fix(webapp): only lock the email field when an IdP really owns the address

The check treated any org with SSO switched on as owning every member's
email. It now requires SSO to be enforced, a live connection, and the
member's domain to be one the org has verified - which is what the
enforcement dialog promises, so contractors on other domains keep their
own address instead of being sent to an admin who can't help them.

An unreachable SSO service is now its own answer rather than being folded
into "an IdP owns this". The save is still refused, but the page says it
couldn't check instead of asserting something it doesn't know. A definite
answer from any org also wins over an org that couldn't be read, so one
unreachable org neither masks a real claim nor blocks the write alone.

Author: samejr

apps/webapp/app/routes/account._index/route.tsx

@@ -65,7 +65,7 @@ import { useFeatures } from "~/hooks/useFeatures";
 import { useHasAdminAccess, useUser } from "~/hooks/useUser";
 import { updateUserEmail, updateUserMarketingEmails, updateUserName } from "~/models/user.server";
 import { profileUpdateRateLimiter } from "~/services/profileUpdateRateLimiter.server";
-import { isSsoManagedUser } from "~/services/ssoManagedIdentity.server";
+import { type EmailOwnership, getEmailOwnership } from "~/services/ssoManagedIdentity.server";
 import {
   updateContrastPreference,
   updateIconContrastPreference,
@@ -209,7 +209,7 @@ export async function loader({ request }: LoaderFunctionArgs) {
     user.admin || (await cachedFlag({ key: "hasThemeSwitcher", defaultValue: false }));
 
   // Picks the modal only; the action re-checks before writing.
-  const isSsoManaged = await isSsoManagedUser(user.id);
+  const emailOwnership = await getEmailOwnership(user);
 
   // Null when the user has no project yet; the row hides itself.
   let sidebarContext: {
@@ -228,7 +228,7 @@ export async function loader({ request }: LoaderFunctionArgs) {
     };
   } catch {}
 
-  return json({ showThemeSwitcher, sidebarContext, isSsoManaged });
+  return json({ showThemeSwitcher, sidebarContext, emailOwnership });
 }
 
 export const action: ActionFunction = async ({ request }) => {
@@ -333,12 +333,20 @@ export const action: ActionFunction = async ({ request }) => {
     if (rateLimited) return rateLimited;
 
     // Re-checked: the loader only picked the modal.
-    if (await isSsoManagedUser(userId)) {
+    const user = await requireUser(request);
+    const ownership = await getEmailOwnership(user);
+    if (ownership === "idp") {
       return profileUpdateError(
         "Your email address is managed by your organization's identity provider.",
         403
       );
     }
+    if (ownership === "unknown") {
+      return profileUpdateError(
+        "We couldn't check your single sign-on settings just now. Please try again shortly.",
+        503
+      );
+    }
 
     const submission = EmailSchema.safeParse({ email: formData.get("email") });
     if (!submission.success) {
@@ -486,7 +494,7 @@ function EditNameButton() {
   );
 }
 
-function EditEmailButton({ isSsoManaged }: { isSsoManaged: boolean }) {
+function EditEmailButton({ ownership }: { ownership: EmailOwnership }) {
   const user = useUser();
   const [isOpen, setIsOpen] = useState(false);
   const { fetcher, error, setError, isSubmitting } = useProfileFieldUpdate({
@@ -517,12 +525,17 @@ function EditEmailButton({ isSsoManaged }: { isSsoManaged: boolean }) {
           <DialogHeader>
             <DialogTitle>Email address</DialogTitle>
           </DialogHeader>
-          {isSsoManaged ? (
+          {ownership === "idp" ? (
             <Paragraph variant="small" className="pt-2">
               Your organization uses single sign-on, so your email address is managed by your
               identity provider rather than here. To change it, ask an organization admin to update
               it for you.
             </Paragraph>
+          ) : ownership === "unknown" ? (
+            <Paragraph variant="small" className="pt-2">
+              We couldn't check your organization's single sign-on settings just now, so this can't
+              be edited yet. Please try again shortly.
+            </Paragraph>
           ) : (
             <fetcher.Form method="post">
               <input type="hidden" name="action" value="update-email" />
@@ -742,7 +755,7 @@ function CustomizeSidebarButton({
 
 export default function Page() {
   const user = useUser();
-  const { showThemeSwitcher, sidebarContext, isSsoManaged } = useLoaderData<typeof loader>();
+  const { showThemeSwitcher, sidebarContext, emailOwnership } = useLoaderData<typeof loader>();
   const themeFetcher = useFetcher();
   const contrastFetcher = useFetcher();
   const iconContrastFetcher = useFetcher();
@@ -860,7 +873,7 @@ export default function Page() {
                 <Paragraph variant="small" className="min-w-0 break-all text-right">
                   {user.email}
                 </Paragraph>
-                <EditEmailButton isSsoManaged={isSsoManaged} />
+                <EditEmailButton ownership={emailOwnership} />
               </div>
             </div>
           </div>

apps/webapp/app/services/ssoManagedIdentity.server.ts

@@ -1,44 +1,83 @@
+import type { OrgSsoStatus } from "@trigger.dev/plugins";
 import { prisma } from "~/db.server";
 import { logger } from "~/services/logger.server";
 import { ssoController } from "~/services/sso.server";
 
