feat(sso): DNS domain verification gating org SSO registration

Add org-scoped domain ownership verification (DNS TXT challenge) as the
security precondition for configuring SSO. Closes the first-come domain-claim
vuln where any org could wire another company's domain to its own IdP.

- New sso_domain table + migration 0266; existing org SSO domains are
  grandfathered as verified so live tenants are unaffected
- Verified-domains settings UI (enterprise-gated) with add/verify/remove
- Register route now requires a verified domain for org-scoped registration;
  personal SSO and already-grandfathered domains are unaffected
- Self-host register script writes the verified sso_domain row directly, so
  script-driven registration stays backwards compatible

Author: waleedlatif1

apps/docs/content/docs/en/platform/enterprise/meta.json

@@ -3,6 +3,7 @@
   "pages": [
     "index",
     "sso",
+    "verified-domains",
     "session-policies",
     "access-control",
     "custom-blocks",

apps/docs/content/docs/en/platform/enterprise/verified-domains.mdx

@@ -0,0 +1,57 @@
+---
+title: Verified Domains
+description: Prove ownership of your email domains to unlock SSO and domain-based provisioning
+---
+
+import { Callout } from 'fumadocs-ui/components/callout'
+import { FAQ } from '@/components/ui/faq'
+
+Verified Domains let organization owners and admins on Enterprise plans prove they control an email domain (like `acme.com`) with a DNS TXT record. Verifying a domain is the security precondition for configuring single sign-on for it — and, in a later release, for enforcing SSO and auto-joining members from that domain.
+
+<Callout type="warning">
+  Configuring SSO for a domain requires it to be verified first. Verifying proves your organization controls the domain — without it, anyone could point another company's domain at their own identity provider. Domains you had already configured for SSO are automatically treated as verified.
+</Callout>
+
+---
+
+## Verify a domain
+
+Go to **Settings → Security → Verified domains** in your organization settings.
+
+1. Enter the domain, for example `acme.com`, and click **Add domain**.
+2. Sim shows a DNS **TXT record** to publish — a host (`_sim-challenge.acme.com`) and a unique value (`sim-domain-verification=…`).
+3. Add that TXT record at your DNS provider.
+4. Click **Verify**. Sim looks up the record; on success the domain is marked **Verified**.
+
+DNS changes can take up to 48 hours to propagate — if verification does not succeed immediately, wait and retry. You can remove the TXT record after the domain is verified; the verification persists.
+
+Add each domain you own separately. Subdomains (`eng.acme.com`) are verified independently of the apex.
+
+---
+
+## FAQ
+
+<FAQ
+  items={[
+    {
+      question: 'Where does the TXT record go?',
+      answer:
+        'On a dedicated host, _sim-challenge.<your-domain>, rather than the root of your domain — this avoids colliding with your SPF, DMARC, or other root TXT records.',
+    },
+    {
+      question: 'What happens to domains we already use for SSO?',
+      answer:
+        'They are automatically treated as verified, so existing single sign-on keeps working with no action needed.',
+    },
+    {
+      question: 'Can two organizations verify the same domain?',
+      answer:
+        'No. A verified domain belongs to exactly one organization. Once verified, another organization cannot claim it.',
+    },
+    {
+      question: 'What if I remove a verified domain?',
+      answer:
+        'You lose the ownership proof, so you cannot configure SSO for that domain until you re-add and re-verify it. Removing it does not sign anyone out — an already-configured SSO provider keeps working.',
+    },
+  ]}
+/>

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -94,6 +94,10 @@ describe('POST /api/auth/sso/register', () => {
     mockValidateUrlWithDNS.mockResolvedValue({ isValid: true, resolvedIP: '1.2.3.4' })
     mockSecureFetchWithPinnedIP.mockRejectedValue(new Error('discovery not mocked for this test'))
     mockRegisterSSOProvider.mockResolvedValue({ providerId: 'acme-oidc' })
+    // Default: the org has already verified the domain, so the ownership gate
+    // passes and each test exercises the logic beyond it. Gate-specific tests
+    // reset the queue to assert the unverified path.
+    queueTableRows(schemaMock.ssoDomain, [{ id: 'verified-domain' }])
   })
 
   afterAll(() => {
@@ -122,6 +126,17 @@ describe('POST /api/auth/sso/register', () => {
     expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
   })
 
