Merge remote-tracking branch 'origin/staging' into feat/crowdstrike-depth

# Conflicts:
#	apps/sim/tools/generated/tool-ids.ts
#	apps/sim/tools/generated/tool-metadata.ts
#	apps/sim/tools/generated/tool-outputs.ts

Author: waleedlatif1

apps/docs/components/icons.tsx

@@ -8726,6 +8726,33 @@ export function BigQueryIcon(props: SVGProps<SVGSVGElement>) {
   )
 }
 
+/**
+ * Splunk wordmark. The lettering is drawn with `currentColor` so it stays legible
+ * bare in both light and dark mode; the chevron keeps its brand green.
+ */
+export function SplunkIcon(props: SVGProps<SVGSVGElement>) {
+  return (
+    <svg
+      viewBox='0 0 48 48'
+      fillRule='evenodd'
+      clipRule='evenodd'
+      xmlns='http://www.w3.org/2000/svg'
+      {...props}
+    >
+      <path
+        fill='currentColor'
+        d='M13.432 18L13.5 28 15 28 15 18zM32 18v10.005h1.805c0 0 .015-3.609.035-3.608.019.001 2.69 3.743 2.716 3.733.027-.01 1.599-.576 1.599-.59 0-.014-2.684-3.441-2.684-3.448 0-.006 2.251-2.509 2.231-2.529-.06-.06-1.281-.586-1.314-.566-.018.011-2.582 2.796-2.582 2.796V18H32zM2.099 21.05c-.651.137-1.259.552-1.509 1.031-.23.44-.227 1.043.007 1.491.16.305.625.735 1.348 1.246.782.552 1.078.832 1.153 1.092.111.385-.06.752-.434.931-.187.089-.27.101-.603.086-.433-.02-.729-.132-1.172-.446-.14-.099-.269-.167-.285-.152-.016.016-.155.224-.311.466L.01 27.23l.109.081c.06.045.248.158.422.255 1.187.66 2.944.555 3.835-.229.475-.418.697-1.025.602-1.647-.089-.582-.409-.965-1.417-1.695-.791-.573-1.166-.889-1.253-1.059-.167-.326-.049-.643.307-.827.178-.092.251-.102.608-.087.347.015.453.041.741.179l.335.161.263-.41c.144-.224.252-.426.239-.445-.048-.071-.598-.299-.941-.391C3.402 20.995 2.521 20.961 2.099 21.05zM10.031 21.935c.788.369 1.212 1.528 1.041 2.852-.06.467-.227 1.032-.383 1.296-.159.268-.463.56-.705.675-.444.212-1.107.13-1.523-.187-.577-.442-.893-1.524-.772-2.649.111-1.032.483-1.684 1.133-1.986C9.156 21.781 9.7 21.781 10.031 21.935zM9.313 20.784c-.472.106-.85.319-1.254.705l-.366.35V21H6.814 6v5 5h1.693v-4.08l.324.319c.592.583 1.287.814 2.101.701.532-.074.904-.21 1.3-.475 1.111-.743 1.721-2.221 1.554-3.771-.158-1.467-.912-2.484-2.128-2.871C10.531 20.724 9.679 20.702 9.313 20.784zM16.258 21c0 0 .055 5.284.091 5.438.136.583.525 1.137.964 1.374.403.218.727.287 1.333.284.861-.004 1.386-.211 2.027-.8L21 27v1h1.742l-.023-7H21c0 0 .025 4.347 0 4.5-.1.611-.573 1.109-1.053 1.27-.287.096-.786.174-1.086.127C18.549 26.848 18.033 26.507 18 26v-4.977L16.258 21zM30.742 28c0 0-.055-5.284-.091-5.438-.136-.583-.525-1.137-.964-1.374-.403-.218-.727-.287-1.333-.284-.861.004-1.386.211-2.027.8L26 22v-1h-1.742l.023 7H26c0 0-.025-4.347 0-4.5.1-.611.573-1.109 1.053-1.27.287-.096.661-.17 1.086-.127C28.566 22.147 29.031 22.535 29 23v4.977L30.742 28z'
+      />
+      <path
+        fill='#77b539'
+        fillRule='evenodd'
+        clipRule='evenodd'
+        d='M40 20.5L40 22 46 24 40 26.601 40 28 47 25 47 23z'
+      />
+    </svg>
+  )
+}
+
 export function SnowflakeIcon(props: SVGProps<SVGSVGElement>) {
   return (
     <svg viewBox='0 0 146.36 139.16' xmlns='http://www.w3.org/2000/svg' {...props}>

