@boxyhq/saml-jackson 1.2.1 → 1.3.0

package/dist/controller/api.js

@@ -31,392 +31,531 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-var __rest = (this && this.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.APIController = void 0;
-const crypto_1 = __importDefault(require("crypto"));
+exports.ConnectionAPIController = void 0;
 const dbutils = __importStar(require("../db/utils"));
 const metrics = __importStar(require("../opentelemetry/metrics"));
-const saml20_1 = __importDefault(require("@boxyhq/saml20"));
-const x509_1 = __importDefault(require("../saml/x509"));
 const error_1 = require("./error");
 const utils_1 = require("./utils");
-class APIController {
-    constructor({ configStore }) {
-        this.configStore = configStore;
-    }
-    _validateRedirectUrl({ redirectUrlList, defaultRedirectUrl }) {
-        if (redirectUrlList) {
-            if (redirectUrlList.length > 100) {
-                throw new error_1.JacksonError('Exceeded maximum number of allowed redirect urls', 400);
-            }
-            for (const url of redirectUrlList) {
-                (0, utils_1.validateAbsoluteUrl)(url, 'redirectUrl is invalid');
-            }
-        }
-        if (defaultRedirectUrl) {
-            (0, utils_1.validateAbsoluteUrl)(defaultRedirectUrl, 'defaultRedirectUrl is invalid');
-        }
-    }
-    _validateIdPConfig(body) {
-        const { encodedRawMetadata, rawMetadata, defaultRedirectUrl, redirectUrl, tenant, product, description } = body;
-        if (!rawMetadata && !encodedRawMetadata) {
-            throw new error_1.JacksonError('Please provide rawMetadata or encodedRawMetadata', 400);
-        }
-        if (!defaultRedirectUrl) {
-            throw new error_1.JacksonError('Please provide a defaultRedirectUrl', 400);
-        }
-        if (!redirectUrl) {
-            throw new error_1.JacksonError('Please provide redirectUrl', 400);
-        }
-        if (!tenant) {
-            throw new error_1.JacksonError('Please provide tenant', 400);
-        }
-        if (!product) {
-            throw new error_1.JacksonError('Please provide product', 400);
-        }
-        if (description && description.length > 100) {
-            throw new error_1.JacksonError('Description should not exceed 100 characters', 400);
-        }
+const oidc_1 = __importDefault(require("./connection/oidc"));
+const saml_1 = __importDefault(require("./connection/saml"));
+class ConnectionAPIController {
+    constructor({ connectionStore }) {
+        this.connectionStore = connectionStore;
     }
     /**
      * @swagger
+     * definitions:
+     *    Connection:
+     *      type: object
+     *      example:
+     *          {
+     *            "idpMetadata": {
+     *              "sso": {
+     *                "postUrl": "https://dev-20901260.okta.com/app/dev-20901260_jacksonnext_1/xxxxxxxxxxxsso/saml",
+     *                "redirectUrl": "https://dev-20901260.okta.com/app/dev-20901260_jacksonnext_1/xxxxxxxxxxxsso/saml"
+     *              },
+     *              "entityID": "http://www.okta.com/xxxxxxxxxxxxx",
+     *              "thumbprint": "Eo+eUi3UM3XIMkFFtdVK3yJ5vO9f7YZdasdasdad",
+     *              "loginType": "idp",
+     *              "provider": "okta.com"
+     *            },
+     *            "defaultRedirectUrl": "https://hoppscotch.io/",
+     *            "redirectUrl": ["https://hoppscotch.io/"],
+     *            "tenant": "hoppscotch.io",
+     *            "product": "API Engine",
+     *            "name": "Hoppscotch-SP",
+     *            "description": "SP for hoppscotch.io",
+     *            "clientID": "Xq8AJt3yYAxmXizsCWmUBDRiVP1iTC8Y/otnvFIMitk",
+     *            "clientSecret": "00e3e11a3426f97d8000000738300009130cd45419c5943",
+     *            "certs": {
+     *              "publicKey": "-----BEGIN CERTIFICATE-----.......-----END CERTIFICATE-----",
+     *              "privateKey": "-----BEGIN PRIVATE KEY-----......-----END PRIVATE KEY-----"
+     *            }
+     *          }
+     *    validationErrorsPost:
+     *      description: Please provide rawMetadata or encodedRawMetadata | Please provide a defaultRedirectUrl | Please provide redirectUrl | redirectUrl is invalid | Exceeded maximum number of allowed redirect urls | defaultRedirectUrl is invalid | Please provide tenant | Please provide product | Please provide a friendly name | Description should not exceed 100 characters | Strategy&#58; xxxx not supported | Please provide the clientId from OpenID Provider | Please provide the clientSecret from OpenID Provider | Please provide the discoveryUrl for the OpenID Provider
      *
+     * parameters:
+     *   nameParamPost:
+     *     name: name
+     *     description: Name/identifier for the connection
+     *     type: string
+     *     in: formData
+     *   descriptionParamPost:
+     *     name: description
+     *     description: A short description for the connection not more than 100 characters
+     *     type: string
+     *     in: formData
+     *   encodedRawMetadataParamPost:
+     *     name: encodedRawMetadata
+     *     description: Base64 encoding of the XML metadata
+     *     in: formData
+     *     type: string
+     *   rawMetadataParamPost:
+     *     name: rawMetadata
+     *     description: Raw XML metadata
+     *     in: formData
+     *     type: string
+     *   defaultRedirectUrlParamPost:
+     *     name: defaultRedirectUrl