+  it('rejects configuring org SSO for a domain the org has not verified', async () => {
+    resetDbChainMock()
+    queueMembers([{ organizationId: 'org1', role: 'owner' }])
+    queueTableRows(schemaMock.ssoDomain, []) // no verified sso_domain row
+    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const json = await res.json()
+    expect(res.status).toBe(403)
+    expect(json.code).toBe('SSO_DOMAIN_NOT_VERIFIED')
+    expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
+  })
+
   it('rejects a domain already registered by another organization', async () => {
     queueMembers([{ organizationId: 'org-attacker', role: 'owner' }])
     queueProviders([{ domain: 'acme.com', userId: 'u-victim', organizationId: 'org-victim' }])

apps/sim/app/api/auth/sso/register/route.ts

@@ -1,4 +1,4 @@
-import { db, member, ssoProvider } from '@sim/db'
+import { db, member, ssoDomain, ssoProvider } from '@sim/db'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { and, eq, sql } from 'drizzle-orm'
@@ -120,6 +120,34 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json({ error: 'Enter a valid domain like company.com' }, { status: 400 })
     }
 
+    // Security gate: configuring org SSO for a domain requires the org to have
+    // proven ownership of it (DNS TXT verification). Without this, the old
+    // first-come claim let any org wire another company's domain to their own
+    // IdP — an account-takeover primitive. Existing domains were grandfathered
+    // as verified by migration 0266, so live tenants are unaffected.
+    if (orgId) {
+      const [verified] = await db
+        .select({ id: ssoDomain.id })
+        .from(ssoDomain)
+        .where(
+          and(
+            eq(ssoDomain.organizationId, orgId),
+            eq(ssoDomain.domain, domain),
+            eq(ssoDomain.status, 'verified')
+          )
+        )
+        .limit(1)
+      if (!verified) {
+        return NextResponse.json(
+          {
+            error: `Verify ownership of ${domain} under Settings → Verified domains before configuring SSO for it.`,
+            code: 'SSO_DOMAIN_NOT_VERIFIED',
+          },
+          { status: 403 }
+        )
+      }
+    }
+
     const isOwnedByCaller = (provider: {
       userId: string | null
       organizationId: string | null

apps/sim/app/api/organizations/[id]/domains/[domainId]/route.ts

@@ -0,0 +1,77 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import { member, ssoDomain } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
+import { and, eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { removeOrganizationDomainContract } from '@/lib/api/contracts/organization'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('OrgDomainDeleteAPI')
+
+/**
+ * DELETE /api/organizations/[id]/domains/[domainId]
+ * Removes a claimed/verified domain. Requires owner/admin role. Removing a
+ * verified domain drops the ownership proof, so SSO can no longer be configured
+ * for it until it is re-verified. It does not retroactively un-register an
+ * already-configured SSO provider — that flows through the SSO provider itself.
+ */
+export const DELETE = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string; domainId: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseRequest(removeOrganizationDomainContract, request, context)
+    if (!parsed.success) return parsed.response
+    const { id: organizationId, domainId } = parsed.data.params
+
+    const [memberEntry] = await db
+      .select({ role: member.role })
+      .from(member)
+      .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+      .limit(1)
+
+    if (!memberEntry) {
+      return NextResponse.json(
+        { error: 'Forbidden - Not a member of this organization' },
+        { status: 403 }
+      )
+    }
+    if (!isOrgAdminRole(memberEntry.role)) {
+      return NextResponse.json(
+        { error: 'Forbidden - Only organization owners and admins can remove domains' },
+        { status: 403 }
+      )
+    }
+
+    const [removed] = await db
+      .delete(ssoDomain)
+      .where(and(eq(ssoDomain.id, domainId), eq(ssoDomain.organizationId, organizationId)))
+      .returning({ domain: ssoDomain.domain })
+
+    if (!removed) {
+      return NextResponse.json({ error: 'Domain not found' }, { status: 404 })
+    }
+
+    logger.info('Domain removed', { organizationId, domain: removed.domain })
+    recordAudit({
+      workspaceId: null,
+      actorId: session.user.id,
+      action: AuditAction.ORGANIZATION_DOMAIN_REMOVED,
+      resourceType: AuditResourceType.ORGANIZATION,
+      resourceId: organizationId,
+      actorName: session.user.name ?? undefined,
+      actorEmail: session.user.email ?? undefined,
+      description: `Removed domain ${removed.domain}`,
+      metadata: { domain: removed.domain },
+      request,
+    })
+
+    return NextResponse.json({ success: true })
+  }
+)

