feat(webapp): gate SSO on an entitlement instead of the Enterprise plan

.server-changes/sso-entitlement.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+SSO and Directory Sync are no longer restricted to Enterprise plans — get in touch and we can turn them on for your organization whatever plan you're on.

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.sso/route.tsx

@@ -39,15 +39,14 @@ import { prisma } from "~/db.server";
 import { useOrganization } from "~/hooks/useOrganizations";
 import { rbac } from "~/services/rbac.server";
 import { ssoController } from "~/services/sso.server";
-import { getCurrentPlan } from "~/services/platform.v3.server";
+import { getSsoEntitlement } from "~/services/platform.v3.server";
 import type { DirectorySyncEffect, DirectorySyncStatus, Role } from "@trigger.dev/plugins";
 import { applyDirectorySyncEffects } from "~/services/directorySyncEffects.server";
 import { flag } from "~/v3/featureFlags.server";
 import { FEATURE_FLAG } from "~/v3/featureFlags";
 import { dashboardAction, dashboardLoader } from "~/services/routeBuilders/dashboardBuilder";
 import { cn } from "~/utils/cn";
 import { throwPermissionDenied } from "~/utils/permissionDenied";
-import { useCurrentPlan } from "../_app.orgs.$organizationSlug/route";
 
 export const meta: MetaFunction = () => [{ title: "SSO & Directory Sync | Trigger.dev" }];
 
@@ -62,17 +61,10 @@ async function resolveOrg(slug: string) {
  });
 }
 
-function planAllowsSso(plan: unknown): boolean {
- if (!plan || typeof plan !== "object") return false;
- const subscription = (plan as { v3Subscription?: { plan?: { code?: string } } }).v3Subscription;
- return subscription?.plan?.code === "enterprise";
-}
-
 // Client-side upsell is cosmetic; gate real IdP mutations server-side.
 async function requireSsoEntitlement(orgId: string): Promise<void> {
- const plan = await getCurrentPlan(orgId);
- if (!planAllowsSso(plan)) {
- throw new Response("SSO requires an Enterprise plan", { status: 403 });
+ if ((await getSsoEntitlement(orgId)) !== "entitled") {
+ throw new Response("This organization is not entitled to SSO", { status: 403 });
  }
 }
 
@@ -142,16 +134,14 @@ export const loader = dashboardLoader(
  throw new Response("Not Found", { status: 404 });
  }
 
- // Not Enterprise: render the upsell for every role, skip role check +
- // queries, return empty data.
- const plan = await getCurrentPlan(orgId);
- if (!planAllowsSso(plan)) {
+ if ((await getSsoEntitlement(orgId)) !== "entitled") {
  return typedjson({
  status: EMPTY_SSO_STATUS,
  orgTitle: context.orgTitle,
  jitRoles: [] as Role[],
  directorySync: EMPTY_DIRECTORY_SYNC_STATUS,
  hasSso: false,
+ isEntitled: false,
  });
  }
 
@@ -182,6 +172,7 @@ export const loader = dashboardLoader(
  jitRoles,
  directorySync,
  hasSso,
+ isEntitled: true,
  });
  }
 );
@@ -374,11 +365,10 @@ function useOverrideDraft<T>(serverValue: T): {
 }
 
 export default function Page() {
- const { status, orgTitle, jitRoles, directorySync, hasSso } = useTypedLoaderData<typeof loader>();
+ const { status, orgTitle, jitRoles, directorySync, hasSso, isEntitled } =
+ useTypedLoaderData<typeof loader>();
  const organization = useOrganization();
- const _plan = useCurrentPlan();
 
- const isEntitled = planAllowsSso(_plan);
  const activeConnections = status.connections.filter((c) => c.state === "active");
  const hasActive = activeConnections.length > 0;
 

apps/webapp/app/services/directorySyncEffects.server.ts

@@ -8,6 +8,7 @@ import {
  removeOrgMemberForDirectory,
 } from "~/models/orgMember.server";
 import { createPlatformNotification } from "~/services/platformNotifications.server";
+import { getSsoEntitlement, type SsoEntitlement } from "~/services/platform.v3.server";
 
 const LAST_OWNER_NOTIFICATION_TITLE = "Directory Sync: last Owner protected";
 
