feat(sso): let organizations require single sign-on by waleedlatif1 · Pull Request #7881 · simstudioai/sim

waleedlatif1 · 2026-09-16T17:49:33Z

Summary

Organizations can now require members to sign in through their identity provider (Settings → Organization → Single sign-on → Sign-in → Allowed sign-in methods)
Enforced only when a session is created, so turning it on signs nobody out — revoking sessions stays the separate action under Security
Owners keep password sign-in as a break-glass path, and the requirement stops enforcing if the organization loses its SSO entitlement or has no identity provider left on a verified domain
Every SSO callback endpoint satisfies the requirement, including the SAML ACS endpoint; unknown session-creating endpoints are refused rather than silently allowed
Checked against every membership, so belonging to a second organization is not a way around the first one's requirement
Refusals surface as a real message on the login page and the OAuth error page instead of "invalid email or password"

Type of Change

New feature

Testing

Tested manually. bun run type-check, bun run lint, bun run check:audits (46 audits), bun run check:api-validation, bun run docs-manifest:check, and bun run check:migrations origin/staging all pass. New unit tests cover the policy module (endpoint classification, entitlement and provider fallbacks, cache), the session hook enforcement, the API route, and the settings control; 587 tests pass across the touched suites.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Adds an organization setting that refuses password and email-code sign-in for members, enforced when a session is created so enabling it signs nobody out. Owners keep every sign-in method as a break-glass path, and the requirement stops enforcing if no identity provider on a verified domain is left to satisfy it.

vercel · 2026-09-16T17:49:39Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 16, 2026 6:25pm UTC

greptile-apps · 2026-09-16T17:55:08Z

Confidence Score: 5/5

The PR appears safe to merge; the previous findings are resolved and no actionable regression remains in the changes since the prior review.

Summary

This PR adds organization-level enforcement of SSO during session creation, with an owner break-glass exception and automatic fallback when entitlement or a usable provider is unavailable.

Adds organization operations and API contracts for reading and changing the requirement.
Enforces the policy in the session-creation hook and classifies SSO, credential, social, and derived-session paths.
Invalidates server and client policy caches when provider or domain state changes.
Adds settings UI, user-facing policy errors, documentation, migration, audit support, and focused tests.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Session creation] --> B[Read user's organization membership]
  B -->|No membership| C[Allow session]
  B -->|Owner| C
  B -->|Member or admin| D{SSO-capable or derived path?}
  D -->|Yes| C
  D -->|No| E[Read stored requirement]
  E --> F{SSO entitled?}
  F -->|No| C
  F -->|Yes| G{Verified sign-in provider exists?}
  G -->|No| C
  G -->|Yes| H[Reject session with SSO_REQUIRED]

_{Reviews (3) · Last reviewed commit: "fix(sso): close the fail-open paths an i..."}

cubic-dev-ai

1 issue found across 24 files

Confidence score: 4/5

In apps/sim/ee/sso/hooks/sso-policy.ts, provider or verified-domain changes may leave hasVerifiedProvider stale for up to 60 seconds, causing the settings control to show an outdated state; invalidate ssoKeys.policy when those mutations complete.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/ee/sso/hooks/sso-policy.ts">

<violation number="1" location="apps/sim/ee/sso/hooks/sso-policy.ts:26">
P2: When a provider or verified domain changes, this query can keep `hasVerifiedProvider` stale for up to 60 seconds because those mutations do not invalidate `ssoKeys.policy`. The settings control can therefore advertise an outdated requirement state or allow an enable attempt that the API immediately rejects; invalidate the policy query from provider/domain mutations when their capability changes.</violation>
</file>

_{Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Fix all with cubic | Re-trigger cubic}

- Let an admin turn the requirement off after the organization loses its SSO entitlement, so a restored entitlement cannot silently resume it - Fail closed when the requirement cannot be read: a failed lookup no longer admits a password sign-in - Invalidate the policy cache when a provider is deleted or a domain's verification changes, on the server and in the query client - Report whether the stored requirement is actually enforced, and say so in the settings copy

waleedlatif1 · 2026-09-16T18:02:52Z

@greptile

waleedlatif1 · 2026-09-16T18:02:53Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-16T18:03:00Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 28 files

_{Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Fix all with cubic | Re-trigger cubic}

… case - Replace the hand-rolled route guards with organization operations, the pattern the SSO domain already uses for its primary-provider change - Drop the multi-membership scan: users belong to at most one organization, the same assumption the expiry clamp makes - Match the provider check to what sign-in resolution actually requires, so a capable provider is never read as incapable - Invalidate the policy cache when a provider is registered or edited - Show a policy refusal as a form-level message rather than marking the password field wrong

- Ask the entitlement read to throw rather than answer "not entitled" on an outage, so a blip cannot drop the requirement and cache that - Keep the membership read's old resilience for paths the requirement allows anyway, and fail closed only on the ones it governs - Say why a verification code was refused instead of calling it invalid - Report the requirement from fresh reads, so the settings surface cannot disagree with what sign-in enforces - Document that social sign-in is refused too, and how an owner without a password gets back in

waleedlatif1 · 2026-09-16T18:24:23Z

@greptile

waleedlatif1 · 2026-09-16T18:24:24Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-16T18:24:29Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 33 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic}

vercel Bot deployed to Preview September 16, 2026 17:51 View deployment

greptile-apps Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread apps/sim/app/api/organizations/[id]/sso-policy/route.ts Outdated

Comment thread apps/sim/app/api/organizations/[id]/sso-policy/route.ts Outdated

Comment thread apps/sim/lib/auth/sso-policy.ts

cubic-dev-ai Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread apps/sim/lib/auth/session-hooks.ts Outdated

Comment thread apps/sim/app/api/organizations/[id]/sso-policy/route.ts Outdated

Comment thread apps/sim/ee/sso/hooks/sso-policy.ts

vercel Bot temporarily deployed to Preview September 16, 2026 18:02 Inactive

cubic-dev-ai Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread apps/sim/app/api/organizations/[id]/sso-policy/route.ts Outdated

vercel Bot temporarily deployed to Preview September 16, 2026 18:16 Inactive

vercel Bot deployed to Preview September 16, 2026 18:25 View deployment

cubic-dev-ai Bot reviewed Sep 16, 2026

View reviewed changes

waleedlatif1 merged commit de0f118 into staging Sep 16, 2026
33 checks passed

waleedlatif1 deleted the feat/require-sso branch September 16, 2026 18:31

waleedlatif1 mentioned this pull request Sep 16, 2026

v0.8.40: browser agent improvements, permission requests #7876

Merged

Conversation

waleedlatif1 commented Sep 16, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 16, 2026

Uh oh!

waleedlatif1 commented Sep 16, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 16, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Sep 16, 2026

Uh oh!

waleedlatif1 commented Sep 16, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 16, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Sep 16, 2026 •

edited

Loading

greptile-apps Bot commented Sep 16, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading