@better-auth/sso 1.3.0-beta.9 → 1.3.0

package/src/saml.test.ts

@@ -13,7 +13,6 @@ import { createAuthClient } from "better-auth/client";
 import { betterFetch } from "@better-fetch/fetch";
 import { setCookieToHeader } from "better-auth/cookies";
 import { bearer } from "better-auth/plugins";
-import { IdentityProvider, ServiceProvider } from "samlify";
 import { sso } from ".";
 import { ssoClient } from "./client";
 import { createServer } from "http";
@@ -27,6 +26,7 @@ import type {
 import express from "express";
 import bodyParser from "body-parser";
 import { randomUUID } from "crypto";
+import { getTestInstanceMemory } from "better-auth/test";
 
 const spMetadata = `
     <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="http://localhost:3001/api/sso/saml2/sp/metadata">
@@ -353,13 +353,15 @@ const createTemplateCallback =
 			context: saml.SamlLib.replaceTagsByValue(template, tagValues),
 		};
 	};
-function createMockSAMLIdP(port: number) {
+
+const createMockSAMLIdP = (port: number) => {
 	const app: ExpressApp = express();
 	let server: ReturnType<typeof createServer> | undefined;
+
 	app.use(bodyParser.urlencoded({ extended: true }));
 	app.use(bodyParser.json());
 
-	const idp = IdentityProvider({
+	const idp = saml.IdentityProvider({
 		metadata: idpMetadata,
 		privateKey: idPk,
 		isAssertionEncrypted: false,
@@ -389,7 +391,7 @@ function createMockSAMLIdP(port: number) {
 			],
 		},
 	});
-	const sp = ServiceProvider({
+	const sp = saml.ServiceProvider({
 		metadata: spMetadata,
 	});
 	app.get(
@@ -420,37 +422,32 @@ function createMockSAMLIdP(port: number) {
 			res.status(200).send({ samlResponse: context, entityEndpoint });
 		},
 	);
-	// @ts-ignore
-	app.post(
-		"/api/sso/saml2/sp/acs",
-		async (req: ExpressRequest, res: ExpressResponse) => {
-			try {
-				const parseResult = await sp.parseLoginResponse(
-					idp,
-					saml.Constants.wording.binding.post,
-					req,
-				);
-				const { extract } = parseResult;
-				const { attributes } = extract;
-				const relayState = req.body.RelayState;
-				if (relayState) {
-					return res.status(200).send({ relayState, attributes });
-				} else {
-					return res
-						.status(200)
-						.send({ extract, message: "RelayState is missing." });
-				}
-			} catch (error) {
-				console.error("Error handling SAML ACS endpoint:", error);
-				res.status(500).send({ error: "Failed to process SAML response." });
+	app.post("/api/sso/saml2/sp/acs", async (req: any, res: any) => {
+		try {
+			const parseResult = await sp.parseLoginResponse(
+				idp,
+				saml.Constants.wording.binding.post,
+				req,
+			);
+			const { extract } = parseResult;
+			const { attributes } = extract;
+			const relayState = req.body.RelayState;
+			if (relayState) {
+				return res.status(200).send({ relayState, attributes });
+			} else {
+				return res
+					.status(200)
+					.send({ extract, message: "RelayState is missing." });
 			}
-		},
-	);
+		} catch (error) {
+			console.error("Error handling SAML ACS endpoint:", error);
+			res.status(500).send({ error: "Failed to process SAML response." });
+		}
+	});
 	app.post(
-		"/api/sso/saml2/callback",
+		"/api/sso/saml2/callback/:providerId",
 		async (req: ExpressRequest, res: ExpressResponse) => {
 			const { SAMLResponse, RelayState } = req.body;
-
 			try {
 				const parseResult = await sp.parseLoginResponse(
 					idp,
@@ -474,29 +471,28 @@ function createMockSAMLIdP(port: number) {
 			res.send(idpMetadata);
 		},
 	);
-
-	return {
-		start: () => {
-			return new Promise<void>((resolve) => {
-				server = app.listen(port, () => {
-					console.log(`Mock SAML IdP running on port ${port}`);
-					resolve();
-				});
+	const start = () =>
+		new Promise<void>((resolve) => {
+			app.use(bodyParser.urlencoded({ extended: true }));
+			server = app.listen(port, () => {
+				console.log(`Mock SAML IdP running on port ${port}`);
+				resolve();
 			});
-		},
-		stop: () => {
-			return new Promise<void>((resolve, reject) => {
-				server?.close((err) => {
-					if (err) reject(err);
-					else resolve();
-				});
+		});
+
+	const stop = () =>
+		new Promise<void>((resolve, reject) => {
+			app.use(bodyParser.urlencoded({ extended: true }));
+			server?.close((err) => {
+				if (err) reject(err);
+				else resolve();
 			});
-		},
-		get metadataUrl() {
-			return `http://localhost:${port}/idp/metadata`;
-		},
-	};
-}
+		});
+
+	const metadataUrl = `http://localhost:${port}/idp/metadata`;
+
+	return { start, stop, metadataUrl };
+};
 