 /**
- * Whether an identity provider owns this user's identity rather than the user.
- * Any org they belong to counts. Fails closed: if the plugin can't answer, treat
- * the account as IdP-managed rather than allowing an unverifiable write.
+ * Who owns a user's email address.
+ *
+ * - `user`    - theirs to change.
+ * - `idp`     - an identity provider asserts it, so changing it here would break
+ *               their next login.
+ * - `unknown` - SSO couldn't be reached. Refuse the write, but don't claim an IdP
+ *               owns it.
  */
-export async function isSsoManagedUser(userId: string): Promise<boolean> {
+export type EmailOwnership = "user" | "idp" | "unknown";
+
+/**
+ * An org owns a member's email only when SSO is enforced, a connection is live,
+ * and the member's domain is one the org has verified. Enforcement alone isn't
+ * enough: members on other domains (contractors) keep their own sign-in, so
+ * their address is still theirs.
+ */
+export function idpOwnsEmailDomain(status: OrgSsoStatus, emailDomain: string): boolean {
+  if (!status.enforced) return false;
+  if (!status.connections.some((connection) => connection.state === "active")) return false;
+  return status.domains.some(
+    (domain) => domain.verified && domain.domain.toLowerCase() === emailDomain
+  );
+}
+
+function domainOf(email: string): string | undefined {
+  const domain = email.toLowerCase().trim().split("@")[1];
+  return domain || undefined;
+}
+
+export async function getEmailOwnership(user: {
+  id: string;
+  email: string;
+}): Promise<EmailOwnership> {
   if (!(await ssoController.isUsingPlugin())) {
-    return false;
+    return "user";
+  }
+
+  const emailDomain = domainOf(user.email);
+  if (!emailDomain) {
+    return "user";
   }
 
   const memberships = await prisma.orgMember.findMany({
-    where: { userId, organization: { deletedAt: null } },
+    where: { userId: user.id, organization: { deletedAt: null } },
     select: { organizationId: true },
   });
 
   if (memberships.length === 0) {
-    return false;
+    return "user";
   }
 
   const statuses = await Promise.all(
     memberships.map((membership) => ssoController.getStatus(membership.organizationId))
   );
 
+  // A definite answer from any org wins over an org we couldn't read, so one
+  // unreachable org doesn't mask a real IdP claim - or block a write on its own.
+  let unreadable = false;
+
   for (const [index, status] of statuses.entries()) {
     if (status.isErr()) {
-      logger.warn("SSO status lookup failed; treating the account as IdP-managed", {
-        userId,
+      unreadable = true;
+      logger.warn("SSO status lookup failed; can't establish email ownership", {
+        userId: user.id,
         organizationId: memberships[index].organizationId,
         reason: status.error,
       });
-      return true;
+      continue;
     }
 
-    if (status.value.hasIdpOrg && status.value.connections.some((c) => c.state === "active")) {
-      return true;
+    if (idpOwnsEmailDomain(status.value, emailDomain)) {
+      return "idp";
     }
   }
 
-  return false;
+  return unreadable ? "unknown" : "user";
 }

apps/webapp/test/ssoManagedIdentity.test.ts

@@ -0,0 +1,86 @@
+import type { OrgSsoStatus } from "@trigger.dev/plugins";
+import { describe, expect, it } from "vitest";
+import { idpOwnsEmailDomain } from "~/services/ssoManagedIdentity.server";
+
+function status(overrides: Partial<OrgSsoStatus> = {}): OrgSsoStatus {
+  return {
+    hasIdpOrg: true,
+    enforced: true,
+    jitProvisioningEnabled: false,
+    jitDefaultRoleId: null,
+    idpOrgId: "idp_123",
+    primaryConnectionId: "conn_123",
+    domains: [
+      { domain: "acme.com", verified: true, state: "verified", verificationFailedReason: null },
+    ],
+    connections: [{ id: "conn_123", name: "Okta", connectionType: "OktaSAML", state: "active" }],
+    ...overrides,
+  };
+}
+
+describe("idpOwnsEmailDomain", () => {
+  it("claims a member on a verified domain of an enforcing org", () => {
+    expect(idpOwnsEmailDomain(status(), "acme.com")).toBe(true);
+  });
+
+  it("leaves a contractor on another domain alone", () => {
+    expect(idpOwnsEmailDomain(status(), "freelance.io")).toBe(false);
+  });
+
+  it("leaves everyone alone until SSO is enforced", () => {
+    expect(idpOwnsEmailDomain(status({ enforced: false }), "acme.com")).toBe(false);
+  });
+
+  it("ignores a domain that hasn't been verified", () => {
+    expect(
+      idpOwnsEmailDomain(
+        status({
+          domains: [
+            {
+              domain: "acme.com",
+              verified: false,
+              state: "pending",
+              verificationFailedReason: null,
+            },
+          ],
+        }),
+        "acme.com"
+      )
+    ).toBe(false);
+  });
+
+  it("ignores an org with no live connection", () => {
+    expect(
+      idpOwnsEmailDomain(
+        status({
+          connections: [
+            { id: "conn_123", name: "Okta", connectionType: "OktaSAML", state: "inactive" },
+          ],
+        }),
+        "acme.com"
+      )
+    ).toBe(false);
+  });
+
+  it("matches domains case-insensitively", () => {
+    expect(
+      idpOwnsEmailDomain(
+        status({
+          domains: [
+            {
+              domain: "ACME.com",
+              verified: true,
+              state: "verified",
+              verificationFailedReason: null,
+            },
+          ],
+        }),
+        "acme.com"
+      )
+    ).toBe(true);
+  });
+
+  it("does not treat a subdomain as the verified domain", () => {
+    expect(idpOwnsEmailDomain(status(), "mail.acme.com")).toBe(false);
+  });
+});