+     *     description: The redirect URL to use in the IdP login flow
+     *     in: formData
+     *     required: true
+     *     type: string
+     *   redirectUrlParamPost:
+     *     name: redirectUrl
+     *     description: JSON encoded array containing a list of allowed redirect URLs
+     *     in: formData
+     *     required: true
+     *     type: string
+     *   tenantParamPost:
+     *     name: tenant
+     *     description: Tenant
+     *     in: formData
+     *     required: true
+     *     type: string
+     *   productParamPost:
+     *     name: product
+     *     description: Product
+     *     in: formData
+     *     required: true
+     *     type: string
+     *   oidcDiscoveryUrlPost:
+     *     name: oidcDiscoveryUrl
+     *     description: well-known URL where the OpenID Provider configuration is exposed
+     *     in: formData
+     *     type: string
+     *   oidcClientIdPost:
+     *     name: oidcClientId
+     *     description: clientId of the application set up on the OpenID Provider
+     *     in: formData
+     *     type: string
+     *   oidcClientSecretPost:
+     *     name: oidcClientSecret
+     *     description: clientSecret of the application set up on the OpenID Provider
+     *     in: formData
+     *     type: string
      * /api/v1/saml/config:
      *   post:
-     *     summary: Create SAML configuration
-     *     operationId: create-saml-config
-     *     tags: [SAML Config]
+     *    summary: Create SAML config
+     *    operationId: create-saml-config
+     *    deprecated: true
+     *    tags: [SAML Config - Deprecated]
+     *    produces:
+     *      - application/json
+     *    consumes:
+     *      - application/x-www-form-urlencoded
+     *      - application/json
+     *    parameters:
+     *      - $ref: '#/parameters/nameParamPost'
+     *      - $ref: '#/parameters/descriptionParamPost'
+     *      - $ref: '#/parameters/encodedRawMetadataParamPost'
+     *      - $ref: '#/parameters/rawMetadataParamPost'
+     *      - $ref: '#/parameters/defaultRedirectUrlParamPost'
+     *      - $ref: '#/parameters/redirectUrlParamPost'
+     *      - $ref: '#/parameters/tenantParamPost'
+     *      - $ref: '#/parameters/productParamPost'
+     *    responses:
+     *      200:
+     *        description: Success
+     *        schema:
+     *          $ref:  '#/definitions/Connection'
+     *      400:
+     *          $ref: '#/definitions/validationErrorsPost'
+     *      401:
+     *        description: Unauthorized
+     * /api/v1/connections:
+     *   post:
+     *     summary: Create SSO connection
+     *     operationId: create-sso-connection
+     *     tags: [Connections]
      *     produces:
-     *       - application/json
+     *      - application/json
      *     consumes:
-     *       - application/x-www-form-urlencoded
+     *      - application/x-www-form-urlencoded
+     *      - application/json
      *     parameters:
-     *       - name: name
-     *         description: Name/identifier for the config
-     *         type: string
-     *         in: formData
-     *       - name: description
-     *         description: A short description for the config not more than 100 characters
-     *         type: string
-     *         in: formData
-     *       - name: encodedRawMetadata
-     *         description: Base64 encoding of the XML metadata
-     *         in: formData
-     *         type: string
-     *       - name: rawMetadata
-     *         description: Raw XML metadata
-     *         in: formData
-     *         type: string
-     *       - name: defaultRedirectUrl
-     *         description: The redirect URL to use in the IdP login flow
-     *         in: formData
-     *         required: true
-     *         type: string
-     *       - name: redirectUrl
-     *         description: JSON encoded array containing a list of allowed redirect URLs
-     *         in: formData
-     *         required: true
-     *         type: string
-     *       - name: tenant
-     *         description: Tenant
-     *         in: formData
-     *         required: true
-     *         type: string
-     *       - name: product
-     *         description: Product
-     *         in: formData
-     *         required: true
-     *         type: string
+     *      - $ref: '#/parameters/nameParamPost'
+     *      - $ref: '#/parameters/descriptionParamPost'
+     *      - $ref: '#/parameters/encodedRawMetadataParamPost'
+     *      - $ref: '#/parameters/rawMetadataParamPost'
+     *      - $ref: '#/parameters/defaultRedirectUrlParamPost'
+     *      - $ref: '#/parameters/redirectUrlParamPost'
+     *      - $ref: '#/parameters/tenantParamPost'
+     *      - $ref: '#/parameters/productParamPost'
+     *      - $ref: '#/parameters/oidcDiscoveryUrlPost'
+     *      - $ref: '#/parameters/oidcClientIdPost'
+     *      - $ref: '#/parameters/oidcClientSecretPost'
      *     responses:
      *       200:
      *         description: Success
      *         schema:
-     *           type: object
-     *           example:
-     *             {
-     *               "idpMetadata": {
-     *                 "sso": {
-     *                   "postUrl": "https://dev-20901260.okta.com/app/dev-20901260_jacksonnext_1/xxxxxxxxxxxxx/sso/saml",
-     *                   "redirectUrl": "https://dev-20901260.okta.com/app/dev-20901260_jacksonnext_1/xxxxxxxxxxxxx/sso/saml"
-     *                 },
