chore: import upstream snapshot with attribution

apps/sim/lib/auth/sso/domain.test.ts

@@ -0,0 +1,44 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { normalizeSSODomain } from '@/lib/auth/sso/domain'
+
+describe('normalizeSSODomain', () => {
+  it('lowercases and trims', () => {
+    expect(normalizeSSODomain('  Company.COM ')).toBe('company.com')
+  })
+
+  it('strips protocol, path, query, and port', () => {
+    expect(normalizeSSODomain('https://company.com/sso?x=1')).toBe('company.com')
+    expect(normalizeSSODomain('company.com:8443')).toBe('company.com')
+  })
+
+  it('strips wildcard, leading @, and email local part', () => {
+    expect(normalizeSSODomain('*.company.com')).toBe('company.com')
+    expect(normalizeSSODomain('@company.com')).toBe('company.com')
+    expect(normalizeSSODomain('user@company.com')).toBe('company.com')
+  })
+
+  it('drops a trailing dot', () => {
+    expect(normalizeSSODomain('company.com.')).toBe('company.com')
+  })
+
+  it('treats casing and formatting variants as the same domain', () => {
+    expect(normalizeSSODomain('Company.COM')).toBe(normalizeSSODomain('company.com'))
+    expect(normalizeSSODomain('user@Company.com')).toBe(normalizeSSODomain('company.com'))
+  })
+
+  it('rejects values that are not registrable domains', () => {
+    expect(normalizeSSODomain('')).toBeNull()
+    expect(normalizeSSODomain('localhost')).toBeNull()
+    expect(normalizeSSODomain('not a domain')).toBeNull()
+    expect(normalizeSSODomain('company')).toBeNull()
+  })
+
+  it('rejects bare IP addresses and numeric TLDs', () => {
+    expect(normalizeSSODomain('10.0.0.1')).toBeNull()
+    expect(normalizeSSODomain('192.168.1.1')).toBeNull()
+    expect(normalizeSSODomain('company.123')).toBeNull()
+  })
+})

apps/sim/lib/auth/sso/domain.ts

@@ -0,0 +1,28 @@
+/**
+ * Normalizes a user-supplied SSO email domain to a canonical, comparable form:
+ * strips protocol, path, query, port, a leading wildcard/`@`, an email local
+ * part, and a trailing dot, then lowercases. Returns `null` for inputs that are
+ * not a registrable domain (e.g. `example.com`), which callers treat as invalid.
+ */
+export function normalizeSSODomain(input: string): string | null {
+  if (typeof input !== 'string') return null
+
+  let value = input.trim().toLowerCase()
+  if (!value) return null
+
+  value = value.replace(/^[a-z][a-z0-9+.-]*:\/\//, '')
+  value = value.replace(/^\*\./, '').replace(/^@/, '')
+  value = value.split('/')[0]
+  value = value.split('?')[0]
+  value = value.split('@').pop() ?? value
+  value = value.split(':')[0]
+  value = value.replace(/\.$/, '')
+
+  if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(value)) return null
+
+  const labels = value.split('.')
+  if (labels.some((label) => label.length === 0 || label.length > 63)) return null
+  if (/^\d+$/.test(labels[labels.length - 1])) return null
+
+  return value
+}