From 572de2727541c497ed4fae986b300e4cdc8d3f30 Mon Sep 17 00:00:00 2001
From: Jordan Lorho <jordan.lorho@gmail.com>
Date: Fri, 1 May 2026 22:14:45 +0200
Subject: [PATCH 1/6] feat(sso): remove sso_enabled flag, always show SSO
 section

SSO settings are now visible to all org members with super-admin
permissions. Enterprise orgs see the configuration form directly;
non-enterprise orgs see an upgrade prompt. The Capgo-managed
sso_enabled column is dropped from orgs and all related DB functions
are updated accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/pages/settings/organization/Security.vue  |   4 +-
 src/types/supabase.types.ts                   |   5 -
 .../_backend/private/sso/providers.ts         |  17 +-
 .../_backend/utils/supabase.types.ts          |   5 -
 ...20260501120000_remove_sso_enabled_flag.sql | 423 ++++++++++++++++++
 .../organization-put-stripe-sync.unit.test.ts |   1 -
 tests/sso.test.ts                             |  28 +-
 7 files changed, 435 insertions(+), 48 deletions(-)
 create mode 100644 supabase/migrations/20260501120000_remove_sso_enabled_flag.sql

diff --git a/src/pages/settings/organization/Security.vue b/src/pages/settings/organization/Security.vue
index 2dfccbdefc..1f7afcd3e2 100644
--- a/src/pages/settings/organization/Security.vue
+++ b/src/pages/settings/organization/Security.vue
@@ -1448,8 +1448,8 @@ onMounted(async () => {
             </div>
           </section>
 
-          <!-- SSO Configuration Section (Enterprise only) -->
-          <section v-if="hasOrgPerm && currentOrganization?.sso_enabled" class="p-6 border rounded-lg border-slate-200 dark:border-slate-700">
+          <!-- SSO Configuration Section -->
+          <section v-if="hasOrgPerm" class="p-6 border rounded-lg border-slate-200 dark:border-slate-700">
             <!-- Enterprise Plan: Show SSO Configuration -->
             <template v-if="isEnterprisePlan">
               <div class="flex items-start gap-4 mb-6">
diff --git a/src/types/supabase.types.ts b/src/types/supabase.types.ts
index 38e56fc4ab..656944ed09 100644
--- a/src/types/supabase.types.ts
+++ b/src/types/supabase.types.ts
@@ -1672,7 +1672,6 @@ export type Database = {
           password_policy_config: Json | null
           require_apikey_expiration: boolean
           required_encryption_key: string | null
-          sso_enabled: boolean
           stats_refresh_requested_at: string | null
           stats_updated_at: string | null
           updated_at: string | null
@@ -1697,7 +1696,6 @@ export type Database = {
           password_policy_config?: Json | null
           require_apikey_expiration?: boolean
           required_encryption_key?: string | null
-          sso_enabled?: boolean
           stats_refresh_requested_at?: string | null
           stats_updated_at?: string | null
           updated_at?: string | null
@@ -1722,7 +1720,6 @@ export type Database = {
           password_policy_config?: Json | null
           require_apikey_expiration?: boolean
           required_encryption_key?: string | null
-          sso_enabled?: boolean
           stats_refresh_requested_at?: string | null
           stats_updated_at?: string | null
           updated_at?: string | null
@@ -3543,7 +3540,6 @@ export type Database = {
               require_apikey_expiration: boolean
               required_encryption_key: string
               role: string
-              sso_enabled: boolean
               stats_refresh_requested_at: string
               stats_updated_at: string
               subscription_end: string
@@ -3581,7 +3577,6 @@ export type Database = {
               require_apikey_expiration: boolean
               required_encryption_key: string
               role: string
-              sso_enabled: boolean
               stats_refresh_requested_at: string
               stats_updated_at: string
               subscription_end: string
diff --git a/supabase/functions/_backend/private/sso/providers.ts b/supabase/functions/_backend/private/sso/providers.ts
index b36830237a..7c470335e3 100644
--- a/supabase/functions/_backend/private/sso/providers.ts
+++ b/supabase/functions/_backend/private/sso/providers.ts
@@ -8,7 +8,7 @@ import { closeClient, getPgClient } from '../../utils/pg.ts'
 import { requireEnterprisePlan } from '../../utils/plan-gating.ts'
 import { checkPermission } from '../../utils/rbac.ts'
 import { createSSOProvider, deleteSSOProvider, ManagementAPIError } from '../../utils/supabase-management.ts'
-import { supabaseAdmin, supabaseWithAuth } from '../../utils/supabase.ts'
+import { supabaseWithAuth } from '../../utils/supabase.ts'
 import { version } from '../../utils/version.ts'
 
 const createBodySchema = type({
@@ -142,21 +142,6 @@ app.post('/', async (c) => {
   await requireManageSsoPermission(c, body.org_id)
   await requireEnterprisePlan(c, body.org_id)
 
