123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470
import { inflateString, base64Decode, isNonEmptyArray } from './utility';import { verifyTime } from './validator';import libsaml from './libsaml';import {  extract,  loginRequestFields,  loginResponseFields,  logoutRequestFields,  logoutResponseFields,  ExtractorFields,  logoutResponseStatusFields,  loginResponseStatusFields} from './extractor';
import {  BindingNamespace,  ParserType,  wording,  MessageSignatureOrder,  StatusCode} from './urn';import simpleSignBinding from './binding-simplesign';
const bindDict = wording.binding;const urlParams = wording.urlParams;
export interface FlowResult {  samlContent: string;  extract: any;  sigAlg?: string|null ;}
// get the default extractor fields based on the parserTypefunction getDefaultExtractorFields(parserType: ParserType, assertion?: any): ExtractorFields {  switch (parserType) {    case ParserType.SAMLRequest:      return loginRequestFields;    case ParserType.SAMLResponse:      if (!assertion) {        // unexpected hit        throw new Error('ERR_EMPTY_ASSERTION');      }      return loginResponseFields(assertion);    case ParserType.LogoutRequest:      return logoutRequestFields;    case ParserType.LogoutResponse:      return logoutResponseFields;    default:      throw new Error('ERR_UNDEFINED_PARSERTYPE');  }}
// proceed the redirect binding flowasync function redirectFlow(options): Promise<FlowResult>  {
  const { request, parserType, self, checkSignature = true, from } = options;  const { query, octetString } = request;  const { SigAlg: sigAlg, Signature: signature } = query;
  const targetEntityMetadata = from.entityMeta;
  // ?SAMLRequest= or ?SAMLResponse=  const direction = libsaml.getQueryParamByType(parserType);  const content = query[direction];
  // query must contain the saml content  if (content === undefined) {    return Promise.reject('ERR_REDIRECT_FLOW_BAD_ARGS');  }
  const xmlString = inflateString(decodeURIComponent(content));
  // validate the xml  try {    await libsaml.isValidXml(xmlString);  } catch (e) {    return Promise.reject('ERR_INVALID_XML');  }
  // check status based on different scenarios  await checkStatus(xmlString, parserType);
  let assertion: string = '';
  if (parserType === urlParams.samlResponse){    // Extract assertion shortcut    const verifiedDoc = extract(xmlString, [{      key: 'assertion',      localPath: ['~Response', 'Assertion'],      attributes: [],      context: true    }]);    if (verifiedDoc && verifiedDoc.assertion){      assertion = verifiedDoc.assertion as string;    }  }
  const extractorFields = getDefaultExtractorFields(parserType, assertion.length > 0 ? assertion : null);
  const parseResult: { samlContent: string, extract: any, sigAlg: (string | null) } = {    samlContent: xmlString,    sigAlg: null,    extract: extract(xmlString, extractorFields),  };
  // see if signature check is required  // only verify message signature is enough  if (checkSignature) {    if (!signature || !sigAlg) {      return Promise.reject('ERR_MISSING_SIG_ALG');    }
    // put the below two assignemnts into verifyMessageSignature function    const base64Signature = Buffer.from(decodeURIComponent(signature), 'base64');    const decodeSigAlg = decodeURIComponent(sigAlg);
    const verified = libsaml.verifyMessageSignature(targetEntityMetadata, octetString, base64Signature, sigAlg);
    if (!verified) {      // Fail to verify message signature      return Promise.reject('ERR_FAILED_MESSAGE_SIGNATURE_VERIFICATION');    }
    parseResult.sigAlg = decodeSigAlg;  }
  /**   *  Validation part: validate the context of response after signature is verified and decrpyted (optional)   */  const issuer = targetEntityMetadata.getEntityID();  const extractedProperties = parseResult.extract;
  // unmatched issuer  if (    (parserType === 'LogoutResponse' || parserType === 'SAMLResponse')    && extractedProperties    && extractedProperties.issuer !== issuer  ) {    return Promise.reject('ERR_UNMATCH_ISSUER');  }
  // invalid session time  // only run the verifyTime when `SessionNotOnOrAfter` exists  if (    parserType === 'SAMLResponse'    && extractedProperties.sessionIndex.sessionNotOnOrAfter    && !verifyTime(      undefined,      extractedProperties.sessionIndex.sessionNotOnOrAfter,      self.entitySetting.clockDrifts    )  ) {    return Promise.reject('ERR_EXPIRED_SESSION');  }
