serialize sso provider mutations

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

apps/sim/app/api/auth/sso/providers/[id]/route.test.ts

@@ -12,6 +12,7 @@ const {
   mockGetSession,
   mockIsOrganizationOnEnterprisePlan,
   mockUpdateSSOProvider,
+  mockWithSSOProviderMutationLock,
   ssoProviderTable,
 } = vi.hoisted(() => ({
   accountTable: {
@@ -32,6 +33,7 @@ const {
   mockGetSession: vi.fn(),
   mockIsOrganizationOnEnterprisePlan: vi.fn(),
   mockUpdateSSOProvider: vi.fn(),
+  mockWithSSOProviderMutationLock: vi.fn((callback: () => Promise<unknown>) => callback()),
   ssoProviderTable: {
     id: 'sso.id',
     issuer: 'sso.issuer',
@@ -74,6 +76,7 @@ vi.mock('@sim/db', () => ({
   account: accountTable,
   member: memberTable,
   ssoProvider: ssoProviderTable,
+  withSSOProviderMutationLock: mockWithSSOProviderMutationLock,
 }))
 
 vi.mock('@/lib/auth', () => ({
@@ -167,6 +170,33 @@ describe('/api/auth/sso/providers/[id]', () => {
     )
   })
 
+  it('re-checks domain overlap inside the mutation lock before updating', async () => {
+    mockWithSSOProviderMutationLock.mockImplementationOnce(
+      async (callback: () => Promise<unknown>) => {
+        dbState.providers = [
+          PROVIDER,
+          {
+            id: 'concurrent',
+            issuer: 'https://other-idp.example.com',
+            domain: 'login.new.example.com',
+            oidcConfig: '{}',
+            samlConfig: null,
+            userId: 'creator-2',
+            providerId: 'concurrent-provider',
+            organizationId: 'org-2',
+          },
+        ]
+        return callback()
+      }
+    )
+
+    const response = await PATCH(createMockRequest('PATCH', SAML_UPDATE), context)
+
+    expect(response.status).toBe(409)
+    expect(mockWithSSOProviderMutationLock).toHaveBeenCalledOnce()
+    expect(mockUpdateSSOProvider).not.toHaveBeenCalled()
+  })
+
   it('reports the compatibility-active state while verification enforcement is disabled', async () => {
     const previousValue = env.SSO_DOMAIN_VERIFICATION_ENABLED
     env.SSO_DOMAIN_VERIFICATION_ENABLED = undefined

apps/sim/app/api/auth/sso/providers/[id]/route.ts

@@ -1,3 +1,4 @@
+import { withSSOProviderMutationLock } from '@sim/db'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import type { NextRequest } from 'next/server'
@@ -68,9 +69,17 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Rout
         existingDomain: provider.domain,
       }
     )
-    const updated = await auth.api.updateSSOProvider({
-      body: providerConfig,
-      headers: collectAuthHeaders(request),
+    const updated = await withSSOProviderMutationLock(async () => {
+      await assertSSOProviderAvailable({
+        providerId: provider.providerId,
+        domain,
+        organizationId: provider.organizationId!,
+        excludeRowId: provider.id,
+      })
+      return auth.api.updateSSOProvider({
+        body: providerConfig,
+        headers: collectAuthHeaders(request),
+      })
     })
 
     logger.info('SSO provider updated', {

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -12,6 +12,7 @@ const {
   mockRegisterSSOProvider,
   mockSecureFetchWithPinnedIP,
   mockValidateUrlWithDNS,
+  mockWithSSOProviderMutationLock,
   ssoProviderTable,
 } = vi.hoisted(() => ({
   dbState: {
@@ -28,6 +29,7 @@ const {
   mockRegisterSSOProvider: vi.fn(),
   mockSecureFetchWithPinnedIP: vi.fn(),
   mockValidateUrlWithDNS: vi.fn(),
+  mockWithSSOProviderMutationLock: vi.fn((callback: () => Promise<unknown>) => callback()),
   ssoProviderTable: {
     id: 'sso.id',
     providerId: 'sso.providerId',
@@ -58,6 +60,7 @@ vi.mock('@sim/db', () => ({
   },
   member: memberTable,
   ssoProvider: ssoProviderTable,
+  withSSOProviderMutationLock: mockWithSSOProviderMutationLock,
 }))
 
 vi.mock('@/lib/auth', () => ({
@@ -196,6 +199,28 @@ describe('POST /api/auth/sso/register', () => {
     expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
   })
 