-  const adminClient = supabaseAdmin(c)
-  const { data: orgData, error: orgError } = await adminClient
-    .from('orgs')
-    .select('sso_enabled')
-    .eq('id', body.org_id)
-    .single()
-
-  if (orgError || !orgData) {
-    return quickError(404, 'org_not_found', 'Organization not found')
-  }
-
-  if (!orgData.sso_enabled) {
-    return quickError(403, 'sso_not_enabled', 'SSO is not enabled for this organization')
-  }
-
   let managementProvider: Awaited<ReturnType<typeof createSSOProvider>>
   try {
     managementProvider = await createSSOProvider(c, domain, body.metadata_url, attributeMapping)
diff --git a/supabase/functions/_backend/utils/supabase.types.ts b/supabase/functions/_backend/utils/supabase.types.ts
index 38e56fc4ab..656944ed09 100644
--- a/supabase/functions/_backend/utils/supabase.types.ts
+++ b/supabase/functions/_backend/utils/supabase.types.ts
@@ -1672,7 +1672,6 @@ export type Database = {
           password_policy_config: Json | null
           require_apikey_expiration: boolean
           required_encryption_key: string | null
-          sso_enabled: boolean
           stats_refresh_requested_at: string | null
           stats_updated_at: string | null
           updated_at: string | null
@@ -1697,7 +1696,6 @@ export type Database = {
           password_policy_config?: Json | null
           require_apikey_expiration?: boolean
           required_encryption_key?: string | null
-          sso_enabled?: boolean
           stats_refresh_requested_at?: string | null
           stats_updated_at?: string | null
           updated_at?: string | null
@@ -1722,7 +1720,6 @@ export type Database = {
           password_policy_config?: Json | null
           require_apikey_expiration?: boolean
           required_encryption_key?: string | null
-          sso_enabled?: boolean
           stats_refresh_requested_at?: string | null
           stats_updated_at?: string | null
           updated_at?: string | null
@@ -3543,7 +3540,6 @@ export type Database = {
               require_apikey_expiration: boolean
               required_encryption_key: string
               role: string
-              sso_enabled: boolean
               stats_refresh_requested_at: string
               stats_updated_at: string
               subscription_end: string
@@ -3581,7 +3577,6 @@ export type Database = {
               require_apikey_expiration: boolean
               required_encryption_key: string
               role: string
-              sso_enabled: boolean
               stats_refresh_requested_at: string
               stats_updated_at: string
               subscription_end: string
diff --git a/supabase/migrations/20260501120000_remove_sso_enabled_flag.sql b/supabase/migrations/20260501120000_remove_sso_enabled_flag.sql
new file mode 100644
index 0000000000..ddbbd37275
--- /dev/null
+++ b/supabase/migrations/20260501120000_remove_sso_enabled_flag.sql
@@ -0,0 +1,423 @@
+-- Migration: Remove sso_enabled feature flag
+-- SSO is now always available: enterprise orgs get the form, others get an upgrade prompt.
+-- The flag is replaced by the enterprise plan check already enforced in requireEnterprisePlan.
+
+-- 1) Update check_domain_sso: SSO is active when a provider is active (no org flag needed)
+CREATE OR REPLACE FUNCTION public.check_domain_sso(p_domain text)
+RETURNS TABLE (
+    has_sso boolean,
+    provider_id text,
+    org_id uuid
+)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+    SELECT
+        true AS has_sso,
+        sp.provider_id,
+        sp.org_id
+    FROM public.sso_providers AS sp
+    JOIN public.orgs AS o ON o.id = sp.org_id
+    WHERE sp."domain" = lower(btrim(p_domain))
+      AND sp.status = 'active'
+    LIMIT 1;
+$$;
+
+ALTER FUNCTION public.check_domain_sso(text) OWNER TO "postgres";
+REVOKE ALL ON FUNCTION public.check_domain_sso(text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.check_domain_sso(text) TO anon;
+GRANT EXECUTE ON FUNCTION public.check_domain_sso(text) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.check_domain_sso(text) TO service_role;
+
+-- 2) Update get_sso_enforcement_by_domain: same, no org flag
+CREATE OR REPLACE FUNCTION "public"."get_sso_enforcement_by_domain"("p_domain" text)
+RETURNS TABLE("org_id" uuid, "enforce_sso" boolean)
+LANGUAGE "sql"
+STABLE
+SECURITY DEFINER
+SET "search_path" TO ''
+AS $$
+  SELECT
+    sp.org_id,
+    sp.enforce_sso
+  FROM "public"."sso_providers" sp
+  JOIN "public"."orgs" o ON o.id = sp.org_id
+  WHERE sp.domain = lower(btrim(p_domain))
+    AND sp.status = 'active'
+  LIMIT 1;
+$$;
+
+ALTER FUNCTION "public"."get_sso_enforcement_by_domain"(text) OWNER TO "postgres";
+REVOKE ALL ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) TO anon;
+GRANT EXECUTE ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) TO authenticated;
+GRANT EXECUTE ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) TO service_role;
+
+-- 3) Update generate_org_on_user_create trigger: remove sso_enabled guard from has_sso check
+CREATE OR REPLACE FUNCTION "public"."generate_org_on_user_create" () RETURNS "trigger" LANGUAGE "plpgsql"
+SET
+  search_path = '' SECURITY DEFINER AS $$
+DECLARE
+  org_record record;
+  has_sso boolean;
+  user_provider text;
+BEGIN
+    SELECT raw_app_meta_data->>'provider'
+    INTO user_provider
+    FROM auth.users
+    WHERE id = NEW.id;
+
+    SELECT EXISTS (
+      SELECT 1 FROM public.sso_providers sp
+      JOIN public.orgs o ON o.id = sp.org_id
+      WHERE sp.domain = lower(btrim(split_part(NEW.email, '@', 2)))
+      AND sp.status = 'active'
+    ) INTO has_sso;
+
+    -- Skip org creation only for genuine SAML SSO logins on SSO-managed domains.
+    IF NOT (user_provider ~ '^sso:' AND has_sso) THEN
+      INSERT INTO public.orgs (created_by, name, management_email) values (NEW.id, format('%s organization', NEW.first_name), NEW.email) RETURNING * INTO org_record;
+    END IF;
+
+    RETURN NEW;
+END $$;
+
+-- 4) Recreate get_orgs_v7 without sso_enabled in the return type
+--    Must DROP first because CREATE OR REPLACE cannot change return type.
+--    Drop no-args overload first (it depends on the with-args overload).
+DROP FUNCTION IF EXISTS public.get_orgs_v7();
+DROP FUNCTION IF EXISTS public.get_orgs_v7(userid uuid);
+
+CREATE FUNCTION public.get_orgs_v7() RETURNS TABLE(
+  gid uuid,
+  created_by uuid,
+  created_at timestamp with time zone,
+  logo text,
+  website text,
+  name text,
+  role character varying,
+  paying boolean,
+  trial_left integer,
+  can_use_more boolean,
+  is_canceled boolean,
+  app_count bigint,
+  subscription_start timestamp with time zone,
+  subscription_end timestamp with time zone,
+  management_email text,
+  is_yearly boolean,
+  stats_updated_at timestamp without time zone,
+  stats_refresh_requested_at timestamp without time zone,
+  next_stats_update_at timestamp with time zone,
+  credit_available numeric,
+  credit_total numeric,
+  credit_next_expiration timestamp with time zone,
+  enforcing_2fa boolean,
+  "2fa_has_access" boolean,
+  enforce_hashed_api_keys boolean,
+  password_policy_config jsonb,
+  password_has_access boolean,
+  require_apikey_expiration boolean,
+  max_apikey_expiration_days integer,
+  enforce_encrypted_bundles boolean,
+  required_encryption_key character varying,
+  use_new_rbac boolean
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $$
+DECLARE
+  api_key_text text;
+  api_key record;
+  user_id uuid;
+BEGIN
+  SELECT public.get_apikey_header() INTO api_key_text;
+  user_id := NULL;
+
+  IF api_key_text IS NOT NULL THEN
+    SELECT * FROM public.find_apikey_by_value(api_key_text) INTO api_key;
+
+    IF api_key IS NULL THEN
+      PERFORM public.pg_log('deny: INVALID_API_KEY', jsonb_build_object('source', 'header'));
+      RAISE EXCEPTION 'Invalid API key provided';
+    END IF;
+
+    IF public.is_apikey_expired(api_key.expires_at) THEN
+      PERFORM public.pg_log('deny: API_KEY_EXPIRED', jsonb_build_object('key_id', api_key.id));
+      RAISE EXCEPTION 'API key has expired';
+    END IF;
+
+    user_id := api_key.user_id;
+
+    IF COALESCE(array_length(api_key.limited_to_orgs, 1), 0) > 0 THEN
+      RETURN QUERY
+      SELECT orgs.*
+      FROM public.get_orgs_v7(user_id) AS orgs
+      WHERE orgs.gid = ANY(api_key.limited_to_orgs::uuid[]);
+      RETURN;
+    END IF;
+  END IF;
+
+  IF user_id IS NULL THEN
+    SELECT public.get_identity() INTO user_id;
+
+    IF user_id IS NULL THEN
+      PERFORM public.pg_log('deny: UNAUTHENTICATED', '{}'::jsonb);
+      RAISE EXCEPTION 'No authentication provided - API key or valid session required';
+    END IF;
+  END IF;
+
+  RETURN QUERY SELECT * FROM public.get_orgs_v7(user_id);
+END;
+$$;
+
+ALTER FUNCTION public.get_orgs_v7() OWNER TO postgres;
+REVOKE ALL ON FUNCTION public.get_orgs_v7() FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.get_orgs_v7() FROM anon;
+REVOKE ALL ON FUNCTION public.get_orgs_v7() FROM authenticated;
+GRANT ALL ON FUNCTION public.get_orgs_v7() TO anon;
+GRANT ALL ON FUNCTION public.get_orgs_v7() TO authenticated;
+GRANT ALL ON FUNCTION public.get_orgs_v7() TO service_role;
+
+CREATE FUNCTION public.get_orgs_v7(userid uuid) RETURNS TABLE(
+  gid uuid,
+  created_by uuid,
+  created_at timestamp with time zone,
+  logo text,
+  website text,
+  name text,
+  role character varying,
+  paying boolean,
+  trial_left integer,
+  can_use_more boolean,
+  is_canceled boolean,
+  app_count bigint,
+  subscription_start timestamp with time zone,
+  subscription_end timestamp with time zone,
+  management_email text,
