1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[70994],{16436:(e,t,n)=>{n.d(t,{k:()=>a});let s=e=>" "===e||" "===e||"\n"===e||"\r"===e;function a(e,t){let n=e.length,a=t+4,i=">"===e[a]?"\x3c!--\x3e":"-"===e[a]&&">"===e[a+1]?"\x3c!---\x3e":null,r=(e,n)=>null===i?{ok:!1,at:e,message:n}:{ok:!1,at:t,message:`"${i}" is an empty comment in HTML, but XML has no rule that closes a comment on a bare ">". This one is still open, so everything after it, including any real markup, is read as comment text. Write "<!---->" for an empty comment, or delete it.`},l=a;for(;l+2<n;){if("-"===e[l]&&"-"===e[l+1]){if(">"===e[l+2])return{ok:!0,end:l+3,body:e.slice(a,l)};let t="-"===e[l+2]?l+3:l+2,n="-"===e[l+2]&&">"===e[l+3];return r(l,n?'a comment ends with "---\x3e". XML does not allow the text of a comment to finish with a "-", so the closing marker has to be exactly "--\x3e". Remove the extra dash.':`"${e.slice(l,t)}" appears inside a comment. XML does not allow "--" in comment text at all. It is only ever the start of the closing "-->". Use an en dash, a single hyphen, or split it into two comments.`)}l+=1}let o=a;for(;o<n&&s(e[o]);)o+=1;let d=(e.slice(o).split("\n")[0]??"").trimEnd(),u=d.length>30?`${d.slice(0,30)}â¦`:d;return r(t,`a comment starts here${u?` ("${u}")`:""} and is never closed with "-->". Add the closing marker, or delete the "<!--".`)}},70994:(e,t,n)=>{n.r(t),n.d(t,{BASES:()=>G,MAX_EXPECTED:()=>ee,SHARE_KEYS:()=>Q,basisFromParams:()=>es,buildShareLink:()=>et,default:()=>eu,expectedFromParams:()=>ei,groupsFromParams:()=>ea,samlModel:()=>er,skewFromParams:()=>en});var s=n(45993),a=n(75837),i=n(84796),r=n(51390),l=n(73950),o=n(77771),d=n(30845),u=n(35323),c=n(41945),h=n(99935),m=n(22925),p=n(95521),g=n(17832);let f=/^[A-Za-z0-9+/=\s-_]+$/,x=["SAMLResponse","SAMLRequest"];function b(e){return e.trimStart().startsWith("<")}async function w(e){try{let t=new Blob([e]).stream().pipeThrough(new DecompressionStream("deflate-raw")),n=await new Response(t).arrayBuffer();return new Uint8Array(n)}catch{return null}}let y=e=>new TextDecoder("utf-8").decode(e);function v(e,t,n){return{xml:"",steps:n,paramName:null,relayState:null,sigAlg:null,detachedSignature:!1,refusal:{kind:e,detail:t}}}async function S(e){let t=[];if(""===e.trim())return v("empty","nothing was pasted",t);if(e.length>4e5)return v("too-long","the box takes "+4e5.toLocaleString("en-US")+" characters and this is "+e.length.toLocaleString("en-US")+". Nothing was decoded",t);let n=function(e){let t=t=>{let n=RegExp("[?&#\\s]"+t+"=([^&#]*)").exec("?"+e);return null===n?null:(n[1]??"").replace(/[\r\n\t]+/g,"").trimEnd()};for(let e of x){let n=t(e);if(null!==n&&""!==n)return{found:!0,name:e,value:n,relayState:t("RelayState"),sigAlg:t("SigAlg"),detachedSignature:null!==t("Signature")}}return{found:!1,name:null,value:e,relayState:null,sigAlg:null,detachedSignature:!1}}(e.trim()),s=n.value;n.found&&t.push({kind:"query-param",detail:"read the "+String(n.name)+" parameter off the "+(e.includes("://")?"URL":"query string")});let a={paramName:n.name,relayState:null===n.relayState?null:k(n.relayState)??n.relayState,sigAlg:null===n.sigAlg?null:k(n.sigAlg)??n.sigAlg,detachedSignature:n.detachedSignature};if(/%[0-9A-Fa-f]{2}/.test(s)){let e=k(s);if(null===e)return v("not-base64","the percent encoding in the value is not valid",t);t.push({kind:"percent-decode",detail:"undid the percent encoding"}),s=e}if(n.found&&(s=s.replace(/ /g,"+")),b(s))return t.push({kind:"already-xml",detail:"the input was XML already"}),N(s,t,a);if(!f.test(s))return v("not-base64",'this is neither XML nor base64. A SAML message starts with a "<" or is base64 of one',t);let i=function(e){let t=e.replace(/\s+/g,"").replace(/-/g,"+").replace(/_/g,"/");if(""===t)return{bytes:null,detail:"nothing left after the whitespace was removed"};let n=/[^A-Za-z0-9+/=]/.exec(t);if(null!==n)return{bytes:null,detail:"the character "+JSON.stringify(n[0]??"")+" at position "+String(n.index+1)+" is not base64"};let s=t.length%4==0?t:t+"=".repeat(4-t.length%4);try{let e=atob(s),t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n);
1return{bytes:t,detail:String(t.length)+" bytes"}}catch{return{bytes:null,detail:"the value is not a whole number of base64 groups"}}}(s);if(null===i.bytes)return v("base64-failed",i.detail,t);t.push({kind:"base64",detail:"base64 decoded to "+i.detail});let r=y(i.bytes);if(b(r))return N(r,t,a);let l=await w(i.bytes);if(null===l)return v("inflate-failed","the base64 decoded cleanly but the bytes are neither XML nor a raw DEFLATE stream",t);t.push({kind:"inflate-raw",detail:"raw DEFLATE inflated "+String(i.bytes.length)+" bytes to "+String(l.length)});let o=y(l);return b(o)?N(o,t,a):v("not-xml",'the stream inflated but what came out does not start with a "<"',t)}function N(e,t,n){return e.length>4e6?v("xml-too-long","the document is "+e.length.toLocaleString("en-US")+" characters, past the "+4e6.toLocaleString("en-US")+" this page reads. Nothing was read",t):{xml:e,steps:t,refusal:null,...n}}function k(e){try{return decodeURIComponent(e.replace(/\+/g," "))}catch{return null}}var j=n(56504),A=n(38379),M=n(16436);let C=new Set([" "," ","\n","\r",">","/"]);function I(e,t){let n=t;for(;n<e.length;){let t=e.charAt(n);if(C.has(t))break;n++}return e.slice(t,n)}function T(e){let t=e.indexOf(":");return -1===t?e:e.slice(t+1)}function L(e){return R(e).tokens}function R(e){let t=[],n=null,s=0;for(;s<e.length;){let a=e.indexOf("<",s);if(-1===a){t.push({kind:"text",start:s,end:e.length,name:"",local:""});break}if(a>s){t.push({kind:"text",start:s,end:a,name:"",local:""}),s=a;continue}if(e.startsWith("\x3c!