improvement(sso): redirect straight to the identity provider from the launch URL

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/sso.mdx

@@ -309,7 +309,7 @@ Once SSO is configured, users with your domain (`company.com`) can sign in throu
 5. If **First sign-in** is **Automatic**, Sim adds them to the organization as a Member, growing a Team seat count or validating available fixed-seat capacity
 6. They land in an accessible workspace, or see a clear no-access state until an admin grants workspace access
 
-People can also open Sim straight from an OIDC identity provider's app dashboard, such as the Okta tile. Open **Sign-in**, select the provider, and copy its **Initiate login URL** from **Identity provider**. Set it as the app's initiate login URI in your identity provider. Sim starts sign-in through that provider without asking for an email, and only when the provider's domain is verified and the request comes from its own issuer. People who are already signed in go straight to Sim. The dashboard sends your organization's issuer, so a provider registered with a custom authorization server issuer falls back to the email sign-in page.
+People can also open Sim straight from an OIDC identity provider's app dashboard, such as the Okta tile. Open **Sign-in**, select the provider, and copy its **Initiate login URL** from **Identity provider**. Set it as the app's initiate login URI in your identity provider. Sim starts sign-in through that provider without asking for an email, and only when the provider's domain is verified and the request comes from its own issuer. People who are already signed in go straight to Sim.
 
 With **Automatic** provisioning, no invitation is required for organization membership. The join follows the organization's seat policy and does not infer a role from IdP claims: every newly provisioned user starts as a Member. Team subscriptions grow their billed seat count with membership; fixed-seat plans reject the join when capacity is full. With **Invite only**, SSO proves identity but does not create new membership or workspace access; new access must be granted separately, while existing organization membership and workspace access remain available.
 

apps/sim/app/(auth)/sso/launch/[providerId]/page.test.tsx

@@ -0,0 +1,120 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest, setEnvFlags } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockGetSession, mockSignInSSO, mockIsAllowed, mockEnforceIpRateLimit } = vi.hoisted(() => ({
+  mockGetSession: vi.fn(),
+  mockSignInSSO: vi.fn(),
+  mockIsAllowed: vi.fn(),
+  mockEnforceIpRateLimit: vi.fn(),
+}))
+
+vi.mock('@/lib/auth', () => ({
+  getSession: mockGetSession,
+  auth: { api: { signInSSO: mockSignInSSO } },
+}))
+vi.mock('@/lib/auth/sso/idp-initiated-login', () => ({ isIdpInitiatedLoginAllowed: mockIsAllowed }))
+vi.mock('@/lib/core/rate-limiter', () => ({ enforceIpRateLimit: mockEnforceIpRateLimit }))
+
+import { GET } from '@/app/(auth)/sso/launch/[providerId]/route'
+
+const context = { params: Promise.resolve({ providerId: 'acme-okta' }) }
+const ISSUER = 'https://acme.okta.test'
+const SIGN_IN_LINK = 'https://test.sim.ai/sso?provider=acme-okta'
+
+function open(search = `?iss=${encodeURIComponent(ISSUER)}`) {
+  return GET(
+    createMockRequest('GET', undefined, {}, `https://test.sim.ai/sso/launch/acme-okta${search}`),
+    context
+  )
+}
+
+/** Better Auth answers with the authorization URL and the signed `state` cookie for it. */
+function authorizationResponse() {
+  return new Response(JSON.stringify({ url: 'https://acme.okta.test/oauth2/v1/authorize?x=1' }), {
+    status: 200,
+    headers: { 'content-type': 'application/json', 'set-cookie': 'sso_state=abc; Path=/' },
+  })
+}
+
+describe('GET /sso/launch/[providerId]', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    setEnvFlags({ isSsoEnabled: true })
+    mockGetSession.mockResolvedValue(null)
+    mockIsAllowed.mockResolvedValue(true)
+    mockEnforceIpRateLimit.mockResolvedValue(null)
+    mockSignInSSO.mockResolvedValue(authorizationResponse())
+  })
+
+  it("redirects to the identity provider and carries Better Auth's state cookie", async () => {
+    const response = await open()
+
+    expect(response.status).toBe(307)
+    expect(response.headers.get('location')).toBe('https://acme.okta.test/oauth2/v1/authorize?x=1')
+    expect(response.headers.get('set-cookie')).toContain('sso_state=abc')
+    expect(mockIsAllowed).toHaveBeenCalledWith('acme-okta', ISSUER)
+    const [{ body }] = mockSignInSSO.mock.calls[0]
+    expect(body.providerId).toBe('acme-okta')
+    expect(body).not.toHaveProperty('email')
+    /** The plugin appends `?error=…`, which must not corrupt the provider on the way back. */
+    const retry = new URL(`${body.errorCallbackURL}?error=invalid_provider`)
+    expect(retry.pathname).toBe('/sso')
+    expect(retry.searchParams.get('provider')).toBe('acme-okta')
+  })
+
+  it('sends someone already signed in to the app without signing in again', async () => {
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+
+    const response = await open()
+
+    expect(response.headers.get('location')).toBe('https://test.sim.ai/home')
+    expect(mockIsAllowed).not.toHaveBeenCalled()
+    expect(mockSignInSSO).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    ['no issuer', '', () => undefined],
+    [
+      'an issuer the provider does not use',
+      `?iss=${encodeURIComponent('https://other.test')}`,
+      () => mockIsAllowed.mockResolvedValue(false),
+    ],
+  ])("sends a visitor with %s to the provider's sign-in link", async (_label, search, arrange) => {
+    arrange()
+
+    const response = await open(search)
+
+    expect(response.headers.get('location')).toBe(SIGN_IN_LINK)
+    expect(mockSignInSSO).not.toHaveBeenCalled()
+  })
+
+  it("falls back to the provider's sign-in link when sign-in cannot start", async () => {
+    mockSignInSSO.mockResolvedValue(new Response('{}', { status: 400 }))
+
+    const response = await open()
+
+    expect(response.headers.get('location')).toBe(SIGN_IN_LINK)
+  })
+
+  it('sends a rate-limited visitor to the sign-in link before any lookup', async () => {
+    mockEnforceIpRateLimit.mockResolvedValue(new Response(null, { status: 429 }))
+
+    const response = await open()
+
+    expect(response.headers.get('location')).toBe(SIGN_IN_LINK)
+    expect(mockGetSession).not.toHaveBeenCalled()
+    expect(mockIsAllowed).not.toHaveBeenCalled()
+  })
+
+  it('leaves SSO off when the deployment has not enabled it', async () => {
+    setEnvFlags({ isSsoEnabled: false })
+
+    const response = await open()
+
+    expect(response.headers.get('location')).toBe('https://test.sim.ai/login')
+    expect(mockEnforceIpRateLimit).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/(auth)/sso/launch/[providerId]/page.tsx