-     *                 "entityID": "http://www.okta.com/xxxxxxxxxxxxx",
-     *                 "thumbprint": "Eo+eUi3UM3XIMkFFtdVK3yJ5vO9f7YZdasdasdad",
-     *                 "loginType": "idp",
-     *                 "provider": "okta.com"
-     *               },
-     *               "defaultRedirectUrl": "https://hoppscotch.io/",
-     *               "redirectUrl": ["https://hoppscotch.io/"],
-     *               "tenant": "hoppscotch.io",
-     *               "product": "API Engine",
-     *               "name": "Hoppscotch-SP",
-     *               "description": "SP for hoppscotch.io",
-     *               "clientID": "Xq8AJt3yYAxmXizsCWmUBDRiVP1iTC8Y/otnvFIMitk",
-     *               "clientSecret": "00e3e11a3426f97d8000000738300009130cd45419c5943",
-     *               "certs": {
-     *                 "publicKey": "-----BEGIN CERTIFICATE-----.......-----END CERTIFICATE-----",
-     *                 "privateKey": "-----BEGIN PRIVATE KEY-----......-----END PRIVATE KEY-----"
-     *               }
-     *           }
+     *           $ref: '#/definitions/Connection'
      *       400:
-     *         description: Please provide rawMetadata or encodedRawMetadata | Please provide a defaultRedirectUrl | Please provide redirectUrl | Please provide tenant | Please provide product | Please provide a friendly name | Description should not exceed 100 characters
+     *           $ref: '#/definitions/validationErrorsPost'
      *       401:
      *         description: Unauthorized
      */
-    config(body) {
+    createSAMLConnection(body) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { encodedRawMetadata, rawMetadata, defaultRedirectUrl, redirectUrl, tenant, product, name, description, } = body;
-            metrics.increment('createConfig');
-            this._validateIdPConfig(body);
-            const redirectUrlList = extractRedirectUrls(redirectUrl);
-            this._validateRedirectUrl({ defaultRedirectUrl, redirectUrlList });
-            let metaData = rawMetadata;
-            if (encodedRawMetadata) {
-                metaData = Buffer.from(encodedRawMetadata, 'base64').toString();
-            }
-            const idpMetadata = yield saml20_1.default.parseMetadata(metaData, {});
-            // extract provider
-            let providerName = extractHostName(idpMetadata.entityID);
-            if (!providerName) {
-                providerName = extractHostName(idpMetadata.sso.redirectUrl || idpMetadata.sso.postUrl);
-            }
-            idpMetadata.provider = providerName ? providerName : 'Unknown';
-            const clientID = dbutils.keyDigest(dbutils.keyFromParts(tenant, product, idpMetadata.entityID));
-            let clientSecret;
-            const exists = yield this.configStore.get(clientID);
-            if (exists) {
-                clientSecret = exists.clientSecret;
-            }
-            else {
-                clientSecret = crypto_1.default.randomBytes(24).toString('hex');
-            }
-            const certs = yield x509_1.default.generate();
-            if (!certs) {
-                throw new Error('Error generating x59 certs');
-            }
-            const record = {
-                idpMetadata,
-                defaultRedirectUrl,
-                redirectUrl: redirectUrlList,
-                tenant,
-                product,
-                name,
-                description,
-                clientID,
-                clientSecret,
-                certs,
-            };
-            yield this.configStore.put(clientID, record, {
-                // secondary index on entityID
-                name: utils_1.IndexNames.EntityID,
-                value: idpMetadata.entityID,
-            }, {
-                // secondary index on tenant + product
-                name: utils_1.IndexNames.TenantProduct,
-                value: dbutils.keyFromParts(tenant, product),
-            });
+            metrics.increment('createConnection');
+            const record = yield saml_1.default.create(body, this.connectionStore);
+            return record;
+        });
+    }
+    // For backwards compatibility
+    config(...args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.createSAMLConnection(...args);
+        });
+    }
+    createOIDCConnection(body) {
+        return __awaiter(this, void 0, void 0, function* () {
+            metrics.increment('createConnection');
+            const record = yield oidc_1.default.create(body, this.connectionStore);
             return record;
         });
     }
     /**
      * @swagger
-     *
+     * definitions:
+     *   validationErrorsPatch:
+     *     description: Please provide clientID | Please provide clientSecret | clientSecret mismatch | Tenant/Product config mismatch with IdP metadata | Description should not exceed 100 characters| redirectUrl is invalid | Exceeded maximum number of allowed redirect urls | defaultRedirectUrl is invalid | Tenant/Product config mismatch with OIDC Provider metadata
+     * parameters:
+     *   clientIDParamPatch:
+     *     name: clientID
+     *     description: Client ID for the connection
+     *     type: string
+     *     in: formData
+     *     required: true
+     *   clientSecretParamPatch:
+     *     name: clientSecret
+     *     description: Client Secret for the connection
+     *     type: string
+     *     in: formData
+     *     required: true
+     *   nameParamPatch:
+     *     name: name
