From ba94ba3bf42c46987a22d72e51bcae147b09bcc0 Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Tue, 2 Sep 2025 15:27:07 +0530
Subject: [PATCH] feat: add certificate fingerprint

---
 .../app/models/account_saml_settings.rb       |  4 +--
 .../accounts/saml_settings_controller_spec.rb |  2 +-
 .../models/account_saml_settings_spec.rb      | 25 +++++++++++--------
 spec/factories/account_saml_settings.rb       |  2 +-
 4 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/enterprise/app/models/account_saml_settings.rb b/enterprise/app/models/account_saml_settings.rb
index 13fde7db1..25e8aeffe 100644
--- a/enterprise/app/models/account_saml_settings.rb
+++ b/enterprise/app/models/account_saml_settings.rb
@@ -35,8 +35,8 @@ class AccountSamlSettings < ApplicationRecord
 
     begin
       cert = OpenSSL::X509::Certificate.new(certificate)
-      OpenSSL::Digest::SHA1.new(cert.to_der).to_sExpand commentResolvedCode has comments.Press enter to view
-        .fingerprint.upcase.gsub(/(.{2})(?=.)/, '\1:')
+      OpenSSL::Digest::SHA1.new(cert.to_der).hexdigest
+                           .upcase.gsub(/(.{2})(?=.)/, '\1:')
     rescue OpenSSL::X509::CertificateError
       nil
     end
diff --git a/spec/enterprise/controllers/api/v1/accounts/saml_settings_controller_spec.rb b/spec/enterprise/controllers/api/v1/accounts/saml_settings_controller_spec.rb
index 39e756086..646a11fae 100644
--- a/spec/enterprise/controllers/api/v1/accounts/saml_settings_controller_spec.rb
+++ b/spec/enterprise/controllers/api/v1/accounts/saml_settings_controller_spec.rb
@@ -102,7 +102,7 @@ RSpec.describe 'Api::V1::Accounts::SamlSettings', type: :request do
         saml_settings: {
           sso_url: 'https://idp.example.com/saml/sso',
           certificate: cert.to_pem,
-          sp_entity_id: 'chatwoot-production',
+          idp_entity_id: 'https://idp.example.com/saml/metadata',
           role_mappings: { 'Admins' => { 'role' => 1 }, 'Users' => { 'role' => 0 } }
         }
       }
diff --git a/spec/enterprise/models/account_saml_settings_spec.rb b/spec/enterprise/models/account_saml_settings_spec.rb
index 0e931478c..b65d0348f 100644
--- a/spec/enterprise/models/account_saml_settings_spec.rb
+++ b/spec/enterprise/models/account_saml_settings_spec.rb
@@ -23,10 +23,10 @@ RSpec.describe AccountSamlSettings, type: :model do
       expect(settings.errors[:certificate]).to include("can't be blank")
     end
 
-    it 'requires sp_entity_id' do
-      settings = build(:account_saml_settings, account: account, sp_entity_id: nil)
+    it 'requires idp_entity_id' do
+      settings = build(:account_saml_settings, account: account, idp_entity_id: nil)
       expect(settings).not_to be_valid
-      expect(settings.errors[:sp_entity_id]).to include("can't be blank")
+      expect(settings.errors[:idp_entity_id]).to include("can't be blank")
     end
   end
 
@@ -56,16 +56,19 @@ RSpec.describe AccountSamlSettings, type: :model do
     end
   end
 
-  describe '#sp_entity_id_or_default' do
-    it 'returns sp_entity_id when present' do
-      settings = build(:account_saml_settings, account: account, sp_entity_id: 'custom-entity-id')
-      expect(settings.sp_entity_id_or_default).to eq('custom-entity-id')
+  describe 'sp_entity_id auto-generation' do
+    it 'automatically generates sp_entity_id when creating' do
+      settings = build(:account_saml_settings, account: account, sp_entity_id: nil)
+      expect(settings).to be_valid
+      settings.save!
+      expect(settings.sp_entity_id).to eq("http://localhost:3000/saml/sp/#{account.id}")
     end
 
-    it 'returns default entity id when sp_entity_id is blank' do
-      settings = build(:account_saml_settings, account: account, sp_entity_id: '')
-      expected = "chatwoot-#{account.id}"
-      expect(settings.sp_entity_id_or_default).to eq(expected)
+    it 'does not override existing sp_entity_id' do
+      custom_id = 'https://custom.example.com/saml/sp/123'
+      settings = build(:account_saml_settings, account: account, sp_entity_id: custom_id)
+      settings.save!
+      expect(settings.sp_entity_id).to eq(custom_id)
     end
   end
 end
diff --git a/spec/factories/account_saml_settings.rb b/spec/factories/account_saml_settings.rb
index c4b7c9ef1..4262daf7b 100644
--- a/spec/factories/account_saml_settings.rb
+++ b/spec/factories/account_saml_settings.rb
@@ -15,7 +15,7 @@ FactoryBot.define do
       cert.sign(key, OpenSSL::Digest.new('SHA256'))
       cert.to_pem
     end
-    sp_entity_id { 'chatwoot-test' }
+    idp_entity_id { 'https://idp.example.com/saml/metadata' }
     role_mappings { {} }
 
     trait :with_role_mappings do