--",s)){let a=(0,M.k)(e,s);if(a.ok){t.push({kind:"comment",start:s,end:a.end,name:"",local:""}),s=a.end;continue}null===n&&(n={at:a.at,message:a.message}),t.push({kind:"text",start:s,end:s+4,name:"",local:""}),s+=4;continue}if(e.startsWith("<![CDATA[",s)){let n=e.indexOf("]]>",s+9),a=-1===n?e.length:n+3;t.push({kind:"cdata",start:s,end:a,name:"",local:""}),s=a;continue}if(e.startsWith("<?",s)){let n=e.indexOf("?>",s+2),a=-1===n?e.length:n+2;t.push({kind:"pi",start:s,end:a,name:"",local:""}),s=a;continue}if(e.startsWith("<!",s)){let n=O(e,s+2);t.push({kind:"doctype",start:s,end:n,name:"",local:""}),s=n;continue}if(e.startsWith("</",s)){let n=I(e,s+2),a=O(e,s+2);t.push({kind:"close",start:s,end:a,name:n,local:T(n)}),s=a;continue}let i=I(e,s+1);if(""===i){t.push({kind:"text",start:s,end:s+1,name:"",local:""}),s+=1;continue}let r=O(e,s+1),l=e.slice(s,r).trimEnd().endsWith("/>");t.push({kind:l?"empty":"open",start:s,end:r,name:i,local:T(i)}),s=r}return{tokens:t,refused:n}}function O(e,t){let n=t,s="";for(;n<e.length;){let t=e.charAt(n);if(""!==s)t===s&&(s="");else if('"'===t||"'"===t)s=t;else if(">"===t)return n+1;n++}return e.length}function D(e,t){let n=[],s=0,a=()=>" ".repeat(Math.min(s,40));for(let i=0;i<t.length;i++){let r=t[i];if(void 0===r)continue;let l=e.slice(r.start,r.end);if("text"===r.kind){let r=l.trim();if(""===r)continue;let o=t[i-1],d=t[i+1];if(o?.kind==="open"&&d?.kind==="close"&&n.length>0){n[n.length-1]=(n[n.length-1]??"")+r+e.slice(d.start,d.end),s--,i++;continue}n.push(a()+r);continue}if("close"===r.kind){s--,n.push(a()+l);continue}n.push(a()+l.trim()),"open"===r.kind&&s++}return n.join("\n")}let U=new Set(["Assertion","EncryptedAssertion","Attribute","AttributeValue","Audience","AudienceRestriction","SubjectConfirmation","AuthnStatement","Reference"]),E=new j.A({ignoreAttributes:!1,attributeNamePrefix:"@",removeNSPrefix:!0,parseTagValue:!1,parseAttributeValue:!1,trimValues:!0,textNodeName:"#text",isArray:e=>U.has(e)}),F=e=>"object"!=typeof e||null===e||Array.isArray(e)?null:e,W=e=>{if(Array.isArray(e))return e.filter(e=>null!==F(e));let t=F(e);return null===t?[]:[t]},X=(e,t)=>{let n=e?.["@"+t];return"string"==typeof n&&""!==n?n:null},V=e=>{if("string"==typeof e)return""===e?null:e;if("number"==typeof e||"boolean"==typeof e)return String(e);let t=F(e);if(null===t)return null;let n=t["#text"];return"string"==typeof n?""===n?null:n:"number"==typeof n||"boolean"==typeof n?String(n):null},P=/(Z|[+-]\d{2}:?\d{2})$/;function B(e){if("string"!=typeof e||""===e.trim())return null;let t=e.trim(),n=P.test(t),s=Date.parse(n?t:t+"Z");return{raw:t,ms:Number.isFinite(s)?s:null,hasZone:n}}function z(e,t,n){let s=F(e?.Signature);if(null===s)return null;let a=F(s.SignedInfo),i=W(a?.Reference)[0]??null,r=X(i,"URI"),l=F(s.KeyInfo),o=F(l?.X509Data);return{on:t,referenceUri:r,coversItsOwnElement:null===r?null:""===r||(null===n?null:r==="#"+n),signatureMethod:X(F(a?.SignatureMethod),"Algorithm"),digestMethod:X(F(i?.DigestMethod),"Algorithm"),canonicalizationMethod:X(F(a?.CanonicalizationMethod),"Algorithm"),hasCertificate:null!==o&&null!==V(o.X509Certificate)}}let q={kind:"",id:null,version:null,issueInstant:null,destination:null,inResponseTo:null,acsUrl:null,protocolBinding:null,issuer:null,statusCode:null,statusSubCode:null,statusMessage:null,encryptedAssertions:0,assertion:null,extraAssertions:0,signatures:[],wellFormed:!1},J=["http://www.w3.org/2000/09/xmldsig#rsa-sha1","http://www.w3.org/2000/09/xmldsig#dsa-sha1","http://www.w3.org/2000/09/xmldsig#sha1"];function $(e){return 0===e.actual.length?{id:e.id+"-absent",level:"warning",text:e.absentText,rule:e.rule}:""===e.expected?{id:e.id+"-not-checked",level:"not-checked",text:e.notCheckedText+e.actual.map(e=>'"'+e+'"').join(" and ")+".",rule:e.rule}:e.actual.some(t=>t===e.expected)?{id:e.id+"-match",level:"note",text:e.what+" matches exactly.",rule:e.rule}:{id:e.id+"-mismatch",level:"blocker",text:e.what+" is "+e.actual.map(e=>'"'+e+'"').join(" and ")+', and you said yours is "'+e.expected+'". These are compared as exact strings, which is how a service provider compares them, so a trailing slash or a capital letter is a mismatch.',rule:e.rule}}function _(e){let t=Math.abs(Math.round(e));if(t<60)return 1===t?"1 second":String(t)+" seconds";if(t<3600){let e=Math.floor(t/60),n=t%60;return(1===e?"1 minute":String(e)+" minutes")+(0===n?"":" "+String(n)+"s")}if(t<86400){let e=Math.floor(t/3600),n=Math.floor(t%3600/60);return(1===e?"1 hour":String(e)+" hours")+(0===n?"":" "+String(n)+"m")}let n=Math.floor(t/86400),s=Math.floor(t%86400/3600);return(1===n?"1 day":String(n)+" days")+(0===s?"":" "+String(s)+"h")}let Z=[{id:"subject",label:"Who it is about",elements:["NameID","AttributeValue","EncryptedID","BaseID"],attributes:["NameQualifier","SPProvidedID"]},{id:"crypto",label:"Signature and certificate material",elements:["SignatureValue","DigestValue","X509Certificate","X509SubjectName","X509IssuerName","X509SerialNumber","Modulus","Exponent","CipherValue"],attributes:[]},{id:"organisation",label:"Which organization it is",elements:["Issuer","Audience"],attributes:["Destination","Recipient","AssertionConsumerServiceURL","SPNameQualifier"]},{id:"identifiers",label:"Message and session identifiers",elements:[],attributes:["ID","InResponseTo","SessionIndex","AssertionID"]}],H=["subject","crypto"],Y=e=>e.toLowerCase().replace(/[^a-z0-9]+/g,""),K="toolbreezy:saml-decoder",Q=["smle","smla","
