fix(sso): report a failed launch sign-in on the provider's sign-in link

Author: waleedlatif1

apps/sim/app/(auth)/sso/launch/[providerId]/route.test.ts

@@ -101,12 +101,18 @@ describe('GET /sso/launch/[providerId]', () => {
     expect(mockSignInSSO).not.toHaveBeenCalled()
   })
 
-  it("falls back to the provider's sign-in link when sign-in cannot start", async () => {
-    mockSignInSSO.mockResolvedValue(new Response('{}', { status: 400 }))
+  it.each([
+    ['refuses', () => mockSignInSSO.mockResolvedValue(new Response('{}', { status: 400 }))],
+    ['throws', () => mockSignInSSO.mockRejectedValue(new Error('network'))],
+  ])("reports the failure on the provider's sign-in link when sign-in %s", async (_l, arrange) => {
+    arrange()
 
     const response = await open()
 
-    expect(response.headers.get('location')).toBe(SIGN_IN_LINK)
+    const failure = new URL(response.headers.get('location') ?? '')
+    expect(failure.pathname).toBe('/sso')
+    expect(failure.searchParams.get('error')).toBe('sso_failed')
+    expect(failure.searchParams.get('provider')).toBe('acme-okta')
   })
 
   it('sends a rate-limited visitor to the sign-in link before any lookup', async () => {

apps/sim/app/(auth)/sso/launch/[providerId]/route.ts

@@ -57,18 +57,25 @@ export const GET = withRouteHandler(async (request: NextRequest, context: RouteC
     `/sso?error=sso_failed&provider=${encodeURIComponent(providerId)}&callbackUrl=${encodeURIComponent(DEFAULT_POST_AUTH_ROUTE)}`,
     getBaseUrl()
   ).toString()
-  const signIn = await auth.api.signInSSO({
-    body: { providerId, callbackURL: DEFAULT_POST_AUTH_ROUTE, errorCallbackURL },
-    headers: request.headers,
-    asResponse: true,
-  })
+  /** A sign-in that never starts is a failure, so it carries the error rather than a blank form. */
+  let signIn: Response
+  try {
+    signIn = await auth.api.signInSSO({
+      body: { providerId, callbackURL: DEFAULT_POST_AUTH_ROUTE, errorCallbackURL },
+      headers: request.headers,
+      asResponse: true,
+    })
+  } catch (error) {
+    logger.error('SSO sign-in could not be started', { providerId, error })
+    return NextResponse.redirect(errorCallbackURL)
+  }
   const payload = (await signIn.json().catch(() => null)) as { url?: string } | null
   if (!signIn.ok || !payload?.url) {
     logger.error('SSO sign-in did not return an authorization URL', {
       providerId,
       status: signIn.status,
     })
-    return NextResponse.redirect(signInLink)
+    return NextResponse.redirect(errorCallbackURL)
   }
 
   const response = NextResponse.redirect(payload.url)