fix(auth): address review on test randomness, the SSO callbackUrl default, and an unused type export

Author: waleedlatif1

apps/docs/content/docs/cli/organizations.mdx

@@ -926,7 +926,7 @@ sim organizations sso providers save [options]
 | `--jwks-endpoint <value>` | No | Optional signing-key endpoint; otherwise resolved through issuer discovery. Available when providerType is oidc. |
 | `--entry-point <value>` | Conditional | Identity provider SAML sign-in endpoint. Available when providerType is saml. Required when providerType is saml. |
 | `--cert <value>` | Conditional | Identity provider signing certificate. Available when providerType is saml. Required when providerType is saml. |
-| `--callback-url <value>` | No | SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL. Available when providerType is saml. |
+| `--callback-url <value>` | No | SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL, and a provider already on the legacy `/sso/saml2/callback` URL keeps it. Available when providerType is saml. |
 | `--audience <value>` | No | SAML audience; omission preserves the saved value. Available when providerType is saml. |
 | `--want-assertions-signed` | No | Require signed assertions; omission preserves the saved value. Available when providerType is saml. |
 | `--no-want-assertions-signed` | No | Send --want-assertions-signed as false. |

apps/docs/content/docs/cli/reference.mdx

@@ -4193,7 +4193,7 @@ sim organizations sso providers save [options]
 | `--jwks-endpoint <value>` | No | Optional signing-key endpoint; otherwise resolved through issuer discovery. Available when providerType is oidc. |
 | `--entry-point <value>` | Conditional | Identity provider SAML sign-in endpoint. Available when providerType is saml. Required when providerType is saml. |
 | `--cert <value>` | Conditional | Identity provider signing certificate. Available when providerType is saml. Required when providerType is saml. |
-| `--callback-url <value>` | No | SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL. Available when providerType is saml. |
+| `--callback-url <value>` | No | SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL, and a provider already on the legacy `/sso/saml2/callback` URL keeps it. Available when providerType is saml. |
 | `--audience <value>` | No | SAML audience; omission preserves the saved value. Available when providerType is saml. |
 | `--want-assertions-signed` | No | Require signed assertions; omission preserves the saved value. Available when providerType is saml. |
 | `--no-want-assertions-signed` | No | Send --want-assertions-signed as false. |

apps/docs/openapi-v2-resources.json

@@ -23741,7 +23741,7 @@
                 "description": "Identity provider signing certificate."
               },
               "callbackUrl": {
-                "description": "SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL.",
+                "description": "SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL, and a provider already on the legacy `/sso/saml2/callback` URL keeps it.",
                 "type": "string",
                 "maxLength": 2048,
                 "format": "uri"

apps/sim/app/api/auth/oauth2/token/route.integration.ts

@@ -1,9 +1,9 @@
-import { randomBytes } from 'node:crypto'
 import { db } from '@sim/db'
 import * as schema from '@sim/db/schema'
 import { envFlagsMock } from '@sim/testing/mocks/env-flags.mock'
 import { requestUtilsMockFns } from '@sim/testing/mocks/request.mock'
 import { generateId } from '@sim/utils/id'
+import { generateRandomBytes, generateRandomHex, randomInt } from '@sim/utils/random'
 import { makeSignature, symmetricEncrypt } from 'better-auth/crypto'
 import { eq, inArray, like, sql } from 'drizzle-orm'
 import { NextRequest } from 'next/server'
@@ -47,7 +47,7 @@ describe('OAuth token route in PostgreSQL', () => {
     async (redirectUri) => {
       const POST = (request: NextRequest) => tokenRoute(request, {})
       /** A fresh TEST-NET-2 address per case, so reruns never draw on an earlier run's bucket. */
-      const clientIp = `198.51.100.${(randomBytes(1)[0] % 254) + 1}`
+      const clientIp = `198.51.100.${randomInt(1, 255)}`
       requestUtilsMockFns.mockGetClientIp.mockReturnValue(clientIp)
       const userId = generateId()
       const clientId = generateId()
@@ -69,7 +69,7 @@ describe('OAuth token route in PostgreSQL', () => {
         })
 
       const issueCode = async () => {
-        const verifier = randomBytes(32).toString('base64url')
+        const verifier = Buffer.from(generateRandomBytes(32)).toString('base64url')
         const challenge = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))
         const url = new URL('/api/auth/oauth2/authorize', baseUrl)
         url.search = new URLSearchParams({
@@ -268,7 +268,7 @@ describe('OAuth token route in PostgreSQL', () => {
     'exchanges a code and refreshes for a confidential client registered for %s',
     async (method) => {
       const POST = (request: NextRequest) => tokenRoute(request, {})
-      const clientIp = `203.0.113.${(randomBytes(1)[0] % 254) + 1}`
+      const clientIp = `203.0.113.${randomInt(1, 255)}`
       requestUtilsMockFns.mockGetClientIp.mockReturnValue(clientIp)
       const baseUrl = 'https://test.sim.ai'
       const redirectUri = 'https://client.example/callback'
@@ -339,7 +339,7 @@ describe('OAuth token route in PostgreSQL', () => {
           updatedAt: now,
         })
 
-        const verifier = randomBytes(32).toString('base64url')
+        const verifier = Buffer.from(generateRandomBytes(32)).toString('base64url')
         const challenge = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))
         const authorizeUrl = new URL('/api/auth/oauth2/authorize', baseUrl)
         authorizeUrl.search = new URLSearchParams({
@@ -391,7 +391,7 @@ describe('OAuth token route in PostgreSQL', () => {
     const exchangeToken = (request: NextRequest) => tokenRoute(request, {})
     const revokeToken = (request: NextRequest) => revokeRoute(request, {})
 
-    const testId = randomBytes(8).toString('hex')
+    const testId = generateRandomHex(16)
     const userId = `oauth-route-test-user-${testId}`
     const sessionId = `oauth-route-test-session-${testId}`
     const sessionToken = `oauth-route-test-session-token-${testId}`

apps/sim/lib/api/contracts/v2/sso.ts

@@ -183,7 +183,7 @@ const v2SaveSsoProviderBodySchema = z.discriminatedUnion('providerType', [
         .max(2048)
         .optional()
         .describe(
-          'SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL.'
+          'SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL, and a provider already on the legacy `/sso/saml2/callback` URL keeps it.'
         ),
       audience: z
         .string()

apps/sim/lib/auth/oauth-protocol-request.ts

@@ -2,7 +2,7 @@ import { truncate } from '@sim/utils/string'
 import { NextRequest, NextResponse } from 'next/server'
 import type { OAuthClientCredentials, OAuthProtocolErrorCode } from '@/lib/auth/oauth-token-family'
 
-export interface ParsedOAuthForm {
+interface ParsedOAuthForm {
   form: URLSearchParams
   credentials: OAuthClientCredentials | null
   rawBody: string

packages/sim-cli/src/generated/v2-api.ts

@@ -23523,7 +23523,7 @@ export const V2_OPERATIONS = {
       callbackUrl: {
         kind: 'string',
         describe:
-          'SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL. Available when providerType is saml.',
+          'SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL, and a provider already on the legacy `/sso/saml2/callback` URL keeps it. Available when providerType is saml.',
       },
       audience: {
         kind: 'string',
@@ -23671,7 +23671,7 @@ export const V2_OPERATIONS = {
           callbackUrl: {
             kind: 'string',
             describe:
-              'SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL.',
+              'SAML ACS URL advertised to the identity provider; defaults to this provider’s Sim ACS URL, and a provider already on the legacy `/sso/saml2/callback` URL keeps it.',
           },
           audience: {
             kind: 'string',