improvement(sso): use the chip switch for the SAML toggles and reuse a legacy key

Both SAML toggles now use ChipSwitch, the canonical control, instead of the legacy Switch primitive; the encrypted-assertions toggle is new here and the signed-assertions one beside it moves with it so the card stays consistent.

An update that keeps the stored decryption key also falls back to the flat decryptionPvk that rows from the retired registration script carry, so an admin enabling encryption on such a provider is not asked to re-paste a key they already hold. The pair is validated against the submitted certificate either way.

Author: waleedlatif1

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -577,6 +577,33 @@ describe('POST /api/auth/sso/register', () => {
       expect(samlConfig.spMetadata.encPrivateKey).toBe(SP_KEY)
     })
 
+    it('reuses a key left behind by the retired registration script', async () => {
+      queueMembers([{ organizationId: 'org1', role: 'owner' }])
+      queueTableRows(schemaMock.ssoProvider, [])
+      queueTableRows(schemaMock.ssoProvider, [])
+      /** Rows the script wrote kept the key flat, where the SAML library never read it. */
+      queueTableRows(schemaMock.ssoProvider, [
+        { samlConfig: JSON.stringify({ decryptionPvk: SP_KEY }) },
+      ])
+      queueTableRows(schemaMock.ssoProvider, [])
+      queueTableRows(schemaMock.ssoProvider, [])
+      queueTableRows(schemaMock.ssoProvider, [{ id: 'p1' }])
+
+      const res = await POST(
+        request(
+          samlBody({
+            encryptAssertions: true,
+            spEncryptionCert: SP_CERT,
+            spDecryptionKey: '[REDACTED]',
+          })
+        )
+      )
+
+      expect(res.status).toBe(200)
+      const { samlConfig } = mockUpdateSSOProvider.mock.calls[0][0].body
+      expect(samlConfig.spMetadata.encPrivateKey).toBe(SP_KEY)
+    })
+
     it('refuses the marker when no key is stored', async () => {
       queueMembers([{ organizationId: 'org1', role: 'owner' }])
       queueTableRows(schemaMock.ssoProvider, [])

apps/sim/app/api/auth/sso/register/route.ts

@@ -134,13 +134,24 @@ function checkKeyPair(cert: string | undefined, privateKey: string | undefined):
   return { certificate }
 }
 
-/** The stored decryption key of a SAML config, when it holds one. */
+/**
+ * The stored decryption key of a SAML config, when it holds one.
+ *
+ * `spMetadata.encPrivateKey` is where the SAML library reads it. The flat
+ * `decryptionPvk` is only ever found on rows written by the retired operator
+ * script, where it sat unread; an admin turning encryption on for such a
+ * provider already holds that key, so it is offered rather than demanded again.
+ * Either way the pair is validated against the submitted certificate before it
+ * is saved.
+ */
 function readStoredDecryptionKey(samlConfig: string | null | undefined): string | null {
   if (!samlConfig) return null
   try {
     const parsed = JSON.parse(samlConfig)
-    const stored = parsed?.spMetadata?.encPrivateKey
-    return typeof stored === 'string' && stored !== '' ? stored : null
+    for (const stored of [parsed?.spMetadata?.encPrivateKey, parsed?.decryptionPvk]) {
+      if (typeof stored === 'string' && stored !== '') return stored
+    }
+    return null
   } catch {
     return null
   }

apps/sim/ee/sso/components/sso-provider-settings.tsx

@@ -13,7 +13,6 @@ import {
   Expandable,
   ExpandableContent,
   Label,
-  Switch,
   toast,
 } from '@sim/emcn'
 import { ArrowLeft, ChevronDown, Eye, EyeOff } from '@sim/emcn/icons'
@@ -61,6 +60,12 @@ const CLIENT_SECRET_FIELD_ID = 'sso-client-secret'
 /** Fixed width, so the mask never leaks how long the stored secret is. */
 const CLIENT_SECRET_MASK = '••••••••••••'
 
+/** On/off options for the SAML toggles, the chip equivalent of a boolean switch. */
+const TOGGLE_OPTIONS = [
+  { value: 'on', label: 'On' },
+  { value: 'off', label: 'Off' },
+] as const
+
 interface ClientSecretFieldProps {
   /** A secret is already saved, so the field opens as a masked fact rather than an input. */
   hasStoredSecret: boolean
@@ -1109,22 +1114,24 @@ export function SsoProviderSettings({
                           <Label htmlFor='sso-signed-assertions'>
                             Require signed SAML assertions
                           </Label>
-                          <Switch
-                            id='sso-signed-assertions'
-                            checked={formData.wantAssertionsSigned}
-                            onCheckedChange={(checked) =>
-                              handleInputChange('wantAssertionsSigned', checked)
+                          <ChipSwitch
+                            aria-label='Require signed SAML assertions'
+                            options={TOGGLE_OPTIONS}
+                            value={formData.wantAssertionsSigned ? 'on' : 'off'}
+                            onChange={(value) =>
+                              handleInputChange('wantAssertionsSigned', value === 'on')
                             }
                           />
                         </div>
 
                         <div className='flex items-center justify-between gap-4'>
                           <Label htmlFor='sso-encrypt-assertions'>Encrypt SAML assertions</Label>
-                          <Switch
-                            id='sso-encrypt-assertions'
-                            checked={formData.encryptAssertions}
-                            onCheckedChange={(checked) =>
-                              handleInputChange('encryptAssertions', checked)
+                          <ChipSwitch
+                            aria-label='Encrypt SAML assertions'
+                            options={TOGGLE_OPTIONS}
+                            value={formData.encryptAssertions ? 'on' : 'off'}
+                            onChange={(value) =>
+                              handleInputChange('encryptAssertions', value === 'on')
                             }
                           />
                         </div>

apps/sim/ee/sso/components/sso-settings.test.tsx

@@ -99,12 +99,14 @@ vi.mock('@sim/emcn', () => ({
     options,
     value,
     onChange,
+    'aria-label': ariaLabel,
   }: {
     options: Array<{ label: string; value: string }>
     value: string
     onChange: (value: string) => void
+    'aria-label'?: string
   }) => (
-    <div>
+    <div role='group' aria-label={ariaLabel}>
       {options.map((option) => (
         <button
           key={option.value}
@@ -720,8 +722,13 @@ describe('SAML encrypted assertions', () => {
     })
   }
 
-  function toggle() {
-    return container.querySelector<HTMLButtonElement>('#sso-encrypt-assertions')
+  /** The chip switch renders one button per option; 'On' enables encryption. */
+  function turnEncryptionOn() {
+    const group = container.querySelector('[aria-label="Encrypt SAML assertions"]')
+    const on = Array.from(group?.querySelectorAll('button') ?? []).find(
+      (button) => button.textContent === 'On'
+    )
+    act(() => on?.click())
   }
 
   it('hides the key pair until encryption is turned on', () => {
@@ -730,7 +737,7 @@ describe('SAML encrypted assertions', () => {
     expect(container.querySelector('#sso-sp-encryption-cert')).toBeNull()
     expect(container.querySelector('#sso-sp-decryption-key')).toBeNull()
 
-    act(() => toggle()?.click())
+    turnEncryptionOn()
 
     expect(container.querySelector('#sso-sp-encryption-cert')).not.toBeNull()
     expect(container.querySelector('#sso-sp-decryption-key')).not.toBeNull()