+  is_yearly boolean,
+  stats_updated_at timestamp without time zone,
+  stats_refresh_requested_at timestamp without time zone,
+  next_stats_update_at timestamp with time zone,
+  credit_available numeric,
+  credit_total numeric,
+  credit_next_expiration timestamp with time zone,
+  enforcing_2fa boolean,
+  "2fa_has_access" boolean,
+  enforce_hashed_api_keys boolean,
+  password_policy_config jsonb,
+  password_has_access boolean,
+  require_apikey_expiration boolean,
+  max_apikey_expiration_days integer,
+  enforce_encrypted_bundles boolean,
+  required_encryption_key character varying,
+  use_new_rbac boolean
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $$
+BEGIN
+  RETURN QUERY
+  WITH app_counts AS (
+    SELECT owner_org, COUNT(*) AS cnt
+    FROM public.apps
+    GROUP BY owner_org
+  ),
+  rbac_roles AS (
+    SELECT rb.org_id, r.name, r.priority_rank
+    FROM public.role_bindings rb
+    JOIN public.roles r ON rb.role_id = r.id
+    WHERE rb.principal_type = public.rbac_principal_user()
+      AND rb.principal_id = userid
+      AND rb.scope_type = public.rbac_scope_org()
+      AND rb.org_id IS NOT NULL
+      AND (rb.expires_at IS NULL OR rb.expires_at > now())
+    UNION ALL
+    SELECT rb.org_id, r.name, r.priority_rank
+    FROM public.role_bindings rb
+    JOIN public.group_members gm ON gm.group_id = rb.principal_id
+    JOIN public.roles r ON rb.role_id = r.id
+    WHERE rb.principal_type = public.rbac_principal_group()
+      AND gm.user_id = userid
+      AND rb.scope_type = public.rbac_scope_org()
+      AND rb.org_id IS NOT NULL
+      AND (rb.expires_at IS NULL OR rb.expires_at > now())
+  ),
+  rbac_org_roles AS (
+    SELECT org_id, (ARRAY_AGG(rbac_roles.name ORDER BY rbac_roles.priority_rank DESC))[1] AS role_name
+    FROM rbac_roles
+    GROUP BY org_id
+  ),
+  user_orgs AS (
+    SELECT ou.org_id
+    FROM public.org_users ou
+    WHERE ou.user_id = userid
+    UNION
+    SELECT rbac_org_roles.org_id
+    FROM rbac_org_roles
+  ),
+  time_constants AS (
+    SELECT
+      NOW() AS current_time,
+      date_trunc('MONTH', NOW()) AS current_month_start, -- NOSONAR: migration-local billing anchor
+      '0 DAYS'::INTERVAL AS zero_day_interval
+  ),
+  paying_orgs_ordered AS (
+    SELECT
+      o.id,
+      ROW_NUMBER() OVER (ORDER BY o.id ASC) - 1 AS preceding_count
+    FROM public.orgs o
+    JOIN public.stripe_info si ON o.customer_id = si.customer_id
+    CROSS JOIN time_constants tc
+    WHERE (
+      (si.status = 'succeeded' -- NOSONAR: existing stripe_info status contract
+        AND (si.canceled_at IS NULL OR si.canceled_at > tc.current_time)
+        AND si.subscription_anchor_end > tc.current_time)
+      OR si.trial_at > tc.current_time
+    )
+  ),
+  billing_cycles AS (
+    SELECT
+      o.id AS org_id,
+      CASE
+        WHEN COALESCE(si.subscription_anchor_start - date_trunc('MONTH', si.subscription_anchor_start), tc.zero_day_interval)
+             > tc.current_time - tc.current_month_start
+        THEN date_trunc('MONTH', tc.current_time - INTERVAL '1 MONTH')
+             + COALESCE(si.subscription_anchor_start - date_trunc('MONTH', si.subscription_anchor_start), tc.zero_day_interval)
+        ELSE tc.current_month_start
+             + COALESCE(si.subscription_anchor_start - date_trunc('MONTH', si.subscription_anchor_start), tc.zero_day_interval)
+      END AS cycle_start
+    FROM public.orgs o
+    CROSS JOIN time_constants tc
+    LEFT JOIN public.stripe_info si ON o.customer_id = si.customer_id
+  ),
+  two_fa_access AS (
+    SELECT
+      o.id AS org_id,
+      o.enforcing_2fa,
+      CASE
+        WHEN o.enforcing_2fa = false THEN true
+        ELSE public.has_2fa_enabled(userid)
+      END AS "2fa_has_access",
+      (o.enforcing_2fa = true AND NOT public.has_2fa_enabled(userid)) AS should_redact_2fa
+    FROM public.orgs o
+    JOIN user_orgs uo ON uo.org_id = o.id
+  ),
+  password_policy_access AS (
+    SELECT
+      o.id AS org_id,
+      o.password_policy_config,
+      public.user_meets_password_policy(userid, o.id) AS password_has_access,
+      NOT public.user_meets_password_policy(userid, o.id) AS should_redact_password
+    FROM public.orgs o
+    JOIN user_orgs uo ON uo.org_id = o.id
+  )
+  SELECT
+    o.id AS gid,
+    o.created_by,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
+      ELSE o.created_at
+    END AS created_at,
+    o.logo,
+    o.website,
+    o.name,
+    CASE
+      WHEN o.use_new_rbac AND ou.user_right::text LIKE 'invite_%' THEN ou.user_right::varchar
+      WHEN o.use_new_rbac THEN COALESCE(ror.role_name, ou.rbac_role_name, ou.user_right::varchar)
+      ELSE COALESCE(ou.user_right::varchar, ror.role_name)
+    END AS role,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
+      ELSE COALESCE(si.status = 'succeeded', false) -- NOSONAR: existing stripe_info status contract
+    END AS paying,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN 0
+      ELSE GREATEST(COALESCE((si.trial_at::date - NOW()::date), 0), 0)::integer
+    END AS trial_left,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
+      ELSE COALESCE((si.status = 'succeeded' AND si.is_good_plan = true) -- NOSONAR: existing stripe_info status contract
+        OR (si.trial_at::date - NOW()::date > 0)
+        OR COALESCE(ucb.available_credits, 0) > 0, false)
+    END AS can_use_more,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
+      ELSE COALESCE(si.status = 'canceled', false)
+    END AS is_canceled,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN 0::bigint
+      ELSE COALESCE(ac.cnt, 0)
+    END AS app_count,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
+      ELSE bc.cycle_start
+    END AS subscription_start,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
+      ELSE (bc.cycle_start + INTERVAL '1 MONTH')
+    END AS subscription_end,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::text
+      ELSE o.management_email
+    END AS management_email,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
+      ELSE COALESCE(si.price_id = p.price_y_id, false)
+    END AS is_yearly,
+    o.stats_updated_at,
+    o.stats_refresh_requested_at,
+    CASE
+      WHEN poo.id IS NOT NULL THEN
+        public.get_next_cron_time('0 3 * * *', NOW()) + make_interval(mins => poo.preceding_count::int * 4)
+      ELSE NULL
+    END AS next_stats_update_at,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::numeric
+      ELSE COALESCE(ucb.available_credits, 0)
+    END AS credit_available,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::numeric
+      ELSE COALESCE(ucb.total_credits, 0)
+    END AS credit_total,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
+      ELSE ucb.next_expiration
+    END AS credit_next_expiration,
+    tfa.enforcing_2fa,
+    tfa."2fa_has_access",
+    o.enforce_hashed_api_keys,
+    ppa.password_policy_config,
+    ppa.password_has_access,
+    o.require_apikey_expiration,
+    o.max_apikey_expiration_days,
+    o.enforce_encrypted_bundles,
+    o.required_encryption_key,
+    o.use_new_rbac
+  FROM public.orgs o
+  JOIN user_orgs uo ON uo.org_id = o.id
+  LEFT JOIN public.org_users ou ON ou.user_id = userid AND o.id = ou.org_id
+  LEFT JOIN rbac_org_roles ror ON ror.org_id = o.id
+  LEFT JOIN two_fa_access tfa ON tfa.org_id = o.id
+  LEFT JOIN password_policy_access ppa ON ppa.org_id = o.id
+  LEFT JOIN public.stripe_info si ON o.customer_id = si.customer_id
+  LEFT JOIN public.plans p ON si.product_id = p.stripe_id
+  LEFT JOIN app_counts ac ON ac.owner_org = o.id
+  LEFT JOIN public.usage_credit_balances ucb ON ucb.org_id = o.id
+  LEFT JOIN paying_orgs_ordered poo ON poo.id = o.id
+  LEFT JOIN billing_cycles bc ON bc.org_id = o.id;
+END;
+$$;
+
+ALTER FUNCTION public.get_orgs_v7(userid uuid) OWNER TO postgres;
+REVOKE ALL ON FUNCTION public.get_orgs_v7(userid uuid) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.get_orgs_v7(userid uuid) FROM anon;
+REVOKE ALL ON FUNCTION public.get_orgs_v7(userid uuid) FROM authenticated;
+GRANT EXECUTE ON FUNCTION public.get_orgs_v7(userid uuid) TO postgres;
+GRANT EXECUTE ON FUNCTION public.get_orgs_v7(userid uuid) TO service_role;
+
+-- 5) Drop the column — functions no longer reference it
+ALTER TABLE public.orgs DROP COLUMN sso_enabled;
diff --git a/tests/organization-put-stripe-sync.unit.test.ts b/tests/organization-put-stripe-sync.unit.test.ts
index 51d4f06522..2cbcb1c8f7 100644
--- a/tests/organization-put-stripe-sync.unit.test.ts
+++ b/tests/organization-put-stripe-sync.unit.test.ts
@@ -80,7 +80,6 @@ function createOrgRow(overrides: Partial<OrgRow> & Pick<OrgRow, 'id' | 'name' |
     password_policy_config: null,
     require_apikey_expiration: false,
     required_encryption_key: null,
-    sso_enabled: false,
     stats_refresh_requested_at: null,
     stats_updated_at: null,
     updated_at: null,
diff --git a/tests/sso.test.ts b/tests/sso.test.ts
index e2a1b04701..275d49cb63 100644
--- a/tests/sso.test.ts
+++ b/tests/sso.test.ts
@@ -29,7 +29,6 @@ beforeAll(async () => {
     management_email: `sso-test-${SSO_TEST_ORG_ID}@capgo.app`,
     created_by: USER_ID,
     customer_id: SSO_TEST_CUSTOMER_ID,
-    sso_enabled: true,
   })
   if (orgError)
     throw orgError
@@ -168,8 +167,7 @@ describe('[POST] /private/sso/check-enforcement', () => {
         management_email: `sso-enforcement-${enforcementOrgId}@capgo.app`,
         created_by: USER_ID,
         customer_id: enforcementCustomerId,
-        sso_enabled: true,
-      })
+          })
       if (enforcementOrgError)
         throw enforcementOrgError
 
