fix(sso): keep a signed-in visitor going to the app when the launch address is rate limited

Author: waleedlatif1

apps/sim/app/(auth)/sso/launch/[providerId]/route.test.ts

@@ -75,6 +75,16 @@ describe('GET /sso/launch/[providerId]', () => {
     expect(mockSignInSSO).not.toHaveBeenCalled()
   })
 
+  it('keeps sending a signed-in visitor to the app when the address is rate limited', async () => {
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockEnforceIpRateLimit.mockResolvedValue(new Response(null, { status: 429 }))
+
+    const response = await open()
+
+    expect(response.headers.get('location')).toBe('https://test.sim.ai/home')
+    expect(mockEnforceIpRateLimit).not.toHaveBeenCalled()
+  })
+
   it.each([
     ['no issuer', '', () => undefined],
     [
@@ -105,8 +115,8 @@ describe('GET /sso/launch/[providerId]', () => {
     const response = await open()
 
     expect(response.headers.get('location')).toBe(SIGN_IN_LINK)
-    expect(mockGetSession).not.toHaveBeenCalled()
     expect(mockIsAllowed).not.toHaveBeenCalled()
+    expect(mockSignInSSO).not.toHaveBeenCalled()
   })
 
   it('leaves SSO off when the deployment has not enabled it', async () => {

apps/sim/app/(auth)/sso/launch/[providerId]/route.ts

@@ -30,18 +30,19 @@ export const GET = withRouteHandler(async (request: NextRequest, context: RouteC
   ).toString()
   if (!isSsoEnabled) return NextResponse.redirect(new URL('/login', getBaseUrl()).toString())
 
+  const session = await getSession()
+  if (session?.user) {
+    return NextResponse.redirect(new URL(DEFAULT_POST_AUTH_ROUTE, getBaseUrl()).toString())
+  }
+
+  /** Admitted per address, after the session, so a busy shared address never strands a signed-in visitor. */
   const rateLimited = await enforceIpRateLimit('sso-launch', request, {
     maxTokens: 30,
     refillRate: 30,
     refillIntervalMs: 60_000,
   })
   if (rateLimited) return NextResponse.redirect(signInLink)
 
-  const session = await getSession()
-  if (session?.user) {
-    return NextResponse.redirect(new URL(DEFAULT_POST_AUTH_ROUTE, getBaseUrl()).toString())
-  }
-
   const issuer = request.nextUrl.searchParams.get('iss')
   if (!issuer || !(await isIdpInitiatedLoginAllowed(providerId, issuer))) {
     return NextResponse.redirect(signInLink)