fix(sso): read SAML InResponseTo from correct path (#8607)

samlify's extractor nests InResponseTo under `extract.response`, not
directly on `extract`. The two login handlers (callbackSSOSAML and
acsEndpoint) were reading `extract.inResponseTo` which is always
undefined, causing InResponseTo validation to always fail. The logout
handler already used the correct path `extract?.response?.inResponseTo`.

Updated SAMLAssertionExtract interface to include the `response` property
with proper typing instead of casting to `any`.

packages/sso/src/routes/sso.ts

@@ -2173,9 +2173,8 @@ export const callbackSSOSAML = (options?: SSOOptions) => {
 				logger: ctx.context.logger,
 			});
 
-			const inResponseTo = (extract as SAMLAssertionExtract).inResponseTo as
-				| string
-				| undefined;
+			const inResponseTo = (extract as SAMLAssertionExtract).response
+				?.inResponseTo;
 			const shouldValidateInResponseTo =
 				options?.saml?.enableInResponseToValidation;
 
@@ -2689,9 +2688,8 @@ export const acsEndpoint = (options?: SSOOptions) => {
 				logger: ctx.context.logger,
 			});
 
-			const inResponseToAcs = (extract as SAMLAssertionExtract).inResponseTo as
-				| string
-				| undefined;
+			const inResponseToAcs = (extract as SAMLAssertionExtract).response
+				?.inResponseTo;
 			const shouldValidateInResponseToAcs =
 				options?.saml?.enableInResponseToValidation;
 

packages/sso/src/types.ts

@@ -99,11 +99,13 @@ export interface SAMLSessionRecord {
 export interface SAMLAssertionExtract {
 	nameID?: string;
 	sessionIndex?: string;
-	inResponseTo?: string;
 	conditions?: {
 		notBefore?: string;
 		notOnOrAfter?: string;
 	};
+	response?: {
+		inResponseTo?: string;
+	};
 }
 
 type BaseSSOProvider = {