From 28e331a114ad0cb4e5968c29685c2f7e24187fcc Mon Sep 17 00:00:00 2001
From: Bereket Engida <Bekacru@gmail.com>
Date: Sat, 16 Aug 2025 14:35:50 -0700
Subject: [PATCH] =?UTF-8?q?fix(sso):=20[=E2=9A=A0=EF=B8=8ESecurity]=20-=20?=
 =?UTF-8?q?membership=20check=20should=20be=20required=20before=20allowing?=
 =?UTF-8?q?=20users=20to=20create=20sso=20for=20an=20organization?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 packages/sso/src/index.ts | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/packages/sso/src/index.ts b/packages/sso/src/index.ts
index ad9d921630..3d5d7a7c5d 100644
--- a/packages/sso/src/index.ts
+++ b/packages/sso/src/index.ts
@@ -589,6 +589,26 @@ export const sso = (options?: SSOOptions) => {
 							message: "Invalid issuer. Must be a valid URL",
 						});
 					}
+					if (ctx.body.organizationId) {
+						const organization = await ctx.context.adapter.findOne({
+							model: "member",
+							where: [
+								{
+									field: "userId",
+									value: user.id,
+								},
+								{
+									field: "organizationId",
+									value: ctx.body.organizationId,
+								},
+							],
+						});
+						if (!organization) {
+							throw new APIError("BAD_REQUEST", {
+								message: "You are not a member of the organization",
+							});
+						}
+					}
 					const provider = await ctx.context.adapter.create<
 						Record<string, any>,
 						SSOProvider