1smlk","smlb","smlg"],G=["now","issued"],ee=400;function et(e,t,n,s,a){let i=Z.every(e=>a.includes(e.id)===H.includes(e.id));return(0,m.CZ)([{key:"smle",value:""===e.trim()?null:e.trim().slice(0,ee)},{key:"smla",value:""===t.trim()?null:t.trim().slice(0,ee)},{key:"smlk",value:0===n?null:String(n)},{key:"smlb",value:"now"===s?null:s},{key:"smlg",value:i?null:a.join(",")}])}function en(e){let t=e.get("smlk");if(null===t||""===t||t.length>4||!/^\d+$/.test(t))return null;let n=Number(t);return!Number.isInteger(n)||n<0||n>600?null:n}function es(e){let t=e.get("smlb");return null===t?null:G.includes(t)?t:null}function ea(e){let t=e.get("smlg");if(null===t)return null;if(""===t)return[];let n=new Set(Z.map(e=>e.id)),s=t.split(",").slice(0,Z.length+1);return s.every(e=>n.has(e))?Z.filter(e=>s.includes(e.id)).map(e=>e.id):null}function ei(e,t){let n=e.get(t);return null===n||n.length>ee?null:n}function er(e,t,n,s,a,i,r){let l=function(e){let t;if(!0!==A.XMLValidator.validate(e)||null!==R(e).refused)return{...q};try{let n=E.parse(e),s=F(n);if(null===s)return{...q};t=s}catch{return{...q}}let n=Object.keys(t).find(e=>"?xml"!==e&&!e.startsWith("@"));if(void 0===n)return{...q};let s=t[n],a=F(s)??(Array.isArray(s)?F(s[0]):null);if(null===a)return{...q,kind:n,wellFormed:!0};let i=W(a.Assertion),r=W(a.EncryptedAssertion),l=X(a,"ID"),o=[],d=z(a,"Response",l);null!==d&&o.push(d);let u="Assertion"===n?a:i[0]??null;if(null!==u&&u!==a){let e=z(u,"Assertion",X(u,"ID"));null!==e&&o.push(e)}else u===a&&null!==d&&(o[0]={...d,on:"Assertion"});let c=F(a.Status),h=F(c?.StatusCode);return{kind:n,id:l,version:X(a,"Version"),issueInstant:B(X(a,"IssueInstant")),destination:X(a,"Destination"),inResponseTo:X(a,"InResponseTo"),acsUrl:X(a,"AssertionConsumerServiceURL"),protocolBinding:X(a,"ProtocolBinding"),issuer:V(a.Issuer),statusCode:X(h,"Value"),statusSubCode:X(F(h?.StatusCode),"Value"),statusMessage:V(c?.StatusMessage),encryptedAssertions:r.length,assertion:null===u?null:function(e){let t=F(e.Subject),n=t?.NameID,s=W(t?.SubjectConfirmation)[0]??null,a=F(s?.SubjectConfirmationData),i=F(e.Conditions),r=W(i?.AudienceRestriction)[0]??null,l=W(e.AuthnStatement)[0]??null,o=F(e.AttributeStatement),d=W(o?.Attribute),u=[];for(let e of d.slice(0,200)){let t=W(e.AttributeValue).map(e=>V(e)).filter(e=>null!==e),n=[...Array.isArray(e.AttributeValue)?e.AttributeValue.filter(e=>"string"==typeof e):"string"==typeof e.AttributeValue?[e.AttributeValue]:[],...t];u.push({name:X(e,"Name")??"(no Name attribute)",friendlyName:X(e,"FriendlyName"),nameFormat:X(e,"NameFormat"),values:n.slice(0,50),valuesNotShown:Math.max(0,n.length-50)})}return{id:X(e,"ID"),issuer:V(e.Issuer),issueInstant:B(X(e,"IssueInstant")),nameId:V(n),nameIdFormat:X(F(n),"Format"),audiences:W(r?.Audience).map(e=>V(e)).filter(e=>null!==e).concat(Array.isArray(r?.Audience)?r.Audience.filter(e=>"string"==typeof e):[]),conditionsNotBefore:B(X(i,"NotBefore")),conditionsNotOnOrAfter:B(X(i,"NotOnOrAfter")),confirmationNotOnOrAfter:B(X(a,"NotOnOrAfter")),confirmationRecipient:X(a,"Recipient"),confirmationInResponseTo:X(a,"InResponseTo"),authnInstant:B(X(l,"AuthnInstant")),sessionIndex:X(l,"SessionIndex"),sessionNotOnOrAfter:B(X(l,"SessionNotOnOrAfter")),authnContext:V(F(l?.AuthnContext)?.AuthnContextClassRef),attributes:u,attributesNotShown:Math.max(0,d.length-200)}}(u),extraAssertions:Math.max(0,i.length-1),signatures:o,wellFormed:!0}}(e),o=l.assertion?.issueInstant?.ms??l.issueInstant?.ms??null,d="issued"===n&&null!==o?o:t,u=function(e,t,n){let s=1e3*Math.max(0,Math.min(600,Math.round(n))),a=[],i=(e,n,i)=>{if(null===i)return;if(null===i.ms)return void a.push({label:e,rule:n,instant:i,state:"unreadable",deltaSeconds:null});let r=Math.round((i.ms-t)/1e3),l="not-before"===n?t+s>=i.ms:t-s<i.ms;a.push({label:e,rule:n,instant:i,state:l?"valid":"not-before"===n?"not-yet":"expired",deltaSeconds:r})},r=e.assertion;i("Conditions NotBefore","not-before",r?.conditionsNotBefore??null),i("Conditions NotOnOrAfter","not-on-or-after",r?.conditionsNotOnOrAfter??null),i("SubjectConfirmationData NotOnOrAfter","not-on-or-after",r?.confirmationNotOnOrAfter??null),i("AuthnStatement SessionNotOnOrAfter","not-on-or-after",r?.sessionNotOnOrAfter??null);let l=a.filter(e=>"not-before"===e.rule&&null!==e.instant.ms),o=a.filter(e=>"not-on-or-after"===e.rule&&null!==e.instant.ms),d=0===l.length?null:Math.max(...l.map(e=>e.instant.ms)),u=0===o.length?null:Math.min(...o.map(e=>e.instant.ms)),c=a.filter(e=>"not-yet"===e.state||"expired"===e.state),h=a.filter(e=>"unreadable"===e.state).length;return{conditions:a,windowStart:d,windowEnd:u,windowSeconds:null===d||null===u?null:Math.round((u-d)/1e3),validNow:0===c.length&&a.length>0,failing:c,unreadable:h}}
