samlify 2.10.2 → 2.11.0

package/src/utility.ts

@@ -3,8 +3,8 @@
 * @author tngan
 * @desc  Library for some common functions (e.g. de/inflation, en/decoding)
 */
-import { pki, util, asn1 } from 'node-forge';
-import { inflate, deflate } from 'pako';
+import { X509Certificate, createPrivateKey } from 'crypto';
+import { deflateRawSync, inflateRawSync } from 'zlib';
 
 const BASE64_STR = 'base64';
 
@@ -102,8 +102,8 @@ export function base64Decode(base64Message: string, isBytes?: boolean): string |
 * @return {string} compressed string
 */
 function deflateString(message: string): number[] {
-  const input = Array.prototype.map.call(message, char => char.charCodeAt(0));
-  return Array.from(deflate(input, { raw: true }));
+  const input = Buffer.from(message, 'utf8');
+  return Array.from(deflateRawSync(input));
 }
 /**
 * @desc Decompress the compressed string
@@ -112,10 +112,7 @@ function deflateString(message: string): number[] {
 */
 export function inflateString(compressedString: string): string {
   const inputBuffer = Buffer.from(compressedString, BASE64_STR);
-  const input = Array.prototype.map.call(inputBuffer.toString('binary'), char => char.charCodeAt(0));
-  return Array.from(inflate(input, { raw: true }))
-    .map((byte: number) => String.fromCharCode(byte))
-    .join('');
+  return inflateRawSync(inputBuffer).toString('utf8');
 }
 /**
 * @desc Abstract the normalizeCerString and normalizePemString
@@ -173,10 +170,9 @@ function applyDefault(obj1, obj2) {
 * @return {string} public key fetched from the certificate
 */
 function getPublicKeyPemFromCertificate(x509Certificate: string) {
-  const certDerBytes = util.decode64(x509Certificate);
-  const obj = asn1.fromDer(certDerBytes);
-  const cert = pki.certificateFromAsn1(obj);
-  return pki.publicKeyToPem(cert.publicKey);
+  const der = Buffer.from(x509Certificate, 'base64');
+  const cert = new X509Certificate(der);
+  return cert.publicKey.export({ type: 'spki', format: 'pem' });
 }
 /**
 * @desc Read private key from pem-formatted string
@@ -186,7 +182,12 @@ function getPublicKeyPemFromCertificate(x509Certificate: string) {
 * If passphrase is used to protect the .pem content (recommend)
 */
 export function readPrivateKey(keyString: string | Buffer, passphrase: string | undefined, isOutputString?: boolean) {
-  return isString(passphrase) ? this.convertToString(pki.privateKeyToPem(pki.decryptRsaPrivateKey(String(keyString), passphrase)), isOutputString) : keyString;
+  if (isString(passphrase)) {
+    const key = createPrivateKey({ key: keyString, format: 'pem', passphrase });
+    const pem = key.export({ type: 'pkcs1', format: 'pem' });
+    return convertToString(pem, isOutputString);
+  }
+  return keyString;
 }
 /**
 * @desc Inline syntax sugar

package/types/src/binding-post.d.ts

@@ -19,7 +19,7 @@ declare function base64LoginRequest(referenceTagXPath: string, entity: any, cust
 * @param  {function} customTagReplacement     used when developers have their own login response template
 * @param  {boolean}  encryptThenSign           whether or not to encrypt then sign first (if signing). Defaults to sign-then-encrypt
 */
-declare function base64LoginResponse(requestInfo: any, entity: any, user?: any, customTagReplacement?: (template: string) => BindingContext, encryptThenSign?: boolean): Promise<BindingContext>;
+declare function base64LoginResponse(requestInfo: any | undefined, entity: any, user?: any, customTagReplacement?: (template: string) => BindingContext, encryptThenSign?: boolean): Promise<BindingContext>;
 /**
 * @desc Generate a base64 encoded logout request
 * @param  {object} user                         current logged user (e.g. req.user)

package/types/src/binding-simplesign.d.ts

@@ -31,7 +31,7 @@ declare function base64LoginRequest(entity: any, customTagReplacement?: (templat
 * @param  {string}  relayState               the relay state
 * @param  {function} customTagReplacement     used when developers have their own login response template
 */
-declare function base64LoginResponse(requestInfo: any, entity: any, user?: any, relayState?: string, customTagReplacement?: (template: string) => BindingContext): Promise<BindingSimpleSignContext>;
+declare function base64LoginResponse(requestInfo: any | undefined, entity: any, user?: any, relayState?: string, customTagReplacement?: (template: string) => BindingContext): Promise<BindingSimpleSignContext>;
 declare const simpleSignBinding: {
     base64LoginRequest: typeof base64LoginRequest;
     base64LoginResponse: typeof base64LoginResponse;

