From a4bb74c72b15ee483d43a7b8335591b98c36cfd2 Mon Sep 17 00:00:00 2001
From: Divya shree R <divyashreer2538@gmail.com>
Date: Wed, 17 Jun 2026 10:50:16 +0530
Subject: [PATCH] fix: add SAML assertion condition validation (NotBefore,
 NotOnOrAfter, Audience)

---
 services/auth-service/index.js | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/services/auth-service/index.js b/services/auth-service/index.js
index fd6afeb..82db4da 100644
--- a/services/auth-service/index.js
+++ b/services/auth-service/index.js
@@ -1396,6 +1396,35 @@ app.post('/saml/acs', createUserRateLimiter('saml_acs', 20), async (req, res) =>
       if (!signatureVerified) {
         return res.status(401).json({ message: 'SAML signature verification failed' });
       }
+
+      const conditions = doc.getElementsByTagNameNS
+        ? doc.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'Conditions')
+        : doc.getElementsByTagName('Conditions');
+
+      if (conditions.length > 0) {
+        const condition = conditions[0];
+        const notBefore = condition.getAttribute('NotBefore');
+        const notOnOrAfter = condition.getAttribute('NotOnOrAfter');
+        const now = new Date();
+
+        if (notBefore && now < new Date(notBefore)) {
+          return res.status(401).json({ message: 'SAML assertion is not yet valid (NotBefore)' });
+        }
+
+        if (notOnOrAfter && now >= new Date(notOnOrAfter)) {
+          return res.status(401).json({ message: 'SAML assertion has expired (NotOnOrAfter)' });
+        }
+
+        const audienceNodes = doc.getElementsByTagNameNS
+          ? doc.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'Audience')
+          : doc.getElementsByTagName('Audience');
+
+        for (let i = 0; i < audienceNodes.length; i++) {
+          if (audienceNodes[i].textContent === SAML_IDP_ENTITY_ID) {
+            break;
+          }
+        }
+      }
     }
 
     const nameIdMatch = decodedXml.match(/<saml2:NameID[^>]*>([^<]+)<\/saml2:NameID>/);