Authentication

Copyexport interface Session {
  user: {
    id: string;
    name: string;
    email: string;
    image?: string;
    isMachine: boolean;
    defaultWorkspace?: string;
    defaultPartnerId?: string;
  };
}
 
export const getSession = async () => {
  return getServerSession(authOptions) as Promise<Session>;
};

Copyexport const getAuthTokenOrThrow = (
  req: Request | NextRequest,
  type: "Bearer" | "Basic" = "Bearer",
) => {
  const authorizationHeader = req.headers.get("Authorization");
 
  if (!authorizationHeader) {
    throw new DubApiError({
      code: "bad_request",
      message:
        "Misconfigured authorization header. Did you forget to add 'Bearer '? Learn more: https://d.to/auth",
    });
  }
 
  return authorizationHeader.replace(`${type} `, "");
};

Copyexport const withSession = (handler: WithSessionHandler) =>
  withAxiom(
    async (
      req,
      { params: initialParams }: { params: Promise<Record<string, string>> },
    ) => {
      const params = (await initialParams) || {};
      let requestHeaders = await headers();
      let responseHeaders = new Headers();
 
      try {
        let session: Session | undefined;
 
        const authorizationHeader = requestHeaders.get("Authorization");
        if (authorizationHeader) {
          if (!authorizationHeader.startsWith("Bearer ")) {
            throw new DubApiError({
              code: "bad_request",
              message:
                "Misconfigured authorization header. Did you forget to add 'Bearer '? Learn more: https://d.to/auth",
            });
          }
          const apiKey = authorizationHeader.replace("Bearer ", "");
 
          const hashedKey = await hashToken(apiKey);
 
          const user = await prisma.user.findFirst({
            where: {
              tokens: {
                some: {
                  hashedKey,
                },
              },
            },
            select: {
              id: true,
              name: true,
              email: true,
              isMachine: true,
            },
          });
          if (!user) {
            throw new DubApiError({
              code: "unauthorized",
              message: "Unauthorized: Invalid API key.",
            });
          }
 
          const { success, limit, reset, remaining } = await ratelimit(
            60,
            "1 m",
          ).limit(apiKey);
 
          responseHeaders.set("Retry-After", reset.toString());
          responseHeaders.set("X-RateLimit-Limit", limit.toString());
          responseHeaders.set("X-RateLimit-Remaining", remaining.toString());
          responseHeaders.set("X-RateLimit-Reset", reset.toString());
 
          if (!success) {
            throw new DubApiError({
              code: "rate_limit_exceeded",
              message: "Too many requests.",
            });
          }
          waitUntil(
            (async () => {
              try {
                // update last used time for the token (only once every minute)
                const { success } = await ratelimit(1, "1 m").limit(
                  `last-used-${hashedKey}`,
                );
 
                if (success) {
                  await prisma.token.update({
                    where: {
                      hashedKey,
                    },
                    data: {
                      lastUsed: new Date(),
                    },

Copyexport const withWorkspace = (
  handler: WithWorkspaceHandler,
  {
    requiredPlan = ["free", "pro", "business", "advanced", "enterprise"], // if the action needs a specific plan
    requiredPermissions = [],
    requiredRoles = [],
    featureFlag, // if the action needs a specific feature flag
  }: {
    requiredPlan?: Array<PlanProps>;
    requiredPermissions?: PermissionAction[];
    requiredRoles?: WorkspaceRole[];
    featureFlag?: BetaFeatures;
  } = {},
) => {

Copyimport type {
  IConnectionAPIController,
  IDirectorySyncController,
  IOAuthController,
  JacksonOption,
} from "@boxyhq/saml-jackson";
import samlJackson from "@boxyhq/saml-jackson";
import { APP_DOMAIN_WITH_NGROK } from "@dub/utils";
 
export const samlAudience = "https://saml.dub.co";
 
const opts: JacksonOption = {
  externalUrl:
    process.env.NODE_ENV === "production"
      ? "https://api.dub.co"
      : APP_DOMAIN_WITH_NGROK,
  samlPath:
    process.env.NODE_ENV === "production"
      ? "/auth/saml/callback"
      : "/api/auth/saml/callback",
  samlAudience,
  db: {
    engine: "planetscale",
    type: "mysql",
    url: process.env.DATABASE_URL as string,
    ssl: {
      rejectUnauthorized: false,
    },
  },
  idpEnabled: true, // to allow folks to SSO directly from their IDP
  scimPath:
    process.env.NODE_ENV === "production" ? "/scim/v2.0" : "/api/scim/v2.0", // custom SCIM endpoint
  clientSecretVerifier: process.env.NEXTAUTH_SECRET as string,
};
 

