samlify 2.11.0 → 2.13.0

package/build/src/entity-idp.js

@@ -68,11 +68,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.IdentityProvider = void 0;
 exports.default = default_1;
 /**
-* @file entity-idp.ts
-* @author tngan
-* @desc  Declares the actions taken by identity provider
-*/
+ * @file entity-idp.ts
+ * @author tngan
+ * @desc Identity provider: builds login responses and parses inbound
+ * login requests coming from a service provider.
+ */
 var entity_1 = __importDefault(require("./entity"));
+var options_1 = require("./options");
 var libsaml_1 = __importDefault(require("./libsaml"));
 var urn_1 = require("./urn");
 var binding_post_1 = __importDefault(require("./binding-post"));
@@ -81,68 +83,149 @@ var binding_simplesign_1 = __importDefault(require("./binding-simplesign"));
 var flow_1 = require("./flow");
 var utility_1 = require("./utility");
 /**
- * Identity provider can be configured using either metadata importing or idpSetting
+ * Factory returning a new {@link IdentityProvider}. An IdP can be built
+ * from an XML metadata document or from a programmatic settings object.
+ *
+ * @param props IdP settings
  */
 function default_1(props) {
     return new IdentityProvider(props);
 }
 /**
- * Identity provider can be configured using either metadata importing or idpSetting
+ * Swap the default `samlp:` / `saml:` prefixes inside an XML template
+ * with caller-supplied prefixes. Both the prefix occurrences and the
+ * `xmlns:` namespace bindings are rewritten so the resulting XML
+ * remains well-formed and namespace-correct (saml-core §1.4 — prefix
+ * choice is not normative).
  */
+function applyTagPrefixes(xml, prefixes) {
+    var out = xml;
+    if (prefixes.protocol && prefixes.protocol !== 'samlp') {
+        var p = prefixes.protocol;
+        out = out
+            .replace(/<samlp:/g, "<".concat(p, ":"))
+            .replace(/<\/samlp:/g, "</".concat(p, ":"))
+            .replace(/xmlns:samlp="/g, "xmlns:".concat(p, "=\""));
+    }
+    if (prefixes.assertion && prefixes.assertion !== 'saml') {
+        var a = prefixes.assertion;
+        out = out
+            .replace(/<saml:/g, "<".concat(a, ":"))
+            .replace(/<\/saml:/g, "</".concat(a, ":"))
+            .replace(/xmlns:saml="/g, "xmlns:".concat(a, "=\""));
+    }
+    return out;
+}
+/** Identity-provider entity. */
 var IdentityProvider = /** @class */ (function (_super) {
     __extends(IdentityProvider, _super);
+    /**
+     * Build an IdP, expanding `loginResponseTemplate.attributes` into a
+     * pre-baked AttributeStatement template when supplied.
+     */
     function IdentityProvider(idpSetting) {
+        var _a, _b, _c;
         var defaultIdpEntitySetting = {
             wantAuthnRequestsSigned: false,
             tagPrefix: {
                 encryptedAssertion: 'saml',
             },
         };
-        var entitySetting = Object.assign(defaultIdpEntitySetting, idpSetting);
-        // build attribute part
+        var entitySetting = Object.assign({}, defaultIdpEntitySetting, idpSetting);
+        // Deep-merge tagPrefix so callers can override `protocol` / `assertion`
+        // without dropping the `encryptedAssertion: 'saml'` default that
+        // libsaml.encryptAssertion depends on (#388, saml-core §1.4).
+        entitySetting.tagPrefix = __assign(__assign({}, defaultIdpEntitySetting.tagPrefix), idpSetting.tagPrefix);
         if (idpSetting.loginResponseTemplate) {
-            if ((0, utility_1.isString)(idpSetting.loginResponseTemplate.context) && Array.isArray(idpSetting.loginResponseTemplate.attributes)) {
-                var attributeStatementTemplate = void 0;
-                var attributeTemplate = void 0;
-                if (!idpSetting.loginResponseTemplate.additionalTemplates || !idpSetting.loginResponseTemplate.additionalTemplates.attributeStatementTemplate) {
-                    attributeStatementTemplate = libsaml_1.default.defaultAttributeStatementTemplate;
-                }
-                else {
-                    attributeStatementTemplate = idpSetting.loginResponseTemplate.additionalTemplates.attributeStatementTemplate;
-                }
-                if (!idpSetting.loginResponseTemplate.additionalTemplates || !idpSetting.loginResponseTemplate.additionalTemplates.attributeTemplate) {
-                    attributeTemplate = libsaml_1.default.defaultAttributeTemplate;
-                }
-                else {
-                    attributeTemplate = idpSetting.loginResponseTemplate.additionalTemplates.attributeTemplate;
-                }
-                var replacement = {
-                    AttributeStatement: libsaml_1.default.attributeStatementBuilder(idpSetting.loginResponseTemplate.attributes, attributeTemplate, attributeStatementTemplate),
-                };
-                entitySetting.loginResponseTemplate = __assign(__assign({}, entitySetting.loginResponseTemplate), { context: libsaml_1.default.replaceTagsByValue(entitySetting.loginResponseTemplate.context, replacement) });
+            var template = idpSetting.loginResponseTemplate;
+            if ((0, utility_1.isString)(template.context) && Array.isArray(template.attributes)) {
+                var additional = template.additionalTemplates;
+                var attributeStatementTemplate = additional && additional.attributeStatementTemplate
+                    ? additional.attributeStatementTemplate
+                    : libsaml_1.default.defaultAttributeStatementTemplate;
+                var attributeTemplate = additional && additional.attributeTemplate
+                    ? additional.attributeTemplate
+                    : libsaml_1.default.defaultAttributeTemplate;
+                var attributeStatement = libsaml_1.default.attributeStatementBuilder(template.attributes, attributeTemplate, attributeStatementTemplate);
+                entitySetting.loginResponseTemplate = __assign(__assign({}, entitySetting.loginResponseTemplate), { context: entitySetting.loginResponseTemplate.context.replace('{AttributeStatement}', attributeStatement) });
             }
             else {
                 console.warn('Invalid login response template');
             }
         }
+        // saml-core §1.4 — XML namespace prefixes are not normative; only the
+        // URI bindings are. When the caller overrides `tagPrefix.protocol` or
+        // `tagPrefix.assertion`, rewrite both the caller's templates and the
+        // built-in defaults so the bindings emit the rebound prefixes
+        // downstream (closes #388). The rewritten defaults land on a separate
+        // `tagPrefixedDefaults` slot so users that only set
+        // `loginResponseTemplate` (without `tagPrefix`) continue to follow the
+        // legacy binding fallback path.
