test(e2e): cover enterprise integrations

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

.github/workflows/test-build.yml

@@ -316,8 +316,8 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      - name: Configure E2E hostname
-        run: echo "127.0.0.1 e2e.sim.ai" | sudo tee -a /etc/hosts
+      - name: Configure E2E hostnames
+        run: echo "127.0.0.1 e2e.sim.ai mcp.e2e.sim.ai" | sudo tee -a /etc/hosts
 
       - name: Install Chromium
         working-directory: apps/sim

apps/docs/content/docs/en/platform/enterprise/sso.mdx

@@ -252,7 +252,7 @@ SSO provisioning creates internal organization members. External workspace membe
   },
   {
     question: "A user already has an account with the same email — what happens when they sign in with SSO?",
-    answer: "Sim links the SSO identity to the existing account automatically, as long as your identity provider reports the email as verified (email_verified) or the provider is trusted. Most OIDC providers (Okta, Google Workspace, Auth0) assert email_verified, so linking just works. If sign-in fails with 'account not linked' — common with SAML providers that omit the claim — add the provider's ID to SSO_TRUSTED_PROVIDER_IDS on self-hosted and restart."
+    answer: "Before verified-domain enforcement is activated, Sim links the SSO identity when your identity provider reports a verified email or the provider is operator-trusted. After enforcement is activated, the provider's verified organization domain is the account-linking trust boundary."
   },
   {
     question: "Who can configure SSO on Sim Cloud?",
@@ -281,11 +281,16 @@ Self-hosted deployments use environment variables instead of the billing/plan ch
 SSO_ENABLED=true
 NEXT_PUBLIC_SSO_ENABLED=true
 
+# Enable only after the SSO schema migration, provider audit, and approved
+# domain-verification backfill described below.
+SSO_DOMAIN_VERIFICATION_ENABLED=false
+
 # Required if you want users auto-added to your organization on first SSO sign-in
 ORGANIZATIONS_ENABLED=true
 NEXT_PUBLIC_ORGANIZATIONS_ENABLED=true
 
-# Optional: comma-separated SSO provider IDs to trust for automatic account linking
+# Optional while domain verification is disabled: comma-separated SSO provider IDs
+# to trust for automatic account linking
 # (links an SSO sign-in to an existing account with the same email). Needed when your
 # IdP does not assert email_verified — typically SAML providers, or OIDC providers that
 # omit the claim. Set it to the Provider ID you registered, then restart.
@@ -295,12 +300,27 @@ SSO_TRUSTED_PROVIDER_IDS=custom-oidc,partner-saml
 ```
 
 <Callout type="info">
-  When someone signs in with SSO and an account with the same email already exists
-  (for example, they previously signed up with email/password), Sim links the SSO
-  identity to that account automatically as long as your IdP reports the email as
-  verified, or the provider is trusted. If you hit an `account not linked` error,
-  either confirm your IdP sends `email_verified`, or add the provider's ID to
-  `SSO_TRUSTED_PROVIDER_IDS` and restart.
+  While `SSO_DOMAIN_VERIFICATION_ENABLED` is false, existing linking behavior uses
+  the IdP's `email_verified` claim or `SSO_TRUSTED_PROVIDER_IDS`. Once the flag is
+  true, Sim requires the SSO provider's organization domain to be verified and no
+  longer trusts an IdP-controlled email-verification claim by itself.
+</Callout>
+
+<Callout type="warning">
+  For upgrades, leave domain verification disabled until the database migration
+  has landed and
+  `SSO_AUDIT_APPROVED_PROVIDER_IDS=reviewed-provider-ids bun run --cwd packages/db db:audit-sso-providers`
+  passes. The approval list records the providers whose existing account links
+  and active sessions operators chose to retain; omit a provider until its
+  links are migrated or removed and its sessions are revoked. The audit reports
+  linked-user and active-session counts and requires one owner organization and
+  one registrable domain per provider.
+  Remediate legacy user-scoped, public-suffix, duplicate, or overlapping rows;
+  explicitly backfill `domain_verified` only for domains your operators have
+  verified; quiesce SSO writes and rerun the audit immediately before enabling
+  the flag. Internal pseudo-domains are not eligible for verified-domain
+  enforcement. Existing internal-domain providers can remain unchanged while
+  the flag is off, but must move to a registrable domain before activation.
 </Callout>
 
 You can register providers through the **Settings UI** (same as cloud) or by running the registration script directly against your database.
@@ -318,6 +338,7 @@ SSO_PROVIDER_ID=okta \
 SSO_ISSUER=https://dev-1234567.okta.com/oauth2/default \
 SSO_DOMAIN=company.com \
 SSO_USER_EMAIL=admin@company.com \
+SSO_ORGANIZATION_ID=your-organization-id \
 SSO_OIDC_CLIENT_ID=your-client-id \
 SSO_OIDC_CLIENT_SECRET=your-client-secret \
 bun run packages/db/scripts/register-sso-provider.ts
@@ -332,6 +353,7 @@ SSO_PROVIDER_ID=adfs \
 SSO_ISSUER=https://your-instance.com \
 SSO_DOMAIN=company.com \
 SSO_USER_EMAIL=admin@company.com \
+SSO_ORGANIZATION_ID=your-organization-id \
 SSO_SAML_ENTRY_POINT=https://adfs.company.com/adfs/ls \
 SSO_SAML_CERT="-----BEGIN CERTIFICATE-----
 ...
@@ -345,5 +367,7 @@ To remove a provider:
 
