Merge branch 'feat/sso-models' into feat/saml-controllers

spec/enterprise/controllers/api/v1/accounts/saml_settings_controller_spec.rb

@@ -102,7 +102,7 @@ RSpec.describe 'Api::V1::Accounts::SamlSettings', type: :request do
         saml_settings: {
           sso_url: 'https://idp.example.com/saml/sso',
           certificate: cert.to_pem,
-          sp_entity_id: 'chatwoot-production',
+          idp_entity_id: 'https://idp.example.com/saml/metadata',
           role_mappings: { 'Admins' => { 'role' => 1 }, 'Users' => { 'role' => 0 } }
         }
       }

spec/enterprise/models/account_saml_settings_spec.rb

@@ -23,10 +23,10 @@ RSpec.describe AccountSamlSettings, type: :model do
       expect(settings.errors[:certificate]).to include("can't be blank")
     end
 
-    it 'requires sp_entity_id' do
-      settings = build(:account_saml_settings, account: account, sp_entity_id: nil)
+    it 'requires idp_entity_id' do
+      settings = build(:account_saml_settings, account: account, idp_entity_id: nil)
       expect(settings).not_to be_valid
-      expect(settings.errors[:sp_entity_id]).to include("can't be blank")
+      expect(settings.errors[:idp_entity_id]).to include("can't be blank")
     end
   end
 
@@ -56,16 +56,62 @@ RSpec.describe AccountSamlSettings, type: :model do
     end
   end
 
-  describe '#sp_entity_id_or_default' do
-    it 'returns sp_entity_id when present' do
-      settings = build(:account_saml_settings, account: account, sp_entity_id: 'custom-entity-id')
-      expect(settings.sp_entity_id_or_default).to eq('custom-entity-id')
+  describe 'sp_entity_id auto-generation' do
+    it 'automatically generates sp_entity_id when creating' do
+      settings = build(:account_saml_settings, account: account, sp_entity_id: nil)
+      expect(settings).to be_valid
+      settings.save!
+      expect(settings.sp_entity_id).to eq("http://localhost:3000/saml/sp/#{account.id}")
     end
 
-    it 'returns default entity id when sp_entity_id is blank' do
-      settings = build(:account_saml_settings, account: account, sp_entity_id: '')
-      expected = "chatwoot-#{account.id}"
-      expect(settings.sp_entity_id_or_default).to eq(expected)
+    it 'does not override existing sp_entity_id' do
+      custom_id = 'https://custom.example.com/saml/sp/123'
+      settings = build(:account_saml_settings, account: account, sp_entity_id: custom_id)
+      settings.save!
+      expect(settings.sp_entity_id).to eq(custom_id)
+    end
+  end
+
+  describe '#certificate_fingerprint' do
+    let(:valid_cert_pem) do
+      key = OpenSSL::PKey::RSA.new(2048)
+      cert = OpenSSL::X509::Certificate.new
+      cert.version = 2
+      cert.serial = 1
+      cert.subject = OpenSSL::X509::Name.parse('/C=US/ST=Test/L=Test/O=Test/CN=test.example.com')
+      cert.issuer = cert.subject
+      cert.public_key = key.public_key
+      cert.not_before = Time.zone.now
+      cert.not_after = cert.not_before + (365 * 24 * 60 * 60)
+      cert.sign(key, OpenSSL::Digest.new('SHA256'))
+      cert.to_pem
+    end
+
+    it 'returns fingerprint for valid certificate' do
+      settings = build(:account_saml_settings, account: account, certificate: valid_cert_pem)
+      fingerprint = settings.certificate_fingerprint
+
+      expect(fingerprint).to be_present
+      expect(fingerprint).to match(/^[A-F0-9]{2}(:[A-F0-9]{2}){19}$/) # SHA1 fingerprint format
+    end
+
+    it 'returns nil for blank certificate' do
+      settings = build(:account_saml_settings, account: account, certificate: '')
+      expect(settings.certificate_fingerprint).to be_nil
+    end
+
+    it 'returns nil for invalid certificate' do
+      settings = build(:account_saml_settings, account: account, certificate: 'invalid-cert-data')
+      expect(settings.certificate_fingerprint).to be_nil
+    end
+
+    it 'formats fingerprint correctly' do
+      settings = build(:account_saml_settings, account: account, certificate: valid_cert_pem)
+      fingerprint = settings.certificate_fingerprint
+
+      # Should be uppercase with colons separating each byte
+      expect(fingerprint).to match(/^[A-F0-9:]+$/)
+      expect(fingerprint.count(':')).to eq(19) # 20 bytes = 19 colons
     end
   end
 end

spec/factories/account_saml_settings.rb

@@ -15,7 +15,7 @@ FactoryBot.define do
       cert.sign(key, OpenSSL::Digest.new('SHA256'))
       cert.to_pem
     end
-    sp_entity_id { 'chatwoot-test' }
+    idp_entity_id { 'https://idp.example.com/saml/metadata' }
     role_mappings { {} }
 
     trait :with_role_mappings do