fix(auth): address SSO/SCIM review feedback

Follow-up to #2924. Implements the actionable review feedback from that PR:

SCIM (apps/api/src/routes/scim.ts)
- Scope GET/PUT/PATCH/DELETE /Users/:id and group membership to the token's
  org so a token can't read or mutate users outside its tenant.
- Honor `active: false` on user create (staged/suspended assignments no longer
  get org membership).
- Recompute roles when a user is reactivated via PUT/PATCH and when a group is
  renamed, so mapped admin/owner members aren't left as developer.
- Guard against removing the org's last owner during deprovisioning.
- Link the SSO provider account for pre-existing users, not just new ones.
- Enforce displayName uniqueness on group rename (PUT/PATCH).
- Push /Users and /Groups filtering + pagination into the database.

SSO management (apps/api/src/routes/sso.ts)
- Block plugin bypass: the raw Better Auth /auth/sso management endpoints are
  now rejected at the HTTP handler (they only require a session).
- Prevent admins (non-owners) from creating owner role mappings.
- Recompute affected members when a role mapping is added or removed.
- Guard against a missing provider row after registration and clean up orphans.
- Clear SCIM tokens' stale provider link when a connection is deleted.
- Derive the SCIM token's provider link from the org's connection.
- Audit SCIM revoke against the token id, not the org id.

Auth enforcement (apps/api/src/auth/config.ts)
- Gate SSO enforcement on SSO_ENABLED and on an active, enterprise org.
- On a blocked non-SSO login, delete only that session, not all of the user's.

UI (apps/ui)
- Preserve the ?redirect= target and surface thrown errors on SSO sign-in.
- Confirm before destructive SSO/SCIM actions; only toast on successful copy;
  show a loading state until the org plan resolves.

Shared role-recompute logic extracted to apps/api/src/lib/sso-roles.ts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: steebchen

apps/api/src/auth/config.ts

@@ -33,19 +33,44 @@ const isHosted = process.env.HOSTED === "true";
 async function isSSOEnforcedForEmail(
 	email: string | null | undefined,
 ): Promise<boolean> {
+	// Keep enforcement tied to the same flag that surfaces the SSO sign-in entry
+	// point: with SSO_ENABLED off there's no way to sign in via SSO, so blocking
+	// password/social/passkey would just lock the domain out entirely.
+	if (process.env.SSO_ENABLED !== "true") {
+		return false;
+	}
+
 	const domain = email?.trim().toLowerCase().split("@")[1];
 	if (!domain) {
 		return false;
 	}
 	const providers = await db.query.ssoProvider.findMany({
 		where: { enforced: { eq: true } },
-		columns: { domain: true },
+		columns: { domain: true, organizationId: true },
+	});
+	const matching = providers.filter(
+		(provider) =>
+			provider.organizationId &&
+			provider.domain
+				.split(",")
+				.map((d) => d.trim().toLowerCase())
+				.includes(domain),
+	);
+	if (!matching.length) {
+		return false;
+	}
+
+	// Only an active, enterprise org can enforce SSO. A soft-deleted org can no
+	// longer be managed to turn enforcement off, so a stale enforced row must not
+	// keep blocking a domain's users forever.
+	const orgs = await db.query.organization.findMany({
+		where: {
+			id: { in: [...new Set(matching.map((p) => p.organizationId as string))] },
+		},
+		columns: { status: true, plan: true },
 	});
-	return providers.some((provider) =>
-		provider.domain
-			.split(",")
-			.map((d) => d.trim().toLowerCase())
-			.includes(domain),
+	return orgs.some(
+		(org) => org.status !== "deleted" && org.plan === "enterprise",
 	);
 }
 
@@ -1060,9 +1085,12 @@ The LLM Gateway Team`.trim();
 						!ctx.path.startsWith("/sso/") &&
 						(await isSSOEnforcedForEmail(dbUser?.email))
 					) {
+						// Delete only the session this blocked attempt just created — not
+						// every session for the user — so a rejected social/passkey login
+						// doesn't also sign them out of valid SSO sessions elsewhere.
 						await db
 							.delete(tables.session)
-							.where(eq(tables.session.userId, userId));
+							.where(eq(tables.session.id, newSession.session.id));
 						return ssoRequiredResponse();
 					}
 

apps/api/src/auth/handler.ts

@@ -7,6 +7,25 @@ import type { ServerTypes } from "@/vars.js";
 // Create a Hono app for auth routes
 export const authHandler = new OpenAPIHono<ServerTypes>();
 