+     *     description: Name/identifier for the connection
+     *     type: string
+     *     in: formData
+     *   descriptionParamPatch:
+     *     name: description
+     *     description: A short description for the connection not more than 100 characters
+     *     type: string
+     *     in: formData
+     *   encodedRawMetadataParamPatch:
+     *     name: encodedRawMetadata
+     *     description: Base64 encoding of the XML metadata
+     *     in: formData
+     *     type: string
+     *   rawMetadataParamPatch:
+     *     name: rawMetadata
+     *     description: Raw XML metadata
+     *     in: formData
+     *     type: string
+     *   oidcDiscoveryUrlPatch:
+     *     name: oidcDiscoveryUrl
+     *     description: well-known URL where the OpenID Provider configuration is exposed
+     *     in: formData
+     *     type: string
+     *   oidcClientIdPatch:
+     *     name: oidcClientId
+     *     description: clientId of the application set up on the OpenID Provider
+     *     in: formData
+     *     type: string
+     *   oidcClientSecretPatch:
+     *     name: oidcClientSecret
+     *     description: clientSecret of the application set up on the OpenID Provider
+     *     in: formData
+     *     type: string
+     *   defaultRedirectUrlParamPatch:
+     *     name: defaultRedirectUrl
+     *     description: The redirect URL to use in the IdP login flow
+     *     in: formData
+     *     type: string
+     *   redirectUrlParamPatch:
+     *     name: redirectUrl
+     *     description: JSON encoded array containing a list of allowed redirect URLs
+     *     in: formData
+     *     type: string
+     *   tenantParamPatch:
+     *     name: tenant
+     *     description: Tenant
+     *     in: formData
+     *     required: true
+     *     type: string
+     *   productParamPatch:
+     *     name: product
+     *     description: Product
+     *     in: formData
+     *     required: true
+     *     type: string
      * /api/v1/saml/config:
      *   patch:
-     *     summary: Update SAML configuration
+     *     summary: Update SAML Config
      *     operationId: update-saml-config
-     *     tags: [SAML Config]
+     *     tags: [SAML Config - Deprecated]
+     *     deprecated: true
+     *     consumes:
+     *       - application/json
+     *       - application/x-www-form-urlencoded
+     *     parameters:
+     *       - $ref: '#/parameters/clientIDParamPatch'
+     *       - $ref: '#/parameters/clientSecretParamPatch'
+     *       - $ref: '#/parameters/nameParamPatch'
+     *       - $ref: '#/parameters/descriptionParamPatch'
+     *       - $ref: '#/parameters/encodedRawMetadataParamPatch'
+     *       - $ref: '#/parameters/rawMetadataParamPatch'
+     *       - $ref: '#/parameters/defaultRedirectUrlParamPatch'
+     *       - $ref: '#/parameters/redirectUrlParamPatch'
+     *       - $ref: '#/parameters/tenantParamPatch'
+     *       - $ref: '#/parameters/productParamPatch'
+     *     responses:
+     *       204:
+     *         description: Success
+     *       400:
+     *         $ref: '#/definitions/validationErrorsPatch'
+     *       401:
+     *         description: Unauthorized
+     * /api/v1/connections:
+     *   patch:
+     *     summary: Update SSO Connection
+     *     operationId: update-sso-connection
+     *     tags: [Connections]
      *     consumes:
      *       - application/json
      *       - application/x-www-form-urlencoded
      *     parameters:
-     *       - name: clientID
-     *         description: Client ID for the config
-     *         type: string
-     *         in: formData
-     *         required: true
-     *       - name: clientSecret
-     *         description: Client Secret for the config
-     *         type: string
-     *         in: formData
-     *         required: true
-     *       - name: name
-     *         description: Name/identifier for the config
-     *         type: string
-     *         in: formData
-     *       - name: description
-     *         description: A short description for the config not more than 100 characters
-     *         type: string
-     *         in: formData
-     *       - name: encodedRawMetadata
-     *         description: Base64 encoding of the XML metadata
-     *         in: formData
-     *         type: string
-     *       - name: rawMetadata
-     *         description: Raw XML metadata
-     *         in: formData
-     *         type: string
-     *       - name: defaultRedirectUrl
-     *         description: The redirect URL to use in the IdP login flow
-     *         in: formData
-     *         required: true
-     *         type: string
-     *       - name: redirectUrl
-     *         description: JSON encoded array containing a list of allowed redirect URLs
-     *         in: formData
-     *         required: true
-     *         type: string
-     *       - name: tenant
-     *         description: Tenant
-     *         in: formData
-     *         required: true
-     *         type: string
-     *       - name: product
-     *         description: Product
-     *         in: formData
-     *         required: true
-     *         type: string
+     *       - $ref: '#/parameters/clientIDParamPatch'
+     *       - $ref: '#/parameters/clientSecretParamPatch'
+     *       - $ref: '#/parameters/nameParamPatch'
+     *       - $ref: '#/parameters/descriptionParamPatch'
