fix(sso): report the row the trust grant actually matched

The grant returned true once it found the proof, without checking that the
provider UPDATE matched anything, so its boolean did not always mean what
callers read it to mean. It now reports the matched row.

Author: waleedlatif1

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -116,6 +116,8 @@ describe('POST /api/auth/sso/register', () => {
     mockSecureFetchWithPinnedIP.mockRejectedValue(new Error('discovery not mocked for this test'))
     mockRegisterSSOProvider.mockResolvedValue({ id: 'row-1', providerId: 'acme-oidc' })
     mockUpdateSSOProvider.mockResolvedValue({ providerId: 'acme-oidc' })
+    // The trust UPDATE reports the row it matched; by default the provider exists.
+    dbChainMockFns.returning.mockResolvedValue([{ id: 'provider-row' }])
     // Default: the org has already verified the domain, so the ownership gate
     // passes and each test exercises the logic beyond it. A successful org-scoped
     // registration reads it three times: the fail-fast entry gate, the

apps/sim/app/api/auth/sso/register/route.ts

@@ -680,8 +680,12 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           .for('share')
         if (!proof) return false
 
-        await tx.update(ssoProvider).set({ domainVerified: true }).where(ownerClause)
-        return true
+        const granted = await tx
+          .update(ssoProvider)
+          .set({ domainVerified: true })
+          .where(ownerClause)
+          .returning({ id: ssoProvider.id })
+        return granted.length > 0
       })
     }