  // invalid time  // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf  if (    parserType === 'SAMLResponse'    && extractedProperties.conditions    && !verifyTime(      extractedProperties.conditions.notBefore,      extractedProperties.conditions.notOnOrAfter,      self.entitySetting.clockDrifts    )  ) {    return Promise.reject('ERR_SUBJECT_UNCONFIRMED');  }
  return Promise.resolve(parseResult);}
// proceed the post flowasync function postFlow(options): Promise<FlowResult> {
  const {    request,    from,    self,    parserType,    checkSignature = true  } = options;
  const { body } = request;
  const direction = libsaml.getQueryParamByType(parserType);  const encodedRequest = body[direction];
  let samlContent = String(base64Decode(encodedRequest));
  const verificationOptions = {    metadata: from.entityMeta,    signatureAlgorithm: from.entitySetting.requestSignatureAlgorithm,  };
  const decryptRequired = from.entitySetting.isAssertionEncrypted;
  let extractorFields: ExtractorFields = [];
  // validate the xml first  await libsaml.isValidXml(samlContent);
  if (parserType !== urlParams.samlResponse) {    extractorFields = getDefaultExtractorFields(parserType, null);  }
  // check status based on different scenarios  await checkStatus(samlContent, parserType);
  // verify the signatures (the repsonse is encrypted then signed, then verify first then decrypt)  if (    checkSignature &&    from.entitySetting.messageSigningOrder === MessageSignatureOrder.ETS  ) {    const [verified, verifiedAssertionNode] = libsaml.verifySignature(samlContent, verificationOptions);    if (!verified) {      return Promise.reject('ERR_FAIL_TO_VERIFY_ETS_SIGNATURE');    }    if (!decryptRequired) {      extractorFields = getDefaultExtractorFields(parserType, verifiedAssertionNode);    }  }
  if (parserType === 'SAMLResponse' && decryptRequired) {    const result = await libsaml.decryptAssertion(self, samlContent);    samlContent = result[0];    extractorFields = getDefaultExtractorFields(parserType, result[1]);  }
  // verify the signatures (the repsonse is signed then encrypted, then decrypt first then verify)  if (    checkSignature &&    from.entitySetting.messageSigningOrder === MessageSignatureOrder.STE  ) {    const [verified, verifiedAssertionNode] = libsaml.verifySignature(samlContent, verificationOptions);    if (verified) {      extractorFields = getDefaultExtractorFields(parserType, verifiedAssertionNode);    } else {      return Promise.reject('ERR_FAIL_TO_VERIFY_STE_SIGNATURE');    }  }
  const parseResult = {    samlContent: samlContent,    extract: extract(samlContent, extractorFields),  };
  /**   *  Validation part: validate the context of response after signature is verified and decrpyted (optional)   */  const targetEntityMetadata = from.entityMeta;  const issuer = targetEntityMetadata.getEntityID();  const extractedProperties = parseResult.extract;
  // unmatched issuer  if (    (parserType === 'LogoutResponse' || parserType === 'SAMLResponse')    && extractedProperties    && extractedProperties.issuer !== issuer  ) {    return Promise.reject('ERR_UNMATCH_ISSUER');  }
  // invalid session time  // only run the verifyTime when `SessionNotOnOrAfter` exists  if (    parserType === 'SAMLResponse'    && extractedProperties.sessionIndex.sessionNotOnOrAfter    && !verifyTime(      undefined,      extractedProperties.sessionIndex.sessionNotOnOrAfter,      self.entitySetting.clockDrifts    )  ) {    return Promise.reject('ERR_EXPIRED_SESSION');  }
  // invalid time  // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf  if (    parserType === 'SAMLResponse'    && extractedProperties.conditions    && !verifyTime(      extractedProperties.conditions.notBefore,      extractedProperties.conditions.notOnOrAfter,      self.entitySetting.clockDrifts    )  ) {    return Promise.reject('ERR_SUBJECT_UNCONFIRMED');  }
  return Promise.resolve(parseResult);}

// proceed the post simple sign binding flowasync function postSimpleSignFlow(options): Promise<FlowResult> {
  const { request, parserType, self, checkSignature = true, from } = options;
  const { body, octetString } = request;
  const targetEntityMetadata = from.entityMeta;
  // ?SAMLRequest= or ?SAMLResponse=  const direction = libsaml.getQueryParamByType(parserType);  const encodedRequest: string = body[direction];  const sigAlg: string = body['SigAlg'];  const signature: string = body['Signature'];