+        var tp = entitySetting.tagPrefix;
+        var protocolPrefix = tp === null || tp === void 0 ? void 0 : tp.protocol;
+        var assertionPrefix = tp === null || tp === void 0 ? void 0 : tp.assertion;
+        var overridesProtocol = !!protocolPrefix && protocolPrefix !== 'samlp';
+        var overridesAssertion = !!assertionPrefix && assertionPrefix !== 'saml';
+        if (overridesProtocol || overridesAssertion) {
+            var prefixes = { protocol: protocolPrefix, assertion: assertionPrefix };
+            // Rewrite any caller-supplied templates in place so customTagReplacement
+            // consumers see the rebound prefixes too.
+            var callerLoginCtx = (_a = entitySetting.loginResponseTemplate) === null || _a === void 0 ? void 0 : _a.context;
+            if ((0, utility_1.isString)(callerLoginCtx)) {
+                entitySetting.loginResponseTemplate = __assign(__assign({}, entitySetting.loginResponseTemplate), { context: applyTagPrefixes(callerLoginCtx, prefixes) });
+            }
+            var callerLogoutReqCtx = (_b = entitySetting.logoutRequestTemplate) === null || _b === void 0 ? void 0 : _b.context;
+            if ((0, utility_1.isString)(callerLogoutReqCtx)) {
+                entitySetting.logoutRequestTemplate = __assign(__assign({}, entitySetting.logoutRequestTemplate), { context: applyTagPrefixes(callerLogoutReqCtx, prefixes) });
+            }
+            var callerLogoutRespCtx = (_c = entitySetting.logoutResponseTemplate) === null || _c === void 0 ? void 0 : _c.context;
+            if ((0, utility_1.isString)(callerLogoutRespCtx)) {
+                entitySetting.logoutResponseTemplate = __assign(__assign({}, entitySetting.logoutResponseTemplate), { context: applyTagPrefixes(callerLogoutRespCtx, prefixes) });
+            }
+            // Pre-rewrite copies of the default templates so the bindings emit
+            // rebound prefixes when no caller template is supplied.
+            entitySetting.tagPrefixedDefaults = {
+                loginResponseTemplate: {
+                    context: applyTagPrefixes(libsaml_1.default.defaultLoginResponseTemplate.context, prefixes),
+                },
+                logoutRequestTemplate: {
+                    context: applyTagPrefixes(libsaml_1.default.defaultLogoutRequestTemplate.context, prefixes),
+                },
+                logoutResponseTemplate: {
+                    context: applyTagPrefixes(libsaml_1.default.defaultLogoutResponseTemplate.context, prefixes),
+                },
+            };
+        }
         return _super.call(this, entitySetting, 'idp') || this;
     }
     /**
-    * @desc  Generates the login response for developers to design their own method
-    * @param  sp                        object of service provider
-    * @param  requestInfo               corresponding request, used to obtain the id
-    * @param  binding                   protocol binding
-    * @param  user                      current logged user (e.g. req.user)
-    * @param  customTagReplacement      used when developers have their own login response template
-    * @param  encryptThenSign           whether or not to encrypt then sign first (if signing)
-    * @param  relayState             the relayState from corresponding request
-    */
-    IdentityProvider.prototype.createLoginResponse = function (sp, requestInfo, binding, user, customTagReplacement, encryptThenSign, relayState) {
+     * Build a login response for delivery to the supplied service provider.
+     *
+     * The fifth parameter accepts either a callback (legacy positional shape)
+     * or an options bag `{ relayState?, customTagReplacement?, encryptThenSign? }`.
+     * When the legacy shape is used, the trailing `legacyEncryptThenSign` and
+     * `legacyRelayState` positional arguments are honoured. Per
+     * `saml-bindings §3.4.3 / §3.5.3`, RelayState is request-scoped — pass it
+     * via the options bag instead of `entitySetting.relayState`.