+     *       - $ref: '#/parameters/encodedRawMetadataParamPatch'
+     *       - $ref: '#/parameters/rawMetadataParamPatch'
+     *       - $ref: '#/parameters/oidcDiscoveryUrlPatch'
+     *       - $ref: '#/parameters/oidcClientIdPatch'
+     *       - $ref: '#/parameters/oidcClientSecretPatch'
+     *       - $ref: '#/parameters/defaultRedirectUrlParamPatch'
+     *       - $ref: '#/parameters/redirectUrlParamPatch'
+     *       - $ref: '#/parameters/tenantParamPatch'
+     *       - $ref: '#/parameters/productParamPatch'
      *     responses:
      *       204:
      *         description: Success
      *       400:
-     *         description: Please provide clientID | Please provide clientSecret | clientSecret mismatch | Tenant/Product config mismatch with IdP metadata | Description should not exceed 100 characters
+     *         $ref: '#/definitions/validationErrorsPatch'
      *       401:
      *         description: Unauthorized
      */
-    updateConfig(body) {
+    updateSAMLConnection(body) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { encodedRawMetadata, // could be empty
-            rawMetadata, // could be empty
-            defaultRedirectUrl, redirectUrl, name, description } = body, clientInfo = __rest(body, ["encodedRawMetadata", "rawMetadata", "defaultRedirectUrl", "redirectUrl", "name", "description"]);
-            if (!(clientInfo === null || clientInfo === void 0 ? void 0 : clientInfo.clientID)) {
-                throw new error_1.JacksonError('Please provide clientID', 400);
-            }
-            if (!(clientInfo === null || clientInfo === void 0 ? void 0 : clientInfo.clientSecret)) {
-                throw new error_1.JacksonError('Please provide clientSecret', 400);
-            }
-            if (description && description.length > 100) {
-                throw new error_1.JacksonError('Description should not exceed 100 characters', 400);
-            }
-            const redirectUrlList = redirectUrl ? extractRedirectUrls(redirectUrl) : null;
-            this._validateRedirectUrl({ defaultRedirectUrl, redirectUrlList });
-            const _currentConfig = yield this.getConfig(clientInfo);
-            if (_currentConfig.clientSecret !== (clientInfo === null || clientInfo === void 0 ? void 0 : clientInfo.clientSecret)) {
-                throw new error_1.JacksonError('clientSecret mismatch', 400);
-            }
-            let metaData = rawMetadata;
-            if (encodedRawMetadata) {
-                metaData = Buffer.from(encodedRawMetadata, 'base64').toString();
-            }
-            let newMetadata;
-            if (metaData) {
-                newMetadata = yield saml20_1.default.parseMetadata(metaData, {});
-                // extract provider
-                let providerName = extractHostName(newMetadata.entityID);
-                if (!providerName) {
-                    providerName = extractHostName(newMetadata.sso.redirectUrl || newMetadata.sso.postUrl);
+            yield saml_1.default.update(body, this.connectionStore, this.getConnections.bind(this));
+        });
+    }
+    // For backwards compatibility
+    updateConfig(...args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.updateSAMLConnection(...args);
+        });
+    }
+    updateOIDCConnection(body) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield oidc_1.default.update(body, this.connectionStore, this.getConnections.bind(this));
+        });
+    }
+    /**
+     * @swagger
+     * parameters:
+     *  tenantParamGet:
+     *     in: query
+     *     name: tenant
+     *     type: string
+     *     description: Tenant
+     *  productParamGet:
+     *     in: query
+     *     name: product
+     *     type: string
+     *     description: Product
+     *  clientIDParamGet:
+     *     in: query
+     *     name: clientID
+     *     type: string
+     *     description: Client ID
+     * definitions:
+     *   Connection:
+     *      type: object
+     *      properties:
+     *        clientID:
+     *          type: string
+     *          description: Connection clientID
+     *        clientSecret:
+     *          type: string
+     *          description: Connection clientSecret
+     *        name:
+     *          type: string
+     *          description: Connection name
+     *        description:
+     *          type: string
+     *          description: Connection description
+     *        redirectUrl:
+     *          type: string
+     *          description: A list of allowed redirect URLs
+     *        defaultRedirectUrl:
+     *          type: string
+     *          description: The redirect URL to use in the IdP login flow
+     *        tenant:
+     *          type: string
+     *          description: Connection tenant
+     *        product:
+     *          type: string
+     *          description: Connection product
+     *        idpMetadata:
+     *          type: object
+     *          description: SAML IdP metadata
+     *        certs:
+     *          type: object
+     *          description: Certs generated for SAML connection
+     *        oidcProvider:
+     *          type: object
+     *          description: OIDC IdP metadata
+     * responses:
+     *   '200Get':
+     *     description: Success
+     *     schema:
+     *       type: array
+     *       items:
+     *         $ref: '#/definitions/Connection'
+     *   '400Get':
+     *     description: Please provide `clientID` or `tenant` and `product`.