@@ -286,8 +284,7 @@ describe('[POST] /private/sso/prelink-users', () => {
         management_email: `sso-prelink-${prelinkOrgId}@capgo.app`,
         created_by: USER_ID,
         customer_id: prelinkCustomerId,
-        sso_enabled: true,
-      })
+          })
       if (prelinkOrgError)
         throw prelinkOrgError
 
@@ -316,8 +313,7 @@ describe('[POST] /private/sso/prelink-users', () => {
         management_email: `sso-foreign-${foreignOrgId}@capgo.app`,
         created_by: USER_ID,
         customer_id: foreignCustomerId,
-        sso_enabled: true,
-      })
+          })
       if (foreignOrgError)
         throw foreignOrgError
 
@@ -497,8 +493,7 @@ describe('generate_org_on_user_create', () => {
         management_email: `managed-sso-${managedOrgId}@capgo.app`,
         created_by: USER_ID,
         customer_id: managedCustomerId,
-        sso_enabled: true,
-      })
+          })
       if (orgError)
         throw orgError
 
@@ -584,8 +579,7 @@ describe('generate_org_on_user_create', () => {
         management_email: `email-managed-${managedOrgId}@capgo.app`,
         created_by: USER_ID,
         customer_id: managedCustomerId,
-        sso_enabled: true,
-      })
+          })
       if (orgError)
         throw orgError
 
@@ -738,8 +732,7 @@ describe('[POST] /private/sso/provision-user', () => {
         management_email: `sso-missing-profile-${managedOrgId}@capgo.app`,
         created_by: USER_ID,
         customer_id: managedCustomerId,
-        sso_enabled: true,
-      })
+          })
       if (orgError)
         throw orgError
 
@@ -862,8 +855,7 @@ describe('[POST] /private/sso/provision-user', () => {
         management_email: `sso-invite-promotion-${managedOrgId}@capgo.app`,
         created_by: USER_ID,
         customer_id: managedCustomerId,
-        sso_enabled: true,
-      })
+          })
       if (orgError)
         throw orgError
 
@@ -999,8 +991,7 @@ describe('[POST] /private/sso/provision-user', () => {
         management_email: `sso-merge-${managedOrgId}@capgo.app`,
         created_by: USER_ID,
         customer_id: managedCustomerId,
-        sso_enabled: true,
-      })
+          })
       if (orgError)
         throw orgError
 
@@ -1175,8 +1166,7 @@ describe('[POST] /private/sso/provision-user', () => {
         management_email: `sso-first-login-${managedOrgId}@capgo.app`,
         created_by: USER_ID,
         customer_id: managedCustomerId,
-        sso_enabled: true,
-      })
+          })
       if (orgError)
         throw orgError
 