 ```bash
 SSO_USER_EMAIL=admin@company.com \
+SSO_ORGANIZATION_ID=your-organization-id \
+SSO_PROVIDER_ID=adfs \
 bun run packages/db/scripts/deregister-sso-provider.ts
 ```

apps/sim/app/api/auth/[...all]/route.test.ts

@@ -137,3 +137,45 @@ describe('auth catch-all route organization mutations', () => {
     expect(json).toEqual({ data: { ok: true } })
   })
 })
+
+describe('auth catch-all route SSO mutations', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it.each([
+    'register',
+    'update-provider',
+    'delete-provider',
+    'request-domain-verification',
+    'verify-domain',
+  ])('blocks the raw Better Auth /sso/%s endpoint', async (path) => {
+    const req = createMockRequest(
+      'POST',
+      undefined,
+      {},
+      `http://localhost:3000/api/auth/sso/${path}`
+    )
+    const res = await POST(req as any)
+
+    expect(res.status).toBe(404)
+    expect(handlerMocks.betterAuthPOST).not.toHaveBeenCalled()
+  })
+
+  it('continues to delegate non-mutation SSO endpoints', async () => {
+    const { NextResponse } = await import('next/server')
+    handlerMocks.betterAuthPOST.mockResolvedValueOnce(
+      new NextResponse(null, { status: 200 }) as any
+    )
+    const req = createMockRequest(
+      'POST',
+      undefined,
+      {},
+      'http://localhost:3000/api/auth/sign-in/sso'
+    )
+
+    const res = await POST(req as any)
+    expect(res.status).toBe(200)
+    expect(handlerMocks.betterAuthPOST).toHaveBeenCalledTimes(1)
+  })
+})

apps/sim/app/api/auth/[...all]/route.ts

@@ -9,6 +9,13 @@ export const dynamic = 'force-dynamic'
 
 const { GET: betterAuthGET, POST: betterAuthPOST } = toNextJsHandler(auth.handler)
 const SAFE_ORGANIZATION_POST_PATHS = new Set(['organization/check-slug', 'organization/set-active'])
+const BLOCKED_SSO_MUTATION_PATHS = new Set([
+  'sso/register',
+  'sso/update-provider',
+  'sso/delete-provider',
+  'sso/request-domain-verification',
+  'sso/verify-domain',
+])
 
 function getAuthPath(request: NextRequest): string {
   const pathname = request.nextUrl?.pathname ?? new URL(request.url).pathname
@@ -40,5 +47,12 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     )
   }
 
+  if (BLOCKED_SSO_MUTATION_PATHS.has(path)) {
+    return NextResponse.json(
+      { error: 'SSO mutations are handled by application API routes.' },
+      { status: 404 }
+    )
+  }
+
   return betterAuthPOST(request)
 })

apps/sim/app/api/auth/sso/providers/[id]/domain-verification/request/route.ts

@@ -0,0 +1,67 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import type { NextRequest } from 'next/server'
+import { NextResponse } from 'next/server'
+import { requestSsoDomainVerificationContract } from '@/lib/api/contracts/auth'
+import { parseRequest } from '@/lib/api/server'
+import { auth, getSession } from '@/lib/auth'
+import {
+  collectAuthHeaders,
+  getDomainVerificationRecordName,
+  getDomainVerificationRecordValue,
+  getManagedSSOProvider,
+  ssoManagementErrorResponse,
+} from '@/lib/auth/sso/management'
+import { env, isTruthy } from '@/lib/core/config/env'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('SSODomainVerificationRequestRoute')
