fix(db): give the SSO index migration the concurrent-build convention it skipped

packages/db/scripts/migrate.ts documents the required shape for CONCURRENTLY
statements, and the previous migration follows it. 0284 did not, and the
omission is silently destructive.

migrate.ts sets a session lock_timeout of 5s, which survives the embedded
COMMIT. CREATE INDEX CONCURRENTLY waits on every concurrent write transaction in
the database — not only ones touching this table — so on a busy database the
build is cancelled with 55P03 and leaves an INVALID index. The retry then
replays the file, IF NOT EXISTS skips the invalid index, and DROP INDEX removes
the only working index on provider_id. The migration journals as applied and
exits 0 with provider_id unindexed and uniqueness unenforced, reopening the
cross-tenant provider resolution this migration exists to close.

Adds SET lock_timeout = 0 around the concurrent statements, a pre-drop of the
target index name so a replay rebuilds rather than skips, and restores the 5s
timeout afterwards. Verified by stranding an INVALID index and replaying: the
end state is a valid unique index with uniqueness enforced.

Also corrects the sso() comment that claimed domainVerified confines linking to
matching email domains. link-account.mjs blocks on
`!isTrustedProvider && !userInfo.emailVerified`, so an IdP asserting
email_verified links regardless of domain — the flag narrows nothing on its own.

Author: waleedlatif1

apps/sim/ee/sso/components/sso-settings.tsx

@@ -48,11 +48,7 @@ interface SSOProvider {
   providerType: 'oidc' | 'saml'
 }
 
-/**
- * Claim/attribute names each protocol uses out of the box. Kept as the fallback
- * rather than seeded into form state so switching protocol needs no reset logic
- * and the inputs can show them as placeholders.
- */
+/** Claim names each protocol uses out of the box; shown as input placeholders. */
 const OIDC_DEFAULT_MAPPING = { id: 'sub', email: 'email', name: 'name', image: 'picture' } as const
 const SAML_DEFAULT_MAPPING = {
   id: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier',
@@ -257,30 +253,6 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
     setShowAdvanced(false)
   }
 
-  const isFormValid = () => {
-    const requiredFields = ['providerId', 'issuerUrl', 'domain']
-    const hasRequiredFields = requiredFields.every((field) => {
-      const value = formData[field as keyof typeof formData]
-      return typeof value === 'string' && value.trim() !== ''
-    })
-
-    const providerType = formData.providerType || 'oidc'
-
-    if (providerType === 'oidc') {
-      return (
-        hasRequiredFields &&
-        formData.clientId.trim() !== '' &&
-        formData.clientSecret.trim() !== '' &&
-        formData.scopes.trim() !== ''
-      )
-    }
-    if (providerType === 'saml') {
-      return hasRequiredFields && formData.entryPoint.trim() !== '' && formData.cert.trim() !== ''
-    }
-
-    return false
-  }
-
   const handleSubmit = async (e?: React.FormEvent) => {
     e?.preventDefault()
 
@@ -359,9 +331,7 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
 
   const handleInputChange = (field: keyof typeof formData, value: string | boolean) => {
     const next = { ...formData, [field]: value }
-    // Claim names are protocol-specific — OIDC's `email` means nothing to a SAML
-    // IdP — so carrying an override across a protocol switch would save a mapping
-    // that cannot resolve. Clear them and fall back to the new protocol's defaults.
+    // Claim names are protocol-specific, so an override must not survive a switch.
     if (field === 'providerType') {
       next.mapId = ''
       next.mapEmail = ''
@@ -499,8 +469,6 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
               </p>
             </SettingRow>
 
-            {/* Admins land here after saving, so this view has to carry the same
-                two values an IdP needs as the form does. */}
             {existingProvider.providerType === 'saml' && (
               <SettingRow label='SP Entity ID'>
                 <ChipCopyInput value={getBaseUrl()} copyLabel='Copy entity ID' />
@@ -554,7 +522,10 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
           ...saveDiscardActions({
             dirty: hasChanges,
             saving: configureSSOMutation.isPending,
-            saveDisabled: hasAnyErrors(errors) || !isFormValid(),
+            // Deliberately not disabled on validation errors: showErrors is only
+            // set by handleSubmit, so a disabled Save left the admin with a greyed
+            // out button and no message. Clicking now reveals what is wrong.
+            saveDisabled: false,
             saveLabel: isEditing ? 'Update' : 'Save',
             savingLabel: isEditing ? 'Updating...' : 'Saving...',
             onSave: () => void handleSubmit(),
@@ -908,10 +879,7 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
                             onChange={(value: string) =>
                               handleInputChange('identifierFormat', value)
                             }
-                            options={SAML_NAMEID_FORMATS.map((a) => ({
-                              label: a.label,
-                              value: a.value,
-                            }))}
+                            options={[...SAML_NAMEID_FORMATS]}
                             placeholder='Provider default'
                           />
                         </SettingRow>
@@ -942,10 +910,7 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
               </p>
             </SettingRow>
 
