feat: add saml app sessions table

[darcyYe]

Summary

Add saml_application_sessions table to help improve the security of OIDC and SAML proxy. (resolves LOG-10581)

1. when we receice SAML auth request, we create create a record (using applicationId, and samlRequestId) in this table
2. and then we start a OIDC auth request on backend, which should update the record and attach oidcState
3. on SAML proxy callback page, we check whether we have unexpired and unused OIDC state in record, if not, throw an error otherwise mark the OIDC state as used (this prevents replay attack)
4. after getting the OIDC token with the OIDC auth code, we get the unused samlRequestId and sent SAML response to the ACS URL in record and hence marked the samlRequestId as parsed

Testing

N/A

Checklist

• .changeset
• unit tests
• integration tests
• necessary TSDoc comments

[github-actions]

COMPARE TO master

Total Size Diff 📈 +5.23 KB

Diff by File

Name	Diff
packages/core/src/saml-applications/queries/sessions.ts	📈 +2.29 KB
packages/core/src/tenants/Queries.ts	📈 +174 Bytes
packages/schemas/alterations/next-1735012422-add-saml-application-sessions-table.ts	📈 +1.27 KB
packages/schemas/src/foundations/jsonb-types/index.ts	📈 +48 Bytes
packages/schemas/src/foundations/jsonb-types/saml-application-sessions.ts	📈 +527 Bytes
packages/schemas/tables/saml_application_sessions.sql	📈 +965 Bytes

[simeng-li]

overall LGTM