chore: import upstream snapshot with attribution

apps/sim/app/api/auth/sso/providers/route.ts

@@ -0,0 +1,107 @@
+import { db, member, ssoProvider } from '@sim/db'
+import { createLogger } from '@sim/logger'
+import { and, eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { listSsoProvidersContract } from '@/lib/api/contracts/auth'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { enforceIpRateLimit } from '@/lib/core/rate-limiter'
+import { REDACTED_MARKER } from '@/lib/core/security/redaction'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('SSOProvidersRoute')
+
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      const rateLimited = await enforceIpRateLimit('sso-providers', request, {
+        maxTokens: 20,
+        refillRate: 20,
+        refillIntervalMs: 60_000,
+      })
+      if (rateLimited) return rateLimited
+    }
+    const parsed = await parseRequest(listSsoProvidersContract, request, {})
+    if (!parsed.success) return parsed.response
+    const { organizationId } = parsed.data.query
+
+    let providers
+    if (session?.user?.id) {
+      const userId = session.user.id
+
+      let verifiedOrganizationId: string | null = null
+      if (organizationId) {
+        const [membership] = await db
+          .select({ organizationId: member.organizationId, role: member.role })
+          .from(member)
+          .where(and(eq(member.userId, userId), eq(member.organizationId, organizationId)))
+          .limit(1)
+        if (!membership) {
+          return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+        }
+        if (membership.role !== 'owner' && membership.role !== 'admin') {
+          return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+        }
+        verifiedOrganizationId = membership.organizationId
+      }
+
+      const whereClause = verifiedOrganizationId
+        ? eq(ssoProvider.organizationId, verifiedOrganizationId)
+        : eq(ssoProvider.userId, userId)
+
+      const results = await db
+        .select({
+          id: ssoProvider.id,
+          providerId: ssoProvider.providerId,
+          domain: ssoProvider.domain,
+          issuer: ssoProvider.issuer,
+          oidcConfig: ssoProvider.oidcConfig,
+          samlConfig: ssoProvider.samlConfig,
+          userId: ssoProvider.userId,
+          organizationId: ssoProvider.organizationId,
+        })
+        .from(ssoProvider)
+        .where(whereClause)
+
+      providers = results.map((provider) => {
+        let oidcConfig = provider.oidcConfig
+        if (oidcConfig) {
+          try {
+            const parsed = JSON.parse(oidcConfig)
+            parsed.clientSecret = REDACTED_MARKER
+            oidcConfig = JSON.stringify(parsed)
+          } catch {
+            oidcConfig = null
+          }
+        }
+        return {
+          ...provider,
+          oidcConfig,
+          providerType: (provider.samlConfig ? 'saml' : 'oidc') as 'oidc' | 'saml',
+        }
+      })
+    } else {
+      const results = await db
+        .select({
+          domain: ssoProvider.domain,
+        })
+        .from(ssoProvider)
+
+      providers = results.map((provider) => ({
+        domain: provider.domain,
+      }))
+    }
+
+    logger.info('Fetched SSO providers', {
+      userId: session?.user?.id,
+      authenticated: !!session?.user?.id,
+      providerCount: providers.length,
+    })
+
+    return NextResponse.json({ providers })
+  } catch (error) {
+    logger.error('Failed to fetch SSO providers', { error })
+    return NextResponse.json({ error: 'Failed to fetch SSO providers' }, { status: 500 })
+  }
+})