fix(auth): correct SCIM email lookup, keep SSO redirect

Address CodeRabbit review on the follow-up PR:

- SCIM `GET /Users?filter=userName eq "…"` resolved an arbitrary org member
  and compared its email, so in multi-member orgs an existing user could be
  missed and the IdP would retry against the 409 create path. Resolve the user
  by email first, then confirm org membership. externalId lookups keep their
  DB-level filter.
- Login: carry the validated `?redirect=` target through `errorCallbackURL` so
  a failed SSO attempt returns to /login with the intended destination.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: steebchen

apps/api/src/routes/scim.ts

@@ -303,27 +303,40 @@ scim.get("/Users", async (c) => {
 	// IdPs poll with an `eq` filter to check whether a specific user already
 	// exists; resolve that with a single targeted lookup instead of scanning the
 	// whole directory.
-	if (emailFilter || externalIdFilter) {
+	if (emailFilter) {
+		// Resolve the user by email (provisioned emails are stored lowercased),
+		// then confirm they belong to this org — filtering must key off the email,
+		// not an arbitrary member row.
+		const user = await db.query.user.findFirst({
+			where: { email: { eq: emailFilter.toLowerCase() } },
+			columns: { id: true, email: true, name: true },
+		});
+		const membership = user ? await getMembership(user.id, orgId) : null;
+		const resources =
+			user && membership
+				? [toScimUser(user, true, membership.scimExternalId)]
+				: [];
+		return scimJson({
+			schemas: [SCHEMA_LIST],
+			totalResults: resources.length,
+			startIndex,
+			itemsPerPage: resources.length,
+			Resources: resources,
+		});
+	}
+
+	if (externalIdFilter) {
 		const membership = await db.query.userOrganization.findFirst({
 			where: {
 				organizationId: { eq: orgId },
-				...(externalIdFilter
-					? { scimExternalId: { eq: externalIdFilter } }
-					: {}),
+				scimExternalId: { eq: externalIdFilter },
 			},
 			columns: { scimExternalId: true },
 			with: { user: { columns: { id: true, email: true, name: true } } },
 		});
-		const match =
-			membership?.user &&
-			(!emailFilter ||
-				membership.user.email.toLowerCase() === emailFilter.toLowerCase())
-				? membership
-				: null;
-		const resources =
-			match && match.user
-				? [toScimUser(match.user, true, match.scimExternalId)]
-				: [];
+		const resources = membership?.user
+			? [toScimUser(membership.user, true, membership.scimExternalId)]
+			: [];
 		return scimJson({
 			schemas: [SCHEMA_LIST],
 			totalResults: resources.length,

apps/ui/src/app/login/page.tsx

@@ -218,12 +218,19 @@ export default function Login() {
 		WebAuthnAbortService.cancelCeremony();
 		try {
 			const origin = location.protocol + "//" + location.host;
+			// Carry the validated `?redirect=` target through the error path too, so a
+			// failed SSO attempt returns to /login with the intended destination and a
+			// retry still lands the user there.
+			const errorUrl = new URL("/login", origin);
+			if (redirectTarget !== "/dashboard") {
+				errorUrl.searchParams.set("redirect", redirectTarget);
+			}
 			const res = await signIn.sso({
 				email: parsed.data,
 				// Honor the same validated `?redirect=` target as the other sign-in
 				// methods so SSO users also land on their intended post-login route.
 				callbackURL: origin + redirectTarget,
-				errorCallbackURL: origin + "/login",
+				errorCallbackURL: errorUrl.toString(),
 			});
 			if (res?.error) {
 				toast({