fix(sso): re-add Directory Sync users the IdP re-creates and report plugin errors

Directory Sync now handles a user who is removed from the identity provider app and later re-assigned. The IdP creates them under a new directory user id, and they now rejoin as the same Trigger.dev user with the role from their groups, instead of failing on every retry. Out-of-order directory events for replaced identities can no longer restore access that was revoked later.

Deleting a directory user now also removes members whose account was created by Directory Sync. SSO login and Directory Sync now resolve the same account for an email, and match an existing account even when its stored email uses different letter case, so they no longer create duplicate accounts.

The SSO plugin contract gains an optional `reportError` hook, so errors the plugin logs reach the host's error tracker.

Mono-RevId: d2c87da245541ecbbca7bf4eed20a856cc277d3c

Author: 0ski

apps/webapp/app/models/directoryUser.server.ts

@@ -0,0 +1,53 @@
+import { Prisma, type PrismaClient } from "@trigger.dev/database";
+import { tryCatch } from "@trigger.dev/core/utils";
+
+type DirectoryUserParams = {
+  email: string;
+  firstName: string | null;
+  lastName: string | null;
+};
+
+// Matches on the lowercased email. New rows are marked SSO since the user will
+// authenticate via the org's IdP.
+export async function findOrCreateDirectoryUser(
+  client: PrismaClient,
+  params: DirectoryUserParams
+): Promise<{ userId: string }> {
+  const email = params.email.toLowerCase().trim();
+  const existingId = await findUserIdByEmail(client, email);
+  if (existingId) return { userId: existingId };
+
+  const name = [params.firstName, params.lastName].filter(Boolean).join(" ").trim() || null;
+  const [error, created] = await tryCatch(
+    client.user.create({
+      data: { email, authenticationMethod: "SSO", name, displayName: name },
+      select: { id: true },
+    })
+  );
+  if (!error) return { userId: created.id };
+
+  // Concurrent directory events for one email race on create; the loser reuses
+  // the winner's row.
+  const isUniqueViolation =
+    error instanceof Prisma.PrismaClientKnownRequestError && error.code === "P2002";
+  if (!isUniqueViolation) throw error;
+
+  const winnerId = await findUserIdByEmail(client, email);
+  if (!winnerId) throw error;
+  return { userId: winnerId };
+}
+
+// Same rule as SSO login: an exact match on the lowercased email (unique
+// index) wins, otherwise a single case-insensitive match. That fallback scans
+// User, which is fine for this rare first-contact lookup. Several casings
+// without an exact match are ambiguous, so nothing matches.
+async function findUserIdByEmail(client: PrismaClient, email: string): Promise<string | null> {
+  const exact = await client.user.findFirst({ where: { email }, select: { id: true } });
+  if (exact) return exact.id;
+
+  const folded = await client.$queryRaw<Array<{ id: string }>>`
+    SELECT "id" FROM "User" WHERE lower("email") = ${email} LIMIT 2
+  `;
+  if (folded.length !== 1) return null;
+  return folded[0].id;
+}

apps/webapp/app/models/orgMember.server.ts

@@ -1,5 +1,6 @@
 import { $transaction, Prisma, prisma } from "~/db.server";
 import { deleteOrgMember } from "./deleteOrgMember.server";
+import { findOrCreateDirectoryUser } from "./directoryUser.server";
 import type { MembershipSource } from "~/models/member.server";
 import { logger } from "~/services/logger.server";
 import { enqueueMemberDevelopmentEnvironments } from "~/services/memberDevEnvironments.server";
@@ -174,45 +175,14 @@ export async function ensureOrgMember(
   return { created: true, orgMemberId: member.id, devEnvironmentsQueued: enqueued };
 }
 
-// Find-or-create a User for a directory-provisioned member. Directory Sync
-// can provision a user before they have ever logged in, so the User row may
-// not exist yet. Email is the natural key (lowercased). New rows are marked
-// SSO since the user will authenticate via the org's IdP.
+// Directory Sync can provision a user before they have ever logged in, so
+// the User row may not exist yet.
 export async function ensureUserForDirectory(params: {
   email: string;
   firstName: string | null;
   lastName: string | null;
 }): Promise<{ userId: string }> {
-  const email = params.email.toLowerCase().trim();
-  const existing = await prisma.user.findFirst({ where: { email }, select: { id: true } });
-  if (existing) return { userId: existing.id };
-
-  const name = [params.firstName, params.lastName].filter(Boolean).join(" ").trim() || null;
-  // `User.email` is unique, so two concurrent directory events for the same
-  // email can both miss the lookup above and race on create; the loser gets
-  // P2002. Treat that as the idempotent "already exists" case (same pattern as
-  // `ensureOrgMember`) rather than throwing and burning a webhook retry.
-  try {
-    const created = await prisma.user.create({
-      data: {
-        email,
-        authenticationMethod: "SSO",
-        name,
-        displayName: name,
-      },
-      select: { id: true },
-    });
-    return { userId: created.id };
-  } catch (error) {
-    if (error instanceof Prisma.PrismaClientKnownRequestError && error.code === "P2002") {
-      const existingAfterConflict = await prisma.user.findFirst({
-        where: { email },
-        select: { id: true },
-      });
-      if (existingAfterConflict) return { userId: existingAfterConflict.id };
-    }
-    throw error;
-  }
+  return findOrCreateDirectoryUser(prisma, params);
 }
 
