fix(sso): require a session to list SSO providers

[waleedlatif1]

Summary

• GET /api/auth/sso/providers returned the domain of every configured SSO provider to unauthenticated callers. It now answers 401 without a session; signed-in callers still get their own providers, or an organization's when they're an owner/admin
• Nothing used the anonymous shape: sign-in resolves one address at a time through POST /api/auth/sso/resolve, and the settings surfaces are always signed in
• /api/auth/sso/resolve drops the unused providerType field and only returns the provider id the sign-in redirect exposes anyway. Fixed its comment, which relied on the public list existing
• Tightened the list contract to the authenticated response shape (fields that were optional only for the anonymous shape are now required)

Type of Change

• Bug fix

Testing

• New providers/route.test.ts: 401 before any DB read without a session (red against the old route), own-provider listing with the secret redacted, 403 for a non-admin org
• SSO suites 126/126, type-check, lint, check:api-validation:strict, check:audits (47) all pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 19, 2026 7:36pm UTC

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding blocking findings or newly introduced actionable issues.

Summary

This PR prevents unauthenticated callers from enumerating configured SSO-provider domains and narrows the provider-resolution response to the identifier used by sign-in.

• Requires a valid session before parsing or querying GET /api/auth/sso/providers.
• Preserves owner/admin authorization for organization-scoped provider listings and redacts OIDC client secrets.
• Removes the unused providerType field from the SSO resolution contract and response.
• Adds coverage for unauthenticated access, caller-owned listings, organization authorization, and the narrowed response shape.

Diagram

sequenceDiagram
  participant C as Client
  participant P as GET /api/auth/sso/providers
  participant A as Session
  participant DB as Database
  C->>P: Request provider list
  P->>A: getSession()
  alt No authenticated user
    P-->>C: 401 Unauthorized
  else Authenticated user
    alt organizationId supplied
      P->>DB: Verify owner/admin membership
      alt Not authorized
        P-->>C: 403 Forbidden
      else Authorized
        P->>DB: Query organization providers
      end
    else No organizationId
      P->>DB: Query caller-registered providers
    end
    P-->>C: Redacted provider list
  end

Loading

_{Reviews (3) · Last reviewed commit: "fix(sso): require a session to list SSO ..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}