Function resolveSso

apps/host-selfhost/src/config.ts:220–257

()

// would be open registration for anyone with an account at the IdP, bypassing
// the invite gate entirely.
const resolveSso = (): SsoConfig | undefined => {
  const clientId = process.env.EXECUTOR_SSO_CLIENT_ID?.trim();
  const clientSecret = process.env.EXECUTOR_SSO_CLIENT_SECRET?.trim();
  if (!clientId && !clientSecret) return undefined;
  if (!clientId || !clientSecret) {
    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: refuse to boot on half-configured SSO credentials
    throw new Error("EXECUTOR_SSO_CLIENT_ID and EXECUTOR_SSO_CLIENT_SECRET must be set together");
  }
  const providerId = process.env.EXECUTOR_SSO_PROVIDER_ID?.trim().toLowerCase() ?? "";
  if (!PROVIDER_ID_PATTERN.test(providerId)) {
    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: refuse to boot on a missing/malformed provider id
    throw new Error(
      'EXECUTOR_SSO_PROVIDER_ID is required when SSO is configured (1-48 chars of [a-z0-9-], e.g. "google" or "okta") — it names the provider and its OAuth callback path',
    );
  }
  const discoveryUrl =
    process.env.EXECUTOR_SSO_DISCOVERY_URL?.trim() || DISCOVERY_PRESETS[providerId];
  if (!discoveryUrl) {
    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: refuse to boot without a way to reach the IdP
    throw new Error(
      `EXECUTOR_SSO_DISCOVERY_URL is required for provider ${JSON.stringify(providerId)} (the IdP's …/.well-known/openid-configuration URL)`,
    );
  }
  const allowedDomains = (process.env.EXECUTOR_SSO_ALLOWED_DOMAINS ?? "")
    .split(",")
    .map((domain) => domain.trim().replace(/^@/, "").toLowerCase())
    .filter((domain) => domain.length > 0);
  if (allowedDomains.length === 0) {
    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: SSO sign-in without a domain allowlist is open registration; refuse to boot
    throw new Error(
      'EXECUTOR_SSO_ALLOWED_DOMAINS is required when SSO is configured (comma-separated email domains, e.g. "example.com") — it is what gates sign-ups in place of an invite code',
    );
  }
  const providerName =
    process.env.EXECUTOR_SSO_PROVIDER_NAME?.trim() ||
    providerId.charAt(0).toUpperCase() + providerId.slice(1);
  return { providerId, providerName, discoveryUrl, clientId, clientSecret, allowedDomains };
};

// A malformed value is refused rather than silently ignored: an operator who
// sets the knob and typos it should find out at boot, not by watching a