  // query must contain the saml content  if (encodedRequest === undefined) {    return Promise.reject('ERR_SIMPLESIGN_FLOW_BAD_ARGS');  }
  const xmlString = String(base64Decode(encodedRequest));
  // validate the xml  try {    await libsaml.isValidXml(xmlString);  } catch (e) {    return Promise.reject('ERR_INVALID_XML');  }
  // check status based on different scenarios  await checkStatus(xmlString, parserType);
  let assertion: string = '';
  if (parserType === urlParams.samlResponse){    // Extract assertion shortcut    const verifiedDoc = extract(xmlString, [{      key: 'assertion',      localPath: ['~Response', 'Assertion'],      attributes: [],      context: true    }]);    if (verifiedDoc && verifiedDoc.assertion){      assertion = verifiedDoc.assertion as string;    }  }
  const extractorFields = getDefaultExtractorFields(parserType, assertion.length > 0 ? assertion : null);
  const parseResult: { samlContent: string, extract: any, sigAlg: (string | null) } = {    samlContent: xmlString,    sigAlg: null,    extract: extract(xmlString, extractorFields),  };
  // see if signature check is required  // only verify message signature is enough  if (checkSignature) {    if (!signature || !sigAlg) {      return Promise.reject('ERR_MISSING_SIG_ALG');    }
    // put the below two assignemnts into verifyMessageSignature function    const base64Signature = Buffer.from(signature, 'base64');
    const verified = libsaml.verifyMessageSignature(targetEntityMetadata, octetString, base64Signature, sigAlg);
    if (!verified) {      // Fail to verify message signature      return Promise.reject('ERR_FAILED_MESSAGE_SIGNATURE_VERIFICATION');    }
    parseResult.sigAlg = sigAlg;  }
  /**   *  Validation part: validate the context of response after signature is verified and decrpyted (optional)   */  const issuer = targetEntityMetadata.getEntityID();  const extractedProperties = parseResult.extract;
  // unmatched issuer  if (    (parserType === 'LogoutResponse' || parserType === 'SAMLResponse')    && extractedProperties    && extractedProperties.issuer !== issuer  ) {    return Promise.reject('ERR_UNMATCH_ISSUER');  }
  // invalid session time  // only run the verifyTime when `SessionNotOnOrAfter` exists  if (    parserType === 'SAMLResponse'    && extractedProperties.sessionIndex.sessionNotOnOrAfter    && !verifyTime(      undefined,      extractedProperties.sessionIndex.sessionNotOnOrAfter,      self.entitySetting.clockDrifts    )  ) {    return Promise.reject('ERR_EXPIRED_SESSION');  }
  // invalid time  // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf  if (    parserType === 'SAMLResponse'    && extractedProperties.conditions    && !verifyTime(      extractedProperties.conditions.notBefore,      extractedProperties.conditions.notOnOrAfter,      self.entitySetting.clockDrifts    )  ) {    return Promise.reject('ERR_SUBJECT_UNCONFIRMED');  }
  return Promise.resolve(parseResult);}

function checkStatus(content: string, parserType: string): Promise<string> {
  // only check response parser  if (parserType !== urlParams.samlResponse && parserType !== urlParams.logoutResponse) {    return Promise.resolve('SKIPPED');  }
  const fields = parserType === urlParams.samlResponse    ? loginResponseStatusFields    : logoutResponseStatusFields;
  const {top, second} = extract(content, fields);
  // only resolve when top-tier status code is success  if (top === StatusCode.Success) {    return Promise.resolve('OK');  }
  if (!top) {    throw new Error('ERR_UNDEFINED_STATUS');  }
  // returns a detailed error for two-tier error code  throw new Error(`ERR_FAILED_STATUS with top tier code: ${top}, second tier code: ${second}`);}
export function flow(options): Promise<FlowResult> {
  const binding = options.binding;  const parserType = options.parserType;
  options.supportBindings = [BindingNamespace.Redirect, BindingNamespace.Post, BindingNamespace.SimpleSign];  // saml response  allows POST, REDIRECT  if (parserType === ParserType.SAMLResponse) {    options.supportBindings = [BindingNamespace.Post, BindingNamespace.Redirect, BindingNamespace.SimpleSign];  }
  if (binding === bindDict.post) {    return postFlow(options);  }
  if (binding === bindDict.redirect) {    return redirectFlow(options);  }
  if (binding === bindDict.simpleSign) {    return postSimpleSignFlow(options);  }
  return Promise.reject('ERR_UNEXPECTED_FLOW');
}