chore(sso): final-review polish — trim script read, unify copy, doc migration edge

Cosmetic cleanup from a final 4-track adversarial review (no bugs found in the
new logic):
- Self-host script: narrow the pre-transaction existence read to select({ id })
  instead of SELECT * (it only feeds a log line now).
- Unify invalid-domain copy ("for example acme.com") and the verified-elsewhere
  409 wording ("is already verified by another organization") across routes.
- p-3 shorthand on the domain row card.
- Document the migration's rare two-orgs-share-a-domain grandfather behavior
  (login unaffected; validated no such duplicates in prod).

Author: waleedlatif1

apps/sim/app/api/auth/sso/register/route.ts

@@ -117,7 +117,10 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     const domain = normalizeSSODomain(body.domain)
     if (!domain) {
-      return NextResponse.json({ error: 'Enter a valid domain like company.com' }, { status: 400 })
+      return NextResponse.json(
+        { error: 'Enter a valid domain, for example acme.com' },
+        { status: 400 }
+      )
     }
 
     // Security gate: configuring org SSO for a domain requires the org to have

apps/sim/app/api/organizations/[id]/domains/[domainId]/verify/route.ts

@@ -90,7 +90,7 @@ export const POST = withRouteHandler(
       .limit(1)
     if (verifiedElsewhere && verifiedElsewhere.organizationId !== organizationId) {
       return NextResponse.json(
-        { error: 'This domain was verified by another organization' },
+        { error: 'This domain is already verified by another organization' },
         { status: 409 }
       )
     }
@@ -117,7 +117,7 @@ export const POST = withRouteHandler(
     } catch (error) {
       if (getPostgresErrorCode(error) === '23505') {
         return NextResponse.json(
-          { error: 'This domain was verified by another organization' },
+          { error: 'This domain is already verified by another organization' },
           { status: 409 }
         )
       }

apps/sim/ee/sso/components/domain-settings.tsx

@@ -51,7 +51,7 @@ function DomainRow({ organizationId, domain, onRemove }: DomainRowProps) {
   }
 
   return (
-    <div className='flex flex-col gap-3 rounded-lg border border-[var(--border-1)] px-3 py-3'>
+    <div className='flex flex-col gap-3 rounded-lg border border-[var(--border-1)] p-3'>
       <div className='flex items-center justify-between gap-2'>
         <span className='truncate text-[var(--text-body)] text-sm'>{domain.domain}</span>
         <div className='flex items-center gap-2'>

packages/db/migrations/0266_sso_domain_verification.sql

@@ -25,6 +25,11 @@ CREATE UNIQUE INDEX "sso_domain_verified_unique" ON "sso_domain" USING btree ("d
 -- keeps the DISTINCT ON dedup key identical to the inserted value, so the
 -- global partial unique index on verified rows can never be violated. The
 -- token is a placeholder since these rows are already verified.
+-- NOTE: if two orgs somehow share a domain (possible only for data predating the
+-- register-route conflict check), DISTINCT ON grandfathers the lowest org_id and
+-- the other org gets no row. Its existing SSO login is unaffected (login never
+-- reads sso_domain); it just can't re-register that domain until an admin
+-- resolves the duplicate. Validated against prod: no such duplicates exist.
 INSERT INTO "sso_domain" ("id", "organization_id", "domain", "status", "verification_token", "verified_at", "created_at", "updated_at")
 SELECT DISTINCT ON ("norm_domain")
 	gen_random_uuid()::text,

packages/db/scripts/register-sso-provider.ts

@@ -561,7 +561,7 @@ async function registerSSOProvider(): Promise<boolean> {
     }
 
     const existingProviders = await db
-      .select()
+      .select({ id: ssoProvider.id })
       .from(ssoProvider)
       .where(eq(ssoProvider.providerId, ssoConfig.providerId))