1(l,d,s),c=function(e,t,n,s){let a=[],i=n.trim(),r=s.trim(),l=e.assertion;if("Response"===e.kind||"LogoutResponse"===e.kind){if(null===e.statusCode)a.push({id:"status-missing",level:"blocker",text:"This response carries no Status element at all.",rule:"SAML 2.0 core, section 3.2.2: a Response must contain a Status."});else if("urn:oasis:names:tc:SAML:2.0:status:Success"!==e.statusCode){let t=e.statusCode.split(":").pop()??e.statusCode;a.push({id:"status-not-success",level:"blocker",text:"The identity provider said "+t+", not Success"+(null===e.statusSubCode?"":", with a second level code of "+(e.statusSubCode.split(":").pop()??""))+(null===e.statusMessage?"":', and the message reads "'+e.statusMessage+'"')+". There is no successful log-in in this document.",rule:"SAML 2.0 core, section 3.2.2.2."})}}for(let n of(e.encryptedAssertions>0&&a.push({id:"encrypted",level:"note",text:"This response carries "+String(e.encryptedAssertions)+" encrypted assertion"+(1===e.encryptedAssertions?"":"s")+". Nothing inside can be read without the service provider private key, which this page never asks for and never holds.",rule:"SAML 2.0 core, section 2.3.4."}),t.failing)){let e=Math.abs(n.deltaSeconds??0);a.push({id:"clock-"+n.rule+"-"+n.label.replace(/\s+/g,"-").toLowerCase(),level:"blocker",text:"expired"===n.state?n.label+" passed "+_(e)+" ago.":n.label+" is still "+_(e)+" away.",rule:"not-on-or-after"===n.rule?"SAML 2.0 core, section 2.5.1.2: the assertion must be rejected at or after this instant.":"SAML 2.0 core, section 2.5.1.2: the assertion must be rejected before this instant."})}t.unreadable>0&&a.push({id:"clock-unreadable",level:"warning",text:String(t.unreadable)+" time condition"+(1===t.unreadable?"":"s")+" could not be read as a date, so "+(1===t.unreadable?"it was":"they were")+" left out of the verdict above rather than assumed to pass.",rule:"XML Schema xs:dateTime."});let o=t.conditions.filter(e=>!e.instant.hasZone);o.length>0&&a.push({id:"no-timezone",level:"warning",text:1===o.length?(o[0]?.label??"A time condition")+" carries no timezone, so it means a different instant depending on where it is read. This page read it as UTC.":String(o.length)+" time conditions carry no timezone, so they mean different instants depending on where they are read. This page read them as UTC.",rule:"SAML 2.0 core, section 1.3.3: time values are UTC and carry a trailing Z."}),null!==t.windowSeconds&&t.windowSeconds>3600&&a.push({id:"window-long",level:"note",text:"The assertion is good for "+_(t.windowSeconds)+", which is a long window for a single sign-on.",rule:"Not a specification rule. The window is whatever the identity provider configured."}),a.push($({id:"audience",what:"Audience",actual:l?.audiences??[],expected:i,absentText:"The assertion names no Audience at all, so it does not say which service provider it is for.",rule:"SAML 2.0 core, section 2.5.1.4: a service provider must reject an assertion whose AudienceRestriction does not name it.",notCheckedText:"Audience is not checked because the service provider entity ID box is empty. The document names "})),a.push($({id:"destination",what:"Destination",actual:null===e.destination?[]:[e.destination],expected:r,absentText:"This message carries no Destination attribute, so it does not say where it was meant to be delivered.",rule:"SAML 2.0 core, section 3.2.2: if Destination is present it must match the address the message arrived at.",notCheckedText:"Destination is not checked because the assertion consumer URL box is empty. The document names "})),a.push($({id:"recipient",what:"SubjectConfirmationData Recipient",actual:l?.confirmationRecipient===null||l?.confirmationRecipient===void 0?[]:[l.confirmationRecipient],expected:r,absentText:"The subject confirmation names no Recipient, so nothing binds this assertion to one endpoint.",rule:"SAML 2.0 profiles, section 4.1.4.3: the Recipient must match the assertion consumer service URL.",notCheckedText:"Recipient is not checked because the assertion consumer URL box is empty. The document names "})),null!==l&&null===l.confirmationNotOnOrAfter&&"Response"===e.kind&&a.push({id:"confirmation-no-expiry",level:"warning",text:"The subject confirmation has no NotOnOrAfter, so nothing in it stops the assertion being replayed later.",rule:"SAML 2.0 profiles, section 4.1.4.2: SubjectConfirmationData must contain a NotOnOrAfter."});let d=e.signatures.some(e=>"Response"===e.on),u=e.signatures.some(e=>"Assertion"===e.on);for(let t of(0===e.signatures.length?a.push({id:"no-signature",level:e.encryptedAssertions>0?"warning":"blocker",text:"There is no Signature element anywhere in this document.",rule:"SAML 2.0 profiles, section 4.1.4.5: the response, the assertion, or both, must be signed."}):d&&!u&&"Response"===e.kind&&0===e.encryptedAssertions&&a.push({id:"assertion-unsigned",level:"warning",text:"The response is signed and the assertion inside it is not, so only the envelope is protected.",rule:"SAML 2.0 profiles, section 4.1.4.5 permits either. Which one your service provider checks is a configuration question."}),e.signatures)){!1===t.coversItsOwnElement&&a.push({id:"signature-covers-elsewhere-"+t.on.toLowerCase(),level:"blocker",text:"The signature on the "+t.on+" references "+String(t.referenceUri)+", which is not the ID of the element it sits on.",rule:"XML Signature: the Reference URI names what is actually covered, and it is not always what it appears to wrap."});let e=t.signatureMethod??"";(J.includes(e)||J.includes(t.digestMethod??""))&&a.push({id:"sha1-"+t.on.toLowerCase(),level:"note",text:"The signature on the "+t.on+" names SHA-1.",rule:"Not a SAML rule. Several identity and service providers now refuse SHA-1