 describe("SAML SSO", async () => {
 	const data = {
@@ -709,7 +705,7 @@ describe("SAML SSO", async () => {
 				samlConfig: {
 					entryPoint: "http://localhost:8081/api/sso/saml2/idp/post",
 					cert: certificate,
-					callbackUrl: "http://localhost:8081/api/sso/saml2/callback",
+					callbackUrl: "http://localhost:8081/dashboard",
 					wantAssertionsSigned: false,
 					signatureAlgorithm: "sha256",
 					digestAlgorithm: "sha256",
@@ -748,7 +744,6 @@ describe("SAML SSO", async () => {
 			url: expect.stringContaining("http://localhost:8081"),
 			redirect: true,
 		});
-
 		let samlResponse: any;
 		await betterFetch(signInResponse?.url as string, {
 			onSuccess: async (context) => {
@@ -756,21 +751,168 @@ describe("SAML SSO", async () => {
 			},
 		});
 		let redirectLocation = "";
-		await betterFetch("http://localhost:8081/api/sso/saml2/callback", {
-			method: "POST",
-			redirect: "manual",
-			headers: {
-				"Content-Type": "application/x-www-form-urlencoded",
+		await betterFetch(
+			"http://localhost:8081/api/sso/saml2/callback/saml-provider-1",
+			{
+				method: "POST",
+				redirect: "manual",
+				headers: {
+					"Content-Type": "application/x-www-form-urlencoded",
+				},
+				body: new URLSearchParams({
+					SAMLResponse: samlResponse.samlResponse,
+				}),
+				onError: (context) => {
+					expect(context.response.status).toBe(302);
+					redirectLocation = context.response.headers.get("location") || "";
+				},
 			},
-			body: new URLSearchParams({
-				SAMLResponse: samlResponse.samlResponse,
-				RelayState: "http://localhost:3000/dashboard",
+		);
+		expect(redirectLocation).toBe("http://localhost:3000/dashboard");
+	});
+
+	it("should not allow creating a provider if limit is set to 0", async () => {
+		const { auth, signInWithTestUser } = await getTestInstanceMemory({
+			plugins: [sso({ providersLimit: 0 })],
+		});
+		const { headers } = await signInWithTestUser();
+		await expect(
+			auth.api.registerSSOProvider({
+				body: {
+					providerId: "saml-provider-1",
+					issuer: "http://localhost:8081",
+					domain: "http://localhost:8081",
+					samlConfig: {
+						entryPoint: mockIdP.metadataUrl,
+						cert: certificate,
+						callbackUrl: "http://localhost:8081/api/sso/saml2/callback",
+						wantAssertionsSigned: false,
+						signatureAlgorithm: "sha256",
+						digestAlgorithm: "sha256",
+						spMetadata: {
+							metadata: spMetadata,
+						},
+					},
+				},
+				headers,
 			}),
-			onError: (context) => {
-				expect(context.response.status).toBe(302);
-				redirectLocation = context.response.headers.get("location") || "";
+		).rejects.toMatchObject({
+			status: "FORBIDDEN",
+			body: { message: "SSO provider registration is disabled" },
+		});
+	});
+
+	it("should not allow creating a provider if limit is reached", async () => {
+		const { auth, signInWithTestUser } = await getTestInstanceMemory({
+			plugins: [sso({ providersLimit: 1 })],
