feat(sso): several identity providers per organization

[waleedlatif1]

Summary

• An organization can run several identity providers at once, one per verified domain (e.g. Okta for eng.acme.com, Entra ID for acme.com)
• Sign-in resolves the provider for the email domain server-side (POST /api/auth/sso/resolve, verified domains only) and passes providerId to Better Auth instead of relying on its unordered domain lookup
• One provider per domain is enforced at the database: migration 0333_sso_provider_org_domain_unique adds a partial unique index on sso_provider (organization_id, normalized domain), built concurrently behind a duplicate pre-check (production has none). Registration checks first for a clear 409 (SSO_DOMAIN_ALREADY_ROUTED) and maps a lost race to the same response
• New DELETE /api/auth/sso/providers/[providerId] (Sim-owned; the plugin's delete stays blocked). Org owners/admins delete org providers, creators delete personal ones. Accounts and memberships are untouched
• Settings sign-in tab lists providers (ordered), opens one via ?provider=, adds another, deletes with confirmation; an org with none goes straight to the form
• JIT admissions record providerId in audit metadata
• Docs: multiple providers, domain routing, deletion

Type of Change

• New feature

Testing

• Full app suite, bun run check:audits, check:migrations origin/staging, type-check, docs-manifest:check, check:openapi
• New tests: resolve route, delete route, registration guard, sign-in form provider naming and 404-only "no provider" message, settings list/add/detail/delete
• Better Auth SSO plugin traced end to end for the explicit-providerId path (sign-in, OIDC and SAML callbacks, catch-all deny list, in-flight sign-ins after delete); no live IdP run

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 9, 2026 6:17pm UTC

[greptile-apps]

Confidence Score: 2/5

The PR is not yet safe to merge because provider routing can select unverified claims, concurrent registration can create ambiguous domain routes, and some authorized self-hosted administrators cannot access the new management UI.

Findings

1.  Unverified providers are resolved ▶
2.  Domain routing check races ▶
3.  Authorized admins lose controls ▶
4.  Route bypasses operation boundary ▶

Summary

• Introduces a public email-domain resolver and passes its selected provider explicitly into SSO sign-in.
• Adds organization-aware provider deletion and multi-provider settings UI.
• Rejects a second provider for an already-routed domain during registration.
• Documents multi-provider routing and deletion behavior.
• The current implementation still routes through unverified providers, does not atomically enforce domain uniqueness, and hides management controls from some self-hosted organization administrators.

Diagram

sequenceDiagram
  actor User
  participant UI as SSO sign-in form
  participant Resolver as POST /api/auth/sso/resolve
  participant DB as sso_provider
  participant Auth as Better Auth SSO
  participant IdP as Selected identity provider
  participant Admission as SSO admission use case

  User->>UI: Enter work email
  UI->>Resolver: Resolve email domain
  Resolver->>DB: Find domain claim
  DB-->>Resolver: providerId
  Resolver-->>UI: providerId and protocol
  UI->>Auth: signIn.sso(email, providerId)
  Auth->>IdP: Redirect for authentication
  IdP-->>Auth: SSO callback
  Auth->>Admission: Admit user for providerId
  Admission->>DB: Verify provider trust and organization
  Admission-->>Auth: Admit or reject

Loading

[waleedlatif1]

@greptile