fix(auth): align SSO admission locks and reject stale provider links

Author: waleedlatif1

apps/docs/openapi-v2-resources.json

@@ -7954,7 +7954,7 @@
       "get": {
         "operationId": "listCredentialMembers",
         "summary": "List Credential Members",
-        "description": "List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access. Credentials must be OAuth or service-account connections. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:read`.",
+        "description": "List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access. Personal API keys and OAuth tokens can access OAuth or service-account credentials; sessions can also access workspace environment credentials. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:read`.",
         "x-sim-operation": "credentials.members.list",
         "x-oauth-scope": "api:read",
         "tags": ["Credentials"],

apps/sim/lib/api/contracts/v2/openapi/credential-members.ts

@@ -18,7 +18,7 @@ export const credentialMemberOpenApiRoutes = [
       applicationOperation: credentialOperations.listMembers,
       operationId: 'listCredentialMembers',
       summary: 'List Credential Members',
-      description: `List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access. Credentials must be OAuth or service-account connections. ${WORKSPACE_API_KEY_DENIED}`,
+      description: `List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access. Personal API keys and OAuth tokens can access OAuth or service-account credentials; sessions can also access workspace environment credentials. ${WORKSPACE_API_KEY_DENIED}`,
       tags: ['Credentials'],
       errors: RESOURCE_ERRORS,
       success: { description: 'List Credential Members result.', headers: RATE_LIMIT_HEADERS },

apps/sim/lib/api/mcp/generated/v2-operations.ts

@@ -1726,7 +1726,7 @@ export const V2_MCP_OPERATIONS = {
     contract: v2ListCredentialMembersContract,
     summary: 'List Credential Members',
     description:
-      'List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access. Credentials must be OAuth or service-account connections. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:read`.',
+      'List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access. Personal API keys and OAuth tokens can access OAuth or service-account credentials; sessions can also access workspace environment credentials. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:read`.',
     workspaceKeyUnsupported: true,
     handler: () =>
       import('@/app/api/v2/credentials/[credentialId]/members/route').then((route) => route.GET),

apps/sim/lib/auth/sim-auth-adapter.ts

@@ -2,7 +2,8 @@ import { db } from '@sim/db'
 import * as schema from '@sim/db/schema'
 import type { BetterAuthOptions } from 'better-auth'
 import { drizzleAdapter } from 'better-auth/adapters/drizzle'
-import { eq } from 'drizzle-orm'
+import { APIError } from 'better-auth/api'
+import { and, eq } from 'drizzle-orm'
 import { runWithAuthDatabase } from '@/lib/auth/database-context'
 import {
   type AuthDatabase,
@@ -39,7 +40,20 @@ function createTransactionAdapter(
           .from(schema.ssoProvider)
           .where(eq(schema.ssoProvider.providerId, input.data.providerId))
           .limit(1)
-        if (provider) await lockSsoProvider(tx, input.data.providerId)
+        if (provider) {
+          await lockSsoProvider(tx, input.data.providerId)
+          const [current] = await tx
+            .select({ id: schema.ssoProvider.id })
+            .from(schema.ssoProvider)
+            .where(
+              and(
+                eq(schema.ssoProvider.id, provider.id),
+                eq(schema.ssoProvider.providerId, input.data.providerId)
+              )
+            )
+            .limit(1)
+          if (!current) throw new APIError('NOT_FOUND', { message: 'SSO provider not found' })
+        }
       }
       return guarded.create(input)
     },

apps/sim/lib/auth/sso/application/admit-sso-user.integration.ts

@@ -1,3 +1,4 @@
+import { createDeferred } from '@sim/testing/helpers/deferred'
 import { auditMock } from '@sim/testing/mocks/audit.mock'
 import { envFlagsMock } from '@sim/testing/mocks/env-flags.mock'
 import { generateId } from '@sim/utils/id'
@@ -18,13 +19,20 @@ vi.mock('@/lib/billing/organizations/seats', () => ({ reconcileOrganizationSeats
 vi.mock('@/lib/posthog/server', () => ({ captureServerEvent: vi.fn() }))
 