1signatures outright."})}return a}(l,u,a,i),h={blocker:0,warning:0,note:0,"not-checked":0};for(let e of c)h[e.level]++;return{reading:l,clock:u,findings:c,redaction:l.wellFormed?function(e,t){let n=new Set(t),s=Z.filter(e=>n.has(e.id)),a=L(e),i={subject:0,crypto:0,organisation:0,identifiers:0},r=[];for(let t of s){if(t.elements.length>0)for(let n of function(e,t,n){let s=[],a=[];for(let i of t){if("open"===i.kind){a.push({name:i.name,local:i.local});continue}if("close"===i.kind){for(let e=a.length-1;e>=0;e--)if(a[e]?.name===i.name){a.length=e;break}continue}if("text"!==i.kind&&"cdata"!==i.kind)continue;let t=a[a.length-1];if(void 0===t||!n.has(t.local))continue;let r="cdata"===i.kind?{start:i.start+9,end:Math.max(i.start+9,i.end-3)}:{start:i.start,end:i.end},l=e.slice(r.start,r.end);""!==l.trim()&&s.push({local:t.local,name:t.name,start:r.start,end:r.end,text:l})}return s}(e,a,new Set(t.elements)))r.push({range:n,group:t.id});if(t.attributes.length>0)for(let n of function(e,t,n){let s=[],a=/([A-Za-z_][\w.\-:]*)\s*=\s*("([^"]*)"|'([^']*)')/g;for(let i of t){let t;if("open"!==i.kind&&"empty"!==i.kind)continue;let r=e.slice(i.start,i.end);for(a.lastIndex=0;null!==(t=a.exec(r));){let e=t[1]??"",a=t[2]??"",r=T(e);if("xmlns"===e||e.startsWith("xmlns:")||!n.has(r))continue;let l=t[3]??t[4]??"";if(""===l)continue;let o=t[0].length-a.length+1,d=i.start+t.index+o;s.push({local:r,name:e,start:d,end:d+l.length,text:l})}}return s}(e,a,new Set(t.attributes)))r.push({range:n,group:t.id})}if(r.length>2e3)return{xml:"",entries:[],perGroup:i,refusedOver:r.length};r.sort((e,t)=>e.range.start-t.range.start);let l=new Map,o=new Map,d=[],u=[];for(let e of r){let t=e.range.text,n=Y(e.range.local),s=n+"\0"+t,a=l.get(s);if(void 0===a){let i=(o.get(n)??0)+1;o.set(n,i),a="redacted-"+n+"-"+String(i),l.set(s,a),d.push({placeholder:a,where:e.range.name,original:t})}i[e.group]++,u.push({start:e.range.start,end:e.range.end,with:a})}return{xml:function(e,t){let n=[...t].sort((e,t)=>t.start-e.start),s=e,a=1/0;for(let e of n)e.end>a||(s=s.slice(0,e.start)+e.with+s.slice(e.end),a=e.start);return s}(e,u),entries:d,perGroup:i,refusedOver:null}}(e,r):null,indented:l.wellFormed?D(e,L(e)):null,judgedAt:d,counts:h}}let el={blocker:"border-destructive/40 bg-destructive/10",warning:"border-amber-500/40 bg-amber-500/10",note:"border-input bg-muted/40","not-checked":"border-dashed border-input bg-transparent"},eo={blocker:"Blocker",warning:"Worth knowing",note:"Note","not-checked":"Not checked"},ed=e=>new Date(e).toISOString().replace(".000","").replace("T"," ");function eu(){let[e,t]=(0,a.useState)(""),[n,f]=(0,a.useState)(null),[x,b]=(0,a.useState)(""),[w,y]=(0,a.useState)(""),[v,N]=(0,a.useState)(0),[k,j]=(0,a.useState)("now"),[A,M]=(0,a.useState)(H),[C,I]=(0,a.useState)(0),[T,R]=(0,a.useState)(""),[O,U]=(0,a.useState)(!1),[E,F]=(0,a.useState)("");(0,a.useEffect)(()=>{I(Date.now());let e=(0,m.qA)(window.location.search,window.location.hash),t=ei(e,"smle"),n=ei(e,"smla"),s=en(e),a=es(e),i=ea(e);if(Q.some(t=>null!==e.get(t))){null!==t&&b(t),null!==n&&y(n),null!==s&&N(s),null!==a&&j(a),null!==i&&M(i),null!==e.get("smlk")&&null===s&&F("The clock tolerance on that link is not a whole number of seconds between "+String(0)+" and "+String(600)+", so the page opened on its own default."),null!==e.get("smlg")&&null===i&&F("That link names a redaction group this page does not have, so the groups opened on their defaults."),null!==e.get("smle")&&null===t&&F("The entity ID on that link is longer than this page accepts, so the box opened empty rather than holding part of it."),null!==e.get("smla")&&null===n&&F("The assertion consumer URL on that link is longer than this page accepts, so the box opened empty rather than holding part of it.");return}let r=(0,p.y5)(K);if(!r.found)return;b(r.str("entityId","",ee)),y(r.str("acsUrl","",ee)),N(r.int("skew",0,600,0)),j(r.oneOf("basis",G,"now"));let l=r.strings("groups",Z.length,20),o=new Set(Z.map(e=>e.id));if(l.length>0&&l.every(e=>o.has(e)))M(Z.filter(e=>l.includes(e.id)).map(e=>e.id));else if(null!==r.value&&"object"==typeof r.value&&"groups"in r.value){let e=r.value.groups;Array.isArray(e)&&0===e.length?M([]):l.length>0&&F("The redaction groups saved in this browser are not ones this page has, so they opened on their defaults.")}},[]);let W=(0,g.Vd)(K,()=>JSON.stringify({entityId:x,acsUrl:w,skew:v,basis:k,groups:A}),[x,w,v,k,A]);(0,a.useEffect)(()=>{let t=!0;return""===e.trim()?(f(null),()=>{t=!1}):(S(e).then(e=>{t&&f(e)}),()=>{t=!1})},[e]);let X=(0,a.useMemo)(()=>null===n||null!==n.refusal?null:er(n.xml,C,k,v,x,w,A),[n,C,k,v,x,w,A]),V=(0,a.useCallback)(e=>{M(t=>t.includes(e)?t.filter(t=>t!==e):Z.filter(n=>
