better_auth-sso 0.6.2 → 0.8.0

data/lib/better_auth/sso/plugin/oidc_runtime.rb

@@ -0,0 +1,420 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_verify_state(value, secret)
+      BetterAuth::Crypto.verify_jwt(value.to_s, secret)
+    rescue
+      nil
+    end
+
+    def sso_oidc_authorization_url(provider, ctx, state, plugin_config = {}, body = {})
+      config = normalize_hash(provider["oidcConfig"] || {})
+      endpoint = config[:authorization_endpoint] || config[:authorization_url]
+      raise APIError.new("BAD_REQUEST", message: "Invalid OIDC configuration. Authorization URL not found.") if endpoint.to_s.empty?
+
+      scopes = Array(body[:scopes] || config[:scopes] || config[:scope] || ["openid", "email", "profile", "offline_access"])
+      query = {
+        client_id: config[:client_id],
+        response_type: "code",
+        redirect_uri: sso_oidc_redirect_uri(ctx.context, provider.fetch("providerId")),
+        scope: scopes.join(" "),
+        state: state
+      }.compact
+      nonce = sso_decode_state(state, ctx.context.secret)&.fetch("nonce", nil)
+      query[:nonce] = nonce if nonce && !nonce.to_s.empty?
+      login_hint = body[:login_hint] || body[:email]
+      query[:login_hint] = login_hint if login_hint
+      code_verifier = sso_decode_state(state, ctx.context.secret)&.fetch("codeVerifier", nil)
+      if code_verifier
+        query[:code_challenge] = sso_base64_urlsafe(OpenSSL::Digest::SHA256.digest(code_verifier))
+        query[:code_challenge_method] = "S256"
+      end
+      "#{endpoint}?#{URI.encode_www_form(query)}"
+    end
+
+    def sso_saml_authorization_url(provider, relay_state, ctx = nil, config = {})
+      auth_request_url = config.dig(:saml, :auth_request_url)
+      if auth_request_url.respond_to?(:call)
+        return auth_request_url.call(provider: provider, relay_state: relay_state, context: ctx)
+      end
+
+      config = normalize_hash(provider["samlConfig"] || {})
+      metadata = sso_saml_idp_metadata(config)
+      entry_point = config[:entry_point] || normalize_hash(sso_saml_preferred_service(metadata[:single_sign_on_service]) || {})[:location]
+      query = {
+        SAMLRequest: Base64.strict_encode64(JSON.generate({providerId: provider.fetch("providerId")})),
+        RelayState: relay_state
+      }
+      "#{entry_point}?#{URI.encode_www_form(query)}"
+    end
+
+    def sso_store_saml_authn_request(ctx, provider, url, config)
+      return if config.dig(:saml, :enable_in_response_to_validation) == false
+
+      request_id = sso_extract_saml_request_id(url)
+      return if request_id.to_s.empty?
+
+      ttl_ms = (config.dig(:saml, :request_ttl) || SSO_DEFAULT_AUTHN_REQUEST_TTL_MS).to_i
+      now_ms = (Time.now.to_f * 1000).to_i
+      expires_at_ms = now_ms + ttl_ms
+      record = {
+        id: request_id,
+        providerId: provider.fetch("providerId"),
+        createdAt: now_ms,
+        expiresAt: expires_at_ms
+      }
+      ctx.context.internal_adapter.create_verification_value(
+        identifier: "#{SSO_SAML_AUTHN_REQUEST_KEY_PREFIX}#{request_id}",
+        value: JSON.generate(record),
+        expiresAt: Time.at(expires_at_ms / 1000.0)
+      )
+    end
+
+    def sso_extract_saml_request_id(url)
+      query = URI.decode_www_form(URI.parse(url.to_s).query.to_s).to_h
+      encoded = query["SAMLRequest"]
+      return nil if encoded.to_s.empty?
