fix(sso): revert a rejected SSO update instead of leaving it stored

Author: waleedlatif1

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -279,27 +279,41 @@ describe('POST /api/auth/sso/register', () => {
 
   /**
    * The create path rolls the provider back when verification is revoked during the
-   * write; the update path has no row to roll back, so it must instead strip the
-   * trust flag. Leaving it set would re-authorize same-email account linking for a
-   * domain the org no longer proves it owns.
+   * write. The update path has no new row to delete, so it restores the pre-update
+   * config and clears the trust flag together. Clearing alone would leave the
+   * rejected config stored, and re-verifying the domain regrants trust
+   * automatically — silently activating a config the caller was told had failed.
    */
-  it('revokes domain trust when verification is removed during an update', async () => {
+  it('reverts the config and revokes trust when verification is removed mid-update', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     resetDbChainMock()
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueTableRows(schemaMock.ssoDomain, [{ id: 'v' }]) // entry gate
     queueTableRows(schemaMock.ssoDomain, [{ id: 'v' }]) // pre-write re-check
     queueTableRows(schemaMock.ssoDomain, []) // locking read in the grant: proof gone
     queueProviders([])
-    queueTableRows(schemaMock.ssoProvider, [{ id: 'p1' }]) // provider already owned → update path
+    queueTableRows(schemaMock.ssoProvider, [
+      {
+        id: 'p1',
+        issuer: 'https://old-issuer.example.com',
+        domain: 'acme.com',
+        oidcConfig: '{"stored":"oidc"}',
+        samlConfig: null,
+      },
+    ]) // provider already owned → update path
 
     const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
     expect(res.status).toBe(403)
     expect(mockUpdateSSOProvider).toHaveBeenCalledTimes(1)
-    // The conditional UPDATE is still issued — it simply matches no rows once the
-    // proof is gone — so the signal is the explicit clear plus the 403, not the
-    // absence of the grant statement.
-    expect(dbChainMockFns.set).toHaveBeenCalledWith({ domainVerified: false })
+    // The conditional grant UPDATE is still issued — it simply matches no rows once
+    // the proof is gone — so the signal is the restoring write plus the 403.
+    expect(dbChainMockFns.set).toHaveBeenCalledWith({
+      issuer: 'https://old-issuer.example.com',
+      domain: 'acme.com',
+      oidcConfig: '{"stored":"oidc"}',
+      samlConfig: null,
+      domainVerified: false,
+    })
   })
 
   it('does not mark domain-verified when the registration is rolled back', async () => {

apps/sim/app/api/auth/sso/register/route.ts

@@ -614,22 +614,21 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           eq(ssoProvider.userId, session.user.id),
           isNull(ssoProvider.organizationId)
         )
+    // Config columns are captured, not just the id: an update whose trust grant is
+    // refused has to be undone, or the rejected config stays stored and goes live
+    // the moment the domain is verified again.
     const [existingOwnedProvider] = await db
-      .select({ id: ssoProvider.id })
+      .select({
+        id: ssoProvider.id,
+        issuer: ssoProvider.issuer,
+        domain: ssoProvider.domain,
+        oidcConfig: ssoProvider.oidcConfig,
+        samlConfig: ssoProvider.samlConfig,
+      })
       .from(ssoProvider)
       .where(ownerClause)
       .limit(1)
 
-    /**
-     * Unconditional write of Better Auth's `domainVerified` flag, which Sim
-     * mirrors from its own DNS proof. Used to withdraw trust; granting on an
-     * org-scoped provider goes through {@link grantProviderDomainTrust}, which
-     * re-tests ownership in the write itself.
-     */
-    const setProviderDomainVerified = async (verified: boolean) => {
-      await db.update(ssoProvider).set({ domainVerified: verified }).where(ownerClause)
-    }
-
     /**
      * Grants domain trust only while the proof is held under a row lock.
      *
@@ -644,7 +643,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
      */
     const grantProviderDomainTrust = async (): Promise<boolean> => {
       if (!orgId) {
-        await setProviderDomainVerified(!isHosted)
+        await db.update(ssoProvider).set({ domainVerified: !isHosted }).where(ownerClause)
         return true
       }
       return db.transaction(async (tx) => {
@@ -683,11 +682,21 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         headers,
       })
 
-      // Nothing to roll back on update, so clear the flag: `updateSSOProvider`
-      // resets it only when the domain changes, leaving same-domain edits stale.
+      // Restore the pre-update config and clear the flag together. Clearing alone
+      // is not enough: re-verifying the domain now regrants trust automatically,
+      // which would activate the very config this request reported as rejected.
       if (!(await grantProviderDomainTrust())) {
-        await setProviderDomainVerified(false)
-        logger.warn('Revoked SSO domain trust: verification was removed mid-update', {
+        await db
+          .update(ssoProvider)
+          .set({
+            issuer: existingOwnedProvider.issuer,
+            domain: existingOwnedProvider.domain,
+            oidcConfig: existingOwnedProvider.oidcConfig,
+            samlConfig: existingOwnedProvider.samlConfig,
+            domainVerified: false,
+          })
+          .where(eq(ssoProvider.id, existingOwnedProvider.id))
+        logger.warn('Reverted SSO update: domain verification was removed mid-write', {
           domain,
           orgId,
           providerId,