1n.id===e||t.includes(n.id)).map(e=>e.id))},[]),P=(0,a.useCallback)(async(e,t)=>{let n=await (0,h.copyText)(e);R(n.ok?t+" copied.":n.note??"Nothing was copied.")},[]),B=X?.reading??null,z=X?.clock??null,q=X?.redaction??null,J=B?.assertion??null,$=function(e){let t=new Set(e),n=["Every attribute NAME, such as the claim URIs, because that is usually what the question is about.","Every timestamp, which can place the session."];return t.has("organisation")||n.push("Every entity ID and every URL, which name your identity provider and your service provider."),t.has("identifiers")||n.push("Every message ID, InResponseTo and SessionIndex, which tie this document to a log line."),t.has("crypto")||n.push("The signature, the digest and the certificate, and a certificate carries a subject name."),t.has("subject")||n.push("\uD83D\uDEA8 The NameID and every attribute VALUE. The person is still in this file."),n}(A);return(0,s.jsxs)("div",{className:"space-y-4","data-steps":null===n?"":n.steps.map(e=>e.kind).join(">"),"data-refusal":n?.refusal?.kind??"","data-kind":B?.kind??"","data-wellformed":null===B?"":B.wellFormed?"1":"0","data-valid":null===z?"":z.validNow?"1":"0","data-window":z?.windowSeconds===null||void 0===z?"":String(z?.windowSeconds??""),"data-blockers":String(X?.counts.blocker??0),"data-warnings":String(X?.counts.warning??0),"data-notchecked":String(X?.counts["not-checked"]??0),"data-redacted":String(q?.entries.length??0),"data-redactrefused":String(q?.refusedOver??0),"data-skew":String(v),"data-basis":k,"data-groups":A.join(","),"data-restorerefused":""===E?"0":"1",children:[(0,s.jsxs)("div",{className:"space-y-1.5",children:[(0,s.jsxs)("div",{className:"flex items-center gap-1.5",children:[(0,s.jsx)(u.J,{htmlFor:"sml-in",children:"Paste the SAML message"}),(0,s.jsxs)(i.i,{label:"What this box takes",children:[(0,s.jsx)("span",{className:"block",children:"Raw XML, base64, base64 of a raw DEFLATE stream, or the whole URL out of your address bar. It works out which and tells you, and the answer is itself useful because it says which binding your identity provider used."}),(0,s.jsx)("span",{className:"block",children:"Nothing you paste is uploaded, saved in this browser, or put in the share link."})]})]}),(0,s.jsx)(c.T,{id:"sml-in",rows:6,spellCheck:!1,value:e,maxLength:4e5,onChange:e=>t(e.target.value),placeholder:"PHNhbWxwOlJlc3BvbnNlIC4uLg== or https://idp.example.org/sso?SAMLRequest=...",className:"font-mono text-xs"})]}),""!==E&&(0,s.jsx)("p",{role:"alert",className:"rounded-md border border-destructive/40 bg-destructive/10 p-3 text-sm",children:E}),n?.refusal!=null&&(0,s.jsxs)("p",{role:"alert",className:"rounded-md border border-destructive/40 bg-destructive/10 p-3 text-sm",children:[n.refusal.detail,"."]}),null!==n&&null===n.refusal&&(0,s.jsxs)("p",{className:"text-sm text-muted-foreground",children:[(0,s.jsx)("span",{className:"font-medium text-foreground",children:"How it was decoded: "}),n.steps.map(e=>e.detail).join(", then "),".",null!==n.relayState&&' RelayState is "'+n.relayState+'".',n.detachedSignature&&" A detached Signature parameter rode with it, which is the Redirect binding signing the query string rather than the XML."]}),(0,s.jsxs)("div",{className:"space-y-4",children:[(0,s.jsxs)("div",{className:"flex flex-wrap items-end gap-4",children:[(0,s.jsxs)("div",{className:"space-y-1.5",children:[(0,s.jsx)(u.J,{htmlFor:"sml-entity",children:"Your service provider entity ID"}),(0,s.jsx)(d.p,{id:"sml-entity",value:x,maxLength:ee,spellCheck:!1,onChange:e=>b(e.target.value),placeholder:"left empty, Audience is not checked",className:"w-72 font-mono text-xs"})]}),(0,s.jsxs)("div",{className:"space-y-1.5",children:[(0,s.jsx)(u.J,{htmlFor:"sml-acs",children:"Your assertion consumer URL"}),(0,s.jsx)(d.p,{id:"sml-acs",value:w,maxLength:ee,spellCheck:!1,onChange:e=>y(e.target.value),placeholder:"left empty, Destination is not checked",className:"w-72 font-mono text-xs"})]})]}),(0,s.jsxs)("div",{className:"flex flex-wrap items-end gap-4",children:[(0,s.jsxs)("div",{className:"space-y-1.5",children:[(0,s.jsxs)("div",{className:"flex items-center gap-1.5",children:[(0,s.jsx)(u.J,{htmlFor:"sml-basis",children:"Judge the clock against"}),(0,s.jsxs)(i.i,{label:"Now, or the moment it was issued",children:[(0,s.jsxs)("span",{className:"block",children:[(0,s.jsx)("strong",{children:"Now"}),' answers "would this be accepted if I replayed it this second", which is what you want while a log-in is failing in front of you.']}),(0,s.jsxs)("span",{className:"block",children:[(0,s.jsx)("strong",{children:"When it was issued"}),' answers "was this ever valid", which separates a clock problem from a message you pasted out of yesterday\'s log.']})]})]}),(0,s.jsxs)("select",{id:"sml-basis",className:"h-9 rounded-md border border-input bg-background px-2 text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",value:k,onChange:e=>j("issued"===e.target.value?"issued":"now"),children:[(0,s.jsx)("option",{value:"now",children:"Now"}),(0,s.jsx)("option",{value:"issued",children:"When it was issued"})]})]}),(0,s.jsxs)("div",{className:"space-y-1.5",children:[(0,s.jsxs)("div",{className:"flex items-center gap-1.5",children:[(0,s.jsx)(u.J,{htmlFor:"sml-skew",children:"Clock tolerance, seconds"}),(0,s.jsx)(i.i,{label:"What tolerance does here",children:"Service providers allow a few minutes of difference between their clock and the identity provider's. Move this and watch the verdict above change. If a tolerance of a minute or two turns a failure into a pass, the problem is a clock and not a configuration."})]}),(0,s.jsx)(d.p,{id:"sml-skew",type:"number",min:0,max:600,step:1,value:v,onCh