+
+      xml = Zlib::Inflate.new(-Zlib::MAX_WBITS).inflate(Base64.decode64(encoded))
+      xml[/\bID=['"]([^'"]+)['"]/, 1]
+    rescue
+      nil
+    end
+
+    def sso_validate_saml_in_response_to(ctx, config, provider, raw_response, state)
+      return nil if config.dig(:saml, :enable_in_response_to_validation) == false
+
+      in_response_to = sso_extract_saml_in_response_to(raw_response)
+      if in_response_to && !in_response_to.empty?
+        identifier = "#{SSO_SAML_AUTHN_REQUEST_KEY_PREFIX}#{in_response_to}"
+        verification = ctx.context.internal_adapter.find_verification_value(identifier)
+        record = sso_parse_saml_authn_request_record(verification&.fetch("value", nil))
+        if !record || record["expiresAt"].to_i < (Time.now.to_f * 1000).to_i
+          return sso_redirect(ctx, sso_append_error(state["callbackURL"] || "/", "invalid_saml_response", "Unknown or expired request ID"))
+        end
+
+        if record["providerId"] != provider.fetch("providerId")
+          ctx.context.internal_adapter.delete_verification_by_identifier(identifier)
+          return sso_redirect(ctx, sso_append_error(state["callbackURL"] || "/", "invalid_saml_response", "Provider mismatch"))
+        end
+
+        ctx.context.internal_adapter.delete_verification_by_identifier(identifier)
+      elsif config.dig(:saml, :allow_idp_initiated) == false
+        return sso_redirect(ctx, sso_append_error(state["callbackURL"] || "/", "unsolicited_response", "IdP-initiated SSO not allowed"))
+      end
+
+      nil
+    end
+
+    def sso_parse_saml_authn_request_record(value)
+      JSON.parse(value.to_s)
+    rescue
+      nil
+    end
+
+    def sso_saml_assertion_replay_expires_at(assertion, config = {})
+      timestamp = sso_saml_timestamp_conditions(assertion)[:not_on_or_after]
+      parsed = Time.parse(timestamp.to_s) if timestamp
+      clock_skew_seconds = ((config.dig(:saml, :clock_skew) || SSO_DEFAULT_CLOCK_SKEW_MS).to_f / 1000.0)
+      return parsed + clock_skew_seconds if parsed && parsed + clock_skew_seconds > Time.now
+
+      ttl_ms = (config.dig(:saml, :assertion_ttl) || SSO_DEFAULT_ASSERTION_TTL_MS).to_i
+      Time.now + (ttl_ms / 1000.0)
+    rescue
+      Time.now + (SSO_DEFAULT_ASSERTION_TTL_MS / 1000.0)
+    end
+
+    def sso_extract_saml_in_response_to(raw_response)
+      xml = Base64.decode64(raw_response.to_s.gsub(/\s+/, ""))
+      xml[/\bInResponseTo=['"]([^'"]+)['"]/, 1]
+    rescue
+      nil
+    end
+
+    def sso_select_provider(ctx, body, config = {})
+      provider_id = body[:provider_id].to_s
+      issuer = body[:issuer].to_s
+      organization_slug = body[:organization_slug].to_s
+      domain = (body[:domain] || body[:email].to_s.split("@").last).to_s.downcase
+      if config[:default_sso]
+        provider = sso_default_provider(config, provider_id: provider_id, domain: domain)
+        return provider if provider
+      end
+
+      providers = ctx.context.adapter.find_many(model: "ssoProvider")
+      provider = if !provider_id.empty?
+        providers.find { |entry| entry["providerId"] == provider_id }
+      elsif !issuer.empty?
+        providers.find { |entry| entry["issuer"] == issuer }
+      elsif !organization_slug.empty?
+        organization = ctx.context.adapter.find_one(model: "organization", where: [{field: "slug", value: organization_slug}])
+        providers.find { |entry| entry["organizationId"] == organization&.fetch("id", nil) }
+      elsif !domain.empty?