apps/docs/components/ui/icon-mapping.ts

@@ -216,6 +216,7 @@ import {
   SmartleadIcon,
   SmtpIcon,
   SnowflakeIcon,
+  SplunkIcon,
   SportmonksIcon,
   SQSIcon,
   SquareIcon,
@@ -507,6 +508,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   smartlead: SmartleadIcon,
   smtp: SmtpIcon,
   snowflake: SnowflakeIcon,
+  splunk: SplunkIcon,
   sportmonks: SportmonksIcon,
   sqs: SQSIcon,
   square: SquareIcon,

apps/docs/content/docs/en/integrations/meta.json

@@ -230,6 +230,7 @@
     "smtp",
     "snowflake",
     "snowflake-service-account",
+    "splunk",
     "sportmonks",
     "sqs",
     "square",

apps/docs/content/docs/en/integrations/okta.mdx

@@ -50,7 +50,7 @@ describe('auth catch-all route (DISABLE_AUTH get-session)', () => {
       'http://localhost:3000/api/auth/get-session'
     )
 
-    const res = await GET(req as any)
+    const res = await GET(req)
     const json = await res.json()
 
     expect(handlerMocks.ensureAnonymousUserExists).toHaveBeenCalledTimes(1)
@@ -68,7 +68,7 @@ describe('auth catch-all route (DISABLE_AUTH get-session)', () => {
     handlerMocks.betterAuthGET.mockResolvedValueOnce(
       new NextResponse(JSON.stringify({ data: { ok: true } }), {
         headers: { 'content-type': 'application/json' },
-      }) as any
+      })
     )
 
     const req = createMockRequest(
@@ -78,7 +78,7 @@ describe('auth catch-all route (DISABLE_AUTH get-session)', () => {
       'http://localhost:3000/api/auth/get-session'
     )
 
-    const res = await GET(req as any)
+    const res = await GET(req)
     const json = await res.json()
 
     expect(handlerMocks.ensureAnonymousUserExists).not.toHaveBeenCalled()
@@ -100,7 +100,7 @@ describe('auth catch-all route organization mutations', () => {
       'http://localhost:3000/api/auth/organization/create'
     )
 
-    const res = await POST(req as any)
+    const res = await POST(req)
     const json = await res.json()
 
     expect(res.status).toBe(404)
@@ -115,7 +115,7 @@ describe('auth catch-all route organization mutations', () => {
     handlerMocks.betterAuthPOST.mockResolvedValueOnce(
       new NextResponse(JSON.stringify({ data: { ok: true } }), {
         headers: { 'content-type': 'application/json' },
-      }) as any
+      })
     )
 
     const req = createMockRequest(
@@ -125,10 +125,77 @@ describe('auth catch-all route organization mutations', () => {
       'http://localhost:3000/api/auth/organization/set-active'
     )
 
-    const res = await POST(req as any)
+    const res = await POST(req)
     const json = await res.json()
 