+     *   '401Get':
+     *     description: Unauthorized
+     * /api/v1/connections:
+     *   get:
+     *     summary: Get SSO Connections
+     *     parameters:
+     *       - $ref: '#/parameters/tenantParamGet'
+     *       - $ref: '#/parameters/productParamGet'
+     *       - $ref: '#/parameters/clientIDParamGet'
+     *     operationId: get-connections
+     *     tags: [Connections]
+     *     responses:
+     *      '200':
+     *        $ref: '#/responses/200Get'
+     *      '400':
+     *        $ref: '#/responses/400Get'
+     *      '401':
+     *        $ref: '#/responses/401Get'
+     */
+    getConnections(body) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const clientID = 'clientID' in body ? body.clientID : undefined;
+            const tenant = 'tenant' in body ? body.tenant : undefined;
+            const product = 'product' in body ? body.product : undefined;
+            const strategy = 'strategy' in body ? body.strategy : undefined;
+            metrics.increment('getConnections');
+            if (clientID) {
+                const connection = yield this.connectionStore.get(clientID);
+                if (!connection || typeof connection !== 'object') {
+                    return [];
                 }
-                newMetadata.provider = providerName ? providerName : 'Unknown';
+                return [connection];
             }
-            if (newMetadata) {
-                // check if clientID matches with new metadata payload
-                const clientID = dbutils.keyDigest(dbutils.keyFromParts(clientInfo.tenant, clientInfo.product, newMetadata.entityID));
-                if (clientID !== (clientInfo === null || clientInfo === void 0 ? void 0 : clientInfo.clientID)) {
-                    throw new error_1.JacksonError('Tenant/Product config mismatch with IdP metadata', 400);
+            if (tenant && product) {
+                const connections = yield this.connectionStore.getByIndex({
+                    name: utils_1.IndexNames.TenantProduct,
+                    value: dbutils.keyFromParts(tenant, product),
+                });
+                if (!connections || !connections.length) {
+                    return [];
+                }
+                // filter if strategy is passed
+                const filteredConnections = strategy
+                    ? connections.filter((connection) => {
+                        if (strategy === 'saml') {
+                            if (connection.idpMetadata) {
+                                return true;
+                            }
+                        }
+                        if (strategy === 'oidc') {
+                            if (connection.oidcProvider) {
+                                return true;
+                            }
+                        }
+                        return false;
+                    })
+                    : connections;
+                if (!filteredConnections.length) {
+                    return [];
                 }
+                return filteredConnections;
             }
-            const record = Object.assign(Object.assign({}, _currentConfig), { name: name ? name : _currentConfig.name, description: description ? description : _currentConfig.description, idpMetadata: newMetadata ? newMetadata : _currentConfig.idpMetadata, defaultRedirectUrl: defaultRedirectUrl ? defaultRedirectUrl : _currentConfig.defaultRedirectUrl, redirectUrl: redirectUrlList ? redirectUrlList : _currentConfig.redirectUrl });
-            yield this.configStore.put(clientInfo === null || clientInfo === void 0 ? void 0 : clientInfo.clientID, record, {
-                // secondary index on entityID
-                name: utils_1.IndexNames.EntityID,
-                value: _currentConfig.idpMetadata.entityID,
-            }, {
-                // secondary index on tenant + product
-                name: utils_1.IndexNames.TenantProduct,
-                value: dbutils.keyFromParts(_currentConfig.tenant, _currentConfig.product),
-            });
+            throw new error_1.JacksonError('Please provide `clientID` or `tenant` and `product`.', 400);
         });
     }
     /**
      * @swagger
-     *
      * /api/v1/saml/config:
      *   get:
-     *     summary: Get SAML configuration
+     *     summary: Get SAML Config
      *     operationId: get-saml-config
-     *     tags:
-     *       - SAML Config
+     *     tags: [SAML Config - Deprecated]
+     *     deprecated: true
      *     parameters:
-     *       - in: query
-     *         name: tenant
-     *         type: string
-     *         description: Tenant
-     *       - in: query
-     *         name: product
-     *         type: string
-     *         description: Product
-     *       - in: query
-     *         name: clientID
-     *         type: string
-     *         description: Client ID
+     *       - $ref: '#/parameters/tenantParamGet'
+     *       - $ref: '#/parameters/productParamGet'
+     *       - $ref: '#/parameters/clientIDParamGet'
      *     responses:
-     *       '200':
+     *      '200':
      *         description: Success
      *         schema:
      *           type: object
      *           example:
      *             {
-     *               "idpMetadata": {
-     *                 "sso": {
-     *                   "postUrl": "https://dev-20901260.okta.com/app/dev-20901260_jacksonnext_1/xxxxxxxxxxxxx/sso/saml",
-     *                   "redirectUrl": "https://dev-20901260.okta.com/app/dev-20901260_jacksonnext_1/xxxxxxxxxxxxx/sso/saml"
-     *                 },
-     *                 "entityID": "http://www.okta.com/xxxxxxxxxxxxx",
-     *                 "thumbprint": "Eo+eUi3UM3XIMkFFtdVK3yJ5vO9f7YZdasdasdad",
-     *                 "loginType": "idp",
-     *                 "provider": "okta.com"
-     *               },
-     *               "defaultRedirectUrl": "https://hoppscotch.io/",
-     *               "redirectUrl": ["https://hoppscotch.io/"],
-     *               "tenant": "hoppscotch.io",
-     *               "product": "API Engine",
-     *               "name": "Hoppscotch-SP",
-     *               "description": "SP for hoppscotch.io",
-     *               "clientID": "Xq8AJt3yYAxmXizsCWmUBDRiVP1iTC8Y/otnvFIMitk",
-     *               "clientSecret": "00e3e11a3426f97d8000000738300009130cd45419c5943",
-     *               "certs": {
-     *                 "publicKey": "-----BEGIN CERTIFICATE-----.......-----END CERTIFICATE-----",
-     *                 "privateKey": "-----BEGIN PRIVATE KEY-----......-----END PRIVATE KEY-----"
-     *               }
-     *           }
-     *       '400':
-     *         description: Please provide `clientID` or `tenant` and `product`.