+        providers.find { |entry| entry["domain"].to_s.downcase == domain } ||
+          providers.find { |entry| sso_email_domain_matches?(domain, entry["domain"]) }
+      end
+      raise APIError.new("NOT_FOUND", message: SSO_ERROR_CODES.fetch("PROVIDER_NOT_FOUND")) unless provider
+
+      provider
+    end
+
+    def sso_callback_provider(ctx, config, provider_id)
+      if config[:default_sso]
+        provider = sso_default_provider(config, provider_id: provider_id.to_s, domain: "")
+        return provider if provider
+      end
+
+      ctx.context.adapter.find_one(model: "ssoProvider", where: [{field: "providerId", value: provider_id.to_s}])
+    end
+
+    def sso_oidc_tokens(ctx, provider, oidc_config, state, plugin_config)
+      token_callback = oidc_config[:get_token]
+      if token_callback.respond_to?(:call)
+        return normalize_hash(token_callback.call(
+          code: ctx.query[:code] || ctx.query["code"],
+          codeVerifier: state["codeVerifier"],
+          redirectURI: sso_oidc_redirect_uri(ctx.context, provider.fetch("providerId")),
+          provider: provider,
+          context: ctx
+        ))
+      end
+
+      token_endpoint = oidc_config[:token_endpoint]
+      return nil if token_endpoint.to_s.empty?
+
+      sso_exchange_oidc_code(
+        token_endpoint: token_endpoint,
+        code: ctx.query[:code] || ctx.query["code"],
+        code_verifier: state["codeVerifier"],
+        redirect_uri: sso_oidc_redirect_uri(ctx.context, provider.fetch("providerId")),
+        client_id: oidc_config[:client_id],
+        client_secret: oidc_config[:client_secret],
+        authentication: oidc_config[:token_endpoint_authentication]
+      )
+    rescue
+      nil
+    end
+
+    def sso_exchange_oidc_code(token_endpoint:, code:, code_verifier:, redirect_uri:, client_id:, client_secret:, authentication:)
+      uri = URI(token_endpoint.to_s)
+      request = Net::HTTP::Post.new(uri)
+      form = {
+        grant_type: "authorization_code",
+        code: code,
+        redirect_uri: redirect_uri,
+        client_id: client_id,
+        code_verifier: code_verifier
+      }.compact
+      if authentication.to_s == "client_secret_post"
+        form[:client_secret] = client_secret
+      elsif client_secret.to_s != ""
+        request.basic_auth(client_id.to_s, client_secret.to_s)
+      end
+      request.set_form_data(form)
+      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      return nil unless response.is_a?(Net::HTTPSuccess)
+
+      normalize_hash(JSON.parse(response.body))
+    end
+
+    def sso_oidc_user_info(ctx, oidc_config, tokens, plugin_config, expected_nonce: nil)
+      user_callback = oidc_config[:get_user_info]
+      raw = if user_callback.respond_to?(:call)
+        user_callback.call(tokens)
+      elsif oidc_config[:user_info_endpoint]
+        sso_fetch_oidc_user_info(oidc_config[:user_info_endpoint], tokens[:access_token])
+      elsif tokens[:id_token]
+        return {_sso_error: "jwks_endpoint_not_found"} if oidc_config[:jwks_endpoint].to_s.empty?