@@ -145,8 +146,37 @@ async function applyEffect(effect: DirectorySyncEffect): Promise<void> {
  }
 }
 
+/**
+ * Applies membership effects, skipping any org that isn't entitled to SSO.
+ *
+ * An unreadable entitlement throws rather than skipping: effects are
+ * idempotent and the worker retries, so retrying is lossless where dropping
+ * would silently lose a directory change.
+ */
 export async function applyDirectorySyncEffects(effects: DirectorySyncEffect[]): Promise<void> {
+ const entitlements = new Map<string, SsoEntitlement>();
+
  for (const effect of effects) {
+ let entitlement = entitlements.get(effect.organizationId);
+ if (entitlement === undefined) {
+ entitlement = await getSsoEntitlement(effect.organizationId);
+ entitlements.set(effect.organizationId, entitlement);
+ }
+
+ if (entitlement === "unknown") {
+ throw retryableEffectError(
+ `directory sync: could not read the SSO entitlement for organization ${effect.organizationId}`
+ );
+ }
+
+ if (entitlement === "not_entitled") {
+ logger.warn("Directory Sync: skipping effect for org without the SSO entitlement", {
+ organizationId: effect.organizationId,
+ kind: effect.kind,
+ });
+ continue;
+ }
+
  await applyEffect(effect);
  }
 }

apps/webapp/app/services/platform.v3.server.ts

@@ -196,6 +196,11 @@ function initializePlatformCache() {
  fresh: 60_000,
  stale: 120_000,
  }),
+ ssoEntitlement: new Namespace<boolean>(ctx, {
+ stores: [memory, redisCacheStore],
+ fresh: 60_000,
+ stale: 120_000,
+ }),
  });
 
  return cache;
@@ -206,12 +211,23 @@ const platformCache = singleton("platformCache", initializePlatformCache);
 function invalidateBillingLimitCaches(organizationId: string) {
  platformCache.billingLimit.remove(organizationId).catch(() => {});
  platformCache.entitlement.remove(organizationId).catch(() => {});
+ platformCache.ssoEntitlement.remove(organizationId).catch(() => {});
 }
 
 export function bustBillingLimitCaches(organizationId: string) {
  invalidateBillingLimitCaches(organizationId);
 }
 
+/**
+ * Clears the caches whose value is derived from the org's plan. Call after a
+ * plan change — a downgrade can revoke SSO, and serving the previous decision
+ * for the stale TTL would keep a surface open that the new plan doesn't allow.
+ */
+function invalidatePlanDerivedCaches(organizationId: string) {
+ platformCache.entitlement.remove(organizationId).catch(() => {});
+ platformCache.ssoEntitlement.remove(organizationId).catch(() => {});
+}
+
 // Clear the cached promo-credits read so a just-granted code shows on the usage
 // page immediately rather than after the stale TTL.
 export function bustPromoCreditsCache(organizationId: string) {
@@ -537,7 +553,7 @@ export async function setPlan(
  case "free_connected": {
  // Selecting Free provisions the plan directly, so any free result is a success.
  opts?.invalidateBillingCache?.(organization.id);
-platformCache.entitlement.remove(organization.id).catch(() => {});
+invalidatePlanDerivedCaches(organization.id);
  const response = redirect(newProjectPath(organization, "You're on the Free plan."));
  await opts?.onFreePlanProvisioned?.(response);
  return response;
@@ -548,13 +564,13 @@ export async function setPlan(
  case "updated_subscription": {
  // Invalidate billing cache since subscription changed
  opts?.invalidateBillingCache?.(organization.id);
-platformCache.entitlement.remove(organization.id).catch(() => {});
+invalidatePlanDerivedCaches(organization.id);
  return redirectWithSuccessMessage(callerPath, request, "Subscription updated successfully.");
  }
  case "canceled_subscription": {
  // Invalidate billing cache since subscription was canceled
  opts?.invalidateBillingCache?.(organization.id);
-platformCache.entitlement.remove(organization.id).catch(() => {});
+invalidatePlanDerivedCaches(organization.id);
  return redirectWithSuccessMessage(callerPath, request, "Subscription canceled.");
  }
  }
@@ -757,6 +773,52 @@ export async function getEntitlement(
  return result.val;
 }
 