+     *
+     * @param sp target service provider
+     * @param requestInfo parsed request used to set `InResponseTo`
+     * @param binding `post`, `simpleSign`, or `redirect`
+     * @param user authenticated user
+     * @param optionsOrCallback per-request options or legacy custom-template callback
+     * @param legacyEncryptThenSign legacy positional `encryptThenSign`; ignored when options bag is used
+     * @param legacyRelayState legacy positional `relayState`; ignored when options bag is used
+     */
+    IdentityProvider.prototype.createLoginResponse = function (sp, requestInfo, binding, user, optionsOrCallback, legacyEncryptThenSign, legacyRelayState) {
         return __awaiter(this, void 0, void 0, function () {
-            var protocol, context, _a;
+            var opts, customTagReplacement, encryptThenSign, relayState, protocol, context, _a;
             return __generator(this, function (_b) {
                 switch (_b.label) {
                     case 0:
+                        opts = (0, options_1.normalizeCreateLoginResponseOptions)(optionsOrCallback, legacyEncryptThenSign, legacyRelayState);
+                        customTagReplacement = opts.customTagReplacement;
+                        encryptThenSign = opts.encryptThenSign;
+                        relayState = opts.relayState;
                         protocol = urn_1.namespace.binding[binding];
                         context = null;
                         _a = protocol;
@@ -164,7 +247,7 @@ var IdentityProvider = /** @class */ (function (_super) {
                             sp: sp,
                         }, user, relayState, customTagReplacement)];
                     case 4:
-                        context = _b.sent();
+                        context = (_b.sent());
                         return [3 /*break*/, 7];
                     case 5: return [2 /*return*/, binding_redirect_1.default.loginResponseRedirectURL(requestInfo, {
                             idp: this,
@@ -177,21 +260,21 @@ var IdentityProvider = /** @class */ (function (_super) {
         });
     };
     /**
-     * Validation of the parsed URL parameters
-     * @param sp ServiceProvider instance
-     * @param binding Protocol binding
-     * @param req RequesmessageSigningOrderst
+     * Parse, validate and verify an inbound login request.
+     *
+     * @param sp service provider that produced the request
+     * @param binding `redirect`, `post`, or `simpleSign`
+     * @param req HTTP request envelope
      */
     IdentityProvider.prototype.parseLoginRequest = function (sp, binding, req) {
-        var self = this;
         return (0, flow_1.flow)({
             from: sp,
-            self: self,
-            checkSignature: self.entityMeta.isWantAuthnRequestsSigned(),
+            self: this,
+            checkSignature: this.entityMeta.isWantAuthnRequestsSigned(),
             parserType: 'SAMLRequest',
             type: 'login',
             binding: binding,
-            request: req
+            request: req,
         });
     };
     return IdentityProvider;

package/build/src/entity-idp.js.map

@@ -1 +1 @@
-{"version":3,"file":"entity-idp.js","sourceRoot":"","sources":["../../src/entity-idp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,4BAEC;AA1BD;;;;EAIE;AACF,oDAAoD;AAOpD,sDAAgC;AAChC,6BAAkC;AAClC,gEAAyC;AACzC,wEAAiD;AACjD,4EAAqD;AACrD,+BAA0C;AAC1C,qCAAqC;AAGrC;;GAEG;AACH,mBAAwB,KAA+B;IACrD,OAAO,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH;IAAsC,oCAAM;IAI1C,0BAAY,UAAoC;QAC9C,IAAM,uBAAuB,GAAG;YAC9B,uBAAuB,EAAE,KAAK;YAC9B,SAAS,EAAE;gBACT,kBAAkB,EAAE,MAAM;aAC3B;SACF,CAAC;QACF,IAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAC;QACzE,uBAAuB;QACvB,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;YACrC,IAAI,IAAA,kBAAQ,EAAC,UAAU,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrH,IAAI,0BAA0B,SAAA,CAAC;gBAC/B,IAAI,iBAAiB,SAAA,CAAC;gBACtB,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,mBAAmB,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,mBAAoB,CAAC,0BAA0B,EAAE,CAAC;oBAC/I,0BAA0B,GAAG,iBAAO,CAAC,iCAAiC,CAAC;gBACzE,CAAC;qBAAM,CAAC;oBACN,0BAA0B,GAAG,UAAU,CAAC,qBAAqB,CAAC,mBAAoB,CAAC,0BAA2B,CAAC;gBACjH,