fix(auth): preserve SSO audit events across application operations

Author: waleedlatif1

apps/sim/app/api/auth/sso/providers/[providerId]/route.test.ts

@@ -28,7 +28,9 @@ describe('DELETE /api/auth/sso/providers/[providerId]', () => {
   beforeEach(() => {
     resetDbChainMock()
     mockGetSession.mockResolvedValue({ user: { id: 'u1' }, session: { id: 'session-1' } })
-    dbChainMockFns.returning.mockResolvedValue([{ id: 'row-1' }])
+    dbChainMockFns.returning.mockResolvedValue([
+      { id: 'row-1', providerId: 'acme-okta', organizationId: null, domain: 'acme.com' },
+    ])
   })
 
   it('leaves domains alone when deleting a personal provider', async () => {
@@ -76,7 +78,9 @@ describe('DELETE /api/auth/sso/providers/[providerId]', () => {
     expect(refused.status).toBe(403)
 
     resetDbChainMock()
-    dbChainMockFns.returning.mockResolvedValue([{ id: 'row-1' }])
+    dbChainMockFns.returning.mockResolvedValue([
+      { id: 'row-1', providerId: 'acme-okta', organizationId: null, domain: 'acme.com' },
+    ])
     queueTableRows(schemaMock.ssoProvider, [
       {
         id: 'row-1',

apps/sim/app/api/organizations/[id]/domains/[domainId]/route.test.ts

@@ -56,6 +56,7 @@ describe('remove org domain route', () => {
    * trust in the same transaction, or the authorization outlives the ownership.
    */
   it('revokes SSO domain trust for providers on the removed domain', async () => {
+    queueTableRows(member, [{ role: 'owner' }])
     queueTableRows(member, [{ role: 'owner' }])
     dbChainMockFns.returning.mockResolvedValueOnce([{ domain: 'acme.com' }])
     const res = await DELETE(createMockRequest('DELETE'), routeContext)
@@ -70,6 +71,7 @@ describe('remove org domain route', () => {
    * the proof was deleted.
    */
   it('matches the provider domain the way it was grandfathered (wildcard-tolerant)', async () => {
+    queueTableRows(member, [{ role: 'owner' }])
     queueTableRows(member, [{ role: 'owner' }])
     dbChainMockFns.returning.mockResolvedValueOnce([{ domain: 'acme.com' }])
     await DELETE(createMockRequest('DELETE'), routeContext)
@@ -80,6 +82,7 @@ describe('remove org domain route', () => {
   })
 
   it('does not revoke trust when no domain was removed', async () => {
+    queueTableRows(member, [{ role: 'owner' }])
     queueTableRows(member, [{ role: 'owner' }])
     dbChainMockFns.returning.mockResolvedValueOnce([]) // delete matched nothing
     const res = await DELETE(createMockRequest('DELETE'), routeContext)

apps/sim/app/api/organizations/[id]/domains/[domainId]/verify/route.test.ts

@@ -43,6 +43,7 @@ const PENDING_ROW = {
 
 /** Queues the membership + pending-row lookups shared by the happy path. */
 function queueAdminWithPendingRow() {
+  queueTableRows(member, [{ role: 'owner' }])
   queueTableRows(member, [{ role: 'owner' }])
   queueTableRows(ssoDomain, [PENDING_ROW]) // row lookup
 }

apps/sim/app/api/organizations/[id]/domains/route.test.ts

@@ -107,6 +107,7 @@ describe('org domains route', () => {
 
     it('re-adds an existing pending domain idempotently without rotating its token', async () => {
       queueTableRows(member, [{ role: 'owner' }]) // membership
+      queueTableRows(member, [{ role: 'owner' }])
       queueTableRows(ssoDomain, []) // verified-elsewhere check → none
       queueTableRows(ssoDomain, [
         {
@@ -131,8 +132,10 @@ describe('org domains route', () => {
 
