[macastelaz]

Description

Validates tenantId and OIDC/SAML providerId resource identifiers against URL path traversal, dot-segments (., .., ..., trailing .), query/fragment injection (?, #, &), and percent-encoded sequences (%) before interpolating them into Identity Toolkit REST API URLs:

• Adds validator.isTenantId(tenantId) enforcing that tenant IDs are non-empty strings consisting of RFC 3986 unreserved characters ([a-zA-Z0-9-_.~]) that do not end with ..
• Applies validator.isTenantId(tenantId) in TenantManager.authForTenant, TenantAwareAuth, AuthRequestHandler.getTenant, AuthRequestHandler.deleteTenant, AuthRequestHandler.updateTenant, TenantAwareAuthRequestHandler, and validateCreateEditRequest.
• Updates SAMLConfig.isProviderId, SAMLConfig.validate, OIDCConfig.isProviderId, and OIDCConfig.validate to require a non-empty suffix after saml. / oidc. consisting of [a-zA-Z0-9-_.~] and not ending with ..
• Adds unit tests covering malformed tenant IDs and OIDC/SAML provider IDs across validator, TenantManager, TenantAwareAuth, SAMLConfig, OIDCConfig, and AuthRequestHandler.

[gemini-code-assist]

Code Review

This pull request introduces stricter validation for tenant IDs and provider IDs (SAML and OIDC) across the authentication module, replacing basic non-empty string checks with regex-based validation and adding a new isTenantId utility. While these changes improve input validation, the review feedback identifies a security vulnerability in the regular expressions used in auth-config.ts and validator.ts. Specifically, the unescaped hyphen in the character class [a-zA-Z0-9-_.~] is interpreted as a range (9-_), which inadvertently permits dangerous characters like ?, @, and \. Escaping the hyphens is highly recommended to prevent potential validation bypasses.

[lahirumaramba]

LGTM! Added a nit comment. Thanks!