@@ -0,0 +1,80 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { auth, getSession } from '@/lib/auth'
+import { isIdpInitiatedLoginAllowed } from '@/lib/auth/sso/idp-initiated-login'
+import { isSsoEnabled } from '@/lib/core/config/env-flags'
+import { enforceIpRateLimit } from '@/lib/core/rate-limiter'
+import { getBaseUrl } from '@/lib/core/utils/urls'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { DEFAULT_POST_AUTH_ROUTE } from '@/app/(auth)/auth-redirect'
+
+const logger = createLogger('SSOLaunchRoute')
+
+type RouteContext = { params: Promise<{ providerId: string }> }
+
+/**
+ * The initiate login URL an identity provider's app dashboard opens (OpenID Connect third-party
+ * initiated login). The dashboard adds its issuer as `iss`, so the URL carries no query of its own.
+ *
+ * Sign-in starts here rather than on the sign-in page: the visitor arrives to be sent onward, and a
+ * redirect spares them a page load and a hydration wait first. Someone already signed in goes
+ * straight to the app, so a link cannot replace their session. Anything else — an unknown issuer, a
+ * provider this deployment does not serve, a refused sign-in — falls back to the provider's ordinary
+ * sign-in link, which asks for an email.
+ */
+export const GET = withRouteHandler(async (request: NextRequest, context: RouteContext) => {
+  const { providerId } = await context.params
+  const signInLink = new URL(
+    `/sso?provider=${encodeURIComponent(providerId)}`,
+    getBaseUrl()
+  ).toString()
+  if (!isSsoEnabled) return NextResponse.redirect(new URL('/login', getBaseUrl()).toString())
+
+  const rateLimited = await enforceIpRateLimit('sso-launch', request, {
+    maxTokens: 30,
+    refillRate: 30,
+    refillIntervalMs: 60_000,
+  })
+  if (rateLimited) return NextResponse.redirect(signInLink)
+
+  const session = await getSession()
+  if (session?.user) {
+    return NextResponse.redirect(new URL(DEFAULT_POST_AUTH_ROUTE, getBaseUrl()).toString())
+  }
+
+  const issuer = request.nextUrl.searchParams.get('iss')
+  if (!issuer || !(await isIdpInitiatedLoginAllowed(providerId, issuer))) {
+    return NextResponse.redirect(signInLink)
+  }
+
+  /**
+   * A failed sign-in returns to the provider's sign-in link with the error. `callbackUrl` comes
+   * last because the SSO plugin appends its own error with a raw `?`, which runs into whichever
+   * parameter is last — there it is harmless, on `provider` it would corrupt the retry.
+   */
+  const errorCallbackURL = new URL(
+    `/sso?error=sso_failed&provider=${encodeURIComponent(providerId)}&callbackUrl=${encodeURIComponent(DEFAULT_POST_AUTH_ROUTE)}`,
+    getBaseUrl()
+  ).toString()
+  const signIn = await auth.api.signInSSO({
+    body: { providerId, callbackURL: DEFAULT_POST_AUTH_ROUTE, errorCallbackURL },
+    headers: request.headers,
+    asResponse: true,
+  })
+  const payload = (await signIn.json().catch(() => null)) as { url?: string } | null
+  if (!signIn.ok || !payload?.url) {
+    logger.error('SSO sign-in did not return an authorization URL', {
+      providerId,
+      status: signIn.status,
+    })
+    return NextResponse.redirect(signInLink)
+  }
+
+  const response = NextResponse.redirect(payload.url)
+  /** Better Auth's signed `state` cookie has to reach the browser before the identity provider does. */
+  const signInHeaders = signIn.headers as Headers & { getSetCookie?: () => string[] }
+  for (const cookie of signInHeaders.getSetCookie?.() ?? []) {
+    response.headers.append('set-cookie', cookie)
+  }
+  return response
+})