     it('stays idempotent when a concurrent claim wins the unique index race', async () => {
       queueTableRows(member, [{ role: 'owner' }]) // membership
+      queueTableRows(member, [{ role: 'owner' }])
       queueTableRows(ssoDomain, []) // verified-elsewhere check → none
       queueTableRows(ssoDomain, []) // org-domains read → none existing, under the cap
+      queueTableRows(ssoDomain, [])
       // insert().returning() loses the race and hits sso_domain_org_domain_unique
       dbChainMockFns.returning.mockRejectedValueOnce(
         Object.assign(new Error('duplicate key'), { code: '23505' })

apps/sim/lib/auth/sso/application/provider-registration.ts

@@ -1,3 +1,4 @@
+import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
 import { db, ssoDomain, ssoProvider } from '@sim/db'
 import { keepDomainSignInProvider, ssoProviderDomainKey } from '@sim/db/sso-primary-provider'
@@ -685,4 +686,20 @@ export const saveSsoProvider = defineOrganizationConfigurationUseCase({
     invalidateSsoPolicyCache(orgId)
     return result
   },
+  projectAudit: ({ input, context, result }) => ({
+    action: result.created
+      ? AuditAction.ORGANIZATION_SSO_PROVIDER_CREATED
+      : AuditAction.ORGANIZATION_SSO_PROVIDER_UPDATED,
+    resourceType: AuditResourceType.ORGANIZATION,
+    resourceId: context.organizationId,
+    description: result.created
+      ? 'Created organization SSO provider'
+      : 'Updated organization SSO provider',
+    metadata: {
+      providerId: result.providerId,
+      providerType: result.providerType,
+      domain: normalizeSSODomain(input.domain),
+      jitProvisioningEnabled: input.jitProvisioningEnabled,
+    },
+  }),
 })

apps/sim/lib/auth/sso/application/provider-settings.integration.ts

@@ -138,6 +138,7 @@ describe('Organization SSO administration through API credentials', () => {
   afterAll(async () => {
     if (!runtime) return
     const { db, schema, eq, inArray } = runtime
+    await db.delete(schema.auditLog).where(eq(schema.auditLog.resourceId, organizationId))
     await db.delete(schema.organization).where(eq(schema.organization.id, organizationId))
     await db.delete(schema.user).where(inArray(schema.user.id, [userId, outsiderId]))
   })
@@ -175,14 +176,17 @@ describe('Organization SSO administration through API credentials', () => {
 
   it('creates and edits a provider without minting a browser session, then deletes it', async () => {
     const { db, schema, eq } = runtime
+    const request = { headers: new Headers({ 'user-agent': 'SSO administration audit fixture' }) }
     const created = await runtime.saveSsoProvider.execute({
       principal,
       input: { ...config(), domain: domain.toUpperCase() },
+      request,
     })
     expect(created).toMatchObject({ providerId, created: true })
     const edited = await runtime.saveSsoProvider.execute({
       principal,
       input: { ...config(), domain: domain.toUpperCase(), cert: 'rotated signing certificate' },
+      request,
     })
     expect(edited.created).toBe(false)
     const [row] = await db
@@ -194,13 +198,37 @@ describe('Organization SSO administration through API credentials', () => {
     expect(
       await db.select().from(schema.session).where(eq(schema.session.userId, userId))
     ).toHaveLength(0)
-    await runtime.deleteSsoProvider.execute({ principal, input: { organizationId, providerId } })
+    await runtime.deleteSsoProvider.execute({
+      principal,
+      input: { organizationId, providerId },
+      request,
+    })
     expect(
       await db
         .select()
         .from(schema.ssoProvider)
         .where(eq(schema.ssoProvider.providerId, providerId))
     ).toHaveLength(0)
+    const history = () =>
+      db.select().from(schema.auditLog).where(eq(schema.auditLog.resourceId, organizationId))
+    await expect
+      .poll(async () => (await history()).map((entry) => entry.action).sort())
+      .toEqual([
+        'organization.sso_provider.created',
+        'organization.sso_provider.deleted',
+        'organization.sso_provider.updated',
+      ])
+    for (const entry of await history()) {
+      expect(entry).toMatchObject({
+        actorId: userId,
+        resourceType: 'organization',
+        resourceId: organizationId,
+        userAgent: 'SSO administration audit fixture',
+        metadata: { organizationId, providerId, domain, actor: { kind: principal.kind } },
+      })
+      expect(JSON.stringify(entry)).not.toContain(config().cert)
+      expect(JSON.stringify(entry)).not.toContain('rotated signing certificate')
+    }
   })
 