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,mBAAmB,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,mBAAoB,CAAC,iBAAiB,EAAE,CAAC;oBACtI,iBAAiB,GAAG,iBAAO,CAAC,wBAAwB,CAAC;gBACvD,CAAC;qBAAM,CAAC;oBACN,iBAAiB,GAAG,UAAU,CAAC,qBAAqB,CAAC,mBAAoB,CAAC,iBAAkB,CAAC;gBAC/F,CAAC;gBACD,IAAM,WAAW,GAAG;oBAClB,kBAAkB,EAAE,iBAAO,CAAC,yBAAyB,CAAC,UAAU,CAAC,qBAAqB,CAAC,UAAU,EAAE,iBAAiB,EAAE,0BAA0B,CAAC;iBAClJ,CAAC;gBACF,aAAa,CAAC,qBAAqB,yBAC9B,aAAa,CAAC,qBAAqB,KACtC,OAAO,EAAE,iBAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,qBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,GAC/F,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAA,MAAK,YAAC,aAAa,EAAE,KAAK,CAAC,SAAC;IAC9B,CAAC;IAED;;;;;;;;;MASE;IACW,8CAAmB,GAAhC,UACE,EAAmB,EACnB,WAAmC,EACnC,OAAe,EACf,IAA4B,EAC5B,oBAA2D,EAC3D,eAAyB,EACzB,UAAmB;;;;;;wBAEb,QAAQ,GAAG,eAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;wBAExC,OAAO,GAAQ,IAAI,CAAC;wBAChB,KAAA,QAAQ,CAAA;;iCACT,eAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAvB,wBAAsB;iCAOtB,eAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAA7B,wBAA4B;iCAM5B,eAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAA3B,wBAA0B;;;4BAZnB,qBAAM,sBAAW,CAAC,mBAAmB,CAAC,WAAW,EAAE;4BAC3D,GAAG,EAAE,IAAI;4BACT,EAAE,IAAA;yBACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,eAAe,CAAC,EAAA;;wBAH/C,OAAO,GAAG,SAGqC,CAAC;wBAChD,wBAAM;4BAGI,qBAAM,4BAAiB,CAAC,mBAAmB,CAAE,WAAW,EAAE;4BAClE,GAAG,EAAE,IAAI;4BAAE,EAAE,IAAA;yBACd,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAA;;wBAF1C,OAAO,GAAG,SAEgC,CAAC;wBAC3C,wBAAM;4BAGN,sBAAO,0BAAe,CAAC,wBAAwB,CAAC,WAAW,EAAE;4BAC3D,GAAG,EAAE,IAAI;4BACT,EAAE,IAAA;yBACH,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAC;4BAG3C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;4BAG7D,4CACK,OAAO,KACV,UAAU,YAAA,EACV,cAAc,EAAG,EAAE,CAAC,UAAsC,CAAC,2BAA2B,CAAC,OAAO,CAAW,EACzG,IAAI,EAAE,cAAc,KACpB;;;;KACH;IAED;;;;;OAKG;IACH,4CAAiB,GAAjB,UAAkB,EAAmB,EAAE,OAAe,EAAE,GAAqB;QAC3E,IAAM,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,IAAA,WAAI,EAAC;YACV,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,yBAAyB,EAAE;YAC3D,UAAU,EAAE,aAAa;YACzB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG;SACb,CAAC,CAAC;IACL,CAAC;IACH,uBAAC;AAAD,CAAC,AAjHD,CAAsC,gBAAM,GAiH3C;AAjHY,4CAAgB"}
+{"version":3,"file":"entity-idp.js","sourceRoot":"","sources":["../../src/entity-idp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,4BAEC;AAtCD;;;;;GAKG;AACH,oDAA8B;AAe9B,qCAAgE;AAChE,sDAAgC;AAChC,6BAAkC;AAClC,gEAAyC;AACzC,wEAAiD;AACjD,4EAAqD;AACrD,+BAA8B;AAC9B,qCAAqC;AAErC;;;;;GAKG;AACH,mBAAyB,KAA+B;IACtD,OAAO,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,GAAW,EACX,QAAmD;IAEnD,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvD,IAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC5B,GAAG,GAAG,GAAG;aACN,OAAO,CAAC,UAAU,EAAE,WAAI,CAAC,MAAG,CAAC;aAC7B,OAAO,CAAC,YAAY,EAAE,YAAK,CAAC,MAAG,CAAC;aAChC,OAAO,CAAC,gBAAgB,EAAE,gBAAS,CAAC,QAAI,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QACxD,IAAM,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC;QAC7B,GAAG,GAAG,GAAG;aACN,OAAO,CAAC,SAAS,EAAE,WAAI,CAAC,MAAG,CAAC;aAC5B,OAAO,CAAC,WAAW,EAAE,YAAK,CAAC,MAAG,CAAC;aAC/B,OAAO,CAAC,eAAe,EAAE,gBAAS,CAAC,QAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gCAAgC;AAChC;IAAsC,oCAAM;IAI1C;;;OAGG;IACH,0BAAY,UAAoC;;QAC9C,IAAM,uBAAuB,GAAsC;YACjE,uBAAuB,EAAE,KAAK;YAC9B,SAAS,EAAE;gBACT,kBAAkB,EAAE,MAAM;aAC3B;SACF,CAAC;QACF,IAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,uBAAuB,EAAE,UAAU,CAA6B,CAAC;QACzG,wEAAwE;QACxE,iEAAiE;QACjE,8DAA8D;QAC9D,aAAa,CAAC,SAAS,yBAClB,uBAAuB,CAAC,SAAS,GACjC,UAAU,CAAC,SAAS,CACxB,CAAC;QAEF,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;YACrC,IAAM,QAAQ,GAAG,UAAU,CAAC,qBAE3B,CAAC;YACF,IAAI,IAAA,kBAAQ,EAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrE,IAAM,UAAU,GAAG,QAAQ,CAAC,mBAAmB,CAAC;gBAChD,IAAM,0BAA0B,GAAG,UAAU,IAAI,UAAU,CAAC,0BAA0B;oBACpF,CAAC,CAAC,UAAU,CAAC,0BAA0B;oBACvC,CAAC,CAAC,iBAAO,CAAC,iCAAiC,CAAC;gBAC9C,IAAM,iBAAiB,GAAG,UAAU,IAAI,UAAU,CAAC,iBAAiB;oBAClE,CAAC,CAAC,UAAU,CAAC,iBAAiB;oBAC9B,CAAC,CAAC,iBAAO,CAAC,wBAAwB,CAAC;gBAErC,IAAM,kBAAkB,GAAG,iBAAO,CAAC,yBAAyB,CAC1D,QAAQ,CAAC,UAAW,EACpB,iBAAiB,EACjB,0BAA0B,CAC3B,CAAC;gBACF,aAAa,CAAC,qBAAqB,yBAC9B,aAAa,CAAC,qBAAqB