+// Better Auth's sso() plugin mounts its own provider-management endpoints under
+// the /auth/* catch-all. They only require a session (any authenticated user),
+// so exposing them would let a user bypass the enterprise/admin-gated /sso
+// wrapper and register a provider — claiming any email domain — with no
+// organization scoping. Block direct HTTP access to them here; our server-side
+// registration calls `apiAuth.api.registerSSOProvider` directly and never goes
+// through this handler, so it is unaffected. The SAML sign-in/callback/metadata
+// endpoints (/auth/sso/saml2/*, /auth/sso/callback, /auth/sign-in/sso) are left
+// reachable because the login flow needs them.
+const BLOCKED_SSO_PLUGIN_PATHS = new Set([
+	"/auth/sso/register",
+	"/auth/sso/update-provider",
+	"/auth/sso/delete-provider",
+	"/auth/sso/get-provider",
+	"/auth/sso/providers",
+	"/auth/sso/request-domain-verification",
+	"/auth/sso/verify-domain",
+]);
+
 authHandler.use("*", async (c, next) => {
 	const session = await apiAuth.api.getSession({ headers: c.req.raw.headers });
 
@@ -22,5 +41,8 @@ authHandler.use("*", async (c, next) => {
 });
 
 authHandler.on(["POST", "GET"], "/auth/*", (c) => {
+	if (BLOCKED_SSO_PLUGIN_PATHS.has(new URL(c.req.url).pathname)) {
+		return c.json({ error: "not_found", message: "Not found" }, 404);
+	}
 	return apiAuth.handler(c.req.raw);
 });

apps/api/src/lib/sso-roles.ts

@@ -0,0 +1,111 @@
+import { db, eq, tables } from "@llmgateway/db";
+
+export type OrgRole = "owner" | "admin" | "developer";
+
+export interface RoleChange {
+	old: OrgRole;
+	new: OrgRole;
+}
+
+const ROLE_RANK: Record<OrgRole, number> = {
+	developer: 1,
+	admin: 2,
+	owner: 3,
+};
+
+// Recompute an org member's role from their SCIM group memberships and the
+// org's group->role mappings. The highest-precedence mapped role wins; the
+// default is `developer`. Owners are never auto-demoted — owner is only ever
+// assigned manually (or by an explicit owner mapping), so an admin who set up
+// SSO can't be locked out by a group that maps to a lower role.
+//
+// Returns the {old,new} role change when it updated the membership, or null
+// when nothing changed, so callers (e.g. SCIM) can audit the transition.
+export async function recomputeUserRole(
+	userId: string,
+	organizationId: string,
+): Promise<RoleChange | null> {
+	const membership = await db.query.userOrganization.findFirst({
+		where: {
+			userId: { eq: userId },
+			organizationId: { eq: organizationId },
+		},
+		columns: { id: true, role: true },
+	});
+	if (!membership) {
+		return null;
+	}
+
+	const groupMemberships = await db.query.scimGroupMember.findMany({
+		where: { userId: { eq: userId } },
+		columns: { scimGroupId: true },
+	});
+	const groupIds = groupMemberships.map((m) => m.scimGroupId);
+
+	let mappedRole: OrgRole = "developer";
+	if (groupIds.length) {
+		const groups = await db.query.scimGroup.findMany({
+			where: {
+				id: { in: groupIds },
+				organizationId: { eq: organizationId },
+			},
+			columns: { displayName: true },
+		});
+		const names = groups.map((g) => g.displayName);
+		if (names.length) {
+			const mappings = await db.query.ssoRoleMapping.findMany({
+				where: {
+					organizationId: { eq: organizationId },
+					groupName: { in: names },
+				},
+				columns: { role: true },
+			});
+			for (const mapping of mappings) {
+				if (ROLE_RANK[mapping.role] > ROLE_RANK[mappedRole]) {
+					mappedRole = mapping.role;
+				}
+			}
+		}
+	}
+
+	if (membership.role === "owner" && ROLE_RANK[mappedRole] < ROLE_RANK.owner) {
+		return null;
+	}
+	if (membership.role !== mappedRole) {
+		await db
+			.update(tables.userOrganization)
+			.set({ role: mappedRole })
+			.where(eq(tables.userOrganization.id, membership.id));
+		return { old: membership.role, new: mappedRole };
+	}
+	return null;
+}
+
+// Recompute the role of every member of the SCIM group(s) with `groupName` in
+// this org. Used when a role mapping is added or removed after the IdP has
+// already pushed the group and its members, so existing members pick up (or
+// lose) the mapped role without waiting for a later SCIM membership event.
+export async function recomputeRoleForGroupName(
+	organizationId: string,
+	groupName: string,
+) {
+	const groups = await db.query.scimGroup.findMany({
+		where: {
+			organizationId: { eq: organizationId },
+			displayName: { eq: groupName },
+		},
+		columns: { id: true },
+	});
+	if (!groups.length) {
+		return;
+	}
+
+	const members = await db.query.scimGroupMember.findMany({
+		where: { scimGroupId: { in: groups.map((g) => g.id) } },
+		columns: { userId: true },
+	});
+	const userIds = [...new Set(members.map((m) => m.userId))];
+	for (const userId of userIds) {
+		await recomputeUserRole(userId, organizationId);
+	}
+}