snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/lib/saml/definition/IAttributeMapping.ts

@@ -0,0 +1,16 @@
+export interface IAttributeMapping {
+	fieldName: string | Array<string>;
+	regex?: string;
+	template?: string;
+}
+
+export interface IUserDataMap {
+	attributeList: Set<string>;
+	identifier: {
+		type: string;
+		attribute?: string;
+	};
+	email: IAttributeMapping;
+	username: IAttributeMapping;
+	name: IAttributeMapping;
+}

apps/meteor/server/lib/saml/definition/IAuthorizeRequestVariables.ts

@@ -0,0 +1,10 @@
+export interface IAuthorizeRequestVariables extends Record<string, string> {
+	newId: string;
+	instant: string;
+	callbackUrl: string;
+	entryPoint: string;
+	issuer: string;
+	identifierFormat: string;
+	authnContextComparison: string;
+	authnContext: string;
+}

apps/meteor/server/lib/saml/definition/ILogoutRequestVariables.ts

@@ -0,0 +1,9 @@
+export interface ILogoutRequestVariables extends Record<string, string> {
+	newId: string;
+	instant: string;
+	idpSLORedirectURL: string;
+	issuer: string;
+	identifierFormat: string;
+	nameID: string;
+	sessionIndex: string;
+}

apps/meteor/server/lib/saml/definition/ILogoutResponse.ts

@@ -0,0 +1,5 @@
+export interface ILogoutResponse {
+	id: string;
+	response: string;
+	inResponseToId: string;
+}

apps/meteor/server/lib/saml/definition/ILogoutResponseVariables.ts

@@ -0,0 +1,10 @@
+export interface ILogoutResponseVariables extends Record<string, string> {
+	newId: string;
+	instant: string;
+	idpSLORedirectURL: string;
+	issuer: string;
+	identifierFormat: string;
+	nameID: string;
+	sessionIndex: string;
+	inResponseToId: string;
+}

apps/meteor/server/lib/saml/definition/IMetadataVariables.ts

@@ -0,0 +1,7 @@
+export interface IMetadataVariables extends Record<string, string> {
+	issuer: string;
+	certificate: string;
+	identifierFormat: string;
+	callbackUrl: string;
+	sloLocation: string;
+}

apps/meteor/server/lib/saml/definition/ISAMLAction.ts

@@ -0,0 +1,5 @@
+export interface ISAMLAction {
+	actionName: string;
+	serviceName: string;
+	credentialToken: string;
+}

apps/meteor/server/lib/saml/definition/ISAMLAssertion.ts

@@ -0,0 +1,4 @@
+export interface ISAMLAssertion {
+	assertion: Element;
+	xml: string;
+}

apps/meteor/server/lib/saml/definition/ISAMLGlobalSettings.ts

@@ -0,0 +1,11 @@
+export interface ISAMLGlobalSettings {
+	generateUsername: boolean;
+	nameOverwrite: boolean;
+	mailOverwrite: boolean;
+	immutableProperty: string;
+	defaultUserRole: string;
+	userDataFieldMap: string;
+	usernameNormalize: string;
+	channelsAttributeUpdate: boolean;
+	includePrivateChannelsInUpdate: boolean;
+}

apps/meteor/server/lib/saml/definition/ISAMLRequest.ts

@@ -0,0 +1,4 @@
+export interface ISAMLRequest {
+	id: string;
+	request: string;
+}

apps/meteor/server/lib/saml/definition/ISAMLUser.ts

@@ -0,0 +1,22 @@
+export interface ISAMLUser {
+	emailList: Array<string>;
+	fullName: string | null;
+	roles?: Array<string>;
+	eppn: string | null;
+
+	username?: string;
+	language?: string;
+	channels?: Array<string>;
+	samlLogin: {
+		provider: string | null;
+		idp: string;
+		idpSession: string;
+		nameID: string;
+	};
+
+	attributeList: Map<string, any>;
+	identifier: {
+		type: string;
+		attribute?: string;
+	};
+}

apps/meteor/server/lib/saml/definition/IServiceProviderOptions.ts

@@ -0,0 +1,28 @@
+import type { SAMLSignatureAlgorithm } from '@rocket.chat/core-typings';
+
+export interface IServiceProviderOptions {
+	provider: string;
+	entryPoint: string;
+	idpSLORedirectURL: string;
+	issuer: string;
+	cert: string;
+	privateCert: string;
+	privateKey: string;
+	signatureAlgorithm: SAMLSignatureAlgorithm;
+	customAuthnContext: string;
+	authnContextComparison: string;
+	defaultUserRole: string;
+	allowedClockDrift: number;
+	signatureValidationType: string;
+	validateLogoutRequestSignature: boolean;
+	validateLogoutResponseSignature: boolean;
+	identifierFormat: string;
+	nameIDPolicyTemplate: string;
+	authnContextTemplate: string;
+	authRequestTemplate: string;
+	logoutResponseTemplate: string;
+	logoutRequestTemplate: string;
+	metadataCertificateTemplate: string;
+	metadataTemplate: string;
+	callbackUrl: string;
+}

apps/meteor/server/lib/saml/definition/SAMLEnvelope.ts

@@ -0,0 +1,43 @@
+// Other binding values are not supported: HTTP-Artifact, URI, SOAP, PAOS
+export type SAMLBinding = 'HTTP-Redirect' | 'HTTP-POST';
+
+export type SAMLDocumentType = 'SAMLRequest' | 'SAMLResponse';
+
+export type SAMLBaseEnvelope<T extends SAMLDocumentType = SAMLDocumentType> = {
+	binding: SAMLBinding;
+	/**
+	 * encodedDocument is the document in the exact format we received it
+	 * */
+	encodedDocument: string;
+	/**
+	 * decodedDocument is the raw XML file; processed according to the binding specification
+	 * */
+	decodedDocument: string;
+	type: T;
+	relayState?: string;
+};
+
+/**
+ * HTTP-Redirect envelope
+ * For this binding, the document must be a Deflated XML file that is then base64 encoded
+ **/
+export type SAMLRedirectEnvelope<T extends SAMLDocumentType = SAMLDocumentType> = SAMLBaseEnvelope<T> & {
+	binding: 'HTTP-Redirect';
+	sigAlg?: string;
+	signature?: string;
+
+	/**
+	 * signedContent is the complete string value that must be matched by the signature
+	 * */
+	signedContent?: string;
+};
+
+/**
+ * HTTP-POST envelope
+ * For this binding, the document must be a regular XML file that is base64 encoded
+ **/
+export type SAMLPOSTEnvelope<T extends SAMLDocumentType = SAMLDocumentType> = SAMLBaseEnvelope<T> & {
+	binding: 'HTTP-POST';
+};
+
+export type SAMLEnvelope<T extends SAMLDocumentType = SAMLDocumentType> = SAMLRedirectEnvelope<T> | SAMLPOSTEnvelope<T>;

apps/meteor/server/lib/saml/definition/callbacks.ts

@@ -0,0 +1,11 @@
+export interface ILogoutRequestValidateCallback {
+	(err: string | object | null, data?: Record<string, string | null> | null): Promise<void>;
+}
+
+export interface ILogoutResponseValidateCallback {
+	(err: string | object | null, inResponseTo?: string | null): Promise<void>;
+}
+
+export interface IResponseValidateCallback {
+	(err: string | object | null, profile?: Record<string, any> | null, loggedOut?: boolean): void;
+}