+
+        sso_validate_oidc_id_token(
+          tokens[:id_token],
+          jwks_endpoint: oidc_config[:jwks_endpoint],
+          audience: oidc_config[:client_id],
+          issuer: oidc_config[:issuer],
+          fetch: plugin_config[:oidc_jwks_fetch],
+          expected_nonce: expected_nonce
+        ) || {_sso_error: "token_not_verified"}
+      else
+        {}
+      end
+      raw = normalize_hash(raw || {})
+      return raw if raw[:_sso_error]
+
+      mapping = normalize_hash(oidc_config[:mapping] || {})
+      extra_fields = normalize_hash(mapping[:extra_fields] || {}).each_with_object({}) do |(target, source), result|
+        result[target] = raw[normalize_key(source)] || raw[source.to_s]
+      end
+      extra_fields.merge(
+        id: raw[normalize_key(mapping[:id] || "sub")] || raw[:id],
+        email: raw[normalize_key(mapping[:email] || "email")],
+        email_verified: plugin_config[:trust_email_verified] ? raw[normalize_key(mapping[:email_verified] || "email_verified")] : false,
+        name: raw[normalize_key(mapping[:name] || "name")],
+        image: raw[normalize_key(mapping[:image] || "picture")]
+      )
+    end
+
+    def sso_fetch_oidc_user_info(endpoint, access_token)
+      uri = URI(endpoint.to_s)
+      request = Net::HTTP::Get.new(uri)
+      request["authorization"] = "Bearer #{access_token}"
+      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      return {} unless response.is_a?(Net::HTTPSuccess)
+
+      JSON.parse(response.body)
+    rescue
+      {}
+    end
+
+    def sso_validate_oidc_id_token(token, jwks_endpoint:, audience:, issuer:, fetch: nil, expected_nonce: nil)
+      jwks = sso_fetch_oidc_jwks(jwks_endpoint, fetch: fetch)
+      payload, = ::JWT.decode(
+        token.to_s,
+        nil,
+        true,
+        algorithms: %w[RS256 RS384 RS512 ES256 ES384 ES512],
+        jwks: jwks,
+        aud: audience,
+        verify_aud: true,
+        iss: issuer,
+        verify_iss: true
+      )
+      if expected_nonce && !expected_nonce.to_s.empty?
+        token_nonce = payload["nonce"] || payload[:nonce]
+        return nil if token_nonce.to_s.empty?
+        return nil unless BetterAuth::Crypto.constant_time_compare(token_nonce.to_s, expected_nonce.to_s)
+      end
+      payload
+    rescue
+      nil
+    end
+
+    def sso_fetch_oidc_jwks(jwks_endpoint, fetch: nil)
+      if fetch.respond_to?(:call)
+        return normalize_hash(fetch.call(jwks_endpoint))
+      end
+
+      uri = URI(jwks_endpoint.to_s)
+      response = Net::HTTP.get_response(uri)
+      return {} unless response.is_a?(Net::HTTPSuccess)
+
+      normalize_hash(JSON.parse(response.body))
+    rescue
+      {}
+    end
+
+    def sso_decode_jwt_payload(token)
+      payload = token.to_s.split(".")[1]
+      return {} unless payload
+
+      JSON.parse(Base64.urlsafe_decode64(payload.ljust((payload.length + 3) & ~3, "=")))
+    rescue
+      {}
+    end
+
+    def sso_append_error(url, error, description = nil)
+      separator = url.to_s.include?("?") ? "&" : "?"
+      query = {error: error, error_description: description}.compact
+      "#{url}#{separator}#{URI.encode_www_form(query)}"
+    end
+
+    def sso_default_provider(config, provider_id:, domain:)
+      Array(config[:default_sso]).each do |raw_provider|
+        default_provider = normalize_hash(raw_provider)
+        next if !provider_id.empty? && default_provider[:provider_id].to_s != provider_id
+        next if provider_id.empty? && default_provider[:domain].to_s.downcase != domain
+
+        oidc_config = default_provider[:oidc_config] ? sso_storage_config(default_provider[:oidc_config]) : nil
+        saml_config = default_provider[:saml_config] ? sso_storage_config(default_provider[:saml_config]) : nil
+        return {
+          "issuer" => default_provider[:issuer] || default_provider.dig(:oidc_config, :issuer) || default_provider.dig(:saml_config, :issuer) || "",
+          "providerId" => default_provider.fetch(:provider_id),
+          "userId" => "default",
+          "domain" => default_provider[:domain],
+          "domainVerified" => true,
+          "oidcConfig" => oidc_config,
+          "samlConfig" => saml_config
+        }.compact
+      end
+      nil
+    end
+
+    def sso_oidc_pkce_state(provider)
+      return {} unless normalize_hash(provider["oidcConfig"] || {})[:pkce]
+
+      {codeVerifier: BetterAuth::Crypto.random_string(128)}
+    end
+
+    def sso_decode_state(state, secret)
+      BetterAuth::Crypto.verify_jwt(state.to_s, secret)
+    rescue
+      nil
+    end
+
+    def sso_base64_urlsafe(value)
+      Base64.strict_encode64(value).tr("+/", "-_").delete("=")
+    end
+
+    def sso_storage_config(config)
+      normalize_hash(config || {}).each_with_object({}) do |(key, value), result|
+        result[Schema.storage_key(key)] = value unless value.respond_to?(:call)
+      end
+    end
+
+    def sso_provider_limit(user, config)
+      limit = config[:providers_limit]
+      limit = 10 if limit.nil?