+export type SsoEntitlement = "entitled" | "not_entitled" | "unknown";
+
+/**
+ * Whether an org may configure and use SSO / Directory Sync.
+ *
+ * `unknown` means billing was configured but unreadable — callers decide:
+ * read paths show the upsell, mutations refuse, and the directory-sync
+ * worker throws so the effect is retried rather than silently dropped.
+ *
+ * Self-hosted deployments have no billing service, so the plugin's presence
+ * (plus the kill switch) is the only gate and this returns `entitled`.
+ *
+ * Loader errors are swallowed inside the loader for the same reason as
+ * `getEntitlement`: @unkey/cache passes the loader promise to waitUntil()
+ * with no .catch(), and returning undefined stops a transient billing
+ * failure from being cached as an access decision. The SWR read is guarded
+ * too, so a cache-infra failure resolves to `unknown` rather than rejecting
+ * into the settings loader and the directory-sync worker.
+ */
+export async function getSsoEntitlement(organizationId: string): Promise<SsoEntitlement> {
+ if (!client) return "entitled";
+
+ try {
+ const result = await platformCache.ssoEntitlement.swr(organizationId, async () => {
+ try {
+ const response = await client.currentPlan(organizationId);
+ if (!response.success) {
+ recordPlatformFailure("getSsoEntitlement", "no_success");
+ return undefined;
+ }
+ return response.v3Subscription?.plan?.limits?.hasSso === true;
+ } catch (_e) {
+ recordPlatformFailure("getSsoEntitlement", "caught");
+ return undefined;
+ }
+ });
+
+ if (result.err || result.val === undefined) return "unknown";
+
+ return result.val ? "entitled" : "not_entitled";
+ } catch (_e) {
+ recordPlatformFailure("getSsoEntitlement", "caught");
+ return "unknown";
+ }
+}
+
 export type PromoCreditsData = {
  grantedCents: number;
  remainingCents: number;

apps/webapp/package.json

@@ -117,7 +117,7 @@
  "@trigger.dev/core": "workspace:*",
  "@trigger.dev/database": "workspace:*",
  "@trigger.dev/otlp-importer": "workspace:*",
- "@trigger.dev/platform": "1.2.0",
+ "@trigger.dev/platform": "1.3.0",
  "@trigger.dev/plugins": "workspace:*",
  "@trigger.dev/rbac": "workspace:*",
  "@trigger.dev/redis-worker": "workspace:*",

