Function registerSSOProvider

packages/db/scripts/register-sso-provider.ts:405–665

()

}

async function registerSSOProvider(): Promise<boolean> {
  try {
    const ssoConfig = buildSSOConfigFromEnv()

    if (!ssoConfig) {
      logger.error('❌ No valid SSO configuration found in environment variables')
      logger.error('')
      logger.error('📝 Required environment variables:')
      logger.error('For OIDC providers (like Okta, Azure AD):')
      const oidcExample = getExampleEnvVars('oidc', 'okta')
      for (const [key, value] of Object.entries(oidcExample)) {
        logger.error(`  ${key}=${value}`)
      }
      logger.error('  SSO_USER_EMAIL=admin@yourdomain.com')
      logger.error('')
      logger.error('For SAML providers (like ADFS):')
      const samlExample = getExampleEnvVars('saml')
      for (const [key, value] of Object.entries(samlExample)) {
        logger.error(`  ${key}=${value}`)
      }
      logger.error('  SSO_USER_EMAIL=admin@yourdomain.com')
      return false
    }

    const adminUser = await getAdminUser()
    if (!adminUser) {
      return false
    }

    logger.info('Registering SSO provider directly in database...', {
      providerId: ssoConfig.providerId,
      providerType: ssoConfig.providerType,
      domain: ssoConfig.domain,
      adminUser: adminUser.email,
    })

    try {
      new URL(ssoConfig.issuer)
    } catch {
      logger.error('Invalid issuer. Must be a valid URL:', ssoConfig.issuer)
      return false
    }

    if (
      ssoConfig.providerType === 'saml' &&
      !process.env.NEXT_PUBLIC_APP_URL &&
      !process.env.BETTER_AUTH_URL
    ) {
      logger.error(
        'NEXT_PUBLIC_APP_URL or BETTER_AUTH_URL is required for SAML — it is used as the SP entity ID in SP metadata. Set one of these env vars.'
      )
      return false
    }

    if (ssoConfig.providerType === 'oidc' && ssoConfig.oidcConfig) {
      const needsDiscovery =
        !ssoConfig.oidcConfig.authorizationEndpoint ||
        !ssoConfig.oidcConfig.tokenEndpoint ||