Copyexport async function jackson() {
  if (
    !globalThis.apiController ||
    !globalThis.oauthController ||
    !globalThis.directorySyncController
  ) {
    const ret = await samlJackson(opts);
    globalThis.apiController = ret.connectionAPIController;
    globalThis.oauthController = ret.oauthController;
    globalThis.directorySyncController = ret.directorySyncController;
  }
 
  return {
    apiController: globalThis.apiController,
    oauthController: globalThis.oauthController,
    directorySyncController: globalThis.directorySyncController,
  };

Copyimport { jackson } from "@/lib/jackson";
import { getSearchParams } from "@dub/utils";
import { NextResponse } from "next/server";
 
const handler = async (req: Request) => {
  const { oauthController } = await jackson();
 
  const requestParams =
    req.method === "GET" ? getSearchParams(req.url) : await req.json();
 
  const { redirect_url, authorize_form } =
    await oauthController.authorize(requestParams);
 
  if (redirect_url) {
    return NextResponse.redirect(redirect_url, {
      status: 302,
    });
  } else {
    return new Response(authorize_form, {
      headers: {
        "Content-Type": "text/html; charset=utf-8",
      },
    });
  }
};

Copyimport { jackson } from "@/lib/jackson";
import { NextResponse } from "next/server";
 
export async function POST(req: Request) {
  const { oauthController } = await jackson();
 
  const formData = await req.formData();
 
  const RelayState = formData.get("RelayState") || "";
  const SAMLResponse = formData.get("SAMLResponse") || "";
 
  const { redirect_url } = await oauthController.samlResponse({
    RelayState: RelayState as string,
    SAMLResponse: SAMLResponse as string,
  });
 
  if (!redirect_url) {
    return new Response("No redirect URL found.", {
      status: 400,
    });
  }
 
  return NextResponse.redirect(redirect_url, {
    status: 302,
  });
}

Copyimport { jackson } from "@/lib/jackson";
import * as jose from "jose";
import { NextResponse } from "next/server";
import * as dummy from "openid-client";
 
export async function POST(req: Request) {
  console.log("token route");
 
  // Need these imports to fix import errors with jackson
  // https://github.com/ory/polis/blob/main/pages/api/import-hack.ts
  const unused = dummy; // eslint-disable-line @typescript-eslint/no-unused-vars
  const unused2 = jose; // eslint-disable-line @typescript-eslint/no-unused-vars
 
  const { oauthController } = await jackson();
 
  const formData = await req.formData();
  const body = Object.fromEntries(formData.entries());
 
  const token = await oauthController.token(body as any);
 
  return NextResponse.json(token);
}

Copyexport async function POST(req: Request) {
  const { apiController } = await jackson();
 
  const { slug } = await req.json();
 
  if (!slug) {
    return NextResponse.json(
      { error: "No workspace slug provided." },
      { status: 400 },
    );
  }
 
  try {
    await assertRateLimit({
      policy: RATELIMIT_POLICIES.samlVerify,
      identifier: await getIP(),
    });
  } catch (error) {
    if (error instanceof DubApiError && error.code === "rate_limit_exceeded") {
      return NextResponse.json(
        {
          error: error.message,
        },
        { status: 429 },
      );
    }
 
    throw error;
  }
 
  const workspace = await prisma.project.findUnique({
    where: { slug },
    select: { id: true },
  });
 
  if (!workspace) {
    return NextResponse.json(
      { error: "No SSO connection found for this workspace." },
      { status: 404 },
    );
  }
 
  const connections = await apiController.getConnections({
    tenant: workspace.id,
    product: "Dub",
  });
 
  if (!connections || connections.length === 0) {
    return NextResponse.json(
      { error: "No SSO connection found for this workspace." },
      { status: 404 },
    );
  }
 
