feat(saml-idp): Slack SSO via signed SAML assertions

apps/api/package.json

@@ -21,6 +21,7 @@
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",
     "@fastify/env": "^6.0.0",
+    "@fastify/formbody": "^8.0.2",
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/static": "^9.1.3",
     "@fastify/swagger": "^9.7.0",
@@ -30,6 +31,7 @@
     "fastify": "^5.8.5",
     "gitsheets": "^1.0.3",
     "jose": "^6.2.3",
+    "samlify": "^2.13.0",
     "uuidv7": "^1.2.1",
     "zod": "^4.4.3"
   },

apps/api/src/app.ts

@@ -21,6 +21,7 @@ import Fastify, { type FastifyInstance, type FastifyServerOptions } from 'fastif
 import fastifyEnv from '@fastify/env';
 import fastifyCors from '@fastify/cors';
 import fastifyCookie from '@fastify/cookie';
+import fastifyFormbody from '@fastify/formbody';
 import fastifySwagger from '@fastify/swagger';
 import fastifySwaggerUi from '@fastify/swagger-ui';
 
@@ -44,6 +45,7 @@ import { projectBuzzRoutes } from './routes/projects-buzz.js';
 import { helpWantedRoutes } from './routes/projects-help-wanted.js';
 import { projectMembershipRoutes } from './routes/projects-members.js';
 import { previewRoutes } from './routes/preview.js';
+import { samlRoutes } from './routes/saml.js';
 
 declare module 'fastify' {
   interface FastifyInstance {
@@ -95,6 +97,10 @@ export async function buildApp(opts: BuildAppOptions = {}): Promise<FastifyInsta
   // ----- 3. Cookie parsing -----
   await fastify.register(fastifyCookie);
 
+  // ----- 3a. Form-body parsing (application/x-www-form-urlencoded) -----
+  // Needed for SAML SP-initiated SSO (Slack POSTs AuthnRequest as form data).
+  await fastify.register(fastifyFormbody);
+
   // ----- 4. Trace ID (UUIDv7 on every request) -----
   await fastify.register(traceIdPlugin);
 
@@ -151,6 +157,7 @@ export async function buildApp(opts: BuildAppOptions = {}): Promise<FastifyInsta
   await fastify.register(helpWantedRoutes);
   await fastify.register(projectMembershipRoutes);
   await fastify.register(previewRoutes);
+  await fastify.register(samlRoutes);
 
   // Serve the OpenAPI JSON at the spec-mandated path /api/_openapi.json
   // (swagger-ui also exposes it at /api/_docs/json, but the spec names this path)

apps/api/src/env.ts

@@ -39,6 +39,11 @@ export const EnvSchema = z.object({
   SAML_PRIVATE_KEY: z.string().optional(),
   /** SAML IdP certificate (PEM) for the Slack SAML integration. */
   SAML_CERTIFICATE: z.string().optional(),
+  /**
+   * Slack workspace host. Used as the SAML `NameQualifier` per
+   * specs/api/saml.md and shared with the `/chat` redirect handler.
+   */
+  SLACK_TEAM_HOST: z.string().default('codeforphilly.slack.com'),
   /**
    * Path to the built apps/web/dist directory. When set, the API serves the
    * SPA as a fallthrough for non-/api/* routes. Set in the production Docker
@@ -77,6 +82,7 @@ export const envJsonSchema = {
     CFP_JWT_SIGNING_KEY: { type: 'string', minLength: 1 },
     SAML_PRIVATE_KEY: { type: 'string' },
     SAML_CERTIFICATE: { type: 'string' },
+    SLACK_TEAM_HOST: { type: 'string', default: 'codeforphilly.slack.com' },
     CFP_WEB_DIST_PATH: { type: 'string' },
   },
 } as const;