Function buildSSOConfigFromEnv

packages/db/scripts/register-sso-provider.ts:162–323

()

}

function buildSSOConfigFromEnv(): SSOProviderConfig | null {
  const enabled = process.env.SSO_ENABLED === 'true'
  if (!enabled) return null

  const providerId = process.env.SSO_PROVIDER_ID
  const issuer = process.env.SSO_ISSUER
  const domain = process.env.SSO_DOMAIN
  const providerType = process.env.SSO_PROVIDER_TYPE as 'oidc' | 'saml'

  if (!providerId || !issuer || !domain || !providerType) {
    return null
  }

  const config: SSOProviderConfig = {
    providerId,
    issuer,
    domain,
    providerType,
  }

  config.mapping = {
    id:
      process.env.SSO_MAPPING_ID ||
      (providerType === 'oidc'
        ? 'sub'
        : 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier'),
    email:
      process.env.SSO_MAPPING_EMAIL ||
      (providerType === 'oidc'
        ? 'email'
        : 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),
    name:
      process.env.SSO_MAPPING_NAME ||
      (providerType === 'oidc'
        ? 'name'
        : 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'),
    image: process.env.SSO_MAPPING_IMAGE || (providerType === 'oidc' ? 'picture' : undefined),
  }

  if (providerType === 'oidc') {
    const clientId = process.env.SSO_OIDC_CLIENT_ID
    const clientSecret = process.env.SSO_OIDC_CLIENT_SECRET

    if (!clientId || !clientSecret) {
      return null
    }

    config.oidcConfig = {
      clientId,
      clientSecret,
      scopes: process.env.SSO_OIDC_SCOPES?.split(',').map((s) => s.trim()) || [
        'openid',
        'profile',
        'email',
      ],
      pkce: process.env.SSO_OIDC_PKCE !== 'false',
      authorizationEndpoint: process.env.SSO_OIDC_AUTHORIZATION_ENDPOINT,
      tokenEndpoint: process.env.SSO_OIDC_TOKEN_ENDPOINT,