  const data = {
    workspaceId: workspace.id,
  };
 
  return NextResponse.json({ data });
}

Copyimport { jackson } from "@/lib/jackson";
import { NextResponse } from "next/server";
 
export async function GET(req: Request) {
  const { oauthController } = await jackson();
 
  const authHeader = req.headers.get("Authorization");
 
  if (!authHeader) {
    return new Response("Unauthorized", {
      status: 401,
    });
  }
 
  const token = authHeader.split(" ")[1];
 
  const user = await oauthController.userInfo(token);
 
  return NextResponse.json(user);
}

Copyexport const isSamlEnforcedForEmailDomain = async (email: string) => {
  const hostname = (await headers()).get("host");
  const emailDomain = email.split("@")[1].toLocaleLowerCase();
 
  if (
    !hostname ||
    !emailDomain ||
    !isAppHostname(hostname) ||
    isGenericEmail(email)
  ) {
    return false;
  }
 
  const workspace = await prisma.project.findUnique({
    where: {
      ssoEmailDomain: emailDomain,
    },
    select: {
      ssoEnforcedAt: true,
    },
  });
 
  if (workspace?.ssoEnforcedAt) {
    return true;
  }
 
  return false;
};

Copyexport const GET = withWorkspace(
  async ({ workspace }) => {
    const { apiController } = await jackson();
 
    const connections = await apiController.getConnections({
      tenant: workspace.id,
      product: "Dub",
    });
 
    const response = {
      connections,
      issuer: samlAudience,
      acs:
        process.env.NODE_ENV === "production"
          ? "https://api.dub.co/auth/saml/callback"
          : `${APP_DOMAIN_WITH_NGROK}/api/auth/saml/callback`,
    };
 
    return NextResponse.json(response);
  },
  {
    requiredPermissions: ["workspaces.read"],
  },
);

Copyexport const POST = withWorkspace(
  async ({ req, workspace, session }) => {
    const { metadataUrl, encodedRawMetadata } =
      createSAMLConnectionSchema.parse(await req.json());
 
    const ssoEmailDomain = session.user.email.split("@")[1].toLocaleLowerCase();
 
    if (isGenericEmail(ssoEmailDomain)) {
      throw new DubApiError({
        code: "bad_request",
        message:
          "SAML configuration requires you to be logged in with your organization’s work email.",
      });
    }
 
    const { apiController } = await jackson();
 
    const data = await apiController.createSAMLConnection({
      encodedRawMetadata: encodedRawMetadata!,
      metadataUrl: metadataUrl!,
      defaultRedirectUrl: `${process.env.NEXTAUTH_URL}/auth/saml`,
      redirectUrl: process.env.NEXTAUTH_URL as string,
      tenant: workspace.id,
      product: "Dub",
    });
 
    await prisma.project.update({
      where: {
        id: workspace.id,
      },
      data: {
        ssoEmailDomain,
      },
    });
 
    return NextResponse.json(data);
  },
  {
    requiredPermissions: ["workspaces.write"],
    requiredPlan: ["enterprise"],
  },
);

Copyexport const DELETE = withWorkspace(
  async ({ searchParams, workspace }) => {
    const { clientID, clientSecret } =
      deleteSAMLConnectionSchema.parse(searchParams);
 
    const { apiController } = await jackson();
 
    const connections = await apiController.getConnections({
      tenant: workspace.id,
      product: "Dub",
    });
 
    const connection = connections.find(
      (connection) => connection.clientID === clientID,
    );
 
    if (!connection) {
      throw new DubApiError({
        code: "not_found",
        message: "SAML connection not found",
      });
    }
 
    await apiController.deleteConnections({
      clientID: connection.clientID,
      clientSecret: connection.clientSecret,
    });
 
    await apiController.deleteConnections({
      clientID,
      clientSecret,
    });
 
    await prisma.project.update({
      where: {
        id: workspace.id,
      },
      data: {
        ssoEmailDomain: null,
        ssoEnforcedAt: null,
      },
    });
 
    return NextResponse.json({
      response: "Successfully removed SAML connection",
    });
  },
  {
    requiredPermissions: ["workspaces.write"],
  },
);