From 9c0ea889a7d8c68d23d2206314413fdc09cdf608 Mon Sep 17 00:00:00 2001
From: Jordan Lorho <jordan.lorho@gmail.com>
Date: Fri, 1 May 2026 22:15:33 +0200
Subject: [PATCH 2/6] chore(deps): update bun.lock after cli workspace install

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 bun.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bun.lock b/bun.lock
index 60b87e2989..52d780cdd9 100644
--- a/bun.lock
+++ b/bun.lock
@@ -138,7 +138,7 @@
     },
     "cli": {
       "name": "@capgo/cli",
-      "version": "7.94.9",
+      "version": "7.95.0",
       "bin": {
         "capgo": "dist/index.js",
       },

From fb601c0df26321f7aed5f9be1f1942334b49f7ae Mon Sep 17 00:00:00 2001
From: Jordan Lorho <jordan.lorho@gmail.com>
Date: Fri, 1 May 2026 22:32:07 +0200
Subject: [PATCH 3/6] fix(migration): rename to valid timestamp, add OWNER for
 trigger function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Renamed 20260501120000 → 20260501200000 (must be > latest on main: 20260501162433)
- Added ALTER FUNCTION generate_org_on_user_create() OWNER TO postgres

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 ...20260501200000_remove_sso_enabled_flag.sql | 425 ++++++++++++++++++
 1 file changed, 425 insertions(+)
 create mode 100644 supabase/migrations/20260501200000_remove_sso_enabled_flag.sql