 async function loadRuntime() {
-  const [{ db }, schema, { eq, inArray }, { admitSsoUser }] = await Promise.all([
+  const [
+    { db },
+    schema,
+    { eq, inArray, sql },
+    { admitSsoUser },
+    { acquireOrganizationMutationLock },
+  ] = await Promise.all([
     import('@sim/db'),
     import('@sim/db/schema'),
     import('drizzle-orm'),
     import('@/lib/auth/sso/application/admit-sso-user'),
+    import('@/lib/billing/organizations/membership'),
   ])
-  return { db, schema, eq, inArray, admitSsoUser }
+  return { db, schema, eq, inArray, sql, admitSsoUser, acquireOrganizationMutationLock }
 }
 
 describe('SSO admission with a hosted SCIM directory in PostgreSQL', () => {
@@ -133,6 +141,58 @@ describe('SSO admission with a hosted SCIM directory in PostgreSQL', () => {
       .where(eq(schema.member.userId, userId))
   }
 
+  it('allows a provider edit to commit while sign-in admission waits for organization mutation', async () => {
+    const { db, schema, eq, sql } = runtime
+    await db
+      .update(schema.scimConnection)
+      .set({ settings: { disableJit: false } })
+      .where(eq(schema.scimConnection.id, connectionId))
+    const held = createDeferred<number>()
+    const release = createDeferred<void>()
+    const pending: Promise<unknown>[] = []
+    try {
+      const mutation = db.transaction(async (tx) => {
+        await runtime.acquireOrganizationMutationLock(tx, organizationId)
+        const [connection] = await tx.execute<{ pid: number }>(sql`SELECT pg_backend_pid() AS pid`)
+        held.resolve(connection.pid)
+        await release.promise
+        await tx
+          .select({ id: schema.ssoProvider.id })
+          .from(schema.ssoProvider)
+          .where(eq(schema.ssoProvider.providerId, providerId))
+          .for('update', { noWait: true })
+        await tx
+          .update(schema.ssoProvider)
+          .set({ jitProvisioningEnabled: false })
+          .where(eq(schema.ssoProvider.providerId, providerId))
+      })
+      pending.push(mutation)
+      void mutation.catch((error: unknown) => held.reject(error))
+      const blockerPid = await held.promise
+      const admission = admit()
+      pending.push(admission)
+      void admission.catch(() => undefined)
+      await vi.waitFor(
+        async () => {
+          const [waiting] = await db.execute<{ pid: number }>(sql`
+            SELECT pid FROM pg_stat_activity
+            WHERE datname = current_database() AND wait_event = 'advisory'
+              AND ${blockerPid}::int = ANY(pg_blocking_pids(pid))
+          `)
+          expect(waiting).toBeDefined()
+        },
+        { timeout: 5_000, interval: 25 }
+      )
+      release.resolve()
+      await mutation
+      await expect(admission).resolves.toEqual({ kind: 'provisioning-disabled', organizationId })
+      expect(await membership()).toEqual([])
+    } finally {
+      release.resolve()
+      await Promise.allSettled(pending)
+    }
+  })
+
   it('honors disableJit without a global billing read creating fresh membership', async () => {
     await expect(admit()).resolves.toEqual({ kind: 'provisioning-disabled', organizationId })
     expect(await membership()).toEqual([])

apps/sim/lib/auth/sso/application/admit-sso-user.test.ts

@@ -71,6 +71,7 @@ function queueIdentity({
   accountLinked?: boolean
   email?: string
 } = {}) {
+  queueTableRows(schemaMock.ssoProvider, [{ id: 'sso-1', organizationId }])
   queueTableRows(schemaMock.ssoProvider, [
     {
       id: 'sso-1',
@@ -152,7 +153,6 @@ describe('SSO JIT admission', () => {
       kind: 'denied',
       reason: 'provider-not-trusted',
     })
-    expect(mockAcquireOrganizationUserMutationLocks).not.toHaveBeenCalled()
     expect(mockEnsureUserInOrganizationTx).not.toHaveBeenCalled()
   })
 

