fix(sso): re-grant provider trust when an already-verified domain is re-submitted

Author: waleedlatif1

apps/sim/app/api/organizations/[id]/domains/[domainId]/verify/route.test.ts

@@ -143,12 +143,29 @@ describe('verify org domain route', () => {
     expect(grantWhere).toBeDefined()
   })
 
-  it('does not grant trust when the conditional update matched no row', async () => {
+  /**
+   * A provider can hold a verified domain while its own trust flag is off, after
+   * an update whose grant was refused reverted the config and cleared it. Re-running
+   * verification is the obvious recovery, so an already-verified domain must still
+   * re-grant instead of returning success having done nothing.
+   */
+  it('re-grants trust when the domain is already verified', async () => {
     queueAdminWithPendingRow()
     queueTableRows(ssoDomain, [])
-    dbChainMockFns.returning.mockResolvedValueOnce([]) // lost the race
-    queueTableRows(ssoDomain, [{ ...PENDING_ROW, status: 'verified' }])
-    await POST(createMockRequest('POST'), routeContext)
+    dbChainMockFns.returning.mockResolvedValueOnce([]) // conditional update matched nothing
+    queueTableRows(ssoDomain, [{ ...PENDING_ROW, status: 'verified' }]) // re-read: verified
+    const res = await POST(createMockRequest('POST'), routeContext)
+    expect(res.status).toBe(200)
+    expect(dbChainMockFns.set).toHaveBeenCalledWith({ domainVerified: true })
+  })
+
+  it('does not grant trust when the challenge is genuinely stale', async () => {
+    queueAdminWithPendingRow()
+    queueTableRows(ssoDomain, [])
+    dbChainMockFns.returning.mockResolvedValueOnce([]) // conditional update matched nothing
+    queueTableRows(ssoDomain, []) // re-read: row deleted or re-tokenized
+    const res = await POST(createMockRequest('POST'), routeContext)
+    expect(res.status).toBe(409)
     expect(dbChainMockFns.set).not.toHaveBeenCalledWith({ domainVerified: true })
   })
 

apps/sim/app/api/organizations/[id]/domains/[domainId]/verify/route.ts

@@ -101,6 +101,17 @@ export const POST = withRouteHandler(
     // instead of mapping an undefined row or trusting a superseded challenge. A
     // concurrent cross-org verification trips the partial unique index; surface
     // that as a 409 rather than an unhandled 500.
+    /**
+     * Providers this proof covers. Normalized the way migration 0268 stored these
+     * rows (lower, trimmed, leading `*.` dropped) and identical to the expression
+     * the deletion path revokes with, so granting and revoking can never diverge.
+     */
+    const providersOnDomain = (verifiedDomain: string) =>
+      and(
+        eq(ssoProvider.organizationId, organizationId),
+        sql`lower(regexp_replace(btrim(${ssoProvider.domain}), '^\\*\\.', '')) = ${verifiedDomain}`
+      )
+
     let updated: (typeof row)[]
     try {
       updated = await db.transaction(async (tx) => {
@@ -118,18 +129,12 @@ export const POST = withRouteHandler(
 
         // Restore trust this proof covers, mirroring the revocation on delete.
         // Without it a delete-then-reverify leaves the provider untrusted, and
-        // since that flag gates sign-in the org sits in a silent SSO outage. The
-        // comparison matches the revoking one exactly so the two stay symmetric.
+        // since that flag gates sign-in the org sits in a silent SSO outage.
         if (flipped.length > 0) {
           await tx
             .update(ssoProvider)
             .set({ domainVerified: true })
-            .where(
-              and(
-                eq(ssoProvider.organizationId, organizationId),
-                sql`lower(regexp_replace(btrim(${ssoProvider.domain}), '^\\*\\.', '')) = ${flipped[0].domain}`
-              )
-            )
+            .where(providersOnDomain(flipped[0].domain))
         }
 
         return flipped
@@ -155,6 +160,15 @@ export const POST = withRouteHandler(
         .where(and(eq(ssoDomain.id, domainId), eq(ssoDomain.organizationId, organizationId)))
         .limit(1)
       if (current?.status === 'verified') {
+        // Re-grant rather than returning early. A provider can hold a verified
+        // domain while its own trust flag is off — an update whose grant was
+        // refused reverts to the previous config and clears it. Re-running
+        // verification is the obvious way to fix that, so it must actually do
+        // something; the proof is present, which is exactly what authorizes this.
+        await db
+          .update(ssoProvider)
+          .set({ domainVerified: true })
+          .where(providersOnDomain(current.domain))
         return NextResponse.json({ success: true, data: { domain: toDomainResponse(current) } })
       }
       return NextResponse.json(