+      limit.respond_to?(:call) ? limit.call(user) : limit
+    end
+
+    def sso_validate_url!(value, message)
+      uri = URI(value.to_s)
+      unless uri.is_a?(URI::HTTP) && !uri.host.to_s.empty?
+        raise APIError.new("BAD_REQUEST", message: message)
+      end
+    rescue URI::InvalidURIError
+      raise APIError.new("BAD_REQUEST", message: message)
+    end
+
+    def sso_validate_organization_membership!(ctx, user_id, organization_id)
+      member = ctx.context.adapter.find_one(
+        model: "member",
+        where: [{field: "userId", value: user_id}, {field: "organizationId", value: organization_id}]
+      )
+      raise APIError.new("BAD_REQUEST", message: "You are not a member of the organization") unless member
+    end
+
+    def sso_hydrate_oidc_config(issuer, oidc_config, ctx)
+      existing = oidc_config.merge(issuer: issuer)
+      discovered = sso_discover_oidc_config(
+        issuer: issuer,
+        existing_config: existing,
+        fetch: ctx.context.options.plugins.find { |plugin| plugin.id == "sso" }&.options&.fetch(:oidc_discovery_fetch, nil),
+        trusted_origin: ->(url) { ctx.context.trusted_origin?(url, allow_relative_paths: false) }
+      )
+      existing.merge(discovered)
+    end
+
+    def sso_oidc_needs_runtime_discovery?(oidc_config)
+      config = normalize_hash(oidc_config || {})
+      config[:authorization_endpoint].to_s.empty? ||
+        config[:token_endpoint].to_s.empty?
+    end
+
+    def sso_ensure_runtime_oidc_provider(ctx, provider, plugin_config, require_jwks: false)
+      oidc_config = normalize_hash(provider["oidcConfig"] || {})
+      needs_discovery = sso_oidc_needs_runtime_discovery?(oidc_config) || (require_jwks && oidc_config[:jwks_endpoint].to_s.empty?)
+      return provider if !needs_discovery
+
+      discovered = sso_discover_oidc_config(
+        issuer: provider.fetch("issuer"),
+        existing_config: oidc_config.merge(issuer: provider.fetch("issuer")),
+        fetch: plugin_config[:oidc_discovery_fetch],
+        trusted_origin: ->(url) { ctx.context.trusted_origin?(url, allow_relative_paths: false) }
+      )
+      provider.merge("oidcConfig" => oidc_config.merge(discovered))
+    end
+  end
+end

data/lib/better_auth/sso/plugin/provider_utils.rb

@@ -0,0 +1,216 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_oidc_redirect_uri(context, provider_id)
+      redirect_uri = context.options.plugins.find { |plugin| plugin.id == "sso" }&.options&.fetch(:redirect_uri, nil)
+      if redirect_uri && !redirect_uri.to_s.strip.empty?
+        value = redirect_uri.to_s
+        return value if URI(value).absolute?
+
+        path = value.start_with?("/") ? value : "/#{value}"
+        return "#{context.base_url}#{path}"
+      end
+
+      "#{context.base_url}/sso/callback/#{provider_id}"
+    rescue URI::InvalidURIError
+      "#{context.base_url}/sso/callback/#{provider_id}"
+    end
+
+    def sso_email_domain_matches?(email_domain, provider_domain)
+      email_domain = email_domain.to_s.strip.downcase
+      email_domain = email_domain.split("@", 2).last if email_domain.include?("@")
+      return false if email_domain.to_s.empty?
