Function processSSOInternal

apps/web/src/lib/user/sso.ts:19–120

(
  args: CreateOrUpdateUserArgs,
  requestHeaders?: Headers,
  affiliateTrackingId?: string | null,
  trackingContext?: CreateOrUpdateUserTrackingContext
)

import { ensureVerifiedDomainOrganizationMembership } from '@/lib/organizations/verified-domain-membership';

const workos = new WorkOS(WORKOS_API_KEY);

async function processSSOInternal(
  args: CreateOrUpdateUserArgs,
  requestHeaders?: Headers,
  affiliateTrackingId?: string | null,
  trackingContext?: CreateOrUpdateUserTrackingContext
): Promise<string | true> {
  if (args.provider !== 'workos') {
    throw new Error('Only SSO logins supported');
  }
  const userDomain = args.google_user_email.split('@').pop();
  if (!userDomain) {
    throw new Error('Invalid email address ' + args.google_user_email);
  }
  const orgs = await workos.organizations.listOrganizations({
    domains: [userDomain],
  });
  if (!orgs.data.length) {
    throw new Error(`No organization found for domain: ${userDomain}`);
  }
  if (orgs.data.length > 1) {
    throw new Error(`Multiple organizations found for domain: ${userDomain}`);
  }
  const workOSOrg = orgs.data[0];
  const orgExternalId = workOSOrg.externalId;

  if (!orgExternalId) {
    throw new Error(
      `Organization ${workOSOrg.name} (${workOSOrg.id}) is not linked to a local organization (missing external_id)`
    );
  }

  const authority = await resolveSsoAuthorityForDomain(userDomain);
  if (authority.status !== 'required' || authority.sourceOrganizationId !== orgExternalId) {
    throw new Error(
      `WorkOS organization does not match the active SSO authority for ${userDomain}`
    );
  }

  const kiloOrg = await getOrganizationById(orgExternalId);
  if (!kiloOrg) {
    throw new Error(
      `No local organization found for WorkOS organization ${workOSOrg.name} (${workOSOrg.id} - ${orgExternalId})`
    );
  }

  const res = await createOrUpdateUser(
    args,
    undefined,
    true,
    requestHeaders,
    affiliateTrackingId,
    trackingContext
  );
  if (!res.success) {
    if (res.error === 'SIGNUP-RATE-LIMITED' || res.error === 'EMAIL-ALREADY-USED') {
      return `${SSO_SIGNIN_PATH}?error=${res.error}`;