+
+type RouteContext = { params: Promise<{ id: string }> }
+
+export const POST = withRouteHandler(async (request: NextRequest, context: RouteContext) => {
+  try {
+    if (!env.SSO_ENABLED) {
+      return NextResponse.json({ error: 'SSO is not enabled' }, { status: 400 })
+    }
+    if (!isTruthy(env.SSO_DOMAIN_VERIFICATION_ENABLED)) {
+      return NextResponse.json({ error: 'SSO domain verification is not enabled' }, { status: 404 })
+    }
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Authentication required' }, { status: 401 })
+    }
+
+    const parsed = await parseRequest(requestSsoDomainVerificationContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const provider = await getManagedSSOProvider(parsed.data.params.id, session.user.id, {
+      requireCreator: true,
+    })
+    const result = await auth.api.requestDomainVerification({
+      body: { providerId: provider.providerId },
+      headers: collectAuthHeaders(request),
+    })
+
+    return NextResponse.json(
+      {
+        recordName: getDomainVerificationRecordName(provider.providerId, provider.domain),
+        recordValue: getDomainVerificationRecordValue(
+          provider.providerId,
+          result.domainVerificationToken
+        ),
+      },
+      { status: 201 }
+    )
+  } catch (error) {
+    const managedResponse = ssoManagementErrorResponse(error)
+    if (managedResponse) return managedResponse
+    logger.error('Failed to request SSO domain verification', {
+      error: getErrorMessage(error, 'Unknown error'),
+    })
+    return NextResponse.json(
+      { error: 'Failed to request SSO domain verification' },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/auth/sso/providers/[id]/domain-verification/route.test.ts

@@ -0,0 +1,140 @@
+/**
+ * @vitest-environment node
+ */
+import { createEnvMock, createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  dbState,
+  memberTable,
+  mockGetSession,
+  mockIsOrganizationOnEnterprisePlan,
+  mockRequestDomainVerification,
+  mockVerifyDomain,
+  ssoProviderTable,
+} = vi.hoisted(() => ({
+  dbState: {
+    members: [] as Array<{ role: string }>,
+    providers: [] as Array<Record<string, unknown>>,
+  },
+  memberTable: {
+    userId: 'member.userId',
+    organizationId: 'member.organizationId',
+    role: 'member.role',
+  },
+  mockGetSession: vi.fn(),
+  mockIsOrganizationOnEnterprisePlan: vi.fn(),
+  mockRequestDomainVerification: vi.fn(),
+  mockVerifyDomain: vi.fn(),
+  ssoProviderTable: {
+    id: 'sso.id',
+    issuer: 'sso.issuer',
+    domain: 'sso.domain',
+    domainVerified: 'sso.domainVerified',
+    oidcConfig: 'sso.oidcConfig',
+    samlConfig: 'sso.samlConfig',
+    userId: 'sso.userId',
+    providerId: 'sso.providerId',
+    organizationId: 'sso.organizationId',
+  },
+}))
+
+function makeBuilder(rows: unknown[]): Promise<unknown[]> & {
+  where: () => ReturnType<typeof makeBuilder>
+  limit: () => Promise<unknown[]>
+} {
+  const builder = Promise.resolve(rows) as Promise<unknown[]> & {
+    where: () => ReturnType<typeof makeBuilder>