     expect(handlerMocks.betterAuthPOST).toHaveBeenCalledTimes(1)
     expect(json).toEqual({ data: { ok: true } })
   })
 })
+
+describe('auth catch-all route SSO provider mutations', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it.each([
+    'sso/update-provider',
+    'sso/delete-provider',
+    'sso/request-domain-verification',
+    'sso/verify-domain',
+  ])('blocks the plugin-served %s endpoint', async (path) => {
+    const req = createMockRequest('POST', undefined, {}, `http://localhost:3000/api/auth/${path}`)
+
+    const res = await POST(req)
+    const json = await res.json()
+
+    expect(res.status).toBe(404)
+    expect(handlerMocks.betterAuthPOST).not.toHaveBeenCalled()
+    expect(json).toEqual({
+      error: 'SSO provider mutations are handled by application API routes.',
+    })
+  })
+
+  it.each([
+    'sso/saml2/callback/acme',
+    'sso/saml2/sp/acs/acme',
+    'sso/saml2/sp/slo/acme',
+    'sso/saml2/logout/acme',
+  ])('allows the SAML protocol endpoint %s', async (path) => {
+    const { NextResponse } = await import('next/server')
+    handlerMocks.betterAuthPOST.mockResolvedValueOnce(
+      new NextResponse(JSON.stringify({ data: { ok: true } }), {
+        headers: { 'content-type': 'application/json' },
+      })
+    )
+
+    const req = createMockRequest('POST', undefined, {}, `http://localhost:3000/api/auth/${path}`)
+
+    const res = await POST(req)
+    const json = await res.json()
+
+    expect(handlerMocks.betterAuthPOST).toHaveBeenCalledTimes(1)
+    expect(json).toEqual({ data: { ok: true } })
+  })
+
+  it('leaves the SSO sign-in endpoint reachable', async () => {
+    const { NextResponse } = await import('next/server')
+    handlerMocks.betterAuthPOST.mockResolvedValueOnce(
+      new NextResponse(JSON.stringify({ data: { url: 'https://idp.example.com' } }), {
+        headers: { 'content-type': 'application/json' },
+      })
+    )
+
+    const req = createMockRequest(
+      'POST',
+      undefined,
+      {},
+      'http://localhost:3000/api/auth/sign-in/sso'
+    )
+
+    const res = await POST(req)
+
+    expect(handlerMocks.betterAuthPOST).toHaveBeenCalledTimes(1)
+    expect(await res.json()).toEqual({ data: { url: 'https://idp.example.com' } })
+  })
+})

apps/docs/content/docs/en/integrations/splunk.mdx

@@ -10,6 +10,14 @@ export const dynamic = 'force-dynamic'
 const { GET: betterAuthGET, POST: betterAuthPOST } = toNextJsHandler(auth.handler)
 const SAFE_ORGANIZATION_POST_PATHS = new Set(['organization/check-slug', 'organization/set-active'])
 
+/**
+ * SAML protocol endpoints the IdP posts to (`saml2/callback/:id`,
+ * `saml2/sp/acs/:id`, `saml2/sp/slo/:id`, `saml2/logout/:id`). These are the
+ * only SSO paths the plugin must keep serving on POST — every other SSO POST
+ * endpoint it registers is a provider mutation.
+ */
+const SAML_PROTOCOL_POST_PREFIX = 'sso/saml2/'
+
 function getAuthPath(request: NextRequest): string {
   const pathname = request.nextUrl?.pathname ?? new URL(request.url).pathname
   return pathname.replace('/api/auth/', '')
@@ -19,6 +27,30 @@ function isBlockedOrganizationMutationPath(path: string): boolean {
   return path.startsWith('organization/') && !SAFE_ORGANIZATION_POST_PATHS.has(path)
 }
 
+/**
+ * SSO provider configuration is owned by `/api/auth/sso/register`, which proves
+ * domain ownership before granting trust and restricts the attribute mapping to
+ * `id`/`email`/`name`/`image`. The plugin's own `sso/update-provider` bypasses
+ * both: it is gated only on provider ownership and merges the caller's config,
+ * so a provider owner could add `mapping.emailVerified` — a change the plugin's
+ * identity-boundary guard does not consider, so it never trips the linked-account
+ * conflict — and then assert an arbitrary victim's email as verified to auto-link
+ * into their account. `sso/delete-provider` likewise lets an owner drop a login
+ * path outside the application's flow.
+ *
+ * `trustEmailVerified: false` independently defuses that claim, so these two
+ * guards are layered, not redundant: this one keeps provider configuration
+ * owned by the register route (which alone proves domain ownership) and is what
+ * stops the mapping rewrite from becoming live again if that option is ever
+ * reconsidered.
+ *
+ * Deny-by-default rather than a blocklist so a future plugin version cannot
+ * introduce another unshadowed provider mutation.
+ */
+function isBlockedSsoMutationPath(path: string): boolean {
+  return path.startsWith('sso/') && !path.startsWith(SAML_PROTOCOL_POST_PREFIX)
+}
+
 export const GET = withRouteHandler(async (request: NextRequest) => {
   const path = getAuthPath(request)
 
@@ -40,5 +72,12 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     )
   }
 
+  if (isBlockedSsoMutationPath(path)) {
+    return NextResponse.json(
+      { error: 'SSO provider mutations are handled by application API routes.' },
+      { status: 404 }
+    )
+  }
+
   return betterAuthPOST(request)
 })