,KACtC,OAAO,EAAE,aAAa,CAAC,qBAAsB,CAAC,OAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,GAC3G,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,8DAA8D;QAC9D,sEAAsE;QACtE,oDAAoD;QACpD,uEAAuE;QACvE,gCAAgC;QAChC,IAAM,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC;QACnC,IAAM,cAAc,GAAG,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,QAAQ,CAAC;QACpC,IAAM,eAAe,GAAG,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,SAAS,CAAC;QACtC,IAAM,iBAAiB,GAAG,CAAC,CAAC,cAAc,IAAI,cAAc,KAAK,OAAO,CAAC;QACzE,IAAM,kBAAkB,GAAG,CAAC,CAAC,eAAe,IAAI,eAAe,KAAK,MAAM,CAAC;QAC3E,IAAI,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;YAC5C,IAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;YAC1E,yEAAyE;YACzE,0CAA0C;YAC1C,IAAM,cAAc,GAAG,MAAA,aAAa,CAAC,qBAAqB,0CAAE,OAAO,CAAC;YACpE,IAAI,IAAA,kBAAQ,EAAC,cAAc,CAAC,EAAE,CAAC;gBAC7B,aAAa,CAAC,qBAAqB,yBAC9B,aAAa,CAAC,qBAAqB,KACtC,OAAO,EAAE,gBAAgB,CAAC,cAAc,EAAE,QAAQ,CAAC,GACpD,CAAC;YACJ,CAAC;YACD,IAAM,kBAAkB,GAAG,MAAA,aAAa,CAAC,qBAAqB,0CAAE,OAAO,CAAC;YACxE,IAAI,IAAA,kBAAQ,EAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjC,aAAa,CAAC,qBAAqB,yBAC9B,aAAa,CAAC,qBAAqB,KACtC,OAAO,EAAE,gBAAgB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,GACxD,CAAC;YACJ,CAAC;YACD,IAAM,mBAAmB,GAAG,MAAA,aAAa,CAAC,sBAAsB,0CAAE,OAAO,CAAC;YAC1E,IAAI,IAAA,kBAAQ,EAAC,mBAAmB,CAAC,EAAE,CAAC;gBAClC,aAAa,CAAC,sBAAsB,yBAC/B,aAAa,CAAC,sBAAsB,KACvC,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,EAAE,QAAQ,CAAC,GACzD,CAAC;YACJ,CAAC;YACD,mEAAmE;YACnE,wDAAwD;YACxD,aAAa,CAAC,mBAAmB,GAAG;gBAClC,qBAAqB,EAAE;oBACrB,OAAO,EAAE,gBAAgB,CAAC,iBAAO,CAAC,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC;iBAClF;gBACD,qBAAqB,EAAE;oBACrB,OAAO,EAAE,gBAAgB,CAAC,iBAAO,CAAC,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC;iBAClF;gBACD,sBAAsB,EAAE;oBACtB,OAAO,EAAE,gBAAgB,CAAC,iBAAO,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC;iBACnF;aACF,CAAC;QACJ,CAAC;QAED,OAAA,MAAK,YAAC,aAAa,EAAE,KAAK,CAAC,SAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACU,8CAAmB,GAAhC,UACE,EAAmB,EACnB,WAAwB,EACxB,OAAe,EACf,IAAc,EACd,iBAAqE,EACrE,qBAA+B,EAC/B,gBAAyB;;;;;;wBAEnB,IAAI,GAAG,IAAA,6CAAmC,EAC9C,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,CACjB,CAAC;wBACI,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC;wBACjD,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;wBACvC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;wBAE7B,QAAQ,GAAG,eAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;wBACxC,OAAO,GAAqD,IAAI,CAAC;wBAC7D,KAAA,QAAQ,CAAA;;iCACT,eAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAvB,wBAAsB;iCAOtB,eAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAA7B,wBAA4B;iCAO5B,eAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAA3B,wBAA0B;;;4BAbnB,qBAAM,sBAAW,CAAC,mBAAmB,CAAC,WAAW,EAAE;4BAC3D,GAAG,EAAE,IAAI;4BACT,EAAE,IAAA;yBACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,eAAe,CAAC,EAAA;;wBAH/C,OAAO,GAAG,SAGqC,CAAC;wBAChD,wBAAM;4BAGI,qBAAM,4BAAiB,CAAC,mBAAmB,CAAC,WAAW,EAAE;4BACjE,GAAG,EAAE,IAAI;4BACT,EAAE,IAAA;yBACH,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAA;;wBAH1C,OAAO,IAAG,SAG4D,CAAA,CAAC;wBACvE,wBAAM;4BAGN,sBAAO,0BAAe,CAAC,wBAAwB,CAAC,WAAW,EAAE;4BAC3D,GAAG,EAAE,IAAI;4BACT,EAAE,IAAA;yBACH,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAC;4BAG3C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;4BAG7D,4CACK,OAAO,KACV,UAAU,YAAA,EACV,cAAc,EAAG,EAAE,CAAC,UAAsC,CAAC,2BAA2B,CAAC,OAAO,CAAW,EACzG,IAAI,EAAE,cAAc,KACpB;;;;KACH;IAED;;;;;;OAMG;IACH,4CAAiB,GAAjB,UAAkB,EAAmB,EAAE,OAAe,EAAE,GAAqB;QAC3E,OAAO,IAAA,WAAI,EAAC;YACV,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,yBAAyB,EAAE;YAC3D,UAAU,EAAE,aAAa;YACzB,IAAI,EAAE,OAAO;YACb,OAAO,SAAA;YACP,OAAO,EAAE,GAAG;SACb,CAAC,CAAC;IACL,CAAC;IACH,uBAAC;AAAD,CAAC,AApMD,CAAsC,gBAAM,GAoM3C;AApMY,4CAAgB"}

package/build/src/entity-sp.js

@@ -32,87 +32,129 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceProvider = void 0;
 exports.default = default_1;
 /**
-* @file entity-sp.ts
-* @author tngan
-* @desc  Declares the actions taken by service provider
-*/
+ * @file entity-sp.ts
+ * @author tngan
+ * @desc Service provider: builds login requests and parses inbound login
+ * responses coming from an identity provider.
