fix(auth): org-scope registered SSO/SAML providers so any org admin can manage them (ADR-0024 / cloud#551)#2407
Merged
Conversation
…an manage them (ADR-0024 / cloud#551) @better-auth/sso gates ORG-LESS providers' delete/update/domain-verification on provider.userId === caller (registrar-only). The register bridges now resolve the caller's active org (best-effort /get-session re-dispatch) and scope the provider to it, so management gates on isOrgAdmin — any org owner/admin can manage the env's IdPs. Falls back to org-less when no active org (no regression). Verified E2E: form-registered OIDC provider lands with organization_id = env org (was null); register + delete still 200. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 10 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
@better-auth/sso's provider-management endpoints (delete / update / request-/verify-domain) gate org-less providers onprovider.userId === caller— so only the original registrar could delete or verify an IdP. A second org admin couldn't manage an IdP someone else registered.What
The register bridges (OIDC + SAML) now resolve the caller's active organization — best-effort, via a
/get-sessionre-dispatch through the same handler — and scope the provider to it. better-auth then gates management onisOrgAdmininstead, so any org owner/admin can manage the environment's IdPs. Falls back to org-less (no behaviour change) when no active org is set.Verification (browser E2E)
organization_id= the env's org (org_seed_local) — wasnull.isOrgAdminpath).This also unblocks any org admin (not just the registrar) using the domain-verification endpoints — the UI for that is a separate follow-up.
🤖 Generated with Claude Code