fix(sso): revoke domain trust when verification is removed mid-update

The create path re-checks domain ownership after Better Auth persists the
provider and rolls the row back if the verified sso_domain row disappeared in
that window. The update path had no equivalent, so deleting the verified domain
while updateSSOProvider was in flight still set domainVerified, restoring
same-email account-linking trust for a domain the org no longer proves it owns.

The update path has no newly-created row to roll back, so it clears the flag
instead: that denies linking and blocks sign-in on the provider until the domain
is verified again.

Author: waleedlatif1

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -275,6 +275,29 @@ describe('POST /api/auth/sso/register', () => {
     expect(dbChainMockFns.set).toHaveBeenCalledWith({ domainVerified: true })
   })
 
+  /**
+   * The create path rolls the provider back when verification is revoked during the
+   * write; the update path has no row to roll back, so it must instead strip the
+   * trust flag. Leaving it set would re-authorize same-email account linking for a
+   * domain the org no longer proves it owns.
+   */
+  it('revokes domain trust when verification is removed during an update', async () => {
+    resetDbChainMock()
+    queueMembers([{ organizationId: 'org1', role: 'owner' }])
+    // Verified for the entry gate and the pre-write re-check, revoked afterwards.
+    queueTableRows(schemaMock.ssoDomain, [{ id: 'verified-domain' }])
+    queueTableRows(schemaMock.ssoDomain, [{ id: 'verified-domain' }])
+    queueTableRows(schemaMock.ssoDomain, [])
+    queueProviders([])
+    queueTableRows(schemaMock.ssoProvider, [{ id: 'p1' }]) // provider already owned → update path
+
+    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    expect(res.status).toBe(403)
+    expect(mockUpdateSSOProvider).toHaveBeenCalledTimes(1)
+    expect(dbChainMockFns.set).toHaveBeenCalledWith({ domainVerified: false })
+    expect(dbChainMockFns.set).not.toHaveBeenCalledWith({ domainVerified: true })
+  })
+
   it('does not mark domain-verified when the registration is rolled back', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     resetDbChainMock()

apps/sim/app/api/auth/sso/register/route.ts

@@ -647,13 +647,13 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
      * flag, which is what lets an SSO sign-in auto-link to an existing same-email
      * account. Must run after every write, not just on create: `registerSSOProvider`
      * always persists `false`, and `updateSSOProvider` resets it to `false` whenever
-     * the domain changes. Only ever called once the verification gate above has
-     * passed for this exact domain, so it can never mark an unproven domain as
-     * verified. Org-less (personal) SSO is not domain-gated by Sim and keeps its
-     * pre-existing trust here, matching how it behaved before the flag existed.
+     * the domain changes. Callers re-check ownership immediately before granting it,
+     * so it can never mark an unproven domain as verified. Org-less (personal) SSO is
+     * not domain-gated by Sim and keeps its pre-existing trust here, matching how it
+     * behaved before the flag existed.
      */
-    const markProviderDomainVerified = async () => {
-      await db.update(ssoProvider).set({ domainVerified: true }).where(ownerClause)
+    const setProviderDomainVerified = async (verified: boolean) => {
+      await db.update(ssoProvider).set({ domainVerified: verified }).where(ownerClause)
     }
 
     if (existingOwnedProvider) {
@@ -667,7 +667,24 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         },
         headers,
       })
-      await markProviderDomainVerified()
+
+      // Compensating re-check, mirroring the create path below: the verified
+      // sso_domain row can be deleted while updateSSOProvider is in flight.
+      // Granting trust here would re-authorize same-email account linking for a
+      // domain the org no longer proves it owns, so clear the flag instead —
+      // that both denies linking and blocks sign-in until it is re-verified.
+      if (orgId && !(await isOrgDomainVerified())) {
+        await setProviderDomainVerified(false)
+        logger.warn('Revoked SSO domain trust: verification was removed mid-update', {
+          domain,
+          orgId,
+          providerId,
+          userId: session.user.id,
+        })
+        return domainNotVerifiedResponse()
+      }
+
+      await setProviderDomainVerified(true)
       logger.info('SSO provider updated successfully', { providerId, providerType, domain })
       return NextResponse.json({
         success: true,
@@ -717,7 +734,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       return domainNotVerifiedResponse()
     }
 
-    await markProviderDomainVerified()
+    await setProviderDomainVerified(true)
 
     logger.info('SSO provider registered successfully', {
       providerId,