+ */
 var entity_1 = __importDefault(require("./entity"));
+var options_1 = require("./options");
 var urn_1 = require("./urn");
 var binding_redirect_1 = __importDefault(require("./binding-redirect"));
 var binding_post_1 = __importDefault(require("./binding-post"));
 var binding_simplesign_1 = __importDefault(require("./binding-simplesign"));
 var flow_1 = require("./flow");
-/*
- * @desc interface function
+/**
+ * Factory returning a new {@link ServiceProvider}. An SP can be built from
+ * an XML metadata document or from a programmatic settings object.
+ *
+ * @param props SP settings
  */
 function default_1(props) {
     return new ServiceProvider(props);
 }
-/**
-* @desc Service provider can be configured using either metadata importing or spSetting
-* @param  {object} spSettingimport { FlowResult } from '../types/src/flow.d';
-
-*/
+/** Service-provider entity. */
 var ServiceProvider = /** @class */ (function (_super) {
     __extends(ServiceProvider, _super);
     /**
-    * @desc  Inherited from Entity
-    * @param {object} spSetting    setting of service provider
-    */
+     * Build an SP with sensible defaults for signing flags.
+     *
+     * @param spSetting SP settings object
+     */
     function ServiceProvider(spSetting) {
         var entitySetting = Object.assign({
             authnRequestsSigned: false,
             wantAssertionsSigned: false,
             wantMessageSigned: false,
         }, spSetting);
+        if (entitySetting.wantMessageSigned && entitySetting.signatureConfig === undefined) {
+            // saml-bindings §3.5 — default signature placement when the SP wants
+            // a signed message but didn't declare where. Matches the fallback the
+            // binding builders already use at sign time, so downstream consumers
+            // (e.g. `getEntitySetting().signatureConfig`) see a populated value
+            // for already-working configurations instead of `undefined`.
+            entitySetting.signatureConfig = {
+                prefix: 'ds',
+                location: {
+                    reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']",
+                    action: 'after',
+                },
+            };
+        }
         return _super.call(this, entitySetting, 'sp') || this;
     }
     /**
-    * @desc  Generates the login request for developers to design their own method
-    * @param  {IdentityProvider} idp               object of identity provider
-    * @param  {string}   binding                   protocol binding
-    * @param  {function} customTagReplacement     used when developers have their own login response template
-    */
-    ServiceProvider.prototype.createLoginRequest = function (idp, binding, customTagReplacement) {
-        if (binding === void 0) { binding = 'redirect'; }
+     * Build a login request targeting the supplied identity provider.
+     *
+     * The third parameter accepts either a callback (legacy shape) or an
+     * options bag `{ relayState?, customTagReplacement? }`. Per
+     * `saml-bindings §3.4.3 / §3.5.3`, RelayState is request-scoped — pass
+     * it via the options bag instead of `entitySetting.relayState`.
+     *
+     * @param idp target identity provider
+     * @param binding `redirect` (default), `post`, or `simpleSign`
+     * @param optionsOrCallback per-request options or a custom-template callback
+     */
+    ServiceProvider.prototype.createLoginRequest = function (idp, binding, optionsOrCallback) {
+        var _a;
+        var opts = (0, options_1.normalizeCreateLoginRequestOptions)(optionsOrCallback);
+        var customTagReplacement = opts.customTagReplacement;
+        var requestRelayState = (_a = opts.relayState) !== null && _a !== void 0 ? _a : this.entitySetting.relayState;
+        // saml-core §3.4.1 — `ForceAuthn` is a per-request boolean flag; when
+        // true the IdP MUST re-authenticate the user instead of relying on a
+        // previous security context (saml-profiles §4.1.4.1).
+        var forceAuthn = opts.forceAuthn;
+        // saml-core §3.4.1 — `AssertionConsumerServiceIndex` is mutually
+        // exclusive with `AssertionConsumerServiceURL` / `ProtocolBinding`.
+        // When set, the binding builders omit both of those attributes so the
+        // request only references the metadata-declared endpoint by index
+        // (saml-profiles §4.1.4.1).
+        var assertionConsumerServiceIndex = opts.assertionConsumerServiceIndex;
+        var selectedBinding = binding !== null && binding !== void 0 ? binding : 'redirect';
         var nsBinding = urn_1.namespace.binding;
-        var protocol = nsBinding[binding];
-        if (this.entityMeta.isAuthnRequestSigned() !== idp.entityMeta.isWantAuthnRequestsSigned()) {
-            throw new Error('ERR_METADATA_CONFLICT_REQUEST_SIGNED_FLAG');
+        var protocol = nsBinding[selectedBinding];
+        // saml-core §3.4.1 / saml-metadata §2.4.4: the SP's `AuthnRequestsSigned`
+        // attribute and the IdP's `WantAuthnRequestsSigned` attribute must agree;
+        // surface both observed values so the operator can tell which side is
+        // misconfigured. The error code stays first so prefix-based handlers
+        // (per saml-conformance §3) keep working.
