fix(sso): close the fail-open paths an independent audit found

- Ask the entitlement read to throw rather than answer "not entitled" on
  an outage, so a blip cannot drop the requirement and cache that
- Keep the membership read's old resilience for paths the requirement
  allows anyway, and fail closed only on the ones it governs
- Say why a verification code was refused instead of calling it invalid
- Report the requirement from fresh reads, so the settings surface cannot
  disagree with what sign-in enforces
- Document that social sign-in is refused too, and how an owner without a
  password gets back in

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/sso.mdx

@@ -324,10 +324,10 @@ SSO provisioning creates internal organization members but does not grant worksp
 By default members can sign in with a password, an email code, or your identity provider. To make single sign-on the only way in, open **Settings → Organization → Single sign-on → Sign-in** and set **Allowed sign-in methods** to **Single sign-on**. It becomes available once the organization has an identity provider on a verified domain.
 
 - The requirement is checked when a session is created, so turning it on signs nobody out. Members keep working and meet the requirement at their next sign-in. To end current sessions too, use **Sign out all members** under **Settings → Organization → Security**.
-- Organization owners keep every sign-in method. If the identity provider breaks, an owner can still sign in with a password and turn the requirement back off.
+- Organization owners keep every sign-in method. If the identity provider breaks, an owner can still sign in with a password — setting one through **Forgot password** if they only ever signed in through the identity provider — and turn the requirement back off.
 - If the last identity provider is deleted or its domain verification lapses, the requirement stops being enforced instead of locking the organization out, and you can switch back to any method at any time.
 - Desktop app handoff from an already signed-in browser keeps working, because that session derives from one the requirement already admitted.
-- A member who tries a password or email code sees a message telling them to sign in through their identity provider.
+- A member who tries a password, an email code, or a social sign-in such as Google or GitHub sees a message telling them to sign in through their identity provider.
 
 <Callout type="info">
   Turning the requirement off restores password and email sign-in immediately for everyone.
@@ -362,7 +362,7 @@ By default members can sign in with a password, an email code, or your identity
   },
   {
     question: "Can I still use email/password login after enabling SSO?",
-    answer: "Yes, unless you require single sign-on. Enabling SSO does not disable password login on its own; set Allowed sign-in methods to Single sign-on to refuse password and email-code sign-in for members. Organization owners keep password sign-in as a way back in if the identity provider breaks."
+    answer: "Yes, unless you require single sign-on. Enabling SSO does not disable password login on its own; set Allowed sign-in methods to Single sign-on to refuse password, email-code, and social sign-in for members. Organization owners keep password sign-in as a way back in if the identity provider breaks, and can set a password through Forgot password if they never had one."
   },
   {
     question: "A user already has an account with the same email — what happens when they sign in with SSO?",

apps/sim/app/(auth)/verify/use-verification.ts

@@ -5,6 +5,7 @@ import { createLogger } from '@sim/logger'
 import { normalizeEmail } from '@sim/utils/string'
 import { useSearchParams } from 'next/navigation'
 import { client, useSession } from '@/lib/auth/auth-client'
+import { SSO_REQUIRED_ERROR_CODE } from '@/lib/auth/constants'
 import { validateCallbackUrl } from '@/lib/core/security/input-validation'
 import { DEFAULT_POST_AUTH_ROUTE, POST_AUTH_REDIRECT_STORAGE_KEY } from '@/app/(auth)/auth-redirect'
 