+
+      provider_domain.to_s.split(",").map { |value| value.strip.downcase }.reject(&:empty?).any? do |domain|
+        email_domain == domain || email_domain.end_with?(".#{domain}")
+      end
+    end
+
+    def sso_find_provider!(ctx, provider_id)
+      provider = ctx.context.adapter.find_one(model: "ssoProvider", where: [{field: "providerId", value: provider_id.to_s}])
+      raise APIError.new("NOT_FOUND", message: "Provider not found", code: "PROVIDER_NOT_FOUND") unless provider
+
+      provider
+    end
+
+    def sso_provider_access?(provider, user_id, ctx)
+      organization_id = provider["organizationId"]
+      return provider["userId"] == user_id if organization_id.to_s.empty?
+      return provider["userId"] == user_id unless ctx.context.options.plugins.any? { |plugin| plugin.id == "organization" }
+
+      member = ctx.context.adapter.find_one(
+        model: "member",
+        where: [{field: "userId", value: user_id}, {field: "organizationId", value: organization_id}]
+      )
+      Array(member&.fetch("role", nil).to_s.split(",")).map(&:strip).any? { |role| %w[owner admin].include?(role) }
+    end
+
+    def sso_authorize_domain_verification!(ctx, provider, user_id)
+      organization_id = provider["organizationId"]
+      is_org_member = true
+      if organization_id
+        is_org_member = !!ctx.context.adapter.find_one(
+          model: "member",
+          where: [{field: "userId", value: user_id}, {field: "organizationId", value: organization_id}]
+        )
+      end
+      return if provider["userId"] == user_id && is_org_member
+
+      raise APIError.new("FORBIDDEN", message: "User must be owner of or belong to the SSO provider organization", code: "INSUFFICIENT_ACCESS")
+    end
+
+    def sso_txt_record_exact_match?(records, expected)
+      Array(records).flatten.any? { |record| record.to_s.strip == expected.to_s }
+    end
+
+    def sso_domain_verification_identifier(config, provider_id)
+      prefix = config.dig(:domain_verification, :token_prefix) || "better-auth-token"
+      "_#{prefix}-#{provider_id}"
+    end
+
+    def sso_future_time?(value)
+      time = value.is_a?(Time) ? value : Time.parse(value.to_s)
+      time > Time.now
+    rescue
+      false
+    end
+
+    def sso_hostname_from_domain(domain)
+      value = domain.to_s.strip
+      return nil if value.empty?
+
+      uri = URI(value.include?("://") ? value : "https://#{value}")
+      uri.host
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    def sso_resolve_txt_records(hostname, config)
+      resolver = config.dig(:domain_verification, :dns_txt_resolver)
+      return Array(resolver.call(hostname)) if resolver.respond_to?(:call)
+
+      Resolv::DNS.open do |dns|
+        dns.getresources(hostname, Resolv::DNS::Resource::IN::TXT).map { |record| record.strings }
+      end
+    rescue
+      []
+    end
+
+    def sso_sanitize_provider(provider, context)
+      data = provider.dup
+      oidc_config = sso_provider_config_hash(data["oidcConfig"])
+      saml_config = sso_provider_config_hash(data["samlConfig"])
+      data["type"] = saml_config.empty? ? "oidc" : "saml"
+      data["organizationId"] ||= nil
+      data["domainVerified"] = !!data["domainVerified"]
+      data.delete("domainVerified") unless sso_context_domain_verification_enabled?(context)
+      data["oidcConfig"] = oidc_config.empty? ? nil : sso_sanitize_oidc_config(oidc_config)
+      data["samlConfig"] = saml_config.empty? ? nil : sso_sanitize_saml_config(saml_config)
+      data["spMetadataUrl"] = "#{context.base_url}/sso/saml2/sp/metadata?providerId=#{URI.encode_www_form_component(data.fetch("providerId"))}"
+      data.compact
+    end
+
+    def sso_provider_config_hash(value)
+      return normalize_hash(value) if value.is_a?(Hash)
+      return {} if value.nil? || value.to_s.strip.empty?