1ange:e=>{let t=Number(e.target.value);Number.isInteger(t)&&t>=0&&t<=600&&N(t)},className:"w-28"})]})]})]}),null!==X&&null!==B&&B.wellFormed&&(0,s.jsxs)(s.Fragment,{children:[null!==z&&z.conditions.length>0&&(0,s.jsxs)("div",{className:"rounded-md border p-3 text-sm "+(z.validNow?"border-emerald-500/40 bg-emerald-500/10":"border-destructive/40 bg-destructive/10"),children:[(0,s.jsx)("p",{className:"font-medium",children:z.validNow?"Every time condition holds at "+ed(X.judgedAt)+" UTC.":"This message is not acceptable at "+ed(X.judgedAt)+" UTC."}),null!==z.windowSeconds&&(0,s.jsxs)("p",{className:"text-muted-foreground",children:["It is good for ",_(z.windowSeconds),", from ",ed(z.windowStart??0)," to"," ",ed(z.windowEnd??0)," UTC."]}),(0,s.jsx)("ul",{className:"mt-2 space-y-0.5",children:z.conditions.map(e=>(0,s.jsxs)("li",{className:"font-mono text-xs",children:[(0,s.jsx)("span",{className:"valid"===e.state?"text-emerald-700 dark:text-emerald-300":"unreadable"===e.state?"text-muted-foreground":"text-destructive",children:"valid"===e.state?"ok ":"unreadable"===e.state?"?? ":"no "}),e.label," ",e.instant.raw,null!==e.deltaSeconds&&" ("+(e.deltaSeconds<0?_(e.deltaSeconds)+" ago":"in "+_(e.deltaSeconds))+")"]},e.label))})]}),(0,s.jsxs)("div",{className:"space-y-2",children:[X.findings.map(e=>(0,s.jsxs)("div",{className:"rounded-md border p-2.5 text-sm "+el[e.level],children:[(0,s.jsx)("span",{className:"mr-2 text-xs font-semibold uppercase tracking-wide text-muted-foreground",children:eo[e.level]}),e.text,(0,s.jsx)(i.i,{label:"Where that rule comes from",children:e.rule})]},e.id)),0===X.findings.length&&(0,s.jsx)("p",{className:"text-sm text-muted-foreground",children:"Nothing to report about this message."})]}),(0,s.jsx)("div",{className:"overflow-x-auto",children:(0,s.jsx)("table",{className:"w-full text-left text-sm",children:(0,s.jsxs)("tbody",{children:[(0,s.jsx)(ec,{label:"Message",value:B.kind+(null===B.id?"":" "+B.id)}),(0,s.jsx)(ec,{label:"Issuer",value:B.issuer}),(0,s.jsx)(ec,{label:"Destination",value:B.destination}),(0,s.jsx)(ec,{label:"In response to",value:B.inResponseTo}),(0,s.jsx)(ec,{label:"Status",value:B.statusCode}),(0,s.jsx)(ec,{label:"Name ID",value:J?.nameId??null}),(0,s.jsx)(ec,{label:"Name ID format",value:J?.nameIdFormat??null}),(0,s.jsx)(ec,{label:"Audience",value:J?.audiences.join(", ")??null}),(0,s.jsx)(ec,{label:"Authentication context",value:J?.authnContext??null}),(0,s.jsx)(ec,{label:"Session index",value:J?.sessionIndex??null}),B.signatures.map(e=>(0,s.jsx)(ec,{label:"Signature on the "+e.on,value:"covers "+(e.referenceUri??"nothing this page can name")+", signed with "+(e.signatureMethod?.split(/[#/]/).pop()??"an unnamed algorithm")+(e.hasCertificate?", certificate attached":", no certificate attached")},e.on))]})})}),null!==J&&J.attributes.length>0&&(0,s.jsxs)("div",{className:"overflow-x-auto",children:[(0,s.jsxs)("table",{className:"w-full text-left text-sm","data-attributes":String(J.attributes.length),children:[(0,s.jsx)("thead",{className:"text-muted-foreground",children:(0,s.jsxs)("tr",{children:[(0,s.jsx)("th",{className:"py-1 pr-3 font-medium",children:"Attribute"}),(0,s.jsx)("th",{className:"py-1 font-medium",children:"Value"})]})}),(0,s.jsx)("tbody",{children:J.attributes.map(e=>(0,s.jsxs)("tr",{className:"border-t align-top",children:[(0,s.jsxs)("td",{className:"py-1 pr-3 font-mono text-xs",children:[e.friendlyName??e.name,null!==e.friendlyName&&(0,s.jsx)("span",{className:"block text-muted-foreground",children:e.name})]}),(0,s.jsxs)("td",{className:"py-1 font-mono text-xs",children:[e.values.join(", "),e.valuesNotShown>0&&(0,s.jsxs)("span",{className:"block text-destructive",children:[e.valuesNotShown," more value",1===e.valuesNotShown?"":"s"," on this attribute were not read at all."]})]})]},e.name))})]}),J.attributesNotShown>0&&(0,s.jsxs)("p",{className:"text-sm text-destructive",children:[J.attributesNotShown," more attribute",1===J.attributesNotShown?" was":"s were"," not read at all."]})]})]}),(0,s.jsxs)("div",{className:"space-y-2 rounded-md border border-input p-3",children:[(0,s.jsxs)("div",{className:"flex items-center gap-1.5",children:[(0,s.jsx)("span",{className:"text-sm font-medium",children:"A copy you can send to
