Merge branch 'feat/sso-models' of github.com:chatwoot/chatwoot into feat/saml-controllers

app/javascript/dashboard/components-next/message/bubbles/Email/Index.vue

@@ -41,9 +41,7 @@ const originalEmailText = computed(() => {
 });
 
 const originalEmailHtml = computed(
-  () =>
-    contentAttributes?.value?.email?.htmlContent?.full ??
-    originalEmailText.value
+  () => contentAttributes?.value?.email?.htmlContent?.full || ''
 );
 
 const messageContent = computed(() => {

db/migrate/20250825070005_create_account_saml_settings.rb

@@ -2,13 +2,9 @@ class CreateAccountSamlSettings < ActiveRecord::Migration[7.1]
   def change
     create_table :account_saml_settings do |t|
       t.references :account, null: false
-      t.boolean :enabled, default: false, null: false
       t.string :sso_url
-      t.string :certificate_fingerprint
       t.text :certificate
       t.string :sp_entity_id
-      t.boolean :enforced_sso, default: false, null: false
-      t.json :attribute_mappings, default: {}
       t.json :role_mappings, default: {}
 
       t.timestamps

db/schema.rb

@@ -30,13 +30,9 @@ ActiveRecord::Schema[7.1].define(version: 2025_08_25_070005) do
 
   create_table "account_saml_settings", force: :cascade do |t|
     t.bigint "account_id", null: false
-    t.boolean "enabled", default: false, null: false
     t.string "sso_url"
-    t.string "certificate_fingerprint"
     t.text "certificate"
     t.string "sp_entity_id"
-    t.boolean "enforced_sso", default: false, null: false
-    t.json "attribute_mappings", default: {}
     t.json "role_mappings", default: {}
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
@@ -280,7 +276,7 @@ ActiveRecord::Schema[7.1].define(version: 2025_08_25_070005) do
     t.jsonb "audience", default: []
     t.datetime "scheduled_at", precision: nil
     t.boolean "trigger_only_during_business_hours", default: false
-    t.jsonb "template_params", default: {}, null: false
+    t.jsonb "template_params"
     t.index ["account_id"], name: "index_campaigns_on_account_id"
     t.index ["campaign_status"], name: "index_campaigns_on_campaign_status"
     t.index ["campaign_type"], name: "index_campaigns_on_campaign_type"

enterprise/app/controllers/api/v1/accounts/saml_settings_controller.rb

@@ -28,13 +28,9 @@ class Api::V1::Accounts::SamlSettingsController < Api::V1::Accounts::BaseControl
 
   def saml_settings_params
     params.require(:saml_settings).permit(
-      :enabled,
       :sso_url,
-      :certificate_fingerprint,
       :certificate,
       :sp_entity_id,
-      :enforced_sso,
-      attribute_mappings: {},
       role_mappings: {}
     )
   end

enterprise/app/models/account_saml_settings.rb

@@ -2,18 +2,14 @@
 #
 # Table name: account_saml_settings
 #
-#  id                      :bigint           not null, primary key
-#  attribute_mappings      :json
-#  certificate             :text
-#  certificate_fingerprint :string
-#  enabled                 :boolean          default(FALSE), not null
-#  enforced_sso            :boolean          default(FALSE), not null
-#  role_mappings           :json
-#  sso_url                 :string
-#  created_at              :datetime         not null
-#  updated_at              :datetime         not null
-#  account_id              :bigint           not null
-#  sp_entity_id            :string
+#  id            :bigint           not null, primary key
+#  certificate   :text
+#  role_mappings :json
+#  sso_url       :string
+#  created_at    :datetime         not null
+#  updated_at    :datetime         not null
+#  account_id    :bigint           not null
+#  sp_entity_id  :string
 #
 # Indexes
 #
@@ -23,38 +19,29 @@ class AccountSamlSettings < ApplicationRecord
   belongs_to :account
 
   validates :account_id, presence: true
-  validates :sso_url, presence: true, if: :enabled?
-  validates :certificate, presence: true, if: :enabled?
-  validates :sp_entity_id, presence: true, if: :enabled?
-
-  before_save :generate_certificate_fingerprint, if: :certificate_changed?
-
-  scope :enabled, -> { where(enabled: true) }
+  validates :sso_url, presence: true
+  validates :certificate, presence: true
+  validates :sp_entity_id, presence: true
 
   def saml_enabled?
-    enabled && sso_url.present? && certificate_fingerprint.present?
+    sso_url.present? && certificate.present?
   end
 
   def sp_entity_id_or_default
     sp_entity_id.presence || "#{installation_name}-#{account_id}".downcase
   end
 
+  def attribute_mappings
+    {
+      'email' => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
+      'first_name' => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname',
+      'last_name' => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'
+    }
+  end
+
   private
 
   def installation_name
     GlobalConfigService.load('INSTALLATION_NAME', 'Chatwoot')
   end
-
-  def generate_certificate_fingerprint
-    return if certificate.blank?
-
-    begin
-      cert = OpenSSL::X509::Certificate.new(certificate)
-      self.certificate_fingerprint = OpenSSL::Digest::SHA256.new(cert.to_der).hexdigest.upcase.scan(/.{2}/).join(':')
-    rescue OpenSSL::X509::CertificateError => e
-      Rails.logger.error "Failed to parse SAML certificate: #{e.message}"
-      errors.add(:certificate, 'is not a valid X.509 certificate')
-      throw(:abort)
-    end
-  end
 end

enterprise/app/models/enterprise/account.rb

@@ -1,6 +1,4 @@
 module Enterprise::Account
-  extend ActiveSupport::Concern
-
   # TODO: Remove this when we upgrade administrate gem to the latest version
   # this is a temporary method since current administrate doesn't support virtual attributes
   def manually_managed_features; end

enterprise/app/views/api/v1/models/_account_saml_settings.json.jbuilder

@@ -1,12 +1,7 @@
 json.id account_saml_settings.id
 json.account_id account_saml_settings.account_id
-json.enabled account_saml_settings.enabled
 json.sso_url account_saml_settings.sso_url
-json.certificate_fingerprint account_saml_settings.certificate_fingerprint
-json.certificate account_saml_settings.certificate
 json.sp_entity_id account_saml_settings.sp_entity_id
-json.enforced_sso account_saml_settings.enforced_sso
-json.attribute_mappings account_saml_settings.attribute_mappings || {}
 json.role_mappings account_saml_settings.role_mappings || {}
 json.created_at account_saml_settings.created_at
-json.updated_at account_saml_settings.updated_at
+json.updated_at account_saml_settings.updated_at

spec/factories/account_saml_settings.rb

@@ -1,9 +1,7 @@
 FactoryBot.define do
   factory :account_saml_settings do
     account
-    enabled { false }
     sso_url { 'https://idp.example.com/saml/sso' }
-    certificate_fingerprint { nil }
     certificate do
       key = OpenSSL::PKey::RSA.new(2048)
       cert = OpenSSL::X509::Certificate.new
@@ -18,14 +16,8 @@ FactoryBot.define do
       cert.to_pem
     end
     sp_entity_id { 'chatwoot-test' }
-    enforced_sso { false }
-    attribute_mappings { {} }
     role_mappings { {} }
 
-    trait :enabled do
-      enabled { true }
-    end
-
     trait :with_role_mappings do
       role_mappings do
         {
@@ -35,15 +27,5 @@ FactoryBot.define do
         }
       end
     end
-
-    trait :with_attribute_mappings do
-      attribute_mappings do
-        {
-          'email' => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
-          'name' => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name',
-          'first_name' => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'
-        }
-      end
-    end
   end
 end