+		});
+		const { headers } = await signInWithTestUser();
+
+		await auth.api.registerSSOProvider({
+			body: {
+				providerId: "saml-provider-1",
+				issuer: "http://localhost:8081",
+				domain: "http://localhost:8081",
+				samlConfig: {
+					entryPoint: mockIdP.metadataUrl,
+					cert: certificate,
+					callbackUrl: "http://localhost:8081/api/sso/saml2/callback",
+					wantAssertionsSigned: false,
+					signatureAlgorithm: "sha256",
+					digestAlgorithm: "sha256",
+					spMetadata: {
+						metadata: spMetadata,
+					},
+				},
+			},
+			headers,
+		});
+
+		await expect(
+			auth.api.registerSSOProvider({
+				body: {
+					providerId: "saml-provider-2",
+					issuer: "http://localhost:8081",
+					domain: "http://localhost:8081",
+					samlConfig: {
+						entryPoint: mockIdP.metadataUrl,
+						cert: certificate,
+						callbackUrl: "http://localhost:8081/api/sso/saml2/callback",
+						wantAssertionsSigned: false,
+						signatureAlgorithm: "sha256",
+						digestAlgorithm: "sha256",
+						spMetadata: {
+							metadata: spMetadata,
+						},
+					},
+				},
+				headers,
+			}),
+		).rejects.toMatchObject({
+			status: "FORBIDDEN",
+			body: {
+				message: "You have reached the maximum number of SSO providers",
+			},
+		});
+	});
+
+	it("should not allow creating a provider if limit from function is reached", async () => {
+		const { auth, signInWithTestUser } = await getTestInstanceMemory({
+			plugins: [
+				sso({
+					providersLimit: async (user) => {
+						return user.email === "pro@example.com" ? 2 : 1;
+					},
+				}),
+			],
+		});
+		const { headers } = await signInWithTestUser();
+
+		await auth.api.registerSSOProvider({
+			body: {
+				providerId: "saml-provider-1",
+				issuer: "http://localhost:8081",
+				domain: "http://localhost:8081",
+				samlConfig: {
+					entryPoint: mockIdP.metadataUrl,
+					cert: certificate,
+					callbackUrl: "http://localhost:8081/api/sso/saml2/callback",
+					wantAssertionsSigned: false,
+					signatureAlgorithm: "sha256",
+					digestAlgorithm: "sha256",
+					spMetadata: {
+						metadata: spMetadata,
+					},
+				},
+			},
+			headers,
+		});
+
+		await expect(
+			auth.api.registerSSOProvider({
+				body: {
+					providerId: "saml-provider-2",
+					issuer: "http://localhost:8081",
+					domain: "http://localhost:8081",
+					samlConfig: {
+						entryPoint: mockIdP.metadataUrl,
+						cert: certificate,
+						callbackUrl: "http://localhost:8081/api/sso/saml2/callback",
+						wantAssertionsSigned: false,
+						signatureAlgorithm: "sha256",
+						digestAlgorithm: "sha256",
+						spMetadata: {
+							metadata: spMetadata,
+						},
+					},
+				},
+				headers,
+			}),
+		).rejects.toMatchObject({
+			status: "FORBIDDEN",
+			body: {
+				message: "You have reached the maximum number of SSO providers",
 			},
 		});
-		expect(redirectLocation).toBe("http://localhost:3000/dashboard");
 	});
 });