 // Whether the user holds the Owner system role in this org. Owner is the one

apps/webapp/app/services/sso.server.ts

@@ -1,6 +1,7 @@
 import { $replica, prisma } from "~/db.server";
 import type { PrismaClient } from "@trigger.dev/database";
 import sso from "@trigger.dev/sso";
+import { Logger } from "@trigger.dev/core/logger";
 import { env } from "~/env.server";
 
 // sso.create() is synchronous — returns a lazy controller that resolves
@@ -30,5 +31,6 @@ export const ssoController = sso.create(
       writerConnectionLimit: env.SSO_DATABASE_WRITER_CONNECTION_LIMIT,
       readerConnectionLimit: env.SSO_DATABASE_READER_CONNECTION_LIMIT,
     },
+    reportError: (message, ...args) => Logger.onError?.(message, ...args),
   }
 );

apps/webapp/app/v3/accountsWebhookWorker.server.ts

@@ -74,7 +74,9 @@ function initializeWorker() {
           data: payload.data,
         });
         if (result.isErr()) {
-          const error = new Error(`account webhook processing failed: ${result.error}`);
+          const error = new Error(
+            `account webhook processing failed for ${payload.event}: ${result.error}`
+          );
           if (result.error === "not_ready") {
             Object.assign(error, { logLevel: "warn" as const });
           }

apps/webapp/test/directoryUser.server.test.ts

@@ -0,0 +1,71 @@
+import { postgresTest } from "@internal/testcontainers";
+import { describe, expect, vi } from "vitest";
+import { findOrCreateDirectoryUser } from "~/models/directoryUser.server";
+
+vi.setConfig({ testTimeout: 60_000 });
+
+describe("findOrCreateDirectoryUser", () => {
+  postgresTest("reuses the user with the lowercased email", async ({ prisma }) => {
+    const existing = await prisma.user.create({
+      data: { email: "kai@example.com", authenticationMethod: "GITHUB" },
+    });
+
+    const result = await findOrCreateDirectoryUser(prisma, {
+      email: "Kai@Example.com",
+      firstName: "Kai",
+      lastName: null,
+    });
+
+    expect(result.userId).toBe(existing.id);
+    expect(await prisma.user.count()).toBe(1);
+  });
+
+  postgresTest("reuses a user whose stored email differs only in case", async ({ prisma }) => {
+    const existing = await prisma.user.create({
+      data: { email: "Kai.Smith@Example.com", authenticationMethod: "GITHUB" },
+    });
+
+    const result = await findOrCreateDirectoryUser(prisma, {
+      email: "kai.smith@example.com",
+      firstName: "Kai",
+      lastName: null,
+    });
+
+    expect(result.userId).toBe(existing.id);
+    expect(await prisma.user.count()).toBe(1);
+  });
+
+  postgresTest("creates a separate user when only ambiguous casings exist", async ({ prisma }) => {
+    const upper = await prisma.user.create({
+      data: { email: "Amb@example.com", authenticationMethod: "GITHUB" },
+    });
+    const shout = await prisma.user.create({
+      data: { email: "AMB@example.com", authenticationMethod: "GOOGLE" },
+    });
+
+    const result = await findOrCreateDirectoryUser(prisma, {
+      email: "amb@example.com",
+      firstName: null,
+      lastName: null,
+    });
+
+    expect([upper.id, shout.id]).not.toContain(result.userId);
+    const created = await prisma.user.findFirstOrThrow({ where: { id: result.userId } });
+    expect(created.email).toBe("amb@example.com");
+  });
+
+  postgresTest("creates a lowercased SSO user when none matches", async ({ prisma }) => {
+    const result = await findOrCreateDirectoryUser(prisma, {
+      email: "  New.User@Example.com ",
+      firstName: "New",
+      lastName: "User",
+    });
+
+    const created = await prisma.user.findFirstOrThrow({ where: { id: result.userId } });
+    expect(created).toMatchObject({
+      email: "new.user@example.com",
+      authenticationMethod: "SSO",
+      name: "New User",
+    });
+  });
+});

internal-packages/sso/src/index.ts

@@ -10,6 +10,7 @@ import type {
   SsoFlow,
   SsoMutationError,
   SsoPlugin,
+  SsoPluginConfig,
   SsoPortalError,
   SsoProfile,
   SsoResolutionDecision,
@@ -38,6 +39,8 @@ export type SsoCreateOptions = {
   // follows the host's writer/replica topology. The fallback ignores this —
   // it queries through the Prisma clients passed as `SsoPrismaInput`.
   database?: PluginDatabaseConfig;
+  // Forwarded to the plugin so the errors it logs reach the host's error tracker.
+  reportError?: SsoPluginConfig["reportError"];
 };
 
 // Loads the cloud plugin lazily; falls back to the OSS no-op
@@ -62,7 +65,7 @@ export class LazyController implements SsoController {
       const module = await importer(moduleName);
       const plugin: SsoPlugin = module.default;
       console.log("SSO: using plugin implementation");
-      return plugin.create({ database: options?.database });
+      return plugin.create({ database: options?.database, reportError: options?.reportError });
     } catch (err) {
       // Distinguish the two failure modes the dynamic import can hit:
       //

packages/plugins/src/sso.ts

@@ -362,6 +362,8 @@ export type SsoPluginConfig = {
   // Database connections for a plugin that owns its own client. Omitted →
   // the plugin falls back to its own defaults.
   database?: PluginDatabaseConfig;
+  // Receives every error the plugin logs, so it reaches the host's error tracker.
+  reportError?: (message: string, ...args: Array<Record<string, unknown> | undefined>) => void;
 };
 
 export interface SsoPlugin {