Repository: Infisical/infisical
File: backend/src/ee/services/saml-config/saml-config-service.ts (TypeScript)

Code before:
    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Sso);

    const plan = await licenseService.getPlan(orgId);
    if (!plan.samlSSO)
      throw new BadRequestError({
        message:
          "Failed to create SAML SSO configuration due to plan restriction. Upgrade plan to create SSO configuration."
      });

    const org = await orgDAL.findOrgById(orgId);

    if (!org) {
      throw new NotFoundError({ message: `Could not find organization with ID "${orgId}"` });
    }

    if (org.googleSsoAuthEnforced && isActive) {
      throw new BadRequestError({
        message:
          "You cannot enable SAML SSO while Google OAuth is enforced. Disable Google OAuth enforcement to enable SAML SSO."
      });
    }

    if (enableGroupSync && !GROUP_SYNC_SUPPORTED_PROVIDERS.includes(authProvider)) {
      throw new BadRequestError({
        message: "Group sync is only supported for Google SAML SSO."
      });
    }

    const { encryptor } = await kmsService.createCipherPairWithDataKey({
      type: KmsDataKey.Organization,
      orgId
    });

    const samlConfig = await samlConfigDAL.create({
      orgId,
      authProvider,
      isActive,
      encryptedSamlCertificate: encryptor({ plainText: Buffer.from(idpCert) }).cipherTextBlob,
      encryptedSamlEntryPoint: encryptor({ plainText: Buffer.from(entryPoint) }).cipherTextBlob,
      encryptedSamlIssuer: encryptor({ plainText: Buffer.from(issuer) }).cipherTextBlob,
      enableGroupSync: enableGroupSync || false
    });

    return samlConfig;
  };

  const updateSamlCfg: TSamlConfigServiceFactory["updateSamlCfg"] = async ({
    orgId,
    actor,
    actorOrgId,

Review comment (suggestion):
I think we should use the same error message as below so we don't have to update this message whenever we add support to other providers

Code after:
            }
          }
        }
      }
    };

    if (tx) {
      await processGroupSync(tx);
    } else {
      await userDAL.transaction(processGroupSync);
    }
  };

  const createSamlCfg: TSamlConfigServiceFactory["createSamlCfg"] = async ({
    idpCert,
    actor,
    actorAuthMethod,
    actorOrgId,
    orgId,
    issuer,
    actorId,
    isActive,
    entryPoint,
    authProvider,
    enableGroupSync
  }) => {
    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Sso);

    const plan = await licenseService.getPlan(orgId);
    if (!plan.samlSSO)
      throw new BadRequestError({
        message:
          "Failed to create SAML SSO configuration due to plan restriction. Upgrade plan to create SSO configuration."
      });

    const org = await orgDAL.findOrgById(orgId);

    if (!org) {
      throw new NotFoundError({ message: `Could not find organization with ID "${orgId}"` });
    }

    if (org.googleSsoAuthEnforced && isActive) {
      throw new BadRequestError({
        message:
          "You cannot enable SAML SSO while Google OAuth is enforced. Disable Google OAuth enforcement to enable SAML SSO."
      });
    }

    if (enableGroupSync && !GROUP_SYNC_SUPPORTED_PROVIDERS.includes(authProvider)) {
      throw new BadRequestError({