@@ -122,7 +123,14 @@ export function useVerification({
         }, 1000)
       } else {
         logger.info('Setting invalid OTP state - API error response')
-        const message = 'Invalid verification code. Please check and try again.'
+        /**
+         * A refusal by policy — an organization requiring single sign-on — is not a bad code, and
+         * telling the person to re-check their code sends them round a loop they cannot exit.
+         */
+        const message =
+          response?.error?.code === SSO_REQUIRED_ERROR_CODE && response.error.message
+            ? response.error.message
+            : 'Invalid verification code. Please check and try again.'
         setStatus('error')
         setErrorMessage(message)
         logger.info('Error state after API error:', { errorMessage: message })

apps/sim/app/oauth-error/page.tsx

@@ -1,5 +1,5 @@
 import type { Metadata } from 'next'
-import { SSO_REQUIRED_ERROR_CODE, SSO_REQUIRED_MESSAGE } from '@/lib/auth/sso-policy'
+import { SSO_REQUIRED_ERROR_CODE, SSO_REQUIRED_MESSAGE } from '@/lib/auth/constants'
 import { DesktopHandoffShell } from '@/app/desktop/components/desktop-handoff-shell'
 
 export const metadata: Metadata = {

apps/sim/lib/auth/constants.ts

@@ -106,3 +106,13 @@ export function applyRegistrationGate<T extends Record<string, RegistrationGate>
   /** The spread widens past what TypeScript can prove; the keys are unchanged. */
   return gated as T
 }
+
+/**
+ * How a sign-in refused by an organization's single sign-on requirement identifies itself. Here
+ * rather than beside the policy so the sign-in and verification screens can recognize the refusal
+ * without pulling the policy module — and its database dependencies — into the browser bundle.
+ */
+export const SSO_REQUIRED_ERROR_CODE = 'SSO_REQUIRED'
+
+export const SSO_REQUIRED_MESSAGE =
+  'Your organization requires single sign-on. Sign in through your identity provider.'

apps/sim/lib/auth/session-hooks.test.ts

@@ -13,10 +13,10 @@ vi.mock('@/lib/auth/access-control', () => ({
   isEmailBlockedByAccessControl: isBlocked,
 }))
 
+import { SSO_REQUIRED_MESSAGE } from '@/lib/auth/constants'
 import { runWithAuthDatabase } from '@/lib/auth/database-context'
 import { prepareSessionForCreation } from '@/lib/auth/session-hooks'
 import { invalidateSessionPolicyCache } from '@/lib/auth/session-policy'
-import { SSO_REQUIRED_MESSAGE } from '@/lib/auth/sso-policy'
 
 const createdAt = new Date('2026-09-08T00:00:00Z')
 const session: Session = {
@@ -108,6 +108,34 @@ describe('prepareSessionForCreation', () => {
     ).rejects.toThrow(SSO_REQUIRED_MESSAGE)
   })
 
+  it('still signs in through the identity provider when the membership read fails', async () => {
+    setEnvFlags({ isBillingEnabled: false, isSsoEnabled: true })
+    const { executor, limit } = transactionExecutor()
+    limit.mockResolvedValueOnce([{ email: 'member@example.com', suspendedAt: null }])
+    limit.mockRejectedValueOnce(new Error('connection reset'))
+
+    /** A database blip must not cost a sign-in the requirement would have allowed anyway. */
+    await expect(
+      runWithAuthDatabase(executor, () =>
+        prepareSessionForCreation(session, { path: '/sso/callback/okta' })
+      )
+    ).resolves.toEqual({ data: session })
+  })
+
+  it('refuses a password sign-in when the membership itself cannot be read', async () => {
+    setEnvFlags({ isBillingEnabled: false, isSsoEnabled: true })
+    const { executor, limit } = transactionExecutor()
+    limit.mockResolvedValueOnce([{ email: 'member@example.com', suspendedAt: null }])
+    limit.mockRejectedValueOnce(new Error('connection reset'))
+
+    /** An unknown membership cannot be read as "no organization requires SSO of this person". */
+    await expect(
+      runWithAuthDatabase(executor, () =>
+        prepareSessionForCreation(session, { path: '/sign-in/email' })
+      )
+    ).rejects.toThrow('connection reset')
+  })
+
   it('refuses the sign-in when the requirement itself cannot be read', async () => {
     setEnvFlags({ isBillingEnabled: false, isSsoEnabled: true })
     const { executor, limit } = transactionExecutor()

apps/sim/lib/auth/session-hooks.ts

@@ -6,7 +6,7 @@ import { eq } from 'drizzle-orm'
 import { getAccessControlConfig, isEmailBlockedByAccessControl } from '@/lib/auth/access-control'
 import { getAuthDatabase } from '@/lib/auth/database-context'
 import { clampExpiryForSession } from '@/lib/auth/session-policy'
-import { assertSsoRequirementSatisfied } from '@/lib/auth/sso-policy'
+import { assertSsoRequirementSatisfied, satisfiesSsoRequirement } from '@/lib/auth/sso-policy'
 
 const logger = createLogger('SessionHooks')
 