diff --git a/supabase/migrations/20260501200000_remove_sso_enabled_flag.sql b/supabase/migrations/20260501200000_remove_sso_enabled_flag.sql
new file mode 100644
index 0000000000..ff6f9014a3
--- /dev/null
+++ b/supabase/migrations/20260501200000_remove_sso_enabled_flag.sql
@@ -0,0 +1,425 @@
+-- Migration: Remove sso_enabled feature flag
+-- SSO is now always available: enterprise orgs get the form, others get an upgrade prompt.
+-- The flag is replaced by the enterprise plan check already enforced in requireEnterprisePlan.
+
+-- 1) Update check_domain_sso: SSO is active when a provider is active (no org flag needed)
+CREATE OR REPLACE FUNCTION public.check_domain_sso(p_domain text)
+RETURNS TABLE (
+    has_sso boolean,
+    provider_id text,
+    org_id uuid
+)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+    SELECT
+        true AS has_sso,
+        sp.provider_id,
+        sp.org_id
+    FROM public.sso_providers AS sp
+    JOIN public.orgs AS o ON o.id = sp.org_id
+    WHERE sp."domain" = lower(btrim(p_domain))
+      AND sp.status = 'active'
+    LIMIT 1;
+$$;
+
+ALTER FUNCTION public.check_domain_sso(text) OWNER TO "postgres";
+REVOKE ALL ON FUNCTION public.check_domain_sso(text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.check_domain_sso(text) TO anon;
+GRANT EXECUTE ON FUNCTION public.check_domain_sso(text) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.check_domain_sso(text) TO service_role;
+
+-- 2) Update get_sso_enforcement_by_domain: same, no org flag
+CREATE OR REPLACE FUNCTION "public"."get_sso_enforcement_by_domain"("p_domain" text)
+RETURNS TABLE("org_id" uuid, "enforce_sso" boolean)
+LANGUAGE "sql"
+STABLE
+SECURITY DEFINER
+SET "search_path" TO ''
+AS $$
+  SELECT
+    sp.org_id,
+    sp.enforce_sso
+  FROM "public"."sso_providers" sp
+  JOIN "public"."orgs" o ON o.id = sp.org_id
+  WHERE sp.domain = lower(btrim(p_domain))
+    AND sp.status = 'active'
+  LIMIT 1;
+$$;
+
+ALTER FUNCTION "public"."get_sso_enforcement_by_domain"(text) OWNER TO "postgres";
+REVOKE ALL ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) TO anon;
+GRANT EXECUTE ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) TO authenticated;
+GRANT EXECUTE ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) TO service_role;
+
+-- 3) Update generate_org_on_user_create trigger: remove sso_enabled guard from has_sso check
+CREATE OR REPLACE FUNCTION "public"."generate_org_on_user_create" () RETURNS "trigger" LANGUAGE "plpgsql"
+SET
+  search_path = '' SECURITY DEFINER AS $$
+DECLARE
+  org_record record;
+  has_sso boolean;
+  user_provider text;
+BEGIN
+    SELECT raw_app_meta_data->>'provider'
+    INTO user_provider
+    FROM auth.users
+    WHERE id = NEW.id;
+
+    SELECT EXISTS (
+      SELECT 1 FROM public.sso_providers sp
+      JOIN public.orgs o ON o.id = sp.org_id
+      WHERE sp.domain = lower(btrim(split_part(NEW.email, '@', 2)))
+      AND sp.status = 'active'
+    ) INTO has_sso;
+
+    -- Skip org creation only for genuine SAML SSO logins on SSO-managed domains.
+    IF NOT (user_provider ~ '^sso:' AND has_sso) THEN
+      INSERT INTO public.orgs (created_by, name, management_email) values (NEW.id, format('%s organization', NEW.first_name), NEW.email) RETURNING * INTO org_record;
+    END IF;
+
+    RETURN NEW;
+END $$;
+
+ALTER FUNCTION public.generate_org_on_user_create() OWNER TO postgres;
+
+-- 4) Recreate get_orgs_v7 without sso_enabled in the return type
+--    Must DROP first because CREATE OR REPLACE cannot change return type.
+--    Drop no-args overload first (it depends on the with-args overload).
+DROP FUNCTION IF EXISTS public.get_orgs_v7();
+DROP FUNCTION IF EXISTS public.get_orgs_v7(userid uuid);
+
+CREATE FUNCTION public.get_orgs_v7() RETURNS TABLE(
+  gid uuid,
+  created_by uuid,
+  created_at timestamp with time zone,
+  logo text,
+  website text,
+  name text,
+  role character varying,
+  paying boolean,
+  trial_left integer,
+  can_use_more boolean,
+  is_canceled boolean,
+  app_count bigint,
+  subscription_start timestamp with time zone,
+  subscription_end timestamp with time zone,
+  management_email text,
+  is_yearly boolean,
+  stats_updated_at timestamp without time zone,
+  stats_refresh_requested_at timestamp without time zone,
+  next_stats_update_at timestamp with time zone,
+  credit_available numeric,
+  credit_total numeric,
+  credit_next_expiration timestamp with time zone,
+  enforcing_2fa boolean,
+  "2fa_has_access" boolean,
+  enforce_hashed_api_keys boolean,
+  password_policy_config jsonb,
+  password_has_access boolean,
+  require_apikey_expiration boolean,
+  max_apikey_expiration_days integer,
+  enforce_encrypted_bundles boolean,
+  required_encryption_key character varying,
+  use_new_rbac boolean
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $$
+DECLARE
+  api_key_text text;
+  api_key record;
+  user_id uuid;
+BEGIN
+  SELECT public.get_apikey_header() INTO api_key_text;
+  user_id := NULL;
+
+  IF api_key_text IS NOT NULL THEN
+    SELECT * FROM public.find_apikey_by_value(api_key_text) INTO api_key;
+
+    IF api_key IS NULL THEN
+      PERFORM public.pg_log('deny: INVALID_API_KEY', jsonb_build_object('source', 'header'));
+      RAISE EXCEPTION 'Invalid API key provided';
+    END IF;
+
+    IF public.is_apikey_expired(api_key.expires_at) THEN
+      PERFORM public.pg_log('deny: API_KEY_EXPIRED', jsonb_build_object('key_id', api_key.id));
+      RAISE EXCEPTION 'API key has expired';
+    END IF;
+
+    user_id := api_key.user_id;
+
+    IF COALESCE(array_length(api_key.limited_to_orgs, 1), 0) > 0 THEN
+      RETURN QUERY
+      SELECT orgs.*
+      FROM public.get_orgs_v7(user_id) AS orgs
+      WHERE orgs.gid = ANY(api_key.limited_to_orgs::uuid[]);
+      RETURN;
+    END IF;
+  END IF;
+
+  IF user_id IS NULL THEN
+    SELECT public.get_identity() INTO user_id;
+
+    IF user_id IS NULL THEN
+      PERFORM public.pg_log('deny: UNAUTHENTICATED', '{}'::jsonb);
+      RAISE EXCEPTION 'No authentication provided - API key or valid session required';
+    END IF;
+  END IF;
+
+  RETURN QUERY SELECT * FROM public.get_orgs_v7(user_id);
+END;
+$$;
+
+ALTER FUNCTION public.get_orgs_v7() OWNER TO postgres;
+REVOKE ALL ON FUNCTION public.get_orgs_v7() FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.get_orgs_v7() FROM anon;
+REVOKE ALL ON FUNCTION public.get_orgs_v7() FROM authenticated;
+GRANT ALL ON FUNCTION public.get_orgs_v7() TO anon;
+GRANT ALL ON FUNCTION public.get_orgs_v7() TO authenticated;
+GRANT ALL ON FUNCTION public.get_orgs_v7() TO service_role;
+
+CREATE FUNCTION public.get_orgs_v7(userid uuid) RETURNS TABLE(
+  gid uuid,
+  created_by uuid,
+  created_at timestamp with time zone,
+  logo text,
+  website text,
+  name text,
+  role character varying,
+  paying boolean,
+  trial_left integer,
+  can_use_more boolean,
+  is_canceled boolean,
+  app_count bigint,
+  subscription_start timestamp with time zone,
+  subscription_end timestamp with time zone,
+  management_email text,
+  is_yearly boolean,
+  stats_updated_at timestamp without time zone,
+  stats_refresh_requested_at timestamp without time zone,
+  next_stats_update_at timestamp with time zone,
+  credit_available numeric,
+  credit_total numeric,
+  credit_next_expiration timestamp with time zone,
+  enforcing_2fa boolean,
+  "2fa_has_access" boolean,
+  enforce_hashed_api_keys boolean,
+  password_policy_config jsonb,
+  password_has_access boolean,
+  require_apikey_expiration boolean,
+  max_apikey_expiration_days integer,
+  enforce_encrypted_bundles boolean,
+  required_encryption_key character varying,
+  use_new_rbac boolean