apps/sim/lib/auth/sso/application/admit-sso-user.ts

@@ -74,6 +74,20 @@ async function runAdmissionTransaction(
   providerId: string
 ): Promise<SuccessfulAdmission> {
   return db.transaction(async (tx) => {
+    const [scope] = await tx
+      .select({ id: ssoProvider.id, organizationId: ssoProvider.organizationId })
+      .from(ssoProvider)
+      .where(eq(ssoProvider.providerId, providerId))
+      .limit(1)
+    if (!scope) {
+      return { providerId, result: { kind: 'denied', reason: 'provider-not-found' } }
+    }
+    if (scope.organizationId) {
+      await acquireOrganizationUserMutationLocks(tx, {
+        userId,
+        organizationIds: [scope.organizationId],
+      })
+    }
     const [provider] = await tx
       .select({
         id: ssoProvider.id,
@@ -83,11 +97,11 @@ async function runAdmissionTransaction(
         organizationId: ssoProvider.organizationId,
       })
       .from(ssoProvider)
-      .where(eq(ssoProvider.providerId, providerId))
+      .where(and(eq(ssoProvider.id, scope.id), eq(ssoProvider.providerId, providerId)))
       .limit(1)
       .for('share')
 
-    if (!provider) {
+    if (!provider || provider.organizationId !== scope.organizationId) {
       return { providerId, result: { kind: 'denied', reason: 'provider-not-found' } }
     }
     if (!provider.domainVerified) {
@@ -127,11 +141,6 @@ async function runAdmissionTransaction(
       }
     }
 
-    await acquireOrganizationUserMutationLocks(tx, {
-      userId,
-      organizationIds: [provider.organizationId],
-    })
-
     /**
      * An organization whose directory is the only way in has said so on its
      * SCIM connection; a first sign-in must not create a membership the directory

apps/sim/lib/auth/sso/application/provider-settings.integration.ts

@@ -1,4 +1,5 @@
 import { execFile } from 'node:child_process'
+import { Resolver } from 'node:dns/promises'
 import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { createServer } from 'node:http'
 import { tmpdir } from 'node:os'
@@ -748,6 +749,16 @@ describe('Organization SSO administration through API credentials', () => {
       .select()
       .from(schema.ssoDomain)
       .where(eq(schema.ssoDomain.organizationId, organizationId))
+    const [pendingClaim] = await db
+      .insert(schema.ssoDomain)
+      .values({
+        id: generateId(),
+        organizationId,
+        domain: `aaa-pending-${suffix}.test`,
+        status: 'pending',
+        verificationToken: generateId(),
+      })
+      .returning()
     const directory = await mkdtemp(resolve(tmpdir(), 'sim-sso-cli-'))
     const cliPath = resolve(process.cwd(), '../../packages/sim-cli/src/index.ts')
     const secret = 'fixture-secret+with-newline\n'
@@ -790,7 +801,7 @@ describe('Organization SSO administration through API credentials', () => {
                 params: Promise.resolve({ organizationId, providerId }),
               })
             : await apiDomainVerification.POST(request, {
-                params: Promise.resolve({ organizationId, domainId: claim.id }),
+                params: Promise.resolve({ organizationId, domainId: pendingClaim.id }),
               })
         outgoing.statusCode = response.status
         response.headers.forEach((value, name) => outgoing.setHeader(name, value))
@@ -800,14 +811,22 @@ describe('Organization SSO administration through API credentials', () => {
         outgoing.end(JSON.stringify({ fixtureError: getErrorMessage(error) }))
       }
     })
+    const dns = vi
+      .spyOn(Resolver.prototype, 'resolveTxt')
+      .mockImplementation(async (host) =>
+        host === `_sim-challenge.${pendingClaim.domain}`
+          ? [[`sim-domain-verification=${pendingClaim.verificationToken}`]]
+          : []
+      )
     try {
+      setEnvFlags({ isHosted: true })
       await new Promise<void>((ready) => server.listen(0, '127.0.0.1', ready))
       const address = server.address()
       if (!address || typeof address === 'string') throw new Error('Fixture did not bind loopback')
       endpoint = `http://127.0.0.1:${address.port}`
       const commands = [
         ['organizations', 'sso', 'providers', 'primary', providerId],
-        ['organizations', 'domains', 'verify', claim.id],
+        ['organizations', 'domains', 'verify', pendingClaim.id],
         [
           'organizations',
           'sso',
@@ -874,10 +893,18 @@ describe('Organization SSO administration through API credentials', () => {
       expect(attempts[2].stdout).not.toContain(secret)
 
