feat(sso): DNS domain verification gating org SSO registration#5909

Merged

waleedlatif1 merged 18 commits into

stagingfrom

feat/sso-domain-verification

Jul 24, 2026

Commits on Jul 24, 2026

feat(sso): DNS domain verification gating org SSO registration
waleedlatif1
committed
fix(sso): harden domain verification against concurrency + fix CI lint
waleedlatif1
committed
fix(sso): re-check domain verification before provider write (TOCTOU)
waleedlatif1
committed
fix(sso): stop rotating verification token on idempotent re-add
waleedlatif1
committed
fix(sso): close register TOCTOU with compensating delete + harden edges
waleedlatif1
committed
fix(sso): redact domain tokens from non-admins + fix script stale-update
waleedlatif1
committed
docs(sso): drop unshipped enforce-SSO / auto-join copy from verified domains
waleedlatif1
committed
fix(sso): guard rollback to new providers only + Enterprise-gate domain removal
waleedlatif1
committed
fix(sso): roll back the SSO provider by row id, not logical keys
waleedlatif1
committed
chore(sso): final-review polish — trim script read, unify copy, doc migration edge
waleedlatif1
committed
fix(sso): apply attribute mapping + make SSO edit work; drop dead guard
waleedlatif1
committed
fix(sso): require null org on personal-mode provider lookups (gate bypass)
waleedlatif1
committed
fix(sso): script updates the observed provider by id, not providerId
waleedlatif1
committed
fix(sso): script upserts provider via delete-then-insert (no unique constraint)
waleedlatif1
committed
fix(sso): guard compensating-delete row id so rollback can't silently no-op
waleedlatif1
committed
Merge remote-tracking branch 'origin/staging' into feat/sso-domain-verification
waleedlatif1
committed
chore(sso): regenerate migration as 0268 after merging staging
waleedlatif1
committed
refactor(sso): share normalizeSSODomain via @sim/utils so script matches gate
waleedlatif1
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(sso): DNS domain verification gating org SSO registration#5909

feat(sso): DNS domain verification gating org SSO registration#5909
waleedlatif1 merged 18 commits into
stagingfrom
feat/sso-domain-verification

Commits on Jul 24, 2026

feat(sso): DNS domain verification gating org SSO registration

fix(sso): harden domain verification against concurrency + fix CI lint

fix(sso): re-check domain verification before provider write (TOCTOU)

fix(sso): stop rotating verification token on idempotent re-add

fix(sso): close register TOCTOU with compensating delete + harden edges

fix(sso): redact domain tokens from non-admins + fix script stale-update

docs(sso): drop unshipped enforce-SSO / auto-join copy from verified domains

fix(sso): guard rollback to new providers only + Enterprise-gate domain removal

fix(sso): roll back the SSO provider by row id, not logical keys

chore(sso): final-review polish — trim script read, unify copy, doc migration edge

fix(sso): apply attribute mapping + make SSO edit work; drop dead guard

fix(sso): require null org on personal-mode provider lookups (gate bypass)

fix(sso): script updates the observed provider by id, not providerId

fix(sso): script upserts provider via delete-then-insert (no unique constraint)

fix(sso): guard compensating-delete row id so rollback can't silently no-op

Merge remote-tracking branch 'origin/staging' into feat/sso-domain-verification

chore(sso): regenerate migration as 0268 after merging staging

refactor(sso): share normalizeSSODomain via @sim/utils so script matches gate