apps/webapp/test/directorySyncEffects.server.test.ts

@@ -0,0 +1,130 @@
+import type { DirectorySyncEffect } from "@trigger.dev/plugins";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("~/db.server", () => ({ prisma: {}, $replica: {} }));
+vi.mock("~/services/platformNotifications.server", () => ({
+ createPlatformNotification: vi.fn(),
+}));
+
+const getSsoEntitlement = vi.fn();
+vi.mock("~/services/platform.v3.server", async (importOriginal) => {
+ const actual = (await importOriginal()) as Record<string, unknown>;
+ return { ...actual, getSsoEntitlement: (orgId: string) => getSsoEntitlement(orgId) };
+});
+
+const setUserRole = vi.fn();
+vi.mock("~/services/rbac.server", () => ({
+ rbac: { setUserRole: (a: unknown) => setUserRole(a) },
+}));
+
+const ensureOrgMember = vi.fn();
+const ensureUserForDirectory = vi.fn();
+const removeOrgMemberForDirectory = vi.fn();
+vi.mock("~/models/orgMember.server", () => ({
+ ensureOrgMember: (a: unknown) => ensureOrgMember(a),
+ ensureUserForDirectory: (a: unknown) => ensureUserForDirectory(a),
+ removeOrgMemberForDirectory: (a: unknown) => removeOrgMemberForDirectory(a),
+}));
+
+import { applyDirectorySyncEffects } from "~/services/directorySyncEffects.server";
+
+const ENTITLED_ORG = "org_entitled";
+const UNENTITLED_ORG = "org_unentitled";
+
+function provision(organizationId: string, email = "someone@acme.com"): DirectorySyncEffect {
+ return {
+ kind: "provision",
+ userId: "user_1",
+ email,
+ firstName: null,
+ lastName: null,
+ organizationId,
+ roleId: null,
+ };
+}
+
+function deprovision(organizationId: string): DirectorySyncEffect {
+ return { kind: "deprovision", userId: "user_1", organizationId };
+}
+
+describe("applyDirectorySyncEffects — SSO entitlement gate", () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ ensureOrgMember.mockResolvedValue(undefined);
+ removeOrgMemberForDirectory.mockResolvedValue({ removed: true });
+ setUserRole.mockResolvedValue({ ok: true });
+ });
+
+ it("applies effects for an entitled org", async () => {
+ getSsoEntitlement.mockResolvedValue("entitled");
+
+ await applyDirectorySyncEffects([provision(ENTITLED_ORG)]);
+
+ expect(ensureOrgMember).toHaveBeenCalledTimes(1);
+ expect(ensureOrgMember).toHaveBeenCalledWith(
+ expect.objectContaining({ organizationId: ENTITLED_ORG, source: "directory_sync" })
+ );
+ });
+
+ it("skips provisioning for an org without the entitlement", async () => {
+ getSsoEntitlement.mockResolvedValue("not_entitled");
+
+ await applyDirectorySyncEffects([provision(UNENTITLED_ORG)]);
+
+ expect(ensureOrgMember).not.toHaveBeenCalled();
+ expect(ensureUserForDirectory).not.toHaveBeenCalled();
+ });
+
+ it("skips deprovisioning too, so revocation cannot remove members", async () => {
+ getSsoEntitlement.mockResolvedValue("not_entitled");
+
+ await applyDirectorySyncEffects([deprovision(UNENTITLED_ORG)]);
+
+ expect(removeOrgMemberForDirectory).not.toHaveBeenCalled();
+ });
+
+ it("throws on an unreadable entitlement so the worker retries", async () => {
+ getSsoEntitlement.mockResolvedValue("unknown");
+
+ await expect(applyDirectorySyncEffects([provision(ENTITLED_ORG)])).rejects.toThrow(
+ /could not read the SSO entitlement/
+ );
+
+ expect(ensureOrgMember).not.toHaveBeenCalled();
+ });
+
+ it("marks the retry as a warning rather than a pageable error", async () => {
+ getSsoEntitlement.mockResolvedValue("unknown");
+
+ await applyDirectorySyncEffects([provision(ENTITLED_ORG)]).then(
+ () => expect.unreachable("should have thrown"),
+ (error) => expect(error).toMatchObject({ logLevel: "warn" })
+ );
+ });
+
+ it("resolves the entitlement once per org across a batch", async () => {
+ getSsoEntitlement.mockResolvedValue("entitled");
+
+ await applyDirectorySyncEffects([
+ provision(ENTITLED_ORG, "a@acme.com"),
+ provision(ENTITLED_ORG, "b@acme.com"),
+ provision(ENTITLED_ORG, "c@acme.com"),
+ ]);
+
+ expect(getSsoEntitlement).toHaveBeenCalledTimes(1);
+ expect(ensureOrgMember).toHaveBeenCalledTimes(3);
+ });
+
+ it("gates per org, so one unentitled org does not block another", async () => {
+ getSsoEntitlement.mockImplementation(async (orgId: string) =>
+ orgId === ENTITLED_ORG ? "entitled" : "not_entitled"
+ );
+
+ await applyDirectorySyncEffects([provision(UNENTITLED_ORG), provision(ENTITLED_ORG)]);
+
+ expect(ensureOrgMember).toHaveBeenCalledTimes(1);
+ expect(ensureOrgMember).toHaveBeenCalledWith(
+ expect.objectContaining({ organizationId: ENTITLED_ORG })
+ );
+ });
+});