feat(sso): DNS domain verification gating org SSO registration - #5909

Merged

waleedlatif1 merged 18 commits into

stagingfrom

feat/sso-domain-verification

Jul 24, 2026

Commits on Jul 24, 2026

feat(sso): DNS domain verification gating org SSO registration
waleedlatif1
committed
5f9f3e6
fix(sso): harden domain verification against concurrency + fix CI lint
waleedlatif1
committed
c27a28a
fix(sso): re-check domain verification before provider write (TOCTOU)
waleedlatif1
committed
6fc3224
fix(sso): stop rotating verification token on idempotent re-add
waleedlatif1
committed
16f92b5
fix(sso): close register TOCTOU with compensating delete + harden edges
waleedlatif1
committed
1995af7
fix(sso): redact domain tokens from non-admins + fix script stale-update
waleedlatif1
committed
99b4f13
docs(sso): drop unshipped enforce-SSO / auto-join copy from verified domains
waleedlatif1
committed
64fceab
fix(sso): guard rollback to new providers only + Enterprise-gate domain removal
waleedlatif1
committed
1e33e89
fix(sso): roll back the SSO provider by row id, not logical keys
waleedlatif1
committed
44bf72c
chore(sso): final-review polish — trim script read, unify copy, doc migration edge
waleedlatif1
committed
98c54f6
fix(sso): apply attribute mapping + make SSO edit work; drop dead guard
waleedlatif1
committed
b4c7a34
fix(sso): require null org on personal-mode provider lookups (gate bypass)
waleedlatif1
committed
bb9637a
fix(sso): script updates the observed provider by id, not providerId
waleedlatif1
committed
464e7e0
fix(sso): script upserts provider via delete-then-insert (no unique constraint)
waleedlatif1
committed
b37655e
fix(sso): guard compensating-delete row id so rollback can't silently no-op
waleedlatif1
committed
c106d87
Merge remote-tracking branch 'origin/staging' into feat/sso-domain-verification
waleedlatif1
committed
c03f389
chore(sso): regenerate migration as 0268 after merging staging
waleedlatif1
committed
dce6d63
refactor(sso): share normalizeSSODomain via @sim/utils so script matches gate
waleedlatif1
committed
085a962

Navigation Menu

Uh oh!

feat(sso): DNS domain verification gating org SSO registration - #5909

feat(sso): DNS domain verification gating org SSO registration#5909
waleedlatif1 merged 18 commits into
stagingfrom
feat/sso-domain-verification

Commits on Jul 24, 2026

feat(sso): DNS domain verification gating org SSO registration

fix(sso): harden domain verification against concurrency + fix CI lint

fix(sso): re-check domain verification before provider write (TOCTOU)

fix(sso): stop rotating verification token on idempotent re-add

fix(sso): close register TOCTOU with compensating delete + harden edges

fix(sso): redact domain tokens from non-admins + fix script stale-update

docs(sso): drop unshipped enforce-SSO / auto-join copy from verified domains

fix(sso): guard rollback to new providers only + Enterprise-gate domain removal

fix(sso): roll back the SSO provider by row id, not logical keys

chore(sso): final-review polish — trim script read, unify copy, doc migration edge

fix(sso): apply attribute mapping + make SSO edit work; drop dead guard

fix(sso): require null org on personal-mode provider lookups (gate bypass)

fix(sso): script updates the observed provider by id, not providerId

fix(sso): script upserts provider via delete-then-insert (no unique constraint)

fix(sso): guard compensating-delete row id so rollback can't silently no-op

Merge remote-tracking branch 'origin/staging' into feat/sso-domain-verification

chore(sso): regenerate migration as 0268 after merging staging

refactor(sso): share normalizeSSODomain via @sim/utils so script matches gate