+  it('re-checks domain overlap inside the mutation lock after configuration work', async () => {
+    mockWithSSOProviderMutationLock.mockImplementationOnce(
+      async (callback: () => Promise<unknown>) => {
+        dbState.providers = [
+          {
+            id: 'concurrent',
+            providerId: 'concurrent-provider',
+            domain: 'login.acme.com',
+            organizationId: 'org-concurrent',
+          },
+        ]
+        return callback()
+      }
+    )
+
+    const response = await POST(request(OIDC_BODY))
+
+    expect(response.status).toBe(409)
+    expect(mockWithSSOProviderMutationLock).toHaveBeenCalledOnce()
+    expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
+  })
+
   it('enforces one provider per organization', async () => {
     dbState.providers = [
       {

apps/sim/app/api/auth/sso/register/route.ts

@@ -1,3 +1,4 @@
+import { withSSOProviderMutationLock } from '@sim/db'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import type { NextRequest } from 'next/server'
@@ -61,9 +62,16 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         organizationId: body.orgId,
       }
     )
-    const registration = await auth.api.registerSSOProvider({
-      body: providerConfig,
-      headers: collectAuthHeaders(request),
+    const registration = await withSSOProviderMutationLock(async () => {
+      await assertSSOProviderAvailable({
+        providerId: body.providerId,
+        domain,
+        organizationId: body.orgId,
+      })
+      return auth.api.registerSSOProvider({
+        body: providerConfig,
+        headers: collectAuthHeaders(request),
+      })
     })
 
     logger.info('SSO provider registered', {

packages/db/db.ts

@@ -47,6 +47,50 @@ const postgresClient = instrumentPoolClient(
 
 export const db = drizzle(postgresClient, { schema })
 
+const SSO_PROVIDER_MUTATION_LOCK_KEY = 4_961_002_271n
+let ssoProviderMutationTail = Promise.resolve()
+
+/**
+ * Serializes SSO provider create/update mutations across app processes.
+ *
+ * Parent/child domain overlap cannot be represented by a normal unique index,
+ * so callers must re-check availability while holding this lock and keep it
+ * through the Better Auth write. The lock uses a reserved connection and a
+ * transaction-scoped advisory lock so it remains safe behind transaction-mode
+ * poolers and is released automatically if the callback or process fails.
+ *
+ * The per-process queue prevents concurrent requests from reserving multiple
+ * primary-pool connections while they wait for the same cross-process lock.
+ */
+export async function withSSOProviderMutationLock<T>(callback: () => Promise<T>): Promise<T> {
+  const predecessor = ssoProviderMutationTail
+  let releaseLocalLock!: () => void
+  ssoProviderMutationTail = new Promise<void>((resolve) => {
+    releaseLocalLock = resolve
+  })
+
+  await predecessor
+  try {
+    const reserved = await postgresClient.reserve()
+    try {
+      await reserved.unsafe('BEGIN')
+      try {
+        await reserved.unsafe(`SELECT pg_advisory_xact_lock(${SSO_PROVIDER_MUTATION_LOCK_KEY})`)
+        const result = await callback()
+        await reserved.unsafe('COMMIT')
+        return result
+      } catch (error) {
+        await reserved.unsafe('ROLLBACK')
+        throw error
+      }
+    } finally {
+      reserved.release()
+    }
+  } finally {
+    releaseLocalLock()
+  }
+}
+
 /**
  * Opt-in read-replica client for reads that tolerate bounded staleness and have
  * no read-your-writes dependency (logs, exports, dashboard aggregations). Never