@@ -41,20 +41,32 @@ export async function prepareSessionForCreation<T extends Session>(
     })
   }
 
-  /** Users belong to at most one organization, the same assumption the expiry clamp below makes. */
-  const [membership] = await executor
-    .select({ organizationId: member.organizationId, role: member.role })
-    .from(member)
-    .where(eq(member.userId, session.userId))
-    .limit(1)
+  /**
+   * A membership that cannot be read is not a membership that does not exist, so a failed lookup
+   * refuses the sign-in methods an organization could be requiring against — and only those. Every
+   * other path keeps the old behavior of continuing without an organization, so a database blip
+   * does not cost a sign-in to people this setting has nothing to say about.
+   */
+  let membership: { organizationId: string; role: string } | undefined
+  try {
+    /** Users belong to at most one organization, the same assumption the expiry clamp makes. */
+    ;[membership] = await executor
+      .select({ organizationId: member.organizationId, role: member.role })
+      .from(member)
+      .where(eq(member.userId, session.userId))
+      .limit(1)
+  } catch (error) {
+    if (!satisfiesSsoRequirement(context?.path)) throw error
+    logger.error('Error reading organization membership', { error, userId: session.userId })
+    return { data: session }
+  }
 
   if (!membership) return { data: session }
 
   /**
    * Outside the fallback below on purpose: a requirement that cannot be read is not a requirement
    * that does not apply, and admitting a password sign-in because a lookup failed is exactly the
-   * bypass the setting exists to prevent. The read runs on the transaction that is creating the
-   * session, so a failure here means that write is failing too.
+   * bypass the setting exists to prevent.
    */
   await assertSsoRequirementSatisfied(
     { userId: session.userId, ...membership },

apps/sim/lib/auth/sso-policy.test.ts

@@ -18,11 +18,11 @@ vi.mock('@/lib/auth/sso/verified-provider', () => ({
   hasSignInCapableSsoProvider: mockHasProvider,
 }))
 
+import { SSO_REQUIRED_MESSAGE } from '@/lib/auth/constants'
 import {
   assertSsoRequirementSatisfied,
   invalidateSsoPolicyCache,
   isSsoRequiredForOrganization,
-  SSO_REQUIRED_MESSAGE,
   satisfiesSsoRequirement,
 } from '@/lib/auth/sso-policy'
 

apps/sim/lib/auth/sso-policy.ts

@@ -4,6 +4,7 @@ import { createLogger } from '@sim/logger'
 import { APIError } from 'better-auth/api'
 import { eq } from 'drizzle-orm'
 import { LRUCache } from 'lru-cache'
+import { SSO_REQUIRED_ERROR_CODE, SSO_REQUIRED_MESSAGE } from '@/lib/auth/constants'
 import { isSsoCallbackPath } from '@/lib/auth/sso/callback-provider'
 import { hasSignInCapableSsoProvider } from '@/lib/auth/sso/verified-provider'
 import { isOrganizationFeatureEntitled } from '@/lib/billing/core/subscription'
@@ -51,14 +52,26 @@ export async function isSsoRequiredForOrganization(
     .where(eq(organization.id, organizationId))
     .limit(1)
 
