fix(sso): make one provider per domain hold at the database and resolve only verified providers

- Partial unique index on sso_provider (organization_id, normalized domain), built concurrently after a duplicate pre-check; a lost race maps to the same 409 as the pre-check
- Sign-in resolution returns only providers whose domain is verified
- Settings controls follow the organization owner/admin model the server enforces, not the creator

Author: waleedlatif1

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -229,6 +229,22 @@ describe('POST /api/auth/sso/register', () => {
     expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
   })
 
+  it('turns a lost race on the domain index into the same 409 as the pre-check', async () => {
+    queueMembers([{ organizationId: 'org1', role: 'owner' }])
+    queueProviders([])
+    mockRegisterSSOProvider.mockRejectedValue(
+      Object.assign(new Error('duplicate key value violates unique constraint'), {
+        code: '23505',
+        constraint_name: 'sso_provider_org_domain_unique',
+      })
+    )
+    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const json = await res.json()
+    expect(res.status).toBe(409)
+    expect(json.code).toBe('SSO_DOMAIN_ALREADY_ROUTED')
+    expect(json.error).toContain('acme.com')
+  })
+
   it('lets the organization add a provider for a different verified domain', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueProviders([])

apps/sim/app/api/auth/sso/register/route.ts

@@ -1,6 +1,6 @@
 import { db, member, ssoDomain, ssoProvider } from '@sim/db'
 import { createLogger } from '@sim/logger'
-import { getErrorMessage } from '@sim/utils/errors'
+import { getErrorMessage, getPostgresConstraintName } from '@sim/utils/errors'
 import { normalizeSSODomain } from '@sim/utils/sso-domain'
 import { and, eq, isNull, sql } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
@@ -81,6 +81,7 @@ async function fetchOIDCDiscoveryDocument(discoveryUrl: string): Promise<Discove
 }
 
 export const POST = withRouteHandler(async (request: NextRequest) => {
+  let requestedDomain: string | null = null
   try {
     if (!isSsoEnabled) {
       return NextResponse.json({ error: 'SSO is not enabled' }, { status: 400 })
@@ -130,6 +131,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     }
 
     const domain = normalizeSSODomain(body.domain)
+    requestedDomain = domain
     if (!domain) {
       return NextResponse.json(
         { error: 'Enter a valid domain, for example acme.com' },
@@ -828,6 +830,20 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       errorDetails: JSON.stringify(error),
     })
 
+    /**
+     * The one-provider-per-domain index is the authority when two registrations
+     * race past the read above; its violation is the same refusal, not a fault.
+     */
+    if (getPostgresConstraintName(error) === 'sso_provider_org_domain_unique') {
+      return NextResponse.json(
+        {
+          error: `${requestedDomain ?? 'This domain'} already signs in through another provider of this organization. Edit that provider, or use a different verified domain.`,
+          code: 'SSO_DOMAIN_ALREADY_ROUTED',
+        },
+        { status: 409 }
+      )
+    }
+
     // Surface Better Auth's own APIError (e.g. a 409 when identity fields change
     // while linked accounts exist, or a 404) with its status and message instead
     // of a generic 500, so the client shows an actionable error.

apps/sim/app/api/auth/sso/resolve/route.test.ts

@@ -31,7 +31,8 @@ describe('POST /api/auth/sso/resolve', () => {
     expect(res.status).toBe(200)
     await expect(res.json()).resolves.toEqual({ providerId: 'acme-okta', providerType: 'oidc' })
     const [condition] = dbChainMockFns.where.mock.calls[0]
-    expect(condition?.values).toContain('acme.com')
+    expect(JSON.stringify(condition)).toContain('acme.com')
+    expect(JSON.stringify(condition)).toContain('domainVerified')
   })
 
   it('reports SAML providers as such', async () => {

apps/sim/app/api/auth/sso/resolve/route.ts

@@ -1,6 +1,6 @@
 import { db, ssoProvider } from '@sim/db'
 import { normalizeSSODomain } from '@sim/utils/sso-domain'
-import { asc, desc, sql } from 'drizzle-orm'
+import { and, asc, eq, sql } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { resolveSsoProviderContract } from '@/lib/api/contracts/auth'
 import { parseRequest } from '@/lib/api/server'
@@ -13,8 +13,9 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
  * Unauthenticated by nature, like the sign-in page that calls it, and admitted
  * per address. It discloses nothing the public provider list does not: which
  * domains have SSO, and the provider id that already appears in the callback
- * URL. A verified domain wins over a stale unverified claim on the same domain,
- * and ties break on provider id so the answer is stable.
+ * URL. Only a provider whose domain is verified is named: an unverified claim
+ * has no authority over the address, and sending someone to its IdP would fail
+ * at the callback anyway. Ties break on provider id so the answer is stable.
  */
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const rateLimited = await enforceIpRateLimit('sso-resolve', request, {
@@ -35,8 +36,13 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   const [provider] = await db
     .select({ providerId: ssoProvider.providerId, samlConfig: ssoProvider.samlConfig })
     .from(ssoProvider)
-    .where(sql`lower(regexp_replace(btrim(${ssoProvider.domain}), '^\\*\\.', '')) = ${domain}`)
-    .orderBy(desc(ssoProvider.domainVerified), asc(ssoProvider.providerId))
+    .where(
+      and(
+        eq(ssoProvider.domainVerified, true),
+        sql`lower(regexp_replace(btrim(${ssoProvider.domain}), '^\\*\\.', '')) = ${domain}`
+      )
+    )
+    .orderBy(asc(ssoProvider.providerId))
     .limit(1)
   if (!provider) {
     return NextResponse.json(