-            {/* SAML IdP admins are typically handed vendor metadata; Sim does not
-                publish a metadata document, so surface the two values that document
-                would carry. Sim's SP entity ID is its base URL — the same value the
-                register route embeds in the generated SP metadata. */}
+            {/* Sim publishes no SP metadata document; these are the values it would carry. */}
             {isSaml && (
               <SettingRow label='SP Entity ID'>
                 <ChipCopyInput value={getBaseUrl()} copyLabel='Copy entity ID' />
@@ -956,10 +921,6 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
               </SettingRow>
             )}
 
-            {/* Identity providers vary in which claim carries each value — Entra,
-                for instance, can send the address as `upn` rather than `email`.
-                Leaving a field blank uses the protocol default shown as its
-                placeholder, so the common case needs no input at all. */}
             <div className='flex flex-col gap-2'>
               <Button
                 type='button'

apps/sim/ee/sso/components/verified-domains-section.tsx

@@ -142,6 +142,14 @@ export function VerifiedDomainsSection({ organizationId }: VerifiedDomainsSectio
               <ChipInput
                 value={newDomain}
                 onChange={(event) => setNewDomain(event.target.value)}
+                onKeyDown={(event) => {
+                  // This section renders inside the SSO provider <form>, so a bare
+                  // Enter would submit that form instead of adding the domain.
+                  if (event.key === 'Enter') {
+                    event.preventDefault()
+                    void handleAdd()
+                  }
+                }}
                 placeholder='acme.com'
                 className='min-w-0 flex-1'
               />

apps/sim/lib/auth/auth.ts

@@ -1113,10 +1113,14 @@ export const auth = betterAuth({
              *
              * Sim does not use Better Auth's own DNS challenge endpoints: ownership is
              * proven by Sim's `sso_domain` flow before a provider can be registered,
-             * and the register route mirrors that decision onto this flag. Linking is
-             * still constrained to emails whose domain matches the provider's domain
-             * (`validateEmailDomain`), so this grants no trust beyond the verified
-             * domain itself.
+             * and the register route mirrors that decision onto this flag.
+             *
+             * This path is constrained to emails whose domain matches the provider's
+             * (`validateEmailDomain`). It is NOT the only path: `link-account.mjs`
+             * blocks on `!isTrustedProvider && !userInfo.emailVerified`, so an IdP
+             * that asserts `email_verified` links regardless of domain — see the
+             * note on `trustEmailVerified` above. This flag narrows nothing on its
+             * own; it exists so linking survives IdPs that omit the claim.
              */
             domainVerification: { enabled: true },
             organizationProvisioning: {

packages/db/migrations/0284_sso_provider_domain_verified.sql

@@ -36,7 +36,20 @@ ALTER TABLE "sso_provider" ADD COLUMN IF NOT EXISTS "domain_verified" boolean DE
 
 COMMIT;--> statement-breakpoint
 
+-- `lock_timeout = 0` for the concurrent builds, per the convention in
+-- packages/db/scripts/migrate.ts. CREATE INDEX CONCURRENTLY waits on every
+-- concurrent write transaction in the database, not just ones touching this
+-- table, so the session's 5s DDL timeout would cancel the build (55P03) and
+-- strand an INVALID index that the IF NOT EXISTS below would then skip forever.
+SET lock_timeout = 0;--> statement-breakpoint
+
+-- Clear any INVALID index left by a previously cancelled build, so a replay
+-- rebuilds it instead of skipping it.
+DROP INDEX CONCURRENTLY IF EXISTS "sso_provider_provider_id_unique";--> statement-breakpoint
+
 -- Build the unique index before dropping the old plain one, so provider_id is never unindexed.
 CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS "sso_provider_provider_id_unique" ON "sso_provider" USING btree ("provider_id");--> statement-breakpoint
 
-DROP INDEX CONCURRENTLY IF EXISTS "sso_provider_provider_id_idx";
+DROP INDEX CONCURRENTLY IF EXISTS "sso_provider_provider_id_idx";--> statement-breakpoint
+
+SET lock_timeout = '5s';