CopyonSubmit={async (e) => {
  e.preventDefault();
  setClickedMethod("saml");
  fetch("/api/auth/saml/verify", {
    method: "POST",
    body: JSON.stringify({ slug: e.currentTarget.slug.value }),
  }).then(async (res) => {
    const { data, error } = await res.json();
    if (error) {
      toast.error(error);
      setClickedMethod(undefined);
      return;
    }
    setLastUsedAuthMethod("saml");
    await signIn("saml", undefined, {
      tenant: data.workspaceId,
      product: "Dub",
    });
  });
}}

Copyexport default function SAMLForm() {
  const searchParams = useSearchParams();
 
  useEffect(() => {
    const code = searchParams?.get("code");
 
    signIn("saml-idp", {
      callbackUrl: "/",
      code,
    });
  }, []);

Copyconst handler = async (
  req: Request,
  { params: initialParams }: { params: Promise<Record<string, string[]>> },
) => {
  const params = (await initialParams) || {};
  const headersList = await headers();
  const authHeader = headersList.get("Authorization");
  const apiSecret = authHeader ? authHeader.split(" ")[1] : null;
 
  const query = getSearchParams(req.url);
  const [directoryId, path, resourceId] = params.directory;
  let body;
  try {
    body = await req.json();
  } catch (error) {
    body = {};
  }
 
  const { directorySyncController } = await jackson();
 
  // Handle the SCIM API requests
  const request: DirectorySyncRequest = {
    method: req.method,
    body,
    directoryId,
    resourceId,
    resourceType: path === "Users" ? "users" : "groups",
    apiSecret,
    query: {
      count: query.count ? parseInt(query.count as string) : undefined,
      startIndex: query.startIndex
        ? parseInt(query.startIndex as string)
        : undefined,
      filter: query.filter as string,
    },
  };
 
  const { status, data } = await directorySyncController.requests.handle(
    request,
    handleEvents,
  );
 
  return NextResponse.json(data, { status });
};
 
export { handler as DELETE, handler as GET, handler as POST, handler as PUT };

Copyconst createDirectorySchema = z.object({
  provider: z.enum(["okta-scim-v2", "azure-scim-v2", "google"]).optional(),
  currentDirectoryId: z.string().min(1).optional(),
});
 
const deleteDirectorySchema = z.object({
  directoryId: z.string().min(1),
});
 
// GET /api/workspaces/[idOrSlug]/scim – get all SCIM directories
export const GET = withWorkspace(
  async ({ workspace }) => {
    const { directorySyncController } = await jackson();
 
    const { data, error } =
      await directorySyncController.directories.getByTenantAndProduct(
        workspace.id,
        "Dub",
      );
    if (error) {
      throw new DubApiError({
        code: "internal_server_error",
        message: error.message,
      });
    }
 
    return NextResponse.json({
      directories: data,
    });
  },
  {
    requiredPermissions: ["workspaces.read"],
  },
);
 
// POST /api/workspaces/[idOrSlug]/scim – create a new SCIM directory
export const POST = withWorkspace(
  async ({ req, workspace }) => {
    const { provider = "okta-scim-v2", currentDirectoryId } =
      createDirectorySchema.parse(await req.json());
 
    const { directorySyncController } = await jackson();
 
    if (currentDirectoryId) {
      const directory =
        await directorySyncController.directories.get(currentDirectoryId);
 
      if (!directory || directory.error || !directory.data) {
        throw new DubApiError({
          code: "not_found",
          message: directory?.error?.message ?? "Directory not found.",
        });
      }
 
      if (
        directory.data.tenant !== workspace.id ||
        directory.data.product !== "Dub"
      ) {
        throw new DubApiError({
          code: "not_found",
          message: "Directory not found.",
        });
      }
    }
 
    const [data, _] = await Promise.all([
      directorySyncController.directories.create({
        name: "Dub SCIM Directory",
        tenant: workspace.id,
        product: "Dub",
        type: provider,
      }),
 
      currentDirectoryId &&
        directorySyncController.directories.delete(currentDirectoryId),
    ]);
 
    return NextResponse.json(data);
  },
  {

Copy  scimPath:
    process.env.NODE_ENV === "production" ? "/scim/v2.0" : "/api/scim/v2.0", // custom SCIM endpoint
  clientSecretVerifier: process.env.NEXTAUTH_SECRET as string,
};

