fix(sso): always write SAML IdP metadata so clearing it takes effect on update

Not storing generated metadata fixed new providers but not existing ones: Better
Auth merges SAML config with `??`, so omitting the key let a previously stored
document survive and keep overriding the certificate.

The key is now always written, empty when the admin supplied none. createIdP
falsy-guards it and falls back to issuer/entryPoint/cert, so clearing the field
actually clears it.

Author: waleedlatif1

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -361,7 +361,7 @@ describe('POST /api/auth/sso/register', () => {
    * it back, resent it, and it then won over the certificate — so rotating a SAML
    * cert through the form silently did nothing.
    */
-  it('does not persist generated IdP metadata when the admin supplied none', async () => {
+  it('writes empty IdP metadata when the admin supplied none, so a stored one clears', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueProviders([])
     await POST(
@@ -376,7 +376,9 @@ describe('POST /api/auth/sso/register', () => {
       })
     )
     const sent = mockRegisterSSOProvider.mock.calls[0][0].body
-    expect(sent.samlConfig.idpMetadata).toBeUndefined()
+    // Written as empty rather than omitted: Better Auth merges with `??`, so an
+    // omitted key would retain a previously stored document on update.
+    expect(sent.samlConfig.idpMetadata).toEqual({ metadata: '' })
     expect(sent.samlConfig.cert).toBe('ORIGINAL-CERT')
   })
 

apps/sim/app/api/auth/sso/register/route.ts

@@ -524,15 +524,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       }
 
       /**
-       * Only persist IdP metadata the admin actually supplied. Storing a document
-       * generated from `cert` + `entryPoint` made re-saving destructive: the form
-       * loads it back into the optional metadata field, resends it, and it then
-       * wins over the certificate — so a cert rotation entered through the form
-       * silently did nothing. With no metadata stored, Better Auth's createIdP
-       * builds the IdP from issuer/entryPoint/cert, which are the fields the form
+       * Persist only IdP metadata the admin actually supplied, and always write the
+       * key so clearing it takes effect. Two failures sat here: a document generated
+       * from `cert` + `entryPoint` used to be stored unconditionally, and the form
+       * loads metadata back and resends it, so it won over the certificate and a
+       * cert rotation silently did nothing. Omitting the key instead is no fix —
+       * Better Auth merges SAML config with `??`, so a previously stored document
+       * would survive. An empty string is written instead, which `createIdP`
+       * falsy-guards, falling back to issuer/entryPoint/cert — the fields the form
        * actually edits.
        */
-      if (idpMetadata) samlConfig.idpMetadata = { metadata: idpMetadata }
+      samlConfig.idpMetadata = { metadata: idpMetadata ?? '' }
 
       if (audience) samlConfig.audience = audience
       if (wantAssertionsSigned !== undefined) samlConfig.wantAssertionsSigned = wantAssertionsSigned