Force SSO on sign-up, not just sign-in

An SSO organization's IdP owns every account on its email domain, but the guard
only covered the sign-in entry points. /users/new was reachable with the email
prefilled - identify redirects there itself when no account exists yet - so an
SSO-managed email could still register a Bike Index account the IdP has never
heard of.

redirect_forced_saml and submitted_email move to Sessionable so both controllers
share one definition; submitted_email now also reads the sign-up form's
user[:email]. An organization whose SAML configuration isn't live yet still
falls through to the ordinary form.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: eld120

app/controllers/concerns/sessionable.rb

@@ -56,6 +56,20 @@ def authenticate_user_for_my_accounts_controller
 
   private
 
+  # SSO orgs force SSO: hand an SSO-managed email off to the IdP rather than let it sign in
+  # or sign up any other way. Redirecting halts the filter chain, so the guarded action
+  # never runs for a forced-SSO email.
+  def redirect_forced_saml
+    organization = Organization.saml_email_matching(submitted_email)
+    redirect_to saml_init_path(org_slug: organization.to_param) if organization.present?
+  end
+
+  # The email an unauthenticated request is offering up, wherever its form puts it:
+  # session[:email] signing in, user[:email] signing up, a bare :email elsewhere.
+  def submitted_email
+    params.dig(:session, :email).presence || params.dig(:user, :email).presence || params[:email]
+  end
+
   # Passwordless users are nudged to set a password, unless their organization is what signs them in.
   # UI::Alerts::FlashMessage renders the hash - it owns the copy and builds the link
   def set_sign_in_flash(user, signed_up)

app/controllers/sessions_controller.rb

@@ -119,13 +119,6 @@ def login_method_for(email)
     Organization.passwordless_email_matching(email).present? ? "magic_link" : "password"
   end
 
-  # See the before_action: hand an SSO-managed email off to the IdP. Redirecting here
-  # halts the filter chain, so the action never runs for a forced-SSO email.
-  def redirect_forced_saml
-    organization = Organization.saml_email_matching(submitted_email)
-    redirect_to saml_init_path(org_slug: organization.to_param) if organization.present?
-  end
-
   def send_magic_link_and_redirect(user)
     # Stash the remember-me choice so the emailed-link GET (which carries no form
     # params) can still honor it in sign_in_and_redirect.
@@ -134,12 +127,6 @@ def send_magic_link_and_redirect(user)
     redirect_to magic_link_sent_session_path(partner: sign_in_partner)
   end
 
-  # The three guarded actions carry the email in different params: identify/create post
-  # session[:email]; create_magic_link posts a top-level :email.
-  def submitted_email
-    params.dig(:session, :email).presence || params[:email]
-  end
-
   def submitted_remember_me
     params.dig(:session, :remember_me).presence || params[:remember_me]
   end

app/controllers/users_controller.rb

@@ -2,6 +2,9 @@ class UsersController < ApplicationController
   include Sessionable
 
   before_action :skip_if_signed_in, only: %i[new]
+  # An SSO org owns its domain's accounts, so signing up is the IdP's job too — otherwise
+  # the sign-in guard is bypassed by whatever link or bookmark lands on the signup form.
+  before_action :redirect_forced_saml, only: %i[new create]
   before_action :find_user_from_token_for_password_reset!, only: %i[update_password_form_with_reset_token update_password_with_reset_token]
 
   def new

spec/requests/users_request_spec.rb

@@ -10,6 +10,24 @@
       expect(response).to render_template(:new)
       expect(Capybara.string(response.body)).to have_css("[data-controller='ui--forms--email'] input#user_email")
     end
+
+    context "sso organization domain" do
+      let!(:organization) do
+        FactoryBot.create(:organization_with_organization_features,
+          enabled_feature_slugs: ["saml_sso"], user_email_domain: "sso.edu")
+      end
+      let!(:saml_configuration) { FactoryBot.create(:organization_saml_configuration, :enabled, organization:) }
+
+      it "hands the prefilled email off to the IdP rather than the signup form" do
+        get "#{base_url}/new", params: {email: "student@sso.edu"}
+        expect(response).to redirect_to(saml_init_path(org_slug: organization.to_param))
+      end
+
+      it "renders for an email the org doesn't claim" do
+        get "#{base_url}/new", params: {email: "student@example.edu"}
+        expect(response).to render_template(:new)
+      end
+    end
   end
 
   describe "create" do
@@ -49,6 +67,32 @@
         expect(response).to redirect_to "https://parkit.bikehub.com/account?reauthenticate_bike_index=true"
       end
     end
+
+    context "sso organization domain" do
+      let(:email) { "student@sso.edu" }
+      let!(:organization) do
+        FactoryBot.create(:organization_with_organization_features,
+          enabled_feature_slugs: ["saml_sso"], user_email_domain: "sso.edu")
+      end
+      let!(:saml_configuration) { FactoryBot.create(:organization_saml_configuration, :enabled, organization:) }
+
+      it "forces SSO instead of creating an account the IdP doesn't know about" do
+        expect {
+          post base_url, params: {user: {email:, name: "Test name", terms_of_service: "1"}}
+        }.to_not change(User, :count)
+        expect(response).to redirect_to(saml_init_path(org_slug: organization.to_param))
+      end
+
+      context "SAML config not yet live" do
+        let(:saml_configuration) { FactoryBot.create(:organization_saml_configuration, organization:) }
+
+        it "signs up normally rather than redirecting into an unconfigured IdP" do
+          expect {
+            post base_url, params: {user: {email:, name: "Test name", terms_of_service: "1"}}
+          }.to change(User, :count).by(1)
+        end
+      end
+    end
   end
 
   describe "create with a null origin" do