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $$
+BEGIN
+  RETURN QUERY
+  WITH app_counts AS (
+    SELECT owner_org, COUNT(*) AS cnt
+    FROM public.apps
+    GROUP BY owner_org
+  ),
+  rbac_roles AS (
+    SELECT rb.org_id, r.name, r.priority_rank
+    FROM public.role_bindings rb
+    JOIN public.roles r ON rb.role_id = r.id
+    WHERE rb.principal_type = public.rbac_principal_user()
+      AND rb.principal_id = userid
+      AND rb.scope_type = public.rbac_scope_org()
+      AND rb.org_id IS NOT NULL
+      AND (rb.expires_at IS NULL OR rb.expires_at > now())
+    UNION ALL
+    SELECT rb.org_id, r.name, r.priority_rank
+    FROM public.role_bindings rb
+    JOIN public.group_members gm ON gm.group_id = rb.principal_id
+    JOIN public.roles r ON rb.role_id = r.id
+    WHERE rb.principal_type = public.rbac_principal_group()
+      AND gm.user_id = userid
+      AND rb.scope_type = public.rbac_scope_org()
+      AND rb.org_id IS NOT NULL
+      AND (rb.expires_at IS NULL OR rb.expires_at > now())
+  ),
+  rbac_org_roles AS (
+    SELECT org_id, (ARRAY_AGG(rbac_roles.name ORDER BY rbac_roles.priority_rank DESC))[1] AS role_name
+    FROM rbac_roles
+    GROUP BY org_id
+  ),
+  user_orgs AS (
+    SELECT ou.org_id
+    FROM public.org_users ou
+    WHERE ou.user_id = userid
+    UNION
+    SELECT rbac_org_roles.org_id
+    FROM rbac_org_roles
+  ),
+  time_constants AS (
+    SELECT
+      NOW() AS current_time,
+      date_trunc('MONTH', NOW()) AS current_month_start, -- NOSONAR: migration-local billing anchor
+      '0 DAYS'::INTERVAL AS zero_day_interval
+  ),
+  paying_orgs_ordered AS (
+    SELECT
+      o.id,
+      ROW_NUMBER() OVER (ORDER BY o.id ASC) - 1 AS preceding_count
+    FROM public.orgs o
+    JOIN public.stripe_info si ON o.customer_id = si.customer_id
+    CROSS JOIN time_constants tc
+    WHERE (
+      (si.status = 'succeeded' -- NOSONAR: existing stripe_info status contract
+        AND (si.canceled_at IS NULL OR si.canceled_at > tc.current_time)
+        AND si.subscription_anchor_end > tc.current_time)
+      OR si.trial_at > tc.current_time
+    )
+  ),
+  billing_cycles AS (
+    SELECT
+      o.id AS org_id,
+      CASE
+        WHEN COALESCE(si.subscription_anchor_start - date_trunc('MONTH', si.subscription_anchor_start), tc.zero_day_interval)
+             > tc.current_time - tc.current_month_start
+        THEN date_trunc('MONTH', tc.current_time - INTERVAL '1 MONTH')
+             + COALESCE(si.subscription_anchor_start - date_trunc('MONTH', si.subscription_anchor_start), tc.zero_day_interval)
+        ELSE tc.current_month_start
+             + COALESCE(si.subscription_anchor_start - date_trunc('MONTH', si.subscription_anchor_start), tc.zero_day_interval)
+      END AS cycle_start
+    FROM public.orgs o
+    CROSS JOIN time_constants tc
+    LEFT JOIN public.stripe_info si ON o.customer_id = si.customer_id
+  ),
+  two_fa_access AS (
+    SELECT
+      o.id AS org_id,
+      o.enforcing_2fa,
+      CASE
+        WHEN o.enforcing_2fa = false THEN true
+        ELSE public.has_2fa_enabled(userid)
+      END AS "2fa_has_access",
+      (o.enforcing_2fa = true AND NOT public.has_2fa_enabled(userid)) AS should_redact_2fa
+    FROM public.orgs o
+    JOIN user_orgs uo ON uo.org_id = o.id
+  ),
+  password_policy_access AS (
+    SELECT
+      o.id AS org_id,
+      o.password_policy_config,
+      public.user_meets_password_policy(userid, o.id) AS password_has_access,
+      NOT public.user_meets_password_policy(userid, o.id) AS should_redact_password
+    FROM public.orgs o
+    JOIN user_orgs uo ON uo.org_id = o.id
+  )
+  SELECT
+    o.id AS gid,
+    o.created_by,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
+      ELSE o.created_at
+    END AS created_at,
+    o.logo,
+    o.website,
+    o.name,
+    CASE
+      WHEN o.use_new_rbac AND ou.user_right::text LIKE 'invite_%' THEN ou.user_right::varchar
+      WHEN o.use_new_rbac THEN COALESCE(ror.role_name, ou.rbac_role_name, ou.user_right::varchar)
+      ELSE COALESCE(ou.user_right::varchar, ror.role_name)
+    END AS role,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
+      ELSE COALESCE(si.status = 'succeeded', false) -- NOSONAR: existing stripe_info status contract
+    END AS paying,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN 0
+      ELSE GREATEST(COALESCE((si.trial_at::date - NOW()::date), 0), 0)::integer
+    END AS trial_left,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
+      ELSE COALESCE((si.status = 'succeeded' AND si.is_good_plan = true) -- NOSONAR: existing stripe_info status contract
+        OR (si.trial_at::date - NOW()::date > 0)
+        OR COALESCE(ucb.available_credits, 0) > 0, false)
+    END AS can_use_more,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
+      ELSE COALESCE(si.status = 'canceled', false)
+    END AS is_canceled,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN 0::bigint
+      ELSE COALESCE(ac.cnt, 0)
+    END AS app_count,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
+      ELSE bc.cycle_start
+    END AS subscription_start,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
+      ELSE (bc.cycle_start + INTERVAL '1 MONTH')
+    END AS subscription_end,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::text
+      ELSE o.management_email
+    END AS management_email,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
+      ELSE COALESCE(si.price_id = p.price_y_id, false)
+    END AS is_yearly,
+    o.stats_updated_at,
+    o.stats_refresh_requested_at,
+    CASE
+      WHEN poo.id IS NOT NULL THEN
+        public.get_next_cron_time('0 3 * * *', NOW()) + make_interval(mins => poo.preceding_count::int * 4)
+      ELSE NULL
+    END AS next_stats_update_at,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::numeric
+      ELSE COALESCE(ucb.available_credits, 0)
+    END AS credit_available,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::numeric
+      ELSE COALESCE(ucb.total_credits, 0)
+    END AS credit_total,
+    CASE
+      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
+      ELSE ucb.next_expiration
+    END AS credit_next_expiration,
+    tfa.enforcing_2fa,
+    tfa."2fa_has_access",
+    o.enforce_hashed_api_keys,
+    ppa.password_policy_config,
+    ppa.password_has_access,
+    o.require_apikey_expiration,
+    o.max_apikey_expiration_days,
+    o.enforce_encrypted_bundles,
+    o.required_encryption_key,
+    o.use_new_rbac
+  FROM public.orgs o
+  JOIN user_orgs uo ON uo.org_id = o.id
+  LEFT JOIN public.org_users ou ON ou.user_id = userid AND o.id = ou.org_id
+  LEFT JOIN rbac_org_roles ror ON ror.org_id = o.id
+  LEFT JOIN two_fa_access tfa ON tfa.org_id = o.id
+  LEFT JOIN password_policy_access ppa ON ppa.org_id = o.id
+  LEFT JOIN public.stripe_info si ON o.customer_id = si.customer_id
+  LEFT JOIN public.plans p ON si.product_id = p.stripe_id
+  LEFT JOIN app_counts ac ON ac.owner_org = o.id
+  LEFT JOIN public.usage_credit_balances ucb ON ucb.org_id = o.id
+  LEFT JOIN paying_orgs_ordered poo ON poo.id = o.id
+  LEFT JOIN billing_cycles bc ON bc.org_id = o.id;
+END;
+$$;
+
+ALTER FUNCTION public.get_orgs_v7(userid uuid) OWNER TO postgres;
+REVOKE ALL ON FUNCTION public.get_orgs_v7(userid uuid) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.get_orgs_v7(userid uuid) FROM anon;
+REVOKE ALL ON FUNCTION public.get_orgs_v7(userid uuid) FROM authenticated;
+GRANT EXECUTE ON FUNCTION public.get_orgs_v7(userid uuid) TO postgres;
+GRANT EXECUTE ON FUNCTION public.get_orgs_v7(userid uuid) TO service_role;
+
+-- 5) Drop the column — functions no longer reference it
+ALTER TABLE public.orgs DROP COLUMN sso_enabled;