+    limit: () => Promise<unknown[]>
+  }
+  builder.where = () => makeBuilder(rows)
+  builder.limit = () => Promise.resolve(rows)
+  return builder
+}
+
+vi.mock('@sim/db', () => ({
+  db: {
+    select: () => ({
+      from: (table: unknown) =>
+        makeBuilder(table === memberTable ? dbState.members : dbState.providers),
+    }),
+  },
+  member: memberTable,
+  ssoProvider: ssoProviderTable,
+}))
+
+vi.mock('@/lib/auth', () => ({
+  getSession: mockGetSession,
+  auth: {
+    api: {
+      requestDomainVerification: mockRequestDomainVerification,
+      verifyDomain: mockVerifyDomain,
+    },
+  },
+}))
+
+vi.mock('@/lib/billing', () => ({
+  isOrganizationOnEnterprisePlan: mockIsOrganizationOnEnterprisePlan,
+}))
+
+vi.mock('@/lib/core/config/env', () =>
+  createEnvMock({ SSO_ENABLED: 'true', SSO_DOMAIN_VERIFICATION_ENABLED: 'true' })
+)
+
+import { POST as requestVerification } from '@/app/api/auth/sso/providers/[id]/domain-verification/request/route'
+import { POST as verifyDomain } from '@/app/api/auth/sso/providers/[id]/domain-verification/verify/route'
+
+const PROVIDER = {
+  id: 'row-1',
+  issuer: 'https://idp.example.com',
+  domain: 'acme.com',
+  domainVerified: false,
+  oidcConfig: null,
+  samlConfig: '{}',
+  userId: 'creator-1',
+  providerId: 'acme-saml',
+  organizationId: 'org-1',
+}
+const context = { params: Promise.resolve({ id: 'row-1' }) }
+
+describe('SSO domain verification façades', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    dbState.members = [{ role: 'admin' }]
+    dbState.providers = [PROVIDER]
+    mockGetSession.mockResolvedValue({ user: { id: 'creator-1' } })
+    mockIsOrganizationOnEnterprisePlan.mockResolvedValue(true)
+    mockRequestDomainVerification.mockResolvedValue({ domainVerificationToken: 'secret-token' })
+    mockVerifyDomain.mockResolvedValue(undefined)
+  })
+
+  it('preserves Better Auth creator identity authorization', async () => {
+    mockGetSession.mockResolvedValue({ user: { id: 'different-admin' } })
+    const response = await requestVerification(createMockRequest('POST'), context)
+    expect(response.status).toBe(403)
+    expect(mockRequestDomainVerification).not.toHaveBeenCalled()
+  })
+
+  it('returns DNS instructions only to the creator', async () => {
+    const response = await requestVerification(
+      createMockRequest('POST', undefined, { cookie: 'session=one' }),
+      context
+    )
+    expect(response.status).toBe(201)
+    await expect(response.json()).resolves.toEqual({
+      recordName: '_better-auth-token-acme-saml.acme.com',
+      recordValue: '_better-auth-token-acme-saml=secret-token',
+    })
+    expect(mockRequestDomainVerification).toHaveBeenCalledWith(
+      expect.objectContaining({ headers: expect.objectContaining({ cookie: 'session=one' }) })
+    )
+  })
+
+  it('delegates DNS verification to Better Auth', async () => {
+    const response = await verifyDomain(createMockRequest('POST'), context)
+    expect(response.status).toBe(200)
+    expect(mockVerifyDomain).toHaveBeenCalledWith(
+      expect.objectContaining({ body: { providerId: 'acme-saml' } })
+    )
+  })
+})