Use authn.Cookie for SAML SSO

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/connect/v1/saml_handler.go

@@ -16,14 +16,19 @@ import (
 )
 
 type SAMLHandler struct {
-	iam          *iam.Service
-	cookieConfig securecookie.Config
-	baseURL      *baseurl.BaseURL
-	logger       *log.Logger
+	iam           *iam.Service
+	sessionCookie *authn.Cookie
+	baseURL       *baseurl.BaseURL
+	logger        *log.Logger
 }
 
 func NewSAMLHandler(iam *iam.Service, cookieConfig securecookie.Config, baseURL *baseurl.BaseURL, logger *log.Logger) *SAMLHandler {
-	return &SAMLHandler{iam: iam, cookieConfig: cookieConfig, baseURL: baseURL, logger: logger}
+	return &SAMLHandler{
+		iam:           iam,
+		sessionCookie: authn.NewCookie(&cookieConfig),
+		baseURL:       baseURL,
+		logger:        logger,
+	}
 }
 
 func (h *SAMLHandler) renderInternalServerError(w http.ResponseWriter, r *http.Request) {
@@ -98,11 +103,8 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := securecookie.Set(w, h.cookieConfig, rootSession.ID.String()); err != nil {
-		h.logger.ErrorCtx(ctx, "cannot set cookie", log.Error(err))
-		h.renderInternalServerError(w, r)
-		return
-	}
+	h.sessionCookie.Set(w, rootSession)
+
 	redirectURL := h.baseURL.WithPath("/organizations/" + membership.OrganizationID.String()).MustString()
 	http.Redirect(w, r, redirectURL, http.StatusFound)
 }

pkg/server/api/connect/v1/schema.graphql

@@ -46,7 +46,7 @@ type Query {
   viewer: Identity @session(required: PRESENT)
   ssoLoginURL(email: EmailAddr!): String
     @goField(forceResolver: true)
-    @session(required: NONE)
+    @session(required: OPTIONAL)
 }
 
 type Mutation {

pkg/server/api/connect/v1/schema/schema.go

@@ -2321,7 +2321,7 @@ type Query {
   viewer: Identity @session(required: PRESENT)
   ssoLoginURL(email: EmailAddr!): String
     @goField(forceResolver: true)
-    @session(required: NONE)
+    @session(required: OPTIONAL)
 }
 
 type Mutation {
@@ -9540,7 +9540,7 @@ func (ec *executionContext) _Query_ssoLoginURL(ctx context.Context, field graphq
 			directive0 := next
 
 			directive1 := func(ctx context.Context) (any, error) {
-				required, err := ec.unmarshalNSessionRequirement2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋgqlutilsᚋdirectivesᚋsessionᚐSessionRequirement(ctx, "NONE")
+				required, err := ec.unmarshalNSessionRequirement2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋgqlutilsᚋdirectivesᚋsessionᚐSessionRequirement(ctx, "OPTIONAL")
 				if err != nil {
 					var zeroVal *string
 					return zeroVal, err

pkg/server/api/connect/v1/v1_resolver.go

@@ -427,7 +427,7 @@ func (r *mutationResolver) SignOut(ctx context.Context) (*types.SignOutPayload,
 	}
 
 	w := gqlutils.HTTPResponseWriterFromContext(ctx)
-	r.sessionCookie.Clear(w, session)
+	r.sessionCookie.Clear(w)
 
 	return &types.SignOutPayload{Success: true}, nil
 }