fix(sso): revoke trust for providers whose domain is spelled with a wildcard

Migration 0268 grandfathered providers by normalizing their domain with
lower + btrim + a stripped leading `*.`, so sso_provider.domain can hold
`*.acme.com` while its verified sso_domain row holds `acme.com`. The revoke on
domain deletion compared the raw column, so such a provider matched nothing and
kept domainVerified after its ownership proof was gone.

The comparison now applies the same normalization 0268 used, so a grandfathered
row is matched the way it was written.

Author: waleedlatif1

apps/sim/app/api/organizations/[id]/domains/[domainId]/route.test.ts

@@ -97,6 +97,22 @@ describe('remove org domain route', () => {
     expect(dbChainMockFns.set).toHaveBeenCalledWith({ domainVerified: false })
   })
 
+  /**
+   * Migration 0268 grandfathered providers by stripping a leading `*.`, so a
+   * provider can be stored as `*.acme.com` while its verified row holds
+   * `acme.com`. A naive equality match would leave that provider trusted after
+   * the proof was deleted.
+   */
+  it('matches the provider domain the way it was grandfathered (wildcard-tolerant)', async () => {
+    queueTableRows(member, [{ role: 'owner' }])
+    dbChainMockFns.returning.mockResolvedValueOnce([{ domain: 'acme.com' }])
+    await DELETE(createMockRequest('DELETE'), routeContext)
+    const revokeWhere = dbChainMockFns.where.mock.calls.find(([condition]) =>
+      JSON.stringify(condition ?? '').includes('regexp_replace')
+    )
+    expect(revokeWhere).toBeDefined()
+  })
+
   it('does not revoke trust when no domain was removed', async () => {
     queueTableRows(member, [{ role: 'owner' }])
     dbChainMockFns.returning.mockResolvedValueOnce([]) // delete matched nothing

apps/sim/app/api/organizations/[id]/domains/[domainId]/route.ts

@@ -74,13 +74,17 @@ export const DELETE = withRouteHandler(
 
       if (!deleted) return null
 
+      // Match the provider domain the same way migration 0268 normalized it when it
+      // grandfathered these rows: lower, trimmed, leading `*.` stripped. A provider
+      // stored as `*.acme.com` against a verified row holding `acme.com` would
+      // otherwise keep its trust after the proof was deleted.
       await tx
         .update(ssoProvider)
         .set({ domainVerified: false })
         .where(
           and(
             eq(ssoProvider.organizationId, organizationId),
-            sql`lower(${ssoProvider.domain}) = ${deleted.domain}`
+            sql`lower(regexp_replace(btrim(${ssoProvider.domain}), '^\\*\\.', '')) = ${deleted.domain}`
           )
         )