fix(sso): withhold domain trust from personal providers on the hosted deployment

A personal (org-less) provider has no verified domain behind it, but the trust
grant treated it as authoritative anyway. On the multi-tenant deployment that is
an account-takeover primitive: anyone able to register one could claim a domain
they do not own, point it at their own IdP, and have a sign-in auto-link to an
existing account on that domain.

Sim's UI always registers org-scoped, so this only reaches direct API callers.
Self-hosted deployments are single-tenant — the operator is the only tenant —
so the org-less path keeps working there.

Also clears the attribute mapping when the protocol changes: claim names are
protocol-specific, so an OIDC override carried into a SAML config would save a
mapping the IdP cannot resolve.

Author: waleedlatif1

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -311,6 +311,26 @@ describe('POST /api/auth/sso/register', () => {
     expect(dbChainMockFns.delete).toHaveBeenCalled() // …then rolled back
   })
 
+  /**
+   * A personal provider has no verified domain behind it. On the hosted
+   * multi-tenant deployment that must grant no linking authority, or anyone able
+   * to register one could claim a domain they do not own and have their own IdP
+   * auto-link to existing accounts on it.
+   */
+  it('does not grant domain trust to a personal provider when hosted', async () => {
+    setEnvFlags({ isSsoEnabled: true, isHosted: true })
+    const res = await POST(request(OIDC_BODY))
+    expect(res.status).toBe(200)
+    expect(dbChainMockFns.set).toHaveBeenCalledWith({ domainVerified: false })
+  })
+
+  it('grants domain trust to a personal provider when self-hosted', async () => {
+    setEnvFlags({ isSsoEnabled: true, isHosted: false })
+    const res = await POST(request(OIDC_BODY))
+    expect(res.status).toBe(200)
+    expect(dbChainMockFns.set).toHaveBeenCalledWith({ domainVerified: true })
+  })
+
   it('nests the attribute mapping inside oidcConfig (Better Auth reads it there)', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     await POST(

apps/sim/app/api/auth/sso/register/route.ts

@@ -8,7 +8,7 @@ import { ssoRegistrationContract } from '@/lib/api/contracts/auth'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { auth, getSession } from '@/lib/auth'
 import { hasSSOAccess } from '@/lib/billing'
-import { isSsoEnabled } from '@/lib/core/config/env-flags'
+import { isHosted, isSsoEnabled } from '@/lib/core/config/env-flags'
 import {
   secureFetchWithPinnedIP,
   validateUrlWithDNS,
@@ -659,12 +659,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
      * clause, so the write matches nothing once the proof is gone and reports that
      * as `false`. Paired with the domain-delete route clearing this flag in the
      * same transaction that removes the proof, the provider cannot end up trusted
-     * without current ownership in either commit order. Org-less (personal) SSO is
-     * not domain-gated by Sim, so it grants unconditionally as it always has.
+     * without current ownership in either commit order.
+     *
+     * Org-less (personal) SSO has no verified domain behind it, so on the hosted
+     * multi-tenant deployment it is granted no linking authority — otherwise anyone
+     * able to register one could claim a domain they do not own and have their own
+     * IdP auto-link to existing accounts on it. Sim's UI always registers
+     * org-scoped, so this only affects direct API callers. Self-hosted deployments
+     * are single-tenant, where the operator is the only tenant and the org-less
+     * path keeps working as before.
      */
     const grantProviderDomainTrust = async (): Promise<boolean> => {
       if (!orgId) {
-        await setProviderDomainVerified(true)
+        await setProviderDomainVerified(!isHosted)
         return true
       }
       const granted = await db

apps/sim/ee/sso/components/sso-settings.tsx

@@ -379,8 +379,13 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
 
   const handleInputChange = (field: keyof typeof formData, value: string | boolean) => {
     const next = { ...formData, [field]: value }
-
+    // Claim names are protocol-specific — OIDC's `email` means nothing to a SAML
+    // IdP — so carrying an override across a protocol switch would save a mapping
+    // that cannot resolve. Clear them and fall back to the new protocol's defaults.
     if (field === 'providerType') {
+      next.mapId = ''
+      next.mapEmail = ''
+      next.mapName = ''
       setShowErrors(false)
     }