Function tryGetSSOResponse

apps/web/src/app/api/sso/organizations/route.ts:118–148

* If the domain has SSO configured, returns a WorkOS response. * Returns null if no SSO is configured or if WorkOS organization lookup fails.

(
  domain: string,
  warningContext: Record<string, unknown>
)

      { status: 503 }
    );
  }
}

/**
 * If the domain has SSO configured, returns a WorkOS response.
 * Returns null if no SSO is configured or if WorkOS organization lookup fails.
 */
async function tryGetSSOResponse(domain: string): Promise<NextResponse | null> {
  const authority = await resolveSsoAuthorityForDomain(domain);
  if (authority.status === 'not_required') {
    return null;
  }
  if (authority.status === 'misconfigured') {
    warnInSentry('Local SSO authority is misconfigured', {
      extra: { domain, reason: authority.reason },
    });
    return NextResponse.json(
      { error: 'Unable to find sign-in methods. Please try again.' },
      { status: 503 }
    );
  }

  const organization = await getWorkOSOrganization(domain);
  if (organization) {
    return discoveryResponse({ kind: 'sso', organizationId: organization.id });
  }

  // DB says SSO exists but WorkOS doesn't have it - this is a config error
  warnInSentry('Local organization has SSO but WorkOS organization not found', {
    extra: { domain, localOrgId: authority.sourceOrganizationId },
  });
  return NextResponse.json(
    { error: 'Unable to find sign-in methods. Please try again.' },
    { status: 503 }