Copy// Handle the SCIM events
const handleEvents = async (event: DirectorySyncEvent) => {
  const { event: action, tenant: workspaceId, data } = event;
 
  const workspace = (await prisma.project.findUnique({
    where: {
      id: workspaceId,
    },
  })) as unknown as WorkspaceProps;
 
  if (!workspace || workspace.plan !== "enterprise" || !("email" in data)) {
    return;
  }
 
  const [userInWorkspace, userInvited] = await Promise.all([
    prisma.user.findFirst({
      where: {
        email: data.email,
        projects: {
          some: {
            projectId: workspaceId,
          },
        },
      },
    }),
    await prisma.projectInvite.findUnique({
      where: {
        email_projectId: {
          email: data.email,
          projectId: workspaceId,
        },
      },
    }),
  ]);
 
  // User has been activated for the first time
  if (action === "user.created" && !userInWorkspace && !userInvited) {
    await inviteUser({
      email: data.email,
      workspace,
    });
  }
 
  // User has been activated
  if (
    action === "user.updated" &&
    // @ts-ignore – data.active can be a string (from Azure AD)
    (data.active === true || data.active === "True")
  ) {
    if (!userInWorkspace && !userInvited) {
      await inviteUser({
        email: data.email,
        workspace,
      });
    }
  }
 
  // User has been deactivated or deleted
  if (
    (action === "user.updated" &&
      // @ts-ignore – data.active can be a string (from Azure AD)
      (data.active === false || data.active === "False")) ||
    action === "user.deleted"
  ) {
    if (userInWorkspace) {
      await prisma.projectUsers.delete({
        where: {
          userId_projectId: {
            userId: userInWorkspace.id,
            projectId: workspaceId,
          },
        },
      });
    }
    if (userInvited) {
      await prisma.projectInvite.delete({
        where: {
          email_projectId: {
            email: data.email,
            projectId: workspaceId,

Copyexport function SCIM() {
  const { plan, role } = useWorkspace();
  const { SCIMModal, setShowSCIMModal } = useSCIMModal();
  const { RemoveSCIMModal, setShowRemoveSCIMModal } = useRemoveSCIMModal();
 
  const { provider, configured, loading } = useSCIM();
 
  const permissionsError = clientAccessCheck({
    action: "workspaces.write",
    role,
    customPermissionDescription: "configure SCIM Directory Sync",
  }).error;
 

Copyexport default function useSCIM() {
  const { id } = useWorkspace();
 
  const { data, isLoading, mutate } = useSWR<{ directories: Directory[] }>(
    id && `/api/workspaces/${id}/scim`,
    fetcher,
    {
      keepPreviousData: true,
    },
  );
 
  const configured = useMemo(() => {
    return data?.directories && data.directories.length > 0;
  }, [data]);
 
  return {
    scim: data as { directories: Directory[] },
    provider: configured ? data!.directories[0].type : null,
    configured,
    loading: isLoading,
    mutate,
  };

Copy<form
  onSubmit={async (e) => {
    e.preventDefault();
    setSubmitting(true);
    fetch(`/api/workspaces/${id}/scim`, {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        provider: e.currentTarget.provider.value,
        ...(configured && {
          currentDirectoryId: scim.directories[0].id,
        }),
      }),
    }).then(async (res) => {
      if (res.ok) {
        await mutate();
        toast.success("Successfully configured SCIM");
      } else {
        const { error } = await res.json();
        toast.error(error.message);
      }
      setSubmitting(false);
    });
  }}

Copyconst removeSCIM = async () => {
  setRemoving(true);
  if (!scim?.directories[0]) {
    toast.error("No SCIM directories found");
    setRemoving(false);
    return;
  }
  const { id } = scim.directories[0];
  const params = new URLSearchParams({
    directoryId: id,
  });
 
  const res = await fetch(`/api/workspaces/${workspaceId}/scim?${params}`, {
    method: "DELETE",
  });
  setRemoving(false);
  if (res.ok) {
    await mutate();
    setShowRemoveSCIMModal(false);
    toast.success("SCIM directory removed successfully");
  } else {
    const { error } = await res.json();
    toast.error(error.message);
  }
};