+        var spSigned = this.entityMeta.isAuthnRequestSigned();
+        var idpWants = idp.entityMeta.isWantAuthnRequestsSigned();
+        if (spSigned !== idpWants) {
+            throw new Error("ERR_METADATA_CONFLICT_REQUEST_SIGNED_FLAG: SP AuthnRequestsSigned=".concat(spSigned, " but IdP WantAuthnRequestsSigned=").concat(idpWants));
         }
         var context = null;
         switch (protocol) {
             case nsBinding.redirect:
-                return binding_redirect_1.default.loginRequestRedirectURL({ idp: idp, sp: this }, customTagReplacement);
+                return binding_redirect_1.default.loginRequestRedirectURL({ idp: idp, sp: this }, customTagReplacement, requestRelayState, forceAuthn, assertionConsumerServiceIndex);
             case nsBinding.post:
-                context = binding_post_1.default.base64LoginRequest("/*[local-name(.)='AuthnRequest']", { idp: idp, sp: this }, customTagReplacement);
+                context = binding_post_1.default.base64LoginRequest("/*[local-name(.)='AuthnRequest']", { idp: idp, sp: this }, customTagReplacement, forceAuthn, assertionConsumerServiceIndex);
                 break;
             case nsBinding.simpleSign:
-                // Object context = {id, context, signature, sigAlg}
-                context = binding_simplesign_1.default.base64LoginRequest({ idp: idp, sp: this }, customTagReplacement);
+                context = binding_simplesign_1.default.base64LoginRequest({ idp: idp, sp: this }, customTagReplacement, requestRelayState, forceAuthn, assertionConsumerServiceIndex);
                 break;
             default:
-                // Will support artifact in the next release
                 throw new Error('ERR_SP_LOGIN_REQUEST_UNDEFINED_BINDING');
         }
-        return __assign(__assign({}, context), { relayState: this.entitySetting.relayState, entityEndpoint: idp.entityMeta.getSingleSignOnService(binding), type: 'SAMLRequest' });
+        return __assign(__assign({}, context), { relayState: requestRelayState, entityEndpoint: idp.entityMeta.getSingleSignOnService(selectedBinding), type: 'SAMLRequest' });
     };
     /**
-    * @desc   Validation of the parsed the URL parameters
-    * @param  {IdentityProvider}   idp             object of identity provider
-    * @param  {string}   binding                   protocol binding
-    * @param  {request}   req                      request
-    */
+     * Parse, validate and verify an inbound login response.
+     *
+     * @param idp identity provider that produced the response
+     * @param binding `redirect`, `post`, or `simpleSign`
+     * @param request HTTP request envelope
+     */
     ServiceProvider.prototype.parseLoginResponse = function (idp, binding, request) {
-        var self = this;
         return (0, flow_1.flow)({
             from: idp,
-            self: self,
-            checkSignature: true, // saml response must have signature
+            self: this,
+            // SAML response is always required to be signed.
+            checkSignature: true,
             parserType: 'SAMLResponse',
             type: 'login',
             binding: binding,
-            request: request
+            request: request,
         });
     };
     return ServiceProvider;

package/build/src/entity-sp.js.map

@@ -1 +1 @@
-{"version":3,"file":"entity-sp.js","sourceRoot":"","sources":["../../src/entity-sp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,4BAEC;AA3BD;;;;EAIE;AACF,oDAKkB;AAMlB,6BAAkC;AAClC,wEAAiD;AACjD,gEAAyC;AACzC,4EAAqD;AACrD,+BAA0C;AAE1C;;GAEG;AACH,mBAAwB,KAA8B;IACpD,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED;;;;EAIE;AACF;IAAqC,mCAAM;IAGzC;;;MAGE;IACF,yBAAY,SAAkC;QAC5C,IAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;YAClC,mBAAmB,EAAE,KAAK;YAC1B,oBAAoB,EAAE,KAAK;YAC3B,iBAAiB,EAAE,KAAK;SACzB,EAAE,SAAS,CAAC,CAAC;QACd,OAAA,MAAK,YAAC,aAAa,EAAE,IAAI,CAAC,SAAC;IAC7B,CAAC;IAED;;;;;MAKE;IACK,4CAAkB,GAAzB,UACE,GAAqB,EACrB,OAAoB,EACpB,oBAA2D;QAD3D,wBAAA,EAAA,oBAAoB;QAGpB,IAAM,SAAS,GAAG,eAAS,CAAC,OAAO,CAAC;QACpC,IAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,KAAK,GAAG,CAAC,UAAU,CAAC,yBAAyB,EAAE,EAAE,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,OAAO,GAAQ,IAAI,CAAC;QACxB,