apps/sim/app/api/organizations/[id]/domains/[domainId]/verify/route.ts

@@ -0,0 +1,119 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import { member, ssoDomain } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
+import { and, eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { verifyOrganizationDomainContract } from '@/lib/api/contracts/organization'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { checkDomainTxtRecord, toDomainResponse } from '@/lib/auth/sso/domain-verification'
+import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
+import { isBillingEnabled } from '@/lib/core/config/env-flags'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('OrgDomainVerifyAPI')
+
+/**
+ * POST /api/organizations/[id]/domains/[domainId]/verify
+ * Checks the domain's DNS TXT challenge record; on success flips it to
+ * `verified`. Requires enterprise plan and owner/admin role. A domain already
+ * verified by another org is refused (the partial unique index also guards it).
+ */
+export const POST = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string; domainId: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseRequest(verifyOrganizationDomainContract, request, context)
+    if (!parsed.success) return parsed.response
+    const { id: organizationId, domainId } = parsed.data.params
+
+    const [memberEntry] = await db
+      .select({ role: member.role })
+      .from(member)
+      .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+      .limit(1)
+
+    if (!memberEntry) {
+      return NextResponse.json(
+        { error: 'Forbidden - Not a member of this organization' },
+        { status: 403 }
+      )
+    }
+    if (!isOrgAdminRole(memberEntry.role)) {
+      return NextResponse.json(
+        { error: 'Forbidden - Only organization owners and admins can verify domains' },
+        { status: 403 }
+      )
+    }
+    if (isBillingEnabled && !(await isOrganizationOnEnterprisePlan(organizationId))) {
+      return NextResponse.json(
+        { error: 'Domain verification is available on Enterprise plans only' },
+        { status: 403 }
+      )
+    }
+
+    const [row] = await db
+      .select()
+      .from(ssoDomain)
+      .where(and(eq(ssoDomain.id, domainId), eq(ssoDomain.organizationId, organizationId)))
+      .limit(1)
+    if (!row) {
+      return NextResponse.json({ error: 'Domain not found' }, { status: 404 })
+    }
+    if (row.status === 'verified') {
+      return NextResponse.json({ success: true, data: { domain: toDomainResponse(row) } })
+    }
+
+    const recordPresent = await checkDomainTxtRecord(row.domain, row.verificationToken)
+    if (!recordPresent) {
+      return NextResponse.json(
+        {
+          error:
+            'The verification TXT record was not found yet. DNS changes can take up to 48 hours to propagate — add the record shown and try again.',
+        },
+        { status: 422 }
+      )
+    }
+
+    // Guard the race where another org verified the same domain between claim
+    // and verify (the partial unique index would also reject the update).
+    const [verifiedElsewhere] = await db
+      .select({ organizationId: ssoDomain.organizationId })
+      .from(ssoDomain)
+      .where(and(eq(ssoDomain.domain, row.domain), eq(ssoDomain.status, 'verified')))
+      .limit(1)
+    if (verifiedElsewhere && verifiedElsewhere.organizationId !== organizationId) {
+      return NextResponse.json(
+        { error: 'This domain was verified by another organization' },
+        { status: 409 }
+      )
+    }
+
+    const [updated] = await db
+      .update(ssoDomain)
+      .set({ status: 'verified', verifiedAt: new Date(), updatedAt: new Date() })
+      .where(eq(ssoDomain.id, domainId))
+      .returning()
+
+    logger.info('Domain verified', { organizationId, domain: row.domain })
+    recordAudit({
+      workspaceId: null,
+      actorId: session.user.id,
+      action: AuditAction.ORGANIZATION_DOMAIN_VERIFIED,
+      resourceType: AuditResourceType.ORGANIZATION,
+      resourceId: organizationId,
+      actorName: session.user.name ?? undefined,
+      actorEmail: session.user.email ?? undefined,
+      description: `Verified domain ${row.domain}`,
+      metadata: { domain: row.domain },
+      request,
+    })
+
+    return NextResponse.json({ success: true, data: { domain: toDomainResponse(updated) } })
+  }
+)