fix(auth): serialize SSO configuration mutations

Block provider and verification-token changes while callback or DNS verification operations are active so in-flight authentication observes a stable configuration.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

apps/sim/app/api/auth/sso/providers/[id]/domain-verification/request/route.ts

@@ -13,6 +13,7 @@ import {
   getManagedSSOProvider,
   ssoManagementErrorResponse,
 } from '@/lib/auth/sso/management'
+import { assertNoActiveSSOProviderOperations } from '@/lib/auth/sso/provider-operation-intent'
 import { env, isTruthy } from '@/lib/core/config/env'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 
@@ -40,6 +41,7 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Route
       const provider = await getManagedSSOProvider(parsed.data.params.id, session.user.id, {
         requireCreator: true,
       })
+      await assertNoActiveSSOProviderOperations(provider.providerId)
       const result = await auth.api.requestDomainVerification({
         body: { providerId: provider.providerId },
         headers: collectAuthHeaders(request),

apps/sim/app/api/auth/sso/providers/[id]/domain-verification/route.test.ts

@@ -7,6 +7,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 const {
   dbState,
   memberTable,
+  mockAssertNoActiveSSOProviderOperations,
   mockGetSession,
   mockIsOrganizationOnEnterprisePlan,
   mockRequestDomainVerification,
@@ -24,6 +25,7 @@ const {
     organizationId: 'member.organizationId',
     role: 'member.role',
   },
+  mockAssertNoActiveSSOProviderOperations: vi.fn(),
   mockGetSession: vi.fn(),
   mockIsOrganizationOnEnterprisePlan: vi.fn(),
   mockRequestDomainVerification: vi.fn(),
@@ -81,6 +83,7 @@ vi.mock('@/lib/auth', () => ({
 }))
 
 vi.mock('@/lib/auth/sso/provider-operation-intent', () => ({
+  assertNoActiveSSOProviderOperations: mockAssertNoActiveSSOProviderOperations,
   withSSODomainVerificationIntent: mockWithSSODomainVerificationIntent,
 }))
 
@@ -92,6 +95,7 @@ vi.mock('@/lib/core/config/env', () =>
   createEnvMock({ SSO_ENABLED: 'true', SSO_DOMAIN_VERIFICATION_ENABLED: 'true' })
 )
 
+import { SSOManagementError } from '@/lib/auth/sso/management'
 import { POST as requestVerification } from '@/app/api/auth/sso/providers/[id]/domain-verification/request/route'
 import { POST as verifyDomain } from '@/app/api/auth/sso/providers/[id]/domain-verification/verify/route'
 
@@ -158,6 +162,23 @@ describe('SSO domain verification façades', () => {
     })
   })
 
+  it('does not replace the verification token while verification is in progress', async () => {
+    mockAssertNoActiveSSOProviderOperations.mockRejectedValueOnce(
+      new SSOManagementError(
+        'An SSO operation is currently completing for this provider. Try again shortly.',
+        409,
+        'SSO_OPERATION_IN_PROGRESS'
+      )
+    )
+
+    const response = await requestVerification(createMockRequest('POST'), context)
+
+    expect(response.status).toBe(409)
+    await expect(response.json()).resolves.toMatchObject({ code: 'SSO_OPERATION_IN_PROGRESS' })
+    expect(mockAssertNoActiveSSOProviderOperations).toHaveBeenCalledWith('acme-saml')
+    expect(mockRequestDomainVerification).not.toHaveBeenCalled()
+  })
+
   it('delegates DNS verification to Better Auth', async () => {
     const response = await verifyDomain(createMockRequest('POST'), context)
     expect(response.status).toBe(200)

apps/sim/app/api/auth/sso/providers/[id]/route.test.ts

@@ -221,6 +221,30 @@ describe('/api/auth/sso/providers/[id]', () => {
     expect(mockUpdateSSOProvider).not.toHaveBeenCalled()
   })
 
+  it('rejects a configuration-only update while an SSO callback is in progress', async () => {
+    mockAssertNoActiveSSOProviderOperations.mockRejectedValueOnce(
+      new SSOManagementError(
+        'An SSO operation is currently completing for this provider. Try again shortly.',
+        409,
+        'SSO_OPERATION_IN_PROGRESS'
+      )
+    )
+
+    const response = await PATCH(
+      createMockRequest('PATCH', {
+        ...SAML_UPDATE,
+        issuer: PROVIDER.issuer,
+        domain: PROVIDER.domain,
+      }),
+      context
+    )
+
+    expect(response.status).toBe(409)
+    await expect(response.json()).resolves.toMatchObject({ code: 'SSO_OPERATION_IN_PROGRESS' })
+    expect(mockAssertNoActiveSSOProviderOperations).toHaveBeenCalledWith('acme-saml')
+    expect(mockUpdateSSOProvider).not.toHaveBeenCalled()
+  })
+
   it('rejects a stale update when the provider changes before lock acquisition', async () => {
     mockWithSSOProviderMutationLock.mockImplementationOnce(
       async (callback: () => Promise<unknown>) => {

apps/sim/app/api/auth/sso/providers/[id]/route.ts

@@ -92,8 +92,8 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Rout
       }
 
       const currentDomain = requireNormalizedSSODomain(body.domain, currentProvider.domain)
+      await assertNoActiveSSOProviderOperations(currentProvider.providerId)
       if (currentDomain !== currentProvider.domain || body.issuer !== currentProvider.issuer) {
-        await assertNoActiveSSOProviderOperations(currentProvider.providerId)
         await assertSSOProviderHasNoAccountLinks(currentProvider.providerId)
       }
       await assertSSOProviderAvailable({