package/types/src/entity.d.ts

@@ -1,4 +1,3 @@
-/// <reference types="node" />
 import { IdpMetadata as IdpMetadataConstructor } from './metadata-idp';
 import { SpMetadata as SpMetadataConstructor } from './metadata-sp';
 import { MetadataIdpConstructor, MetadataSpConstructor, EntitySetting } from './types';
@@ -31,7 +30,7 @@ export interface ParseResult {
     extract: any;
     sigAlg: string;
 }
-export declare type EntityConstructor = (MetadataIdpConstructor | MetadataSpConstructor) & {
+export type EntityConstructor = (MetadataIdpConstructor | MetadataSpConstructor) & {
     metadata?: string | Buffer;
 };
 export default class Entity {

package/types/src/extractor.d.ts

@@ -6,7 +6,7 @@ interface ExtractorField {
     attributePath?: string[];
     context?: boolean;
 }
-export declare type ExtractorFields = ExtractorField[];
+export type ExtractorFields = ExtractorField[];
 export declare const loginRequestFields: ExtractorFields;
 export declare const loginResponseStatusFields: {
     key: string;

package/types/src/libsaml.d.ts

@@ -3,7 +3,6 @@
 * @author tngan
 * @desc  A simple library including some common functions
 */
-/// <reference types="node" />
 import { MetadataInterface } from './metadata';
 export interface SignatureConstructor {
     rawSamlMessage: string;
@@ -58,7 +57,7 @@ export interface LogoutRequestTemplate extends BaseSamlTemplate {
 }
 export interface LogoutResponseTemplate extends BaseSamlTemplate {
 }
-export declare type KeyUse = 'signing' | 'encryption';
+export type KeyUse = 'signing' | 'encryption';
 export interface KeyComponent {
     [key: string]: any;
 }
@@ -86,7 +85,7 @@ export interface LibSamlInterface {
     defaultLogoutResponseTemplate: LogoutResponseTemplate;
 }
 declare const _default: {
-    createXPath: (local: any, isExtractAll?: boolean | undefined) => string;
+    createXPath: (local: any, isExtractAll?: boolean) => string;
     getQueryParamByType: (type: string) => "SAMLRequest" | "SAMLResponse";
     defaultLoginRequestTemplate: {
         context: string;
@@ -166,7 +165,7 @@ declare const _default: {
     * @param  {string} signingAlgorithm          signing algorithm
     * @return {string} message signature
     */
-    constructMessageSignature(octetString: string, key: string, passphrase?: string | undefined, isBase64?: boolean | undefined, signingAlgorithm?: string | undefined): string | Buffer;
+    constructMessageSignature(octetString: string, key: string, passphrase?: string, isBase64?: boolean, signingAlgorithm?: string): string | Buffer<ArrayBufferLike>;
     /**
     * @desc Verifies message signature
     * @param  {Metadata} metadata                 metadata object of identity provider or service provider
@@ -175,7 +174,7 @@ declare const _default: {
     * @param  {string} verifyAlgorithm            algorithm used to verify
     * @return {boolean} verification result
     */
-    verifyMessageSignature(metadata: any, octetString: string, signature: string | Buffer, verifyAlgorithm?: string | undefined): boolean;
+    verifyMessageSignature(metadata: any, octetString: string, signature: string | Buffer, verifyAlgorithm?: string): boolean;
     /**
     * @desc Get the public key in string format
     * @param  {string} x509Certificate certificate
@@ -192,7 +191,7 @@ declare const _default: {
     * @param  {string} xml                      response in xml string format
     * @return {Promise} a promise to resolve the finalized xml
     */
-    encryptAssertion(sourceEntity: any, targetEntity: any, xml?: string | undefined): Promise<string>;
+    encryptAssertion(sourceEntity: any, targetEntity: any, xml?: string): Promise<string>;
     /**
     * @desc Decrypt the assertion section in Response
     * @param  {string} type             only accept SAMLResponse to proceed decryption

package/types/src/metadata.d.ts

@@ -1,4 +1,3 @@
-/// <reference types="node" />
 export interface MetadataInterface {
     xmlString: string;
     getMetadata: () => string;

