fix(sso): close register TOCTOU with compensating delete + harden edges

Audit-driven hardening:
- Close the residual register TOCTOU: registerSSOProvider is create-only (throws
  if the providerId exists), so a compensating delete after the write is provably
  safe — it can only remove the just-created row. If verification was revoked
  during the write, roll the provider back and 403.
- Verify is now idempotent under concurrency: a same-org row already flipped to
  verified by a racing request returns 200, not a confusing 409.
- Grandfather backfill + self-host script now match normalizeSSODomain's dominant
  transforms (lower + trim + strip leading wildcard) so a non-canonical legacy
  domain can't miss the runtime gate's lookup. Prod backfill result is unchanged.
- Cleanup: drop dead default export, align card radius to sibling convention.

Author: waleedlatif1

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -96,9 +96,11 @@ describe('POST /api/auth/sso/register', () => {
     mockRegisterSSOProvider.mockResolvedValue({ providerId: 'acme-oidc' })
     // Default: the org has already verified the domain, so the ownership gate
     // passes and each test exercises the logic beyond it. The gate is checked
-    // twice for org-scoped registration (fail-fast entry + authoritative
-    // re-check before the write), so queue two rows. Gate-specific tests reset
-    // the queue to assert the unverified path.
+    // three times for a successful org-scoped registration (fail-fast entry +
+    // authoritative re-check before the write + compensating re-check after the
+    // write), so queue three rows. Gate-specific tests reset the queue to assert
+    // the unverified paths.
+    queueTableRows(schemaMock.ssoDomain, [{ id: 'verified-domain' }])
     queueTableRows(schemaMock.ssoDomain, [{ id: 'verified-domain' }])
     queueTableRows(schemaMock.ssoDomain, [{ id: 'verified-domain' }])
   })
@@ -152,6 +154,20 @@ describe('POST /api/auth/sso/register', () => {
     expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
   })
 
+  it('rolls back the newly-created provider if verification is revoked after the write', async () => {
+    resetDbChainMock()
+    queueMembers([{ organizationId: 'org1', role: 'owner' }])
+    queueTableRows(schemaMock.ssoDomain, [{ id: 'v' }]) // entry gate: verified
+    queueTableRows(schemaMock.ssoDomain, [{ id: 'v' }]) // pre-write re-check: verified
+    queueTableRows(schemaMock.ssoDomain, []) // post-write compensating check: revoked
+    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const json = await res.json()
+    expect(res.status).toBe(403)
+    expect(json.code).toBe('SSO_DOMAIN_NOT_VERIFIED')
+    expect(mockRegisterSSOProvider).toHaveBeenCalledTimes(1) // it was created…
+    expect(dbChainMockFns.delete).toHaveBeenCalled() // …then rolled back
+  })
+
   it('rejects a domain already registered by another organization', async () => {
     queueMembers([{ organizationId: 'org-attacker', role: 'owner' }])
     queueProviders([{ domain: 'acme.com', userId: 'u-victim', organizationId: 'org-victim' }])

apps/sim/app/api/auth/sso/register/route.ts

@@ -555,6 +555,31 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       headers,
     })
 
+    // Close the residual TOCTOU between the re-check above and Better Auth
+    // persisting the provider: the verified sso_domain row could be removed in
+    // that window. registerSSOProvider is create-only (it throws if the
+    // providerId already exists), so a successful call ALWAYS created this exact
+    // row — this compensating delete can never remove a pre-existing provider.
+    // Scoped to (providerId, orgId) as defense-in-depth; personal SSO is not
+    // gated, so this only runs for org-scoped registration.
+    if (orgId && !(await isOrgDomainVerified())) {
+      await db
+        .delete(ssoProvider)
+        .where(
+          and(
+            eq(ssoProvider.providerId, registration.providerId),
+            eq(ssoProvider.organizationId, orgId)
+          )
+        )
+      logger.warn('Rolled back SSO provider: domain verification revoked mid-registration', {
+        domain,
+        orgId,
+        providerId: registration.providerId,
+        userId: session.user.id,
+      })
+      return domainNotVerifiedResponse()
+    }
+
     logger.info('SSO provider registered successfully', {
       providerId,
       providerType,

apps/sim/app/api/organizations/[id]/domains/[domainId]/verify/route.test.ts

@@ -92,6 +92,18 @@ describe('verify org domain route', () => {
     )
   })
 