1somebody"}),(0,s.jsxs)(i.i,{label:"What a redacted copy is and is not",children:[(0,s.jsxs)("span",{className:"block",children:[(0,s.jsx)("strong",{children:"It will not verify."})," A signature covers bytes, and this changes them. That is what a signature is for."]}),(0,s.jsxs)("span",{className:"block",children:[(0,s.jsx)("strong",{children:"Redacted is not anonymous."})," What each group leaves behind is listed under the copy, and the list changes as you switch groups on and off."]}),(0,s.jsx)("span",{className:"block",children:"The key stays in this tab. It is never copied with the document and never leaves your browser, so you can translate a reply that quotes a placeholder back."})]})]}),(0,s.jsx)("div",{className:"flex flex-wrap gap-3",children:Z.map(e=>(0,s.jsxs)("label",{className:"flex items-center gap-1.5 text-sm",children:[(0,s.jsx)("input",{type:"checkbox",id:"sml-g-"+e.id,checked:A.includes(e.id),onChange:()=>V(e.id),className:"h-4 w-4 rounded border-input"}),e.label,null!==q&&(0,s.jsxs)("span",{className:"tabular-nums text-muted-foreground",children:["(",q.perGroup[e.id],")"]})]},e.id))}),null===X?(0,s.jsx)("p",{className:"text-sm text-muted-foreground",children:"Paste a message above and the redacted copy appears here."}):null===q?(0,s.jsx)("p",{className:"text-sm text-muted-foreground",children:"No redacted copy, because this is not well formed XML."}):null!==q.refusedOver?(0,s.jsxs)("p",{role:"alert",className:"rounded-md border border-destructive/40 bg-destructive/10 p-3 text-sm",children:["This document holds ",q.refusedOver.toLocaleString("en-US")," values in the groups you chose, past the ",2e3.toLocaleString("en-US")," this page will replace. No redacted copy was produced at all, because handing back one that is half scrubbed would be worse than handing back none."]}):(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(c.T,{id:"sml-redacted",rows:8,readOnly:!0,spellCheck:!1,value:D(q.xml,L(q.xml)),className:"font-mono text-xs"}),(0,s.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,s.jsx)(o.$,{type:"button",variant:"secondary",onClick:()=>void P(q.xml,"The redacted copy"),children:"Copy the redacted copy"}),(0,s.jsx)(o.$,{type:"button",variant:"ghost",onClick:()=>U(e=>!e),"aria-expanded":O,children:O?"Hide the key":"Show the key ("+String(q.entries.length)+")"}),""!==T&&(0,s.jsx)("span",{role:"status",className:"text-sm text-muted-foreground",children:T})]}),O&&(0,s.jsxs)("table",{className:"w-full text-left text-xs","data-keyrows":String(q.entries.length),children:[(0,s.jsx)("thead",{className:"text-muted-foreground",children:(0,s.jsxs)("tr",{children:[(0,s.jsx)("th",{className:"py-1 pr-3 font-medium",children:"Placeholder"}),(0,s.jsx)("th",{className:"py-1 pr-3 font-medium",children:"Was in"}),(0,s.jsx)("th",{className:"py-1 font-medium",children:"Original"})]})}),(0,s.jsx)("tbody",{children:q.entries.map(e=>(0,s.jsxs)("tr",{className:"border-t",children:[(0,s.jsx)("td",{className:"py-1 pr-3 font-mono",children:e.placeholder}),(0,s.jsx)("td",{className:"py-1 pr-3 font-mono text-muted-foreground",children:e.where}),(0,s.jsx)("td",{className:"py-1 font-mono",children:e.original})]},e.placeholder))})]}),(0,s.jsxs)("div",{className:"text-sm",children:[(0,s.jsx)("span",{className:"font-medium",children:"What this copy still carries"}),(0,s.jsx)("ul",{className:"mt-1 list-disc space-y-0.5 pl-5 text-muted-foreground",children:$.map(e=>(0,s.jsx)("li",{children:e},e))})]})]})]}),null!==X&&null!==X.indented&&(0,s.jsxs)("div",{className:"space-y-1.5",children:[(0,s.jsx)(u.J,{htmlFor:"sml-xml",children:"The document, indented"}),(0,s.jsx)(c.T,{id:"sml-xml",rows:12,readOnly:!0,spellCheck:!1,value:X.indented,className:"font-mono text-xs"})]}),null!==X&&null!==B&&!B.wellFormed&&(0,s.jsx)("p",{role:"alert",className:"rounded-md border border-destructive/40 bg-destructive/10 p-3 text-sm",children:"That decoded to something, and it is not well formed XML, so nothing below it would be a reading of your document. The indented view and the redaction are both switched off rather than shown over a guess."}),(0,s.jsx)(r.A,{blocked:W,keeps:"your entity ID, your assertion consumer URL, the clock tolerance and the redaction groups"}),(0,s.jsxs)("p",{className:"text-sm text-muted-foreground",children:["Everything happens in this tab. Nothing is uploaded, there is no sign-up, and the message you paste is never saved in this browser or put in the share link."," ",(0,s.jsx)(i.i,{label:"why this page will not tell you a signature is valid",children:"Checking an XML signature means canonicalising the signed part of the document, hashing it, comparing that to the stated digest, then verifying the signature over a second canonicalisation, against a key you have separately decided to trust. Each of those steps has a subtlety that produces a wrong answer rather than an error, and real authentication bypasses have come from getting them wrong. A decoder that told you a forged document was valid would be worse than one that says nothing, so this page reports what the signature claims and stops there."})]}),(0,s.jsx)(l.ToolActions,{share:()=>et(x,w,v,k,A),title:"SAML Decoder",embedCarriesPersonal:!1,queryIsImpersonal:"your entity ID, your assertion consumer URL, the clock tolerance and the redaction groups"})]})}function ec({label:e,value:t}){return null==t||""===t?null:(0,s.jsxs)("tr",{className:"border-t align-top",children:[(0,s.jsx)("td",{className:"w-56 py-1 pr-3 text-muted-foreground",children:e}),(0,s.jsx)("td",{className:"py-1 font-mono text-xs break-all",children:t})]})}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.