From 4f6facb6ac743416556aca35ffec233bed3adf00 Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Wed, 10 Sep 2025 10:26:29 +0530
Subject: [PATCH] refactor: move saml strategy to a separate proc

---
 config/initializers/omniauth.rb | 72 +++++++++++++++++----------------
 1 file changed, 37 insertions(+), 35 deletions(-)

diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index 8f6c31c78..397285438 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -2,45 +2,47 @@
 # SAML authentication is sensitive to URL mismatches, so OmniAuth needs the correct host
 OmniAuth.config.full_host = ENV.fetch('FRONTEND_URL', 'http://localhost:3000')
 
+# SAML setup proc for multi-tenant configuration
+SAML_SETUP_PROC = proc do |env|
+  request = ActionDispatch::Request.new(env)
+
+  # Extract account_id from various sources
+  account_id = request.params['account_id'] ||
+               request.session[:saml_account_id] ||
+               env['omniauth.params']&.dig('account_id')
+
+  if account_id
+    # Store in session and omniauth params for callback
+    request.session[:saml_account_id] = account_id
+    env['omniauth.params'] ||= {}
+    env['omniauth.params']['account_id'] = account_id
+
+    # Find SAML settings for this account
+    settings = AccountSamlSettings.find_by(account_id: account_id)
+
+    if settings
+      # Configure the strategy options dynamically
+      env['omniauth.strategy'].options[:assertion_consumer_service_url] = "#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/omniauth/saml/callback?account_id=#{account_id}"
+      env['omniauth.strategy'].options[:sp_entity_id] = settings.sp_entity_id
+      env['omniauth.strategy'].options[:idp_entity_id] = settings.idp_entity_id
+      env['omniauth.strategy'].options[:idp_sso_service_url] = settings.sso_url
+      env['omniauth.strategy'].options[:idp_cert] = settings.certificate
+      env['omniauth.strategy'].options[:name_identifier_format] = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
+    else
+      # Set a dummy certificate to avoid the error
+      env['omniauth.strategy'].options[:idp_cert] = 'DUMMY'
+    end
+  else
+    # Set a dummy certificate to avoid the error
+    env['omniauth.strategy'].options[:idp_cert] = 'DUMMY'
+  end
+end
+
 Rails.application.config.middleware.use OmniAuth::Builder do
   provider :google_oauth2, ENV.fetch('GOOGLE_OAUTH_CLIENT_ID', nil), ENV.fetch('GOOGLE_OAUTH_CLIENT_SECRET', nil), {
     provider_ignores_state: true
   }
 
   # SAML provider with setup phase for multi-tenant configuration
-  provider :saml,
-           setup: lambda { |env|
-             request = ActionDispatch::Request.new(env)
-
-             # Extract account_id from various sources
-             account_id = request.params['account_id'] ||
-                          request.session[:saml_account_id] ||
-                          env['omniauth.params']&.dig('account_id')
-
-             if account_id
-               # Store in session and omniauth params for callback
-               request.session[:saml_account_id] = account_id
-               env['omniauth.params'] ||= {}
-               env['omniauth.params']['account_id'] = account_id
-
-               # Find SAML settings for this account
-               settings = AccountSamlSettings.find_by(account_id: account_id)
-
-               if settings
-                 # Configure the strategy options dynamically
-                 env['omniauth.strategy'].options[:assertion_consumer_service_url] = "#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/omniauth/saml/callback?account_id=#{account_id}"
-                 env['omniauth.strategy'].options[:sp_entity_id] = settings.sp_entity_id
-                 env['omniauth.strategy'].options[:idp_entity_id] = settings.idp_entity_id
-                 env['omniauth.strategy'].options[:idp_sso_service_url] = settings.sso_url
-                 env['omniauth.strategy'].options[:idp_cert] = settings.certificate
-                 env['omniauth.strategy'].options[:name_identifier_format] = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
-               else
-                 # Set a dummy certificate to avoid the error
-                 env['omniauth.strategy'].options[:idp_cert] = 'DUMMY'
-               end
-             else
-               # Set a dummy certificate to avoid the error
-               env['omniauth.strategy'].options[:idp_cert] = 'DUMMY'
-             end
-           }
+  provider :saml, setup: SAML_SETUP_PROC
 end