+  it('is idempotent when a concurrent same-org request already verified the row', async () => {
+    queueAdminWithPendingRow()
+    queueTableRows(ssoDomain, []) // verified-elsewhere check → none
+    dbChainMockFns.returning.mockResolvedValueOnce([]) // our conditional update lost the race
+    queueTableRows(ssoDomain, [{ ...PENDING_ROW, status: 'verified' }]) // re-read: now verified
+    const res = await POST(createMockRequest('POST'), routeContext)
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.data.domain).toMatchObject({ status: 'verified' })
+    expect(mockRecordAudit).not.toHaveBeenCalled() // the winning request recorded it
+  })
+
   it('409s when the row changed (deleted/re-tokenized) during the DNS lookup', async () => {
     queueAdminWithPendingRow()
     queueTableRows(ssoDomain, []) // verified-elsewhere check → none

apps/sim/app/api/organizations/[id]/domains/[domainId]/verify/route.ts

@@ -125,6 +125,18 @@ export const POST = withRouteHandler(
     }
 
     if (updated.length === 0) {
+      // The conditional update matched nothing. If a concurrent request for this
+      // same org already flipped the row to verified, treat this as an idempotent
+      // success; otherwise the challenge is genuinely stale (row deleted or
+      // re-tokenized mid-lookup) and we ask the caller to retry.
+      const [current] = await db
+        .select()
+        .from(ssoDomain)
+        .where(and(eq(ssoDomain.id, domainId), eq(ssoDomain.organizationId, organizationId)))
+        .limit(1)
+      if (current?.status === 'verified') {
+        return NextResponse.json({ success: true, data: { domain: toDomainResponse(current) } })
+      }
       return NextResponse.json(
         { error: 'The domain changed during verification. Refresh and try again.' },
         { status: 409 }

apps/sim/ee/sso/components/domain-settings.tsx

@@ -51,7 +51,7 @@ function DomainRow({ organizationId, domain, onRemove }: DomainRowProps) {
   }
 
   return (
-    <div className='flex flex-col gap-3 rounded-[10px] border border-[var(--border-1)] px-3 py-3'>
+    <div className='flex flex-col gap-3 rounded-lg border border-[var(--border-1)] px-3 py-3'>
       <div className='flex items-center justify-between gap-2'>
         <span className='truncate text-[var(--text-body)] text-sm'>{domain.domain}</span>
         <div className='flex items-center gap-2'>
@@ -193,5 +193,3 @@ export function DomainSettings({ organizationId }: DomainSettingsProps) {
     </>
   )
 }
-
-export default DomainSettings

packages/db/migrations/0266_sso_domain_verification.sql

@@ -18,19 +18,26 @@ CREATE UNIQUE INDEX "sso_domain_org_domain_unique" ON "sso_domain" USING btree (
 CREATE UNIQUE INDEX "sso_domain_verified_unique" ON "sso_domain" USING btree ("domain") WHERE status = 'verified';--> statement-breakpoint
 -- Grandfather existing org-scoped SSO provider domains as verified: they were
 -- claimed under the old first-come model, so treat them as owned/verified to
--- avoid breaking live SSO. DISTINCT ON keeps one verified row per domain
--- (the partial unique index is global on verified rows); the token is a
--- placeholder since these rows are already verified.
+-- avoid breaking live SSO. The normalized value must match normalizeSSODomain
+-- (the runtime gate's canonicalizer) so grandfathered lookups hit — hence
+-- lower + trim + strip a leading wildcard label; other artifacts (protocol,
+-- port, path) never occur in stored SSO domains. Computing it in a subquery
+-- keeps the DISTINCT ON dedup key identical to the inserted value, so the
+-- global partial unique index on verified rows can never be violated. The
+-- token is a placeholder since these rows are already verified.
 INSERT INTO "sso_domain" ("id", "organization_id", "domain", "status", "verification_token", "verified_at", "created_at", "updated_at")
-SELECT DISTINCT ON (lower("domain"))
+SELECT DISTINCT ON ("norm_domain")
 	gen_random_uuid()::text,
 	"organization_id",
-	lower("domain"),
+	"norm_domain",
 	'verified',
 	gen_random_uuid()::text,
 	now(),
 	now(),
 	now()
-FROM "sso_provider"
-WHERE "organization_id" IS NOT NULL
-ORDER BY lower("domain"), "organization_id";
+FROM (
+	SELECT "organization_id", lower(regexp_replace(btrim("domain"), '^\*\.', '')) AS "norm_domain"
+	FROM "sso_provider"
+	WHERE "organization_id" IS NOT NULL
+) AS "normalized"
+ORDER BY "norm_domain", "organization_id";

packages/db/scripts/register-sso-provider.ts

@@ -653,7 +653,11 @@ async function registerSSOProvider(): Promise<boolean> {
       // verified record and the UI/API would treat it as unverified. Org-scoped
       // only — user-scoped providers have no org to attach a domain to.
       if (providerData.organizationId) {
-        const normalizedDomain = ssoConfig.domain.trim().toLowerCase()
+        // Match normalizeSSODomain's dominant transforms (lower + trim + strip a
+        // leading wildcard) so this row lines up with the runtime gate's lookup.
+        // normalizeSSODomain itself lives in apps/sim and can't be imported here
+        // (packages never import apps); other artifacts don't occur in SSO_DOMAIN.
+        const normalizedDomain = ssoConfig.domain.trim().toLowerCase().replace(/^\*\./, '')
         const existingDomain = await tx
           .select({ id: ssoDomain.id })
           .from(ssoDomain)