package/types/src/types.d.ts

@@ -1,11 +1,10 @@
-/// <reference types="node" />
 import { LoginResponseTemplate } from './libsaml';
 export { IdentityProvider as IdentityProviderConstructor } from './entity-idp';
 export { IdpMetadata as IdentityProviderMetadata } from './metadata-idp';
 export { ServiceProvider as ServiceProviderConstructor } from './entity-sp';
 export { SpMetadata as ServiceProviderMetadata } from './metadata-sp';
-export declare type MetadataFile = string | Buffer;
-declare type SSOService = {
+export type MetadataFile = string | Buffer;
+type SSOService = {
     isDefault?: boolean;
     Binding: string;
     Location: string;
@@ -20,7 +19,7 @@ export interface MetadataIdpOptions {
     singleLogoutService?: SSOService[];
     requestSignatureAlgorithm?: string;
 }
-export declare type MetadataIdpConstructor = MetadataIdpOptions | MetadataFile;
+export type MetadataIdpConstructor = MetadataIdpOptions | MetadataFile;
 export interface MetadataSpOptions {
     entityID?: string;
     signingCert?: string | Buffer | (string | Buffer)[];
@@ -37,8 +36,8 @@ export interface MetadataSpOptions {
     assertionConsumerService?: SSOService[];
     elementsOrder?: string[];
 }
-export declare type MetadataSpConstructor = MetadataSpOptions | MetadataFile;
-export declare type EntitySetting = ServiceProviderSettings & IdentityProviderSettings;
+export type MetadataSpConstructor = MetadataSpOptions | MetadataFile;
+export type EntitySetting = ServiceProviderSettings & IdentityProviderSettings;
 export interface SignatureConfig {
     prefix?: string;
     location?: {
@@ -49,7 +48,7 @@ export interface SignatureConfig {
 export interface SAMLDocumentTemplate {
     context?: string;
 }
-export declare type ServiceProviderSettings = {
+export type ServiceProviderSettings = {
     metadata?: string | Buffer;
     entityID?: string;
     authnRequestsSigned?: boolean;
@@ -76,7 +75,7 @@ export declare type ServiceProviderSettings = {
     relayState?: string;
     clockDrifts?: [number, number];
 };
-export declare type IdentityProviderSettings = {
+export type IdentityProviderSettings = {
     metadata?: string | Buffer;
     /** signature algorithm */
     requestSignatureAlgorithm?: string;

package/types/src/utility.d.ts

@@ -1,4 +1,3 @@
-/// <reference types="node" />
 /**
  * @desc Mimic lodash.zipObject
  * @param arr1 {string[]}
@@ -35,7 +34,7 @@ export declare function get(obj: any, path: any, defaultValue: any): any;
  * @desc Check if the input is string
  * @param {any} input
  */
-export declare function isString(input: any): boolean;
+export declare function isString(input: any): input is string;
 /**
 * @desc Encode string with base64 format
 * @param  {string} message                       plain-text message

package/types/src/validator.d.ts

@@ -1,3 +1,3 @@
-declare type DriftTolerance = [number, number];
+type DriftTolerance = [number, number];
 declare function verifyTime(utcNotBefore: string | undefined, utcNotOnOrAfter: string | undefined, drift?: DriftTolerance): boolean;
 export { verifyTime };

package/.travis.yml

@@ -1,29 +0,0 @@
-language: node_js
-
-node_js:
-  - "16"
-  - "18"
-  - "20"
-
-env:
-  - INSTALL_JDK=1
-  - INSTALL_JDK=0
-
-before_install:
-  - if [[ "$INSTALL_JDK" == "1" ]] ; then make install_jdk ; fi
-
-install:
-  - yarn install --production=true
-
-script:
-  - yarn add @authenio/samlify-xsd-schema-validator
-  - yarn test --timeout=30s
-
-branches:
-  only:
-  - master
-  - /^.*-alpha$/
-  - /^.*-rc.*$/
-  - /^feature\/.*$/
-
-after_success: npm run coverage

package/CHANGELOG.md

@@ -1,7 +0,0 @@
-# 2.10.1
-
-* Changes to libsaml.ts verifySignature. This is an internal function, but we still document changes
-  - Does not raise error when signature is missing/invalid. Instead it now returns false. This is to simplify logic
-  - When there are encrypted assertions, returns the entire response, as the "verifiedAssertionNode"
-
-* Fix logic around handling encrypted assertions

package/types/vitest.config.d.ts

@@ -1,2 +0,0 @@
-declare const _default: import("vite").UserConfig;
-export default _default;