       expect(JSON.parse(attempts[1].stdout)).toMatchObject({
-        id: claim.id,
+        id: pendingClaim.id,
         status: 'verified',
       })
+      const [verified] = await db
+        .select()
+        .from(schema.ssoDomain)
+        .where(eq(schema.ssoDomain.id, pendingClaim.id))
+      expect(verified.status).toBe('verified')
+      expect(verified.verifiedAt).not.toBeNull()
     } finally {
+      dns.mockRestore()
+      setEnvFlags({ isHosted: false })
       await new Promise<void>((complete, reject) => {
         server.close((error) => (error ? reject(error) : complete()))
         server.closeAllConnections()

apps/sim/lib/auth/sso/provider-concurrency.integration.ts

@@ -42,6 +42,105 @@ describe('SSO account link concurrency', () => {
     runtime = await loadRuntime()
   }, 60_000)
 
+  it.each([
+    [false, false],
+    [true, false],
+    [false, true],
+    [true, true],
+  ])(
+    'refuses an account link when provider deletion wins with transactional adapter=%s and replacement=%s',
+    async (transactional, replacement) => {
+      const { db, schema, eq, sql } = runtime
+      const userId = generateId()
+      const providerId = `deleted-${generateId()}`
+      const held = createDeferred<number>()
+      const release = createDeferred<void>()
+      const pending: Promise<unknown>[] = []
+      try {
+        const now = new Date()
+        await db.insert(schema.user).values({
+          id: userId,
+          name: 'SSO deletion concurrency',
+          email: `${userId}@example.com`,
+          emailVerified: true,
+          createdAt: now,
+          updatedAt: now,
+        })
+        await db.insert(schema.ssoProvider).values({
+          id: generateId(),
+          userId,
+          providerId,
+          issuer: 'https://original.example.com',
+          domain: 'example.com',
+        })
+        const deletion = db.transaction(async (tx) => {
+          await runtime.lockSsoProvider(tx, providerId)
+          const [connection] = await tx.execute<{ pid: number }>(
+            sql`SELECT pg_backend_pid() AS pid`
+          )
+          held.resolve(connection.pid)
+          await release.promise
+          await tx.delete(schema.ssoProvider).where(eq(schema.ssoProvider.providerId, providerId))
+          if (replacement)
+            await tx.insert(schema.ssoProvider).values({
+              id: generateId(),
+              userId,
+              providerId,
+              issuer: 'https://replacement.example.com',
+              domain: 'example.com',
+            })
+        })
+        pending.push(deletion)
+        void deletion.catch((error: unknown) => held.reject(error))
+        const blockerPid = await held.promise
+        const adapter = runtime.createSimAuthAdapter({})
+        const input = {
+          model: 'account',
+          forceAllowId: true,
+          data: {
+            id: generateId(),
+            accountId: generateId(),
+            userId,
+            providerId,
+            createdAt: now,
+            updatedAt: now,
+          },
+        }
+        const insertion = (
+          transactional ? adapter.transaction((tx) => tx.create(input)) : adapter.create(input)
+        ).then(
+          (value) => ({ status: 'fulfilled' as const, value }),
+          (reason: unknown) => ({ status: 'rejected' as const, reason })
+        )
+        pending.push(insertion)
+        await vi.waitFor(
+          async () => {
+            const [waiting] = await db.execute<{ pid: number }>(sql`
+              SELECT pid FROM pg_stat_activity
+              WHERE datname = current_database() AND wait_event = 'advisory'
+                AND ${blockerPid}::int = ANY(pg_blocking_pids(pid))
+            `)
+            expect(waiting).toBeDefined()
+          },
+          { timeout: 5_000, interval: 25 }
+        )
+        release.resolve()
+        await deletion
+        expect(await insertion).toMatchObject({ status: 'rejected', reason: { statusCode: 404 } })
+        expect(
+          await db.select().from(schema.account).where(eq(schema.account.providerId, providerId))
+        ).toEqual([])
+      } finally {
+        release.resolve()
+        await Promise.allSettled(pending)
+        await db.delete(schema.account).where(eq(schema.account.providerId, providerId))
+        await db.delete(schema.ssoProvider).where(eq(schema.ssoProvider.providerId, providerId))
+        await db.delete(schema.user).where(eq(schema.user.id, userId))
+      }
+    },
+    30_000
+  )
+
   it.each([false, true])(
     'allows a non-SSO account link while an SSO mutation lock is held with transactional adapter=%s',
     async (transactional) => {