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,SAAS,CAAC,QAAQ;gBACrB,OAAO,0BAAe,CAAC,uBAAuB,CAAC,EAAE,GAAG,KAAA,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAE1F,KAAK,SAAS,CAAC,IAAI;gBACjB,OAAO,GAAG,sBAAW,CAAC,kBAAkB,CAAC,kCAAkC,EAAE,EAAE,GAAG,KAAA,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;gBACtH,MAAM;YAER,KAAK,SAAS,CAAC,UAAU;gBACvB,oDAAoD;gBACpD,OAAO,GAAG,4BAAiB,CAAC,kBAAkB,CAAE,EAAE,GAAG,KAAA,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;gBACzF,MAAM;YAER;gBACE,4CAA4C;gBAC5C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC9D,CAAC;QAED,6BACK,OAAO,KACV,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,UAAU,EACzC,cAAc,EAAE,GAAG,CAAC,UAAU,CAAC,sBAAsB,CAAC,OAAO,CAAW,EACxE,IAAI,EAAE,aAAa,IACnB;IACJ,CAAC;IAED;;;;;MAKE;IACK,4CAAkB,GAAzB,UAA0B,GAAG,EAAE,OAAO,EAAE,OAAyB;QAC/D,IAAM,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,IAAA,WAAI,EAAC;YACV,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,IAAI,EAAE,oCAAoC;YAC1D,UAAU,EAAE,cAAc;YAC1B,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;IACL,CAAC;IAEH,sBAAC;AAAD,CAAC,AA/ED,CAAqC,gBAAM,GA+E1C;AA/EY,0CAAe"}
+{"version":3,"file":"entity-sp.js","sourceRoot":"","sources":["../../src/entity-sp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,4BAEC;AAjCD;;;;;GAKG;AACH,oDAA8B;AAY9B,qCAA+D;AAC/D,6BAAkC;AAClC,wEAAiD;AACjD,gEAAyC;AACzC,4EAAqD;AACrD,+BAA8B;AAE9B;;;;;GAKG;AACH,mBAAyB,KAA8B;IACrD,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,+BAA+B;AAC/B;IAAqC,mCAAM;IAGzC;;;;OAIG;IACH,yBAAY,SAAkC;QAC5C,IAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;YAClC,mBAAmB,EAAE,KAAK;YAC1B,oBAAoB,EAAE,KAAK;YAC3B,iBAAiB,EAAE,KAAK;SACzB,EAAE,SAAS,CAAC,CAAC;QACd,IAAI,aAAa,CAAC,iBAAiB,IAAI,aAAa,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACnF,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,6DAA6D;YAC7D,aAAa,CAAC,eAAe,GAAG;gBAC9B,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE;oBACR,SAAS,EAAE,wDAAwD;oBACnE,MAAM,EAAE,OAAO;iBAChB;aACF,CAAC;QACJ,CAAC;QACD,OAAA,MAAK,YAAC,aAAa,EAAE,IAAI,CAAC,SAAC;IAC7B,CAAC;IAED;;;;;;;;;;;OAWG;IACI,4CAAkB,GAAzB,UACE,GAAqB,EACrB,OAAgB,EAChB,iBAAoE;;QAEpE,IAAM,IAAI,GAAG,IAAA,4CAAkC,EAAC,iBAAiB,CAAC,CAAC;QACnE,IAAM,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACvD,IAAM,iBAAiB,GAAG,MAAA,IAAI,CAAC,UAAU,mCAAI,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,sDAAsD;QACtD,IAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,iEAAiE;QACjE,oEAAoE;QACpE,sEAAsE;QACtE,kEAAkE;QAClE,4BAA4B;QAC5B,IAAM,6BAA6B,GAAG,IAAI,CAAC,6BAA6B,CAAC;QACzE,IAAM,eAAe,GAAG,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,UAAU,CAAC;QAE9C,IAAM,SAAS,GAAG,eAAS,CAAC,OAAO,CAAC;QACpC,IAAM,QAAQ,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;QAC5C,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,qEAAqE;QACrE,0CAA0C;QAC1C,IAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;QACxD,IAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,yBAAyB,EAAE,CAAC;QAC5D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,4EAAqE,QAAQ,8CAAoC,QAAQ,CAAE,CAC5H,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,GAAqD,IAAI,CAAC;QACrE,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,SAAS,CAAC,QAAQ;gBACrB,OAAO,0BAAe,CAAC,uBAAuB,CAC5C,EAAE,GAAG,KAAA,EAAE,EAAE,EAAE,IAAI,EAAE,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,UAAU,EACV,6BAA6B,CAC9B,CAAC;YAEJ,KAAK,SAAS,CAAC,IAAI;gBACjB,OAAO,GAAG,sBAAW,CAAC,kBAAkB,CACtC,kCAAkC,EAClC,EAAE,GAAG,KAAA,EAAE,EAAE,EAAE,IAAI,EAAE,EACjB,oBAAoB,EACpB,UAAU,EACV,6BAA6B,CAC9B,CAAC;gBACF,MAAM;YAER,KAAK,SAAS,CAAC,UAAU;gBACvB,OAAO,GAAG,4BAAiB,CAAC,kBAAkB,CAC5C,EAAE,GAAG,KAAA,EAAE,EAAE,EAAE,IAAI,EAAE,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,UAAU,EACV,6BAA6B,CACF,CAAC;gBAC9B,MAAM;YAER;gBACE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC9D,CAAC;QAED,6BACK,OAAO,KACV,UAAU,EAAE,iBAAiB,EAC7B,cAAc,EAAE,GAAG,CAAC,UAAU,CAAC,sBAAsB,CAAC,eAAe,CAAW,EAChF,IAAI,EAAE,aAAa,IACnB;IACJ,CAAC;IAED;;;;;;OAMG;IACI,4CAAkB,GAAzB,UAA0B,GAAqB,EAAE,OAAe,EAAE,OAAyB;QACzF,OAAO,IAAA,WAAI,EAAC;YACV,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,IAAI;YACV,iDAAiD;YACjD,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,cAAc;YAC1B,IAAI,EAAE,OAAO;YACb,OAAO,SAAA;YACP,OAAO,SAAA;SACR,CAAC,CAAC;IACL,CAAC;IACH,sBAAC;AAAD,CAAC,AA5ID,CAAqC,gBAAM,GA4I1C;AA5IY,0CAAe"}