fix(sso): recover gracefully from an unreadable saved SAML key

An update that keeps the stored key returned 500 when the key could not be decrypted; it now returns the same kind of 400 the OIDC path does, asking for the key again. Replace gained the Keep saved action its client-secret counterpart has, so opening the field is no longer a one-way door, and the form recognizes a key left flat by the retired registration script, matching the fallback the server already had.

Author: waleedlatif1

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -604,6 +604,36 @@ describe('POST /api/auth/sso/register', () => {
       expect(samlConfig.spMetadata.encPrivateKey).toBe(SP_KEY)
     })
 
+    it('asks for the key again when the stored one cannot be decrypted', async () => {
+      mockDecryptSecret.mockRejectedValue(new Error('auth tag mismatch'))
+      queueMembers([{ organizationId: 'org1', role: 'owner' }])
+      queueTableRows(schemaMock.ssoProvider, [])
+      queueTableRows(schemaMock.ssoProvider, [])
+      queueTableRows(schemaMock.ssoProvider, [
+        {
+          samlConfig: JSON.stringify({
+            spMetadata: { encPrivateKey: `sim.sso.v1:${'a'.repeat(32)}:dead:${'b'.repeat(32)}` },
+          }),
+        },
+      ])
+
+      const res = await POST(
+        request(
+          samlBody({
+            encryptAssertions: true,
+            spEncryptionCert: SP_CERT,
+            spDecryptionKey: '[REDACTED]',
+          })
+        )
+      )
+
+      /** A key the app can no longer read is an operator action, not a server fault. */
+      expect(res.status).toBe(400)
+      await expect(res.json()).resolves.toMatchObject({
+        error: expect.stringContaining('Re-enter it'),
+      })
+    })
+
     it('refuses the marker when no key is stored', async () => {
       queueMembers([{ organizationId: 'org1', role: 'owner' }])
       queueTableRows(schemaMock.ssoProvider, [])

apps/sim/app/api/auth/sso/register/route.ts

@@ -615,9 +615,23 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           .from(ssoProvider)
           .where(ownerClause)
           .limit(1)
-        const storedKey = existing?.samlConfig
-          ? readStoredDecryptionKey(await decryptProviderConfig(existing.samlConfig, 'samlConfig'))
-          : null
+        let storedKey: string | null = null
+        if (existing?.samlConfig) {
+          try {
+            storedKey = readStoredDecryptionKey(
+              await decryptProviderConfig(existing.samlConfig, 'samlConfig')
+            )
+          } catch {
+            /** A key the app can no longer read is re-entered, not a 500. */
+            return NextResponse.json(
+              {
+                error:
+                  'Cannot update: failed to read the saved service provider private key. Re-enter it.',
+              },
+              { status: 400 }
+            )
+          }
+        }
         if (!storedKey) {
           return NextResponse.json(
             {

apps/sim/ee/sso/components/sso-provider-settings.tsx

@@ -170,7 +170,9 @@ function hasStoredSpDecryptionKey(samlConfig: string | null | undefined): boolea
     const config: unknown = JSON.parse(samlConfig)
     if (!isRecordLike(config)) return false
     const spMetadata = config.spMetadata
-    return isRecordLike(spMetadata) && typeof spMetadata.encPrivateKey === 'string'
+    if (isRecordLike(spMetadata) && typeof spMetadata.encPrivateKey === 'string') return true
+    /** Rows from the retired registration script kept the key flat; the server reuses it too. */
+    return typeof config.decryptionPvk === 'string'
   } catch {
     return false
   }
@@ -1191,22 +1193,36 @@ export function SsoProviderSettings({
                                   </Chip>
                                 </div>
                               ) : (
-                                <ChipTextarea
-                                  id='sso-sp-decryption-key'
-                                  placeholder={
-                                    '-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----'
-                                  }
-                                  value={formData.spDecryptionKey}
-                                  autoComplete='off'
-                                  autoCapitalize='none'
-                                  spellCheck={false}
-                                  onChange={(e) =>
-                                    handleInputChange('spDecryptionKey', e.target.value)
-                                  }
-                                  className='min-h-20'
-                                  error={showErrors && errors.spDecryptionKey?.length > 0}
-                                  rows={3}
-                                />
+                                <div className='flex flex-col gap-2'>
+                                  <ChipTextarea
+                                    id='sso-sp-decryption-key'
+                                    placeholder={
+                                      '-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----'
+                                    }
+                                    value={formData.spDecryptionKey}
+                                    autoComplete='off'
+                                    autoCapitalize='none'
+                                    spellCheck={false}
+                                    onChange={(e) =>
+                                      handleInputChange('spDecryptionKey', e.target.value)
+                                    }
+                                    className='min-h-20'
+                                    error={showErrors && errors.spDecryptionKey?.length > 0}
+                                    rows={3}
+                                  />
+                                  {/** The pair to Replace, as on the client secret: put the saved key back. */}
+                                  {hasStoredDecryptionKey && (
+                                    <Chip
+                                      className='w-fit'
+                                      onClick={() => {
+                                        setIsReplacingDecryptionKey(false)
+                                        handleInputChange('spDecryptionKey', '')
+                                      }}
+                                    >
+                                      Keep saved
+                                    </Chip>
+                                  )}
+                                </div>
                               )}
                             </SettingRow>
                           </>

apps/sim/ee/sso/components/sso-settings.test.tsx

@@ -743,6 +743,36 @@ describe('SAML encrypted assertions', () => {
     expect(container.querySelector('#sso-sp-decryption-key')).not.toBeNull()
   })
 
+  it('offers to keep the saved key after choosing Replace', () => {
+    editSaml(
+      JSON.stringify({
+        entryPoint: 'https://idp.test/sso',
+        cert: 'IDP',
+        spMetadata: { isAssertionEncrypted: true, encPrivateKey: '[REDACTED]' },
+      })
+    )
+
+    act(() => findButton('Replace')?.click())
+
+    expect(container.querySelector('#sso-sp-decryption-key')).not.toBeNull()
+    expect(findButton('Keep saved')).toBeDefined()
+  })
+
+  it('recognizes a key stored by the retired registration script', () => {
+    editSaml(
+      JSON.stringify({
+        entryPoint: 'https://idp.test/sso',
+        cert: 'IDP',
+        decryptionPvk: '[REDACTED]',
+        spMetadata: { isAssertionEncrypted: true },
+      })
+    )
+
+    /** Masked rather than demanding a fresh paste, because the server reuses that key. */
+    const keyField = container.querySelector<HTMLInputElement>('#sso-sp-decryption-key')
+    expect(keyField?.value).toMatch(/^•+$/)
+  })
+
   it('shows the saved certificate and masks the stored private key', () => {
     const cert = '-----BEGIN CERTIFICATE-----\nQUJD\n-----END CERTIFICATE-----'
     editSaml(