apps/sim/ee/sso/components/sso-settings.tsx

@@ -4,7 +4,6 @@ import { useState } from 'react'
 import { ChipConfirmModal, ChipModalTabs, toast } from '@sim/emcn'
 import { getErrorMessage } from '@sim/utils/errors'
 import { useQueryStates } from 'nuqs'
-import { useSession } from '@/lib/auth/auth-client'
 import { isEnterprise } from '@/lib/billing/plan-helpers'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import {
@@ -45,7 +44,6 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
     ssoSettingsParsers,
     ssoSettingsUrlKeys
   )
-  const { data: session } = useSession()
   const { billingEnabled, features } = useDeploymentShape()
   const billing = useOrganizationBilling(organizationId)
   const providers = useSSOProviders({ organizationId })
@@ -79,10 +77,6 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
       toast.error(getErrorMessage(error, 'Failed to delete identity provider'))
     }
   }
-  const canManageProvider =
-    billingEnabled ||
-    providerList.length === 0 ||
-    providerList.some((entry) => entry.userId === session?.user?.id)
 
   if (billingEnabled && billing.isLoading) {
     return <SettingsEmptyState variant='inline'>Loading sign-in settings...</SettingsEmptyState>
@@ -129,10 +123,6 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
             isRetrying={providers.isFetching}
             onRetry={() => void providers.refetch()}
           />
-        ) : !canManageProvider ? (
-          <SettingsEmptyState variant='inline'>
-            Only the user who configured SSO can manage these settings.
-          </SettingsEmptyState>
         ) : signInView === 'list' ? (
           <SsoProviderList
             providers={providerList}

packages/db/migrations/0333_sso_provider_org_domain_unique.sql

@@ -0,0 +1,47 @@
+-- An organization may run several identity providers, but sign-in routes by email domain, so
+-- each of its domains must name exactly one provider. The registration route checks this before
+-- writing, but that check is a plain read: two concurrent registrations with different provider
+-- ids can both see no sibling and both land. This index makes the invariant hold at the database.
+--
+-- Keyed on the same expression the verify and resolve paths compare domains with, so a legacy
+-- leading `*.` or stray case cannot slip a second provider onto a domain already routed.
+--
+-- Duplicates must be resolved first. Failing here, inside the transaction, avoids letting the
+-- CONCURRENT build fail afterwards and strand an INVALID index that IF NOT EXISTS would skip
+-- forever. Which row survives is a judgement call, so this reports the ids and stops.
+DO $$
+DECLARE duplicate_provider_ids text;
+BEGIN
+  SELECT string_agg(provider_id, ', ')
+    INTO duplicate_provider_ids
+    FROM "sso_provider"
+    WHERE "organization_id" IS NOT NULL
+      AND ("organization_id", lower(regexp_replace(btrim("domain"), '^\*\.', ''))) IN (
+        SELECT "organization_id", lower(regexp_replace(btrim("domain"), '^\*\.', ''))
+          FROM "sso_provider"
+         WHERE "organization_id" IS NOT NULL
+         GROUP BY 1, 2
+        HAVING count(*) > 1
+      );
+  IF duplicate_provider_ids IS NOT NULL THEN
+    RAISE EXCEPTION
+      'sso_provider has several providers on one organization domain: %. Keep one provider per (organization, domain) and re-run.',
+      duplicate_provider_ids;
+  END IF;
+END $$;--> statement-breakpoint
+
+COMMIT;--> statement-breakpoint
+
+-- `lock_timeout = 0` for the concurrent build, per packages/db/scripts/migrate.ts.
+-- CREATE INDEX CONCURRENTLY waits on every concurrent write in the database, not just
+-- this table, so the session's 5s DDL timeout would cancel it (55P03) and strand an
+-- INVALID index that the IF NOT EXISTS below would skip forever.
+SET lock_timeout = 0;--> statement-breakpoint
+
+-- Clear any INVALID index left by a previously cancelled build, so a replay
+-- rebuilds it instead of skipping it.
+DROP INDEX CONCURRENTLY IF EXISTS "sso_provider_org_domain_unique";--> statement-breakpoint
+
+CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS "sso_provider_org_domain_unique" ON "sso_provider" USING btree ("organization_id", lower(regexp_replace(btrim("domain"), '^\*\.', ''))) WHERE "sso_provider"."organization_id" is not null;--> statement-breakpoint
+
+SET lock_timeout = '5s';