-     *       '401':
-     *         description: Unauthorized
+     *                "idpMetadata": {
+     *                  "sso": {
+     *                    "postUrl": "https://dev-20901260.okta.com/app/dev-20901260_jacksonnext_1/xxxxxxxxxxxxx/sso/saml",
+     *                    "redirectUrl": "https://dev-20901260.okta.com/app/dev-20901260_jacksonnext_1/xxxxxxxxxxxxx/sso/saml"
+     *                  },
+     *                  "entityID": "http://www.okta.com/xxxxxxxxxxxxx",
+     *                  "thumbprint": "Eo+eUi3UM3XIMkFFtdVK3yJ5vO9f7YZdasdasdad",
+     *                  "loginType": "idp",
+     *                  "provider": "okta.com"
+     *                },
+     *                "defaultRedirectUrl": "https://hoppscotch.io/",
+     *                "redirectUrl": ["https://hoppscotch.io/"],
+     *                "tenant": "hoppscotch.io",
+     *                "product": "API Engine",
+     *                "name": "Hoppscotch-SP",
+     *                "description": "SP for hoppscotch.io",
+     *                "clientID": "Xq8AJt3yYAxmXizsCWmUBDRiVP1iTC8Y/otnvFIMitk",
+     *                "clientSecret": "00e3e11a3426f97d8000000738300009130cd45419c5943",
+     *                "certs": {
+     *                  "publicKey": "-----BEGIN CERTIFICATE-----.......-----END CERTIFICATE-----",
+     *                  "privateKey": "-----BEGIN PRIVATE KEY-----......-----END PRIVATE KEY-----"
+     *                }
+     *            }
+     *      '400':
+     *        $ref: '#/responses/400Get'
+     *      '401':
+     *        $ref: '#/responses/401Get'
      */
     getConfig(body) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { clientID, tenant, product } = body;
-            metrics.increment('getConfig');
+            const clientID = 'clientID' in body ? body.clientID : undefined;
+            const tenant = 'tenant' in body ? body.tenant : undefined;
+            const product = 'product' in body ? body.product : undefined;
+            metrics.increment('getConnections');
             if (clientID) {
-                const samlConfig = yield this.configStore.get(clientID);
+                const samlConfig = yield this.connectionStore.get(clientID);
                 return samlConfig || {};
             }
             if (tenant && product) {
-                const samlConfigs = yield this.configStore.getByIndex({
+                const samlConfigs = yield this.connectionStore.getByIndex({
                     name: utils_1.IndexNames.TenantProduct,
                     value: dbutils.keyFromParts(tenant, product),
                 });
@@ -430,52 +569,90 @@ class APIController {
     }
     /**
      * @swagger
+     * parameters:
+     *   clientIDDel:
+     *     name: clientID
+     *     in: formData
+     *     type: string
+     *     description: Client ID
+     *   clientSecretDel:
+     *     name: clientSecret
+     *     in: formData
+     *     type: string
+     *     description: Client Secret
+     *   tenantDel:
+     *     name: tenant
+     *     in: formData
+     *     type: string
+     *     description: Tenant
+     *   productDel:
+     *     name: product
+     *     in: formData
+     *     type: string
+     *     description: Product
+     *   strategyDel:
+     *     name: strategy
+     *     in: formData
+     *     type: string
+     *     description: Strategy
+     * /api/v1/connections:
+     *   delete:
+     *     parameters:
+     *      - $ref: '#/parameters/clientIDDel'
+     *      - $ref: '#/parameters/clientSecretDel'
+     *      - $ref: '#/parameters/tenantDel'
+     *      - $ref: '#/parameters/productDel'
+     *      - $ref: '#/parameters/strategyDel'
+     *     summary: Delete SSO Connections
+     *     operationId: delete-sso-connection
+     *     tags: [Connections]
+     *     consumes:
+     *       - application/x-www-form-urlencoded
+     *       - application/json
+     *     responses:
+     *       '200':
+     *         description: Success
+     *       '400':
+     *         description: clientSecret mismatch | Please provide `clientID` and `clientSecret` or `tenant` and `product`.
