feat(saml): add SAML IdP admin API surface, fix missing client_id field#49
Merged
Conversation
Verified this SDK against a real quay.io/authorizer/authorizer:2.4.0-rc.7 instance and closed the remaining server API coverage gap: SAML IdP admin (Authorizer acting as Identity Provider for downstream SPs) had zero methods/types. Added, dual graphql+rest like client/trustedIssuer: createSAMLServiceProvider, updateSAMLServiceProvider, deleteSAMLServiceProvider, samlServiceProvider, listSAMLServiceProviders, rotateSAMLIDPCert, retireSAMLIDPKey, listSAMLIDPKeys, importSAMLSPMetadata. Also fixed: Client's GraphQL fragment and TS interface were missing client_id — the schema documents it as the public OAuth identifier used at authorize/token endpoints, distinct from the internal id. It rode along untyped in REST JSON but was never fetched over graphql at all; only didn't break anything today because the server currently defaults client_id to id when unset, which is an implementation coincidence, not a contract guarantee. Verified: tsc --noEmit, tsup build, eslint all clean. New samlIdp.test.ts (8 tests, mocked fetch) plus a live smoke pass against the real rc.7 image exercising all 9 new methods end-to-end over both graphql and rest (create org, full SP lifecycle, rotate IdP cert twice, list/retire keys, import SP metadata, delete, 404-after-delete). This SDK has no gRPC transport (browsers can't speak raw gRPC), confirmed no gRPC-native service-to-service auth path applies here.
CI was pinned to quay.io/authorizer/authorizer:2.3.0, which predates the schema/CLI surface this PR's new coverage (and the existing suite) needs: - admin.test.ts's ListUsersRequest queries and newer User fields (has_skipped_mfa_setup_at, mfa_locked_at, enrolled_mfa_methods) don't exist on 2.3.0's schema, failing GraphQL validation. - index.test.ts passes --disable-mfa, a flag that doesn't exist on the 2.3.0 binary -- an unrecognized flag makes it print usage and exit immediately, so the container's port 8080 never opens and testcontainers' health-check waits the full 900s before timing out. Bumped to rc.7. Verified locally: `AUTHORIZER_IMAGE=...:2.4.0-rc.7 npm test` passes 99/99 in ~8s (vs. 900s+ timeout before).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verified this SDK against a real
quay.io/authorizer/authorizer:2.4.0-rc.7instance and closed the remaining server API coverage gap: SAML IdP admin (Authorizer acting as Identity Provider for downstream SPs) had zero methods/types.Added, dual
graphql+restlikeclient/trustedIssuer:createSAMLServiceProvider,updateSAMLServiceProvider,deleteSAMLServiceProvidersamlServiceProvider,listSAMLServiceProvidersrotateSAMLIDPCert,retireSAMLIDPKey,listSAMLIDPKeysimportSAMLSPMetadataBug fix
Client's GraphQL fragment and TS interface were missingclient_id— the schema documents it as the public OAuth identifier used at authorize/token endpoints, distinct from the internalid. It rode along untyped in REST JSON but was never fetched over GraphQL at all. Only didn't break anything today because the server currently defaultsclient_idtoidwhen unset — an implementation coincidence, not a contract guarantee.Test plan
tsc --noEmit,tsupbuild,eslintall cleansamlIdp.test.ts(8 tests, mocked fetch)