fix(sso): normalize audited domain overlaps

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

packages/db/index.ts

@@ -1,6 +1,7 @@
 export * from './connection-url'
 export * from './db'
 export * from './schema'
+export * from './sso-domain'
 export * from './sso-lock'
 export * from './triggers'
 export { instrumentPoolClient, runOutsideTransactionContext } from './tx-tripwire'

packages/db/scripts/audit-sso-providers.ts

@@ -4,6 +4,7 @@ import { drizzle } from 'drizzle-orm/postgres-js'
 import postgres from 'postgres'
 import { parse as parseDomain } from 'tldts'
 import { account, session, ssoProvider } from '../schema'
+import { ssoDomainsOverlap } from '../sso-domain'
 
 const connectionString = process.env.POSTGRES_URL ?? process.env.DATABASE_URL
 if (!connectionString) {
@@ -31,10 +32,6 @@ function isRegistrableDomain(value: string): boolean {
   )
 }
 
-function domainsOverlap(left: string, right: string): boolean {
-  return left === right || left.endsWith(`.${right}`) || right.endsWith(`.${left}`)
-}
-
 const client = postgres(connectionString, {
   prepare: false,
   max: 1,
@@ -98,7 +95,7 @@ try {
       if (left.organizationId && left.organizationId === right.organizationId) {
         findings.push(`organization ${left.organizationId} owns multiple providers`)
       }
-      if (domainsOverlap(left.domain, right.domain)) {
+      if (ssoDomainsOverlap(left.domain, right.domain)) {
         findings.push(`overlapping domains: ${left.domain} and ${right.domain}`)
       }
     }

packages/db/scripts/register-sso-provider.ts

@@ -46,6 +46,7 @@ import { drizzle } from 'drizzle-orm/postgres-js'
 import postgres from 'postgres'
 import { parse as parseDomain } from 'tldts'
 import { member, organization, ssoProvider, user } from '../schema'
+import { ssoDomainsOverlap } from '../sso-domain'
 import { SSO_PROVIDER_MUTATION_LOCK_KEY } from '../sso-lock'
 
 interface SSOMapping {
@@ -191,10 +192,6 @@ function normalizeDomain(value: string): string | null {
     : null
 }
 
-function domainsOverlap(left: string, right: string): boolean {
-  return left === right || left.endsWith(`.${right}`) || right.endsWith(`.${left}`)
-}
-
 function buildSSOConfigFromEnv(): SSOProviderConfig | null {
   const enabled = process.env.SSO_ENABLED === 'true'
   if (!enabled) return null
@@ -700,7 +697,7 @@ async function registerSSOProvider(): Promise<boolean> {
         allProviders.some(
           (provider) =>
             provider.organizationId === organizationId ||
-            domainsOverlap(provider.domain, ssoConfig.domain)
+            ssoDomainsOverlap(provider.domain, ssoConfig.domain)
         )
       ) {
         logger.error(

packages/db/sso-domain.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { ssoDomainsOverlap } from './sso-domain'
+
+describe('ssoDomainsOverlap', () => {
+  it.each([
+    ['acme.com', 'acme.com'],
+    ['ACME.COM', 'acme.com'],
+    ['LOGIN.ACME.COM', 'acme.com'],
+    ['acme.com', 'LOGIN.ACME.COM'],
+  ])('detects exact and parent/child overlap between %s and %s', (left, right) => {
+    expect(ssoDomainsOverlap(left, right)).toBe(true)
+  })
+
+  it('does not treat a label suffix as a subdomain', () => {
+    expect(ssoDomainsOverlap('notacme.com', 'acme.com')).toBe(false)
+  })
+})

packages/db/sso-domain.ts

@@ -0,0 +1,9 @@
+export function ssoDomainsOverlap(left: string, right: string): boolean {
+  const normalizedLeft = left.toLowerCase()
+  const normalizedRight = right.toLowerCase()
+  return (
+    normalizedLeft === normalizedRight ||
+    normalizedLeft.endsWith(`.${normalizedRight}`) ||
+    normalizedRight.endsWith(`.${normalizedLeft}`)
+  )
+}