From 35249b10af57425bbd8074a56146780d5b6d2b48 Mon Sep 17 00:00:00 2001
From: Jordan Lorho <jordan.lorho@gmail.com>
Date: Fri, 1 May 2026 22:33:55 +0200
Subject: [PATCH 4/6] chore(migration): remove old migration with incorrect
 timestamp

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 ...20260501120000_remove_sso_enabled_flag.sql | 423 ------------------
 1 file changed, 423 deletions(-)
 delete mode 100644 supabase/migrations/20260501120000_remove_sso_enabled_flag.sql

diff --git a/supabase/migrations/20260501120000_remove_sso_enabled_flag.sql b/supabase/migrations/20260501120000_remove_sso_enabled_flag.sql
deleted file mode 100644
index ddbbd37275..0000000000
--- a/supabase/migrations/20260501120000_remove_sso_enabled_flag.sql
+++ /dev/null
@@ -1,423 +0,0 @@
--- Migration: Remove sso_enabled feature flag
--- SSO is now always available: enterprise orgs get the form, others get an upgrade prompt.
--- The flag is replaced by the enterprise plan check already enforced in requireEnterprisePlan.
-
--- 1) Update check_domain_sso: SSO is active when a provider is active (no org flag needed)
-CREATE OR REPLACE FUNCTION public.check_domain_sso(p_domain text)
-RETURNS TABLE (
-    has_sso boolean,
-    provider_id text,
-    org_id uuid
-)
-LANGUAGE sql
-STABLE
-SECURITY DEFINER
-SET search_path = ''
-AS $$
-    SELECT
-        true AS has_sso,
-        sp.provider_id,
-        sp.org_id
-    FROM public.sso_providers AS sp
-    JOIN public.orgs AS o ON o.id = sp.org_id
-    WHERE sp."domain" = lower(btrim(p_domain))
-      AND sp.status = 'active'
-    LIMIT 1;
-$$;
-
-ALTER FUNCTION public.check_domain_sso(text) OWNER TO "postgres";
-REVOKE ALL ON FUNCTION public.check_domain_sso(text) FROM PUBLIC;
-GRANT EXECUTE ON FUNCTION public.check_domain_sso(text) TO anon;
-GRANT EXECUTE ON FUNCTION public.check_domain_sso(text) TO authenticated;
-GRANT EXECUTE ON FUNCTION public.check_domain_sso(text) TO service_role;
-
--- 2) Update get_sso_enforcement_by_domain: same, no org flag
-CREATE OR REPLACE FUNCTION "public"."get_sso_enforcement_by_domain"("p_domain" text)
-RETURNS TABLE("org_id" uuid, "enforce_sso" boolean)
-LANGUAGE "sql"
-STABLE
-SECURITY DEFINER
-SET "search_path" TO ''
-AS $$
-  SELECT
-    sp.org_id,
-    sp.enforce_sso
-  FROM "public"."sso_providers" sp
-  JOIN "public"."orgs" o ON o.id = sp.org_id
-  WHERE sp.domain = lower(btrim(p_domain))
-    AND sp.status = 'active'
-  LIMIT 1;
-$$;
-
-ALTER FUNCTION "public"."get_sso_enforcement_by_domain"(text) OWNER TO "postgres";
-REVOKE ALL ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) FROM PUBLIC;
-GRANT EXECUTE ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) TO anon;
-GRANT EXECUTE ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) TO authenticated;
-GRANT EXECUTE ON FUNCTION "public"."get_sso_enforcement_by_domain"(text) TO service_role;
-
--- 3) Update generate_org_on_user_create trigger: remove sso_enabled guard from has_sso check
-CREATE OR REPLACE FUNCTION "public"."generate_org_on_user_create" () RETURNS "trigger" LANGUAGE "plpgsql"
-SET
-  search_path = '' SECURITY DEFINER AS $$
-DECLARE
-  org_record record;
-  has_sso boolean;
-  user_provider text;
-BEGIN
-    SELECT raw_app_meta_data->>'provider'
-    INTO user_provider
-    FROM auth.users
-    WHERE id = NEW.id;
-
-    SELECT EXISTS (
-      SELECT 1 FROM public.sso_providers sp
-      JOIN public.orgs o ON o.id = sp.org_id
-      WHERE sp.domain = lower(btrim(split_part(NEW.email, '@', 2)))
-      AND sp.status = 'active'
-    ) INTO has_sso;
-
-    -- Skip org creation only for genuine SAML SSO logins on SSO-managed domains.
-    IF NOT (user_provider ~ '^sso:' AND has_sso) THEN
-      INSERT INTO public.orgs (created_by, name, management_email) values (NEW.id, format('%s organization', NEW.first_name), NEW.email) RETURNING * INTO org_record;
-    END IF;
-
-    RETURN NEW;
-END $$;
-
--- 4) Recreate get_orgs_v7 without sso_enabled in the return type
---    Must DROP first because CREATE OR REPLACE cannot change return type.
---    Drop no-args overload first (it depends on the with-args overload).
-DROP FUNCTION IF EXISTS public.get_orgs_v7();
-DROP FUNCTION IF EXISTS public.get_orgs_v7(userid uuid);
-
-CREATE FUNCTION public.get_orgs_v7() RETURNS TABLE(
-  gid uuid,
-  created_by uuid,
-  created_at timestamp with time zone,
-  logo text,
-  website text,
-  name text,
-  role character varying,
-  paying boolean,
-  trial_left integer,
-  can_use_more boolean,
-  is_canceled boolean,
-  app_count bigint,
-  subscription_start timestamp with time zone,
-  subscription_end timestamp with time zone,
-  management_email text,
-  is_yearly boolean,
-  stats_updated_at timestamp without time zone,
-  stats_refresh_requested_at timestamp without time zone,
-  next_stats_update_at timestamp with time zone,
-  credit_available numeric,
-  credit_total numeric,
-  credit_next_expiration timestamp with time zone,
-  enforcing_2fa boolean,
-  "2fa_has_access" boolean,
-  enforce_hashed_api_keys boolean,
-  password_policy_config jsonb,
-  password_has_access boolean,
-  require_apikey_expiration boolean,
-  max_apikey_expiration_days integer,
-  enforce_encrypted_bundles boolean,
-  required_encryption_key character varying,
-  use_new_rbac boolean
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path TO ''
-AS $$
-DECLARE
-  api_key_text text;
-  api_key record;
-  user_id uuid;
-BEGIN
-  SELECT public.get_apikey_header() INTO api_key_text;
-  user_id := NULL;
-
-  IF api_key_text IS NOT NULL THEN
-    SELECT * FROM public.find_apikey_by_value(api_key_text) INTO api_key;
-
-    IF api_key IS NULL THEN
-      PERFORM public.pg_log('deny: INVALID_API_KEY', jsonb_build_object('source', 'header'));
-      RAISE EXCEPTION 'Invalid API key provided';
-    END IF;
-
-    IF public.is_apikey_expired(api_key.expires_at) THEN
-      PERFORM public.pg_log('deny: API_KEY_EXPIRED', jsonb_build_object('key_id', api_key.id));
-      RAISE EXCEPTION 'API key has expired';
-    END IF;
-
-    user_id := api_key.user_id;
-
-    IF COALESCE(array_length(api_key.limited_to_orgs, 1), 0) > 0 THEN
-      RETURN QUERY
-      SELECT orgs.*
-      FROM public.get_orgs_v7(user_id) AS orgs
-      WHERE orgs.gid = ANY(api_key.limited_to_orgs::uuid[]);
-      RETURN;
-    END IF;
-  END IF;
-
-  IF user_id IS NULL THEN
-    SELECT public.get_identity() INTO user_id;
-
-    IF user_id IS NULL THEN
-      PERFORM public.pg_log('deny: UNAUTHENTICATED', '{}'::jsonb);
-      RAISE EXCEPTION 'No authentication provided - API key or valid session required';
-    END IF;
-  END IF;
-
-  RETURN QUERY SELECT * FROM public.get_orgs_v7(user_id);
-END;
-$$;
-
-ALTER FUNCTION public.get_orgs_v7() OWNER TO postgres;
-REVOKE ALL ON FUNCTION public.get_orgs_v7() FROM PUBLIC;
-REVOKE ALL ON FUNCTION public.get_orgs_v7() FROM anon;
-REVOKE ALL ON FUNCTION public.get_orgs_v7() FROM authenticated;
-GRANT ALL ON FUNCTION public.get_orgs_v7() TO anon;
-GRANT ALL ON FUNCTION public.get_orgs_v7() TO authenticated;
-GRANT ALL ON FUNCTION public.get_orgs_v7() TO service_role;
-
-CREATE FUNCTION public.get_orgs_v7(userid uuid) RETURNS TABLE(
-  gid uuid,
-  created_by uuid,
-  created_at timestamp with time zone,
-  logo text,
-  website text,
-  name text,
-  role character varying,
-  paying boolean,
-  trial_left integer,
-  can_use_more boolean,
-  is_canceled boolean,
-  app_count bigint,
-  subscription_start timestamp with time zone,
-  subscription_end timestamp with time zone,
-  management_email text,
-  is_yearly boolean,
-  stats_updated_at timestamp without time zone,
-  stats_refresh_requested_at timestamp without time zone,
-  next_stats_update_at timestamp with time zone,
-  credit_available numeric,
-  credit_total numeric,
-  credit_next_expiration timestamp with time zone,
-  enforcing_2fa boolean,
-  "2fa_has_access" boolean,
-  enforce_hashed_api_keys boolean,
-  password_policy_config jsonb,
-  password_has_access boolean,
-  require_apikey_expiration boolean,
-  max_apikey_expiration_days integer,
-  enforce_encrypted_bundles boolean,
-  required_encryption_key character varying,
-  use_new_rbac boolean
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path TO ''
-AS $$
-BEGIN
-  RETURN QUERY
-  WITH app_counts AS (
-    SELECT owner_org, COUNT(*) AS cnt
-    FROM public.apps
-    GROUP BY owner_org
-  ),