+
+      parsed = JSON.parse(value.to_s)
+      normalize_hash(parsed)
+    rescue JSON::ParserError, TypeError
+      {}
+    end
+
+    def sso_context_domain_verification_enabled?(context)
+      context.options.plugins.any? do |plugin|
+        plugin.id == "sso" && plugin.options.dig(:domain_verification, :enabled)
+      end
+    end
+
+    def sso_sanitize_config(config)
+      data = normalize_hash(config || {})
+      data.delete(:client_secret)
+      data.each_with_object({}) { |(key, value), result| result[Schema.storage_key(key)] = value unless value.respond_to?(:call) }
+    end
+
+    def sso_sanitize_oidc_config(config)
+      {
+        "clientIdLastFour" => sso_mask_client_id(config[:client_id]),
+        "authorizationEndpoint" => config[:authorization_endpoint],
+        "tokenEndpoint" => config[:token_endpoint],
+        "userInfoEndpoint" => config[:user_info_endpoint],
+        "jwksEndpoint" => config[:jwks_endpoint],
+        "scopes" => config[:scopes],
+        "tokenEndpointAuthentication" => config[:token_endpoint_authentication],
+        "pkce" => config[:pkce],
+        "discoveryEndpoint" => config[:discovery_endpoint],
+        "mapping" => config[:mapping] && sso_sanitize_config(config[:mapping])
+      }.compact
+    end
+
+    def sso_sanitize_saml_config(config)
+      {
+        "entryPoint" => config[:entry_point],
+        "callbackUrl" => config[:callback_url],
+        "audience" => config[:audience],
+        "wantAssertionsSigned" => config[:want_assertions_signed],
+        "authnRequestsSigned" => config[:authn_requests_signed],
+        "identifierFormat" => config[:identifier_format],
+        "signatureAlgorithm" => config[:signature_algorithm],
+        "digestAlgorithm" => config[:digest_algorithm],
+        "certificate" => sso_parse_certificate(config[:cert]),
+        "idpMetadata" => sso_sanitize_saml_metadata_config(config[:idp_metadata]),
+        "spMetadata" => sso_sanitize_saml_metadata_config(config[:sp_metadata]),
+        "mapping" => config[:mapping] && sso_sanitize_config(config[:mapping])
+      }.compact
+    end
+
+    def sso_sanitize_saml_metadata_config(metadata)
+      data = normalize_hash(metadata || {})
+      return nil if data.empty?
+
+      data.except(:private_key, :private_key_pass, :enc_private_key, :enc_private_key_pass, :decryption_pvk).each_with_object({}) do |(key, value), result|
+        result[(key == :entity_id) ? "entityID" : Schema.storage_key(key)] = value
+      end
+    end
+
+    def sso_mask_client_id(client_id)
+      value = client_id.to_s
+      return "****" if value.length <= 4
+
+      "****#{value[-4, 4]}"
+    end
+
+    def sso_parse_certificate(cert)
+      OpenSSL::X509::Certificate.new(cert.to_s)
+      {subject: cert.to_s.lines.first.to_s.strip}
+    rescue
+      {error: "Failed to parse certificate"}
+    end
+
+    def sso_fetch(data, key)
+      return nil unless data.respond_to?(:[])
+
+      compact = key.to_s.delete("_").downcase
+      direct = data[key] ||
+        data[key.to_s] ||
+        data[Schema.storage_key(key)] ||
+        data[Schema.storage_key(key).to_sym] ||
+        data[compact] ||
+        data[compact.to_sym]
+      return direct unless direct.nil?
+
+      data.each do |candidate, value|
+        normalized = candidate.to_s.delete("_").downcase
+        return value if normalized == compact
+      end
+      nil
+    end
+
+    def sso_redirect(ctx, location)
+      [302, ctx.response_headers.merge("location" => location), [""]]
+    end
+  end
+end