chore: import upstream snapshot with attribution

apps/sim/app/api/files/public/[token]/sso/route.test.ts

@@ -0,0 +1,82 @@
+/**
+ * @vitest-environment node
+ */
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockResolveActiveShareByToken, mockIsEmailAllowed, mockCheckRateLimitDirect } = vi.hoisted(
+  () => ({
+    mockResolveActiveShareByToken: vi.fn(),
+    mockIsEmailAllowed: vi.fn(),
+    mockCheckRateLimitDirect: vi.fn(),
+  })
+)
+
+vi.mock('@/lib/public-shares/share-manager', () => ({
+  resolveActiveShareByToken: mockResolveActiveShareByToken,
+}))
+vi.mock('@/lib/core/security/deployment', () => ({ isEmailAllowed: mockIsEmailAllowed }))
+vi.mock('@/lib/core/rate-limiter', () => ({
+  RateLimiter: class {
+    checkRateLimitDirect = mockCheckRateLimitDirect
+  },
+}))
+
+import { POST } from '@/app/api/files/public/[token]/sso/route'
+
+const params = (token = 'tok_1') => ({ params: Promise.resolve({ token }) })
+const post = (email: string, token = 'tok_1') =>
+  new NextRequest(`http://localhost/api/files/public/${token}/sso`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ email }),
+  })
+
+const ssoShare = {
+  share: { id: 'sh_1', authType: 'sso', password: null, allowedEmails: ['@acme.com'] },
+  file: { originalName: 'report.pdf' },
+}
+
+describe('POST /api/files/public/[token]/sso', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockCheckRateLimitDirect.mockResolvedValue({ allowed: true })
+    mockResolveActiveShareByToken.mockResolvedValue(ssoShare)
+  })
+
+  it('returns eligible:true for an allow-listed email', async () => {
+    mockIsEmailAllowed.mockReturnValueOnce(true)
+    const res = await POST(post('user@acme.com'), params())
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ eligible: true })
+  })
+
+  it('returns eligible:false for a non-listed email', async () => {
+    mockIsEmailAllowed.mockReturnValueOnce(false)
+    const res = await POST(post('user@evil.com'), params())
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ eligible: false })
+  })
+
+  it('rejects a non-sso share with 400', async () => {
+    mockResolveActiveShareByToken.mockResolvedValueOnce({
+      ...ssoShare,
+      share: { ...ssoShare.share, authType: 'email' },
+    })
+    const res = await POST(post('user@acme.com'), params())
+    expect(res.status).toBe(400)
+  })
+
+  it('returns 404 for an unknown token', async () => {
+    mockResolveActiveShareByToken.mockResolvedValueOnce(null)
+    const res = await POST(post('user@acme.com'), params())
+    expect(res.status).toBe(404)
+  })
+
+  it('returns 429 when rate-limited', async () => {
+    mockCheckRateLimitDirect.mockResolvedValueOnce({ allowed: false, retryAfterMs: 2000 })
+    const res = await POST(post('user@acme.com'), params())
+    expect(res.status).toBe(429)
+    expect(res.headers.get('Retry-After')).toBe('2')
+  })
+})

apps/sim/app/api/files/public/[token]/sso/route.ts

@@ -0,0 +1,72 @@
+import { createLogger } from '@sim/logger'
+import { normalizeEmail } from '@sim/utils/string'
+import type { NextRequest } from 'next/server'
+import { NextResponse } from 'next/server'
+import { publicFileSSOContract } from '@/lib/api/contracts/public-shares'
+import { parseRequest } from '@/lib/api/server'
+import type { TokenBucketConfig } from '@/lib/core/rate-limiter'
+import { RateLimiter } from '@/lib/core/rate-limiter'
+import { isEmailAllowed } from '@/lib/core/security/deployment'
+import { generateRequestId, getClientIp } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { resolveActiveShareByToken } from '@/lib/public-shares/share-manager'
+
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+
+const logger = createLogger('PublicFileSSOAPI')
+
+const rateLimiter = new RateLimiter()
+
+const SSO_IP_RATE_LIMIT: TokenBucketConfig = {
+  maxTokens: 20,
+  refillRate: 20,
+  refillIntervalMs: 15 * 60_000,
+}
+
+/**
+ * POST /api/files/public/[token]/sso
+ * Reports whether an email is on the allow-list for an SSO-gated share. The actual
+ * authentication is the global Sim session (checked at the page/route gate).
+ */
+export const POST = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ token: string }> }) => {
+    const requestId = generateRequestId()
+
+    const ip = getClientIp(request)
+    const ipRateLimit = await rateLimiter.checkRateLimitDirect(
+      `file-sso:ip:${ip}`,
+      SSO_IP_RATE_LIMIT
+    )
+    if (!ipRateLimit.allowed) {
+      logger.warn(`[${requestId}] SSO eligibility rate limit exceeded from ${ip}`)
+      const response = NextResponse.json(
+        { error: 'Too many requests. Please try again later.' },
+        { status: 429 }
+      )
+      response.headers.set(
+        'Retry-After',
+        String(Math.ceil((ipRateLimit.retryAfterMs ?? SSO_IP_RATE_LIMIT.refillIntervalMs) / 1000))
+      )
+      return response
+    }
+
+    const parsed = await parseRequest(publicFileSSOContract, request, context)
+    if (!parsed.success) return parsed.response
+    const { token } = parsed.data.params
+    const email = normalizeEmail(parsed.data.body.email)
+
+    const resolved = await resolveActiveShareByToken(token)
+    if (!resolved) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 })
+    }
+    if (resolved.share.authType !== 'sso') {
+      return NextResponse.json({ error: 'This file is not configured for SSO' }, { status: 400 })
+    }
+
+    const allowedEmails = Array.isArray(resolved.share.allowedEmails)
+      ? (resolved.share.allowedEmails as string[])
+      : []
+    return NextResponse.json({ eligible: isEmailAllowed(email, allowedEmails) })
+  }
+)