.length > 1) {
+                    value = node.map((n) => n.toString());
+                }
+                return { ...result, [key]: value };
+            }
+            catch (e) {
+                return { ...result, [key]: null };
+            }
+        }
+        // 多属性对象
+        if (attributes.length > 1 && !listMode) {
+            try {
+                // @ts-ignore
+                const baseNodeList = select(baseXPath, targetDoc);
+                if (baseNodeList.length === 0)
+                    return { ...result, [key]: null };
+                const attributeValues = baseNodeList.map((node) => {
+                    const nodeStr = node.toString();
+                    if (!nodeStr)
+                        return {};
+                    const nodeDoc = dom.parseFromString(nodeStr, 'application/xml');
+                    const childXPath = `${buildAbsoluteXPath([last(currentLocalPath)])}${buildAttributeXPath(attributes)}`;
+                    // @ts-ignore
+                    const values = select(childXPath, nodeDoc).reduce((r, n) => {
+                        if (n.name && n.value !== undefined)
+                            r[camelCase(n.name, { locale: 'en-us' })] = n.value;
+                        return r;
+                    }, {});
+                    return values;
+                });
+                return { ...result, [key]: attributeValues.length === 1 ? attributeValues[0] : attributeValues };
+            }
+            catch (e) {
+                return { ...result, [key]: null };
+            }
+        }
+        // 单个属性
+        if (attributes.length === 1 && !listMode) {
+            try {
+                const fullPath = `${baseXPath}${buildAttributeXPath(attributes)}`;
+                // @ts-ignore
+                const attributeValues = select(fullPath, targetDoc).map((n) => n.value);
+                return { ...result, [key]: attributeValues[0] || null };
+            }
+            catch (e) {
+                return { ...result, [key]: null };
+            }
+        }
+        // 纯文本内容
+        if (attributes.length === 0 && !listMode) {
+            try {
+                // @ts-ignore
+                const node = select(baseXPath, targetDoc);
+                if (parseCallback) {
+                    // 使用自定义回调函数处理单个节点
+                    return { ...result, [key]: parseCallback(node[0]) };
+                }
+                let attributeValue = null;
+                if (node.length === 1) {
+                    const fullPath = `string(${baseXPath})`;
+                    // @ts-ignore
+                    attributeValue = select(fullPath, targetDoc);
+                }
+                if (node.length > 1) {
+                    attributeValue = node.filter((n) => n.firstChild)
+                        .map((n) => {
+                        let t = n.firstChild.nodeValue;
+                        if (!t && n.textContent)
+                            t = n.textContent;
+                        return t ? t.trim() : null;
+                    });
+                }
+                return { ...result, [key]: attributeValue };
+            }
+            catch (e) {
+                return { ...result, [key]: null };
+            }
+        }
+        return result;
+    }, {});
+}
+// 新增函数：调用 extractSpToll 提取 SP 数据
+export function extractSpData(context) {
+    return extractSpToll(context, spMetadataFields);
+}
 export function extractIdp(context) {
     return extract(context, idpMetadataFields);
 }
 export function extractSp(context) {
     return extract(context, spMetadataFields);
 }
+export function extractAuthRequest(context) {
+    return extract(context, loginRequestFields);
+}
+export function extractResponse(context, ass) {
+    return extractSpToll(context, loginResponseFieldsFullList);
+}