+     *       '401':
+     *         description: Unauthorized
      * /api/v1/saml/config:
      *   delete:
-     *     summary: Delete SAML configuration
+     *     summary: Delete SAML Config
      *     operationId: delete-saml-config
-     *     tags:
-     *       - SAML Config
+     *     tags: [SAML Config - Deprecated]
+     *     deprecated: true
      *     consumes:
      *       - application/x-www-form-urlencoded
+     *       - application/json
      *     parameters:
-     *       - name: clientID
-     *         in: formData
-     *         type: string
-     *         required: true
-     *         description: Client ID
-     *       - name: clientSecret
-     *         in: formData
-     *         type: string
-     *         required: true
-     *         description: Client Secret
-     *       - name: tenant
-     *         in: formData
-     *         type: string
-     *         description: Tenant
-     *       - name: product
-     *         in: formData
-     *         type: string
-     *         description: Product
+     *      - $ref: '#/parameters/clientIDDel'
+     *      - $ref: '#/parameters/clientSecretDel'
+     *      - $ref: '#/parameters/tenantDel'
+     *      - $ref: '#/parameters/productDel'
      *     responses:
      *       '200':
      *         description: Success
      *       '400':
-     *         description: clientSecret mismatch | Please provide `clientID` and `clientSecret` or `tenant` and `product`.'
+     *         description: clientSecret mismatch | Please provide `clientID` and `clientSecret` or `tenant` and `product`.
      *       '401':
      *         description: Unauthorized
      */
-    deleteConfig(body) {
+    deleteConnections(body) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { clientID, clientSecret, tenant, product } = body;
-            metrics.increment('deleteConfig');
+            const clientID = 'clientID' in body ? body.clientID : undefined;
+            const clientSecret = 'clientSecret' in body ? body.clientSecret : undefined;
+            const tenant = 'tenant' in body ? body.tenant : undefined;
+            const product = 'product' in body ? body.product : undefined;
+            const strategy = 'strategy' in body ? body.strategy : undefined;
+            metrics.increment('deleteConnections');
             if (clientID && clientSecret) {
-                const samlConfig = yield this.configStore.get(clientID);
-                if (!samlConfig) {
+                const connection = yield this.connectionStore.get(clientID);
+                if (!connection) {
                     return;
                 }
-                if (samlConfig.clientSecret === clientSecret) {
-                    yield this.configStore.delete(clientID);
+                if (connection.clientSecret === clientSecret) {
+                    yield this.connectionStore.delete(clientID);
                 }
                 else {
                     throw new error_1.JacksonError('clientSecret mismatch', 400);
@@ -483,47 +660,41 @@ class APIController {
                 return;
             }
             if (tenant && product) {
-                const samlConfigs = yield this.configStore.getByIndex({
+                const connections = yield this.connectionStore.getByIndex({
                     name: utils_1.IndexNames.TenantProduct,
                     value: dbutils.keyFromParts(tenant, product),
                 });
-                if (!samlConfigs || !samlConfigs.length) {
+                if (!connections || !connections.length) {
                     return;
                 }
-                for (const conf of samlConfigs) {
-                    yield this.configStore.delete(conf.clientID);
+                // filter if strategy is passed
+                const filteredConnections = strategy
+                    ? connections.filter((connection) => {
+                        if (strategy === 'saml') {
+                            if (connection.idpMetadata) {
+                                return true;
+                            }
+                        }
+                        if (strategy === 'oidc') {
+                            if (connection.oidcProvider) {
+                                return true;
+                            }
+                        }
+                        return false;
+                    })
+                    : connections;
+                for (const conf of filteredConnections) {
+                    yield this.connectionStore.delete(conf.clientID);
                 }
                 return;
             }
             throw new error_1.JacksonError('Please provide `clientID` and `clientSecret` or `tenant` and `product`.', 400);
         });
     }
-}
-exports.APIController = APIController;
-const extractHostName = (url) => {
-    try {
-        const pUrl = new URL(url);
-        if (pUrl.hostname.startsWith('www.')) {
-            return pUrl.hostname.substring(4);
-        }
-        return pUrl.hostname;
-    }
-    catch (err) {
-        return null;
-    }
-};
-const extractRedirectUrls = (urls) => {
-    if (!urls) {
-        return [];
-    }
-    if (typeof urls === 'string') {
-        if (urls.startsWith('[')) {
-            // redirectUrl is a stringified array
-            return JSON.parse(urls);
-        }
-        // redirectUrl is a single URL
-        return [urls];
+    deleteConfig(body) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.deleteConnections(Object.assign(Object.assign({}, body), { strategy: 'saml' }));
+        });
     }
-    // redirectUrl is an array of URLs
-    return urls;
-};
+}
+exports.ConnectionAPIController = ConnectionAPIController;