+  /**
+   * `onError: 'throw'` because a swallowed read is a permissive answer here: an outage on the
+   * subscription read would otherwise return "not entitled", drop the requirement, and — worse —
+   * cache that for the whole TTL. A throw leaves the cache untouched and refuses the sign-in.
+   */
+  /** Stored, entitled, and a provider that could satisfy it — the three terms, cheapest first. */
   const required =
     row?.requireSso === true &&
-    (await isOrganizationFeatureEntitled(organizationId, isSsoEnabled, executor)) &&
+    (await isOrganizationFeatureEntitled(organizationId, isSsoEnabled, executor, {
+      onError: 'throw',
+    })) &&
     (await hasSignInCapableSsoProvider(organizationId, executor))
   if (executor === db) requirementCache.set(organizationId, required)
   return required
 }
 
+/**
+ * Drops this process's copy. Other instances keep theirs until the TTL expires, so the TTL — not
+ * this call — is what bounds how long a change takes to reach the whole fleet.
+ */
 export function invalidateSsoPolicyCache(organizationId: string): void {
   requirementCache.delete(organizationId)
 }
@@ -88,11 +101,6 @@ export function satisfiesSsoRequirement(path: string | undefined): boolean {
   return DERIVED_SESSION_PATHS.has(path) || isSsoCallbackPath(path)
 }
 
-export const SSO_REQUIRED_ERROR_CODE = 'SSO_REQUIRED'
-
-export const SSO_REQUIRED_MESSAGE =
-  'Your organization requires single sign-on. Sign in through your identity provider.'
-
 /**
  * Refuses a session that an organization's sign-in requirement does not allow. Owners keep every
  * sign-in method as a break-glass path, so a broken identity provider cannot lock an organization

apps/sim/lib/auth/sso/application/sso-requirement.ts

@@ -3,7 +3,7 @@ import { db } from '@sim/db'
 import { organization } from '@sim/db/schema'
 import { eq } from 'drizzle-orm'
 import { hasSignInCapableSsoProvider } from '@/lib/auth/sso/verified-provider'
-import { invalidateSsoPolicyCache, isSsoRequiredForOrganization } from '@/lib/auth/sso-policy'
+import { invalidateSsoPolicyCache } from '@/lib/auth/sso-policy'
 import { isOrganizationFeatureEntitled } from '@/lib/billing/core/subscription'
 import { recordProjectedUseCaseAuditEntries } from '@/lib/core/application/authorized-workspace-use-case'
 import type { OperationUseCase } from '@/lib/core/application/operation'
@@ -49,11 +49,17 @@ async function loadRequirement(organizationId: string): Promise<SsoRequirement>
     .limit(1)
   if (!org) throw new OrchestrationError('not_found', 'Organization not found')
 
-  const [hasVerifiedProvider, isEnforced] = await Promise.all([
+  /** Read fresh rather than through the sign-in cache: an admin is waiting on this answer. */
+  const [hasVerifiedProvider, entitled] = await Promise.all([
     hasSignInCapableSsoProvider(organizationId),
-    isSsoRequiredForOrganization(organizationId),
+    isOrganizationFeatureEntitled(organizationId, isSsoEnabled),
   ])
-  return { requireSso: org.requireSso, hasVerifiedProvider, isEnforced }
+  /** The same three terms sign-in checks, so the surface reports what is actually enforced. */
+  return {
+    requireSso: org.requireSso,
+    hasVerifiedProvider,
+    isEnforced: org.requireSso && entitled && hasVerifiedProvider,
+  }
 }
 
 export const readSsoRequirement: OperationUseCase<

apps/sim/lib/billing/core/subscription.ts

@@ -589,10 +589,11 @@ export const isOrganizationOnEnterprisePlan = cache(resolveOrganizationEnterpris
 export async function isOrganizationFeatureEntitled(
   organizationId: string,
   selfHostEntitlement: boolean,
-  executor: DbOrTx = db
+  executor: DbOrTx = db,
+  options: { onError?: EnterprisePlanErrorPolicy } = {}
 ): Promise<boolean> {
   if (!isBillingEnabled) return selfHostEntitlement
-  return isOrganizationOnEnterprisePlan(organizationId, 'return-false', executor)
+  return isOrganizationOnEnterprisePlan(organizationId, options.onError ?? 'return-false', executor)
 }
 
 /**