fix(auth): stop trusting IdP email_verified for SSO account linking

Better Auth's link gate is `!isTrustedProvider && !userInfo.emailVerified`,
so trustEmailVerified let a true email_verified claim stand in for the domain
binding. Any principal able to register an SSO provider — an Enterprise org
admin, or any signed-in user when self-hosted — could point it at an IdP they
control, assert an arbitrary victim's address as verified, and auto-link into
that account across tenant boundaries, persisting as an account row.

With it off, linking requires isTrustedProvider, which is domainVerified plus
validateEmailDomain(email, provider.domain) — a provider can only claim
identities inside the domain it proved. That is the model the codebase already
documents for trustProviderByName: false.

The option only ever set emailVerified on the local row; it was never what
made linking work, since Entra omits the claim and SAML ignores it without a
mapping the register contract does not accept.

Author: waleedlatif1

apps/sim/lib/auth/auth.ts

@@ -1169,14 +1169,24 @@ export const auth = betterAuth({
       ? [
           sso({
             /**
-             * Honor the IdP's `email_verified` claim so the local account is
-             * verified rather than forced to false.
+             * MUST stay false. Better Auth's link gate is
+             * `!isTrustedProvider && !userInfo.emailVerified`, so a true
+             * `email_verified` claim substitutes for the domain binding
+             * entirely: an IdP could assert any address — including one from a
+             * domain it does not own — and auto-link into that user's existing
+             * account. Since a provider row can be registered by any Enterprise
+             * org admin (and by any signed-in user when self-hosted), trusting
+             * the claim makes every account reachable from any tenant's IdP.
              *
-             * This is not what enables linking — Entra omits the claim entirely,
-             * and SAML ignores it without an explicit `mapping.emailVerified`.
-             * `domainVerification` below establishes linking trust.
+             * Turning it on only ever set `emailVerified` on the local row; it
+             * was never what made linking work. Entra omits the claim, and SAML
+             * ignores it without an explicit `mapping.emailVerified` that the
+             * register contract does not accept — so SSO users are created
+             * unverified either way, and `domainVerification` below is the sole
+             * linking trust source, which is what `trustProviderByName: false`
+             * already assumes.
              */
-            trustEmailVerified: true,
+            trustEmailVerified: false,
             /**
              * Marks a provider authoritative for its domain, which is what lets an
              * SSO sign-in auto-link to an existing same-email account. Without it
@@ -1187,9 +1197,10 @@ export const auth = betterAuth({
              * proven by the `sso_domain` flow before registration, and the register
              * route mirrors that decision onto this flag.
              *
-             * It narrows nothing on its own — an IdP asserting `email_verified`
-             * links regardless of domain (see `trustEmailVerified` above). It
-             * exists so linking survives IdPs that omit the claim.
+             * With `trustEmailVerified` off this is the only path to linking, and
+             * it is domain-scoped: `isTrustedProvider` additionally requires
+             * `validateEmailDomain(userInfo.email, provider.domain)`, so a
+             * provider can only ever claim identities inside the domain it proved.
              */
             domainVerification: { enabled: true },
             organizationProvisioning: {

apps/sim/lib/auth/sso-trust.test.ts

@@ -0,0 +1,39 @@
+/**
+ * @vitest-environment node
+ *
+ * Locks the SSO linking trust model. Better Auth's account-link gate is
+ * `!isTrustedProvider && !userInfo.emailVerified`, so a truthy
+ * `trustEmailVerified` lets any registered IdP assert an out-of-domain address
+ * as verified and auto-link into that user's account, bypassing the
+ * domain-verification proof entirely.
+ */
+import { resetEnvFlagsMock, setEnvFlags } from '@sim/testing'
+import { afterAll, expect, it, vi } from 'vitest'
+
+const { ssoOptions } = vi.hoisted(() => ({
+  ssoOptions: { current: undefined as Record<string, unknown> | undefined },
+}))
+
+vi.mock('@better-auth/sso', () => ({
+  sso: (options: Record<string, unknown>) => {
+    ssoOptions.current = options
+    return { id: 'sso' }
+  },
+}))
+
+setEnvFlags({ isSsoEnabled: true })
+
+afterAll(resetEnvFlagsMock)
+
+it('never trusts the IdP-supplied email_verified claim for SSO linking', async () => {
+  await import('@/lib/auth/auth')
+
+  expect(ssoOptions.current).toBeDefined()
+  expect(ssoOptions.current?.trustEmailVerified).toBe(false)
+})
+
+it('keeps domain verification as the sole SSO linking trust source', async () => {
+  await import('@/lib/auth/auth')
+
+  expect(ssoOptions.current?.domainVerification).toEqual({ enabled: true })
+})