apps/mock-saml-idp/src/index.ts (1)

88-94: Encode tenant slugs when generating mock IdP URLs.

Slugs from STACK_MOCK_SAML_TENANTS are directly interpolated into URLs. If a slug contains reserved URL characters like /, ?, or #, the metadata and SSO URLs will be malformed and tenant routing will fail. Per coding guidelines, use encodeURIComponent() to encode the path segment.

♻️ Suggested change

 function entityIdFor(slug: string): string {
-  return `http://localhost:${port}/idp/${slug}/metadata`;
+  const encodedSlug = encodeURIComponent(slug);
+  return `http://localhost:${port}/idp/${encodedSlug}/metadata`;
 }
 
 function ssoUrlFor(slug: string): string {
-  return `http://localhost:${port}/idp/${slug}/sso`;
+  const encodedSlug = encodeURIComponent(slug);
+  return `http://localhost:${port}/idp/${encodedSlug}/sso`;
 }

Also applies to line 432.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/mock-saml-idp/src/index.ts` around lines 88 - 94, The entityIdFor and
ssoUrlFor functions currently interpolate raw slug values into URLs, which
breaks when slugs contain reserved URL characters; update both functions (and
the similar occurrence around the symbol referenced at line ~432) to encode the
slug using encodeURIComponent() before inserting it into the path so metadata
and SSO URLs are always valid and safe for routing.

apps/backend/src/lib/seed-dummy-data.ts (1)

1986-2002: ⚡ Quick win

Remove the cast by typing overlay with the target parameter type.

The as Parameters<...> cast bypasses type safety and is avoidable here.

Suggested change

-  const overlay: Record<string, unknown> = {};
+  const overlay: Parameters<typeof overrideEnvironmentConfigOverride>[0]['environmentConfigOverrideOverride'] = {};
@@
   await overrideEnvironmentConfigOverride({
     projectId,
     branchId: DEFAULT_BRANCH_ID,
-    environmentConfigOverrideOverride: overlay as Parameters<typeof overrideEnvironmentConfigOverride>[0]["environmentConfigOverrideOverride"],
+    environmentConfigOverrideOverride: overlay,
   });

As per coding guidelines, "Do NOT use as/any/type casts or anything else like that to bypass the type system."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/backend/src/lib/seed-dummy-data.ts` around lines 1986 - 2002, The
overlay object is being cast with a broad as-cast when passed to
overrideEnvironmentConfigOverride; instead declare overlay with the exact
parameter type so you don’t bypass the type system. Replace the current const
overlay: Record<string, unknown> = {} with a declaration using Parameters<typeof
overrideEnvironmentConfigOverride>[0]["environmentConfigOverrideOverride"] as
the type (e.g., const overlay: Parameters<typeof
overrideEnvironmentConfigOverride>[0]["environmentConfigOverrideOverride"] =
{}), keep building properties from fetched (f.slug, f.displayName, etc.) and
then call overrideEnvironmentConfigOverride(projectId, DEFAULT_BRANCH_ID, {
environmentConfigOverrideOverride: overlay }) without the as cast. Ensure the
property shapes you assign match that parameter type.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

apps/e2e/tests/snapshot-serializer.ts (1)

116-121: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

POST-bound SAML form payloads are still not redacted.

stripUrlQueryParams only applies inside URL parsing (Line 201), so hidden form inputs like SAMLResponse/RelayState remain dynamic and can still reroll snapshots.

Suggested fix

 const stringRegexReplacements = [
   [/(\/integrations\/(neon|custom)\/oauth\/idp\/(interaction|auth)\/)[a-zA-Z0-9_-]+/gi, "$1<stripped $3 UID>"],
   [new RegExp(`localhost\:${getPortPrefix()}`, "gi"), "localhost:<$$NEXT_PUBLIC_STACK_PORT_PREFIX>"],
   [new RegExp(`localhost\%3A${getPortPrefix()}`, "gi"), "localhost%3A%3C%24NEXT_PUBLIC_STACK_PORT_PREFIX%3E"],
   [/(Timeout exceeded: elapsed )[0-9.]+( ms)/gi, "$1<stripped time>$2"],
+  [/(name="(?:SAMLRequest|SAMLResponse|RelayState)"\s+value=")[^"]*(")/g, '$1<stripped SAML form value>$2'],
   // SAML XML timestamps (e.g. IssueInstant, NotBefore, NotOnOrAfter).
   [/(IssueInstant|NotBefore|NotOnOrAfter)="[^"]+"/g, '$1="<stripped SAML timestamp>"'],
 ] as const;

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/e2e/tests/snapshot-serializer.ts` around lines 116 - 121, The serializer
currently redacts SAML params only from URLs via stripUrlQueryParams, leaving
POST-bound hidden form fields like SAMLResponse and RelayState dynamic; update
the snapshot serializer to also detect and replace values of hidden form inputs
(names "SAMLRequest", "SAMLResponse", "RelayState") during HTML serialization so
snapshots are stable. Locate the HTML form handling/serialization logic in this
file (where stripUrlQueryParams is defined/used) and add a step that parses form
input elements (or runs a regex over <input ... type="hidden" name="...">) to
replace their value attributes with a fixed placeholder, applying the same
redaction list already used for URLs. Ensure the change targets those exact
parameter names so other inputs remain unchanged.

apps/e2e/tests/snapshot-serializer.ts (1)

116-121: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

POST-bound SAML form values are still not redacted.

stripUrlQueryParams only helps when SAML fields appear in URLs. The mock IdP auto-post page carries SAMLRequest/SAMLResponse/RelayState in hidden form inputs, so snapshots can still churn.

Suggested patch

 const stringRegexReplacements = [
   [/(\/integrations\/(neon|custom)\/oauth\/idp\/(interaction|auth)\/)[a-zA-Z0-9_-]+/gi, "$1<stripped $3 UID>"],
   [new RegExp(`localhost\:${getPortPrefix()}`, "gi"), "localhost:<$$NEXT_PUBLIC_STACK_PORT_PREFIX>"],
   [new RegExp(`localhost\%3A${getPortPrefix()}`, "gi"), "localhost%3A%3C%24NEXT_PUBLIC_STACK_PORT_PREFIX%3E"],
   [/(Timeout exceeded: elapsed )[0-9.]+( ms)/gi, "$1<stripped time>$2"],
+  [/(name="(?:SAMLRequest|SAMLResponse|RelayState)"\s+value=")[^"]*(")/g, '$1<stripped SAML form value>$2'],
   [/(IssueInstant|NotBefore|NotOnOrAfter)="[^"]+"/g, '$1="<stripped SAML timestamp>"'],
 ] as const;

Also applies to: 134-135

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/e2e/tests/snapshot-serializer.ts` around lines 116 - 121, The SAML form
hidden inputs (names "SAMLRequest", "SAMLResponse", "RelayState") are not being
redacted because stripUrlQueryParams only handles URLs; update the snapshot
serializer that handles HTML output (the same code that currently calls
stripUrlQueryParams) to also scan form inputs and replace value attributes for
inputs whose name matches "SAMLRequest" | "SAMLResponse" | "RelayState" with a
stable placeholder (same placeholder used for URL params), handling
single/double quotes and variations (hidden/text/textarea), and apply the same
change for the other occurrence referenced around lines 134-135 so POST-bound
SAML values are consistently redacted from snapshots.