   it('refuses unverified domains and conceals organizations from outsiders', async () => {

apps/sim/lib/auth/sso/application/provider-settings.ts

@@ -1,3 +1,4 @@
+import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
 import { db, ssoDomain, ssoProvider } from '@sim/db'
 import {
@@ -21,11 +22,13 @@ import { markSignInProviders } from '@/lib/auth/sso/primary-provider'
 import { lockSsoProvider } from '@/lib/auth/sso/provider-lock'
 import { invalidateSsoPolicyCache } from '@/lib/auth/sso-policy'
 import { acquireOrganizationMutationLock } from '@/lib/billing/organizations/membership'
+import { recordProjectedUseCaseAuditEntries } from '@/lib/core/application/authorized-workspace-use-case'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { requireOAuthOperationScope } from '@/lib/core/application/oauth-authorization'
 import type { OperationUseCase } from '@/lib/core/application/operation'
 import { authorizeOrganizationOperation } from '@/lib/core/application/organization-authorization'
 import { PrincipalKindAuthorizationError } from '@/lib/core/application/workspace-authorization'
+import type { OrchestrationRequestContext } from '@/lib/core/orchestration/types'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 
 interface ProviderScope {
@@ -155,7 +158,8 @@ export const listSsoProviders: OperationUseCase<
 
 async function executeDeleteProvider(
   principal: Principal,
-  input: { organizationId?: string; providerId: string }
+  input: { organizationId?: string; providerId: string },
+  request?: OrchestrationRequestContext
 ) {
   requireProviderPrincipal(principal, ssoProviderOperations.delete)
   const [provider] = await db
@@ -193,14 +197,38 @@ async function executeDeleteProvider(
     const deleted = await tx
       .delete(ssoProvider)
       .where(and(eq(ssoProvider.id, provider.id), ownerClause))
-      .returning({ id: ssoProvider.id })
+      .returning({
+        id: ssoProvider.id,
+        providerId: ssoProvider.providerId,
+        organizationId: ssoProvider.organizationId,
+        domain: ssoProvider.domain,
+      })
     if (deleted.length && provider.organizationId)
       await forgetPrimaryProvider(tx, provider.organizationId, provider.providerId)
     return deleted
   })
-  if (!removed.length) throw new OrchestrationError('not_found', 'Provider not found')
-  if (provider.organizationId) invalidateSsoPolicyCache(provider.organizationId)
-  return { providerId: provider.providerId }
+  const deleted = removed[0]
+  if (!deleted) throw new OrchestrationError('not_found', 'Provider not found')
+  if (deleted.organizationId) {
+    invalidateSsoPolicyCache(deleted.organizationId)
+    recordProjectedUseCaseAuditEntries(
+      ssoProviderOperations.delete,
+      null,
+      principal,
+      request,
+      [
+        {
+          action: AuditAction.ORGANIZATION_SSO_PROVIDER_DELETED,
+          resourceType: AuditResourceType.ORGANIZATION,
+          resourceId: deleted.organizationId,
+          description: 'Deleted organization SSO provider',
+          metadata: { providerId: deleted.providerId, domain: deleted.domain },
+        },
+      ],
+      deleted.organizationId
+    )
+  }
+  return { providerId: deleted.providerId }
 }
 
 export const deleteSsoProvider: OperationUseCase<
@@ -209,7 +237,7 @@ export const deleteSsoProvider: OperationUseCase<
   { providerId: string }
 > = {
   operation: ssoProviderOperations.delete,
-  execute: ({ principal, input }) => executeDeleteProvider(principal, input),
+  execute: ({ principal, input, request }) => executeDeleteProvider(principal, input, request),
 }
 
 export const getSsoProvider: OperationUseCase<