feat: mock SAML 2.0 IdP for testing

.github/workflows/e2e-api-tests.yaml

@@ -143,6 +143,15 @@ jobs:
           tail: true
           wait-for: 30s
           log-output-if: true
+      - name: Start mock-saml-idp in background
+        uses: JarvusInnovations/background-action@v1.0.7
+        with:
+          run: pnpm run start:mock-saml-idp --log-order=stream &
+          wait-on: |
+            http://localhost:8142/idp
+          tail: true
+          wait-for: 30s
+          log-output-if: true
       - name: Start run-email-queue in background
         uses: JarvusInnovations/background-action@v1.0.7
         with:

apps/dev-launchpad/public/index.html

@@ -271,6 +271,13 @@ <h2 style="margin-top: 64px;">Background services</h2>
             "Src: ./apps/mock-oauth-server",
           ],
         },
+        {
+          name: "SAML mock IdP",
+          portSuffix: "42",
+          description: [
+            "Src: ./apps/mock-saml-idp",
+          ],
+        },
         {
           name: "examples/supabase",
           portSuffix: "15",

apps/e2e/tests/snapshot-serializer.ts

@@ -113,17 +113,26 @@ const stripUrlQueryParams = [
   "code",
   "code_challenge",
   "interaction_uid",
+  // SAML — both URL-binding (query) and POST-binding (form) carry these,
+  // each encodes the AuthnRequest ID + timestamps + signature so snapshots
+  // would re-roll on every test run.
+  "SAMLRequest",
+  "SAMLResponse",
+  "RelayState",
 ] as const;
 
 const keyedCookieNamePrefixes = [
   "stack-oauth-inner-",
+  "stack-saml-inner-",
 ] as const;
 
 const stringRegexReplacements = [
   [/(\/integrations\/(neon|custom)\/oauth\/idp\/(interaction|auth)\/)[a-zA-Z0-9_-]+/gi, "$1<stripped $3 UID>"],
   [new RegExp(`localhost\:${getPortPrefix()}`, "gi"), "localhost:<$$NEXT_PUBLIC_STACK_PORT_PREFIX>"],
   [new RegExp(`localhost\%3A${getPortPrefix()}`, "gi"), "localhost%3A%3C%24NEXT_PUBLIC_STACK_PORT_PREFIX%3E"],
   [/(Timeout exceeded: elapsed )[0-9.]+( ms)/gi, "$1<stripped time>$2"],
+  // SAML XML timestamps (e.g. IssueInstant, NotBefore, NotOnOrAfter).
+  [/(IssueInstant|NotBefore|NotOnOrAfter)="[^"]+"/g, '$1="<stripped SAML timestamp>"'],
 ] as const;
 
 
@@ -219,8 +228,9 @@ const snapshotSerializer: SnapshotSerializer = {
           if (headerName === "set-cookie") {
             const partsStrings = value.split(";").map((part) => part.trim());
             let cookieName = partsStrings[0].split("=")[0];
-            if (keyedCookieNamePrefixes.some((prefix) => cookieName.startsWith(prefix))) {
-              cookieName = `${keyedCookieNamePrefixes}<stripped cookie name key>`;
+            const matchedPrefix = keyedCookieNamePrefixes.find((prefix) => cookieName.startsWith(prefix));
+            if (matchedPrefix) {
+              cookieName = `${matchedPrefix}<stripped cookie name key>`;
             }
             const cookieValue = partsStrings[0].split("=")[1];
             const parts = new Map(partsStrings.map((part) => {

apps/mock-saml-idp/.eslintrc.cjs

@@ -0,0 +1,6 @@
+module.exports = {
+  "extends": [
+    "../../configs/eslint/defaults.js",
+  ],
+  "ignorePatterns": ['/*', '!/src']
+};

apps/mock-saml-idp/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@stackframe/mock-saml-idp",
+  "version": "2.8.86",
+  "repository": "https://github.com/stack-auth/stack-auth",
+  "private": true,
+  "main": "index.js",
+  "scripts": {
+    "start": "tsx src/index.ts",
+    "dev": "tsx watch --clear-screen=false src/index.ts",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint --ext .tsx,.ts .",
+    "clean": "rimraf dist && rimraf node_modules"
+  },
+  "dependencies": {
+    "express": "^4.21.2",
+    "handlebars": "^4.7.8",
+    "node-forge": "^1.3.1",
+    "samlify": "^2.10.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "@types/node-forge": "^1.3.11",
+    "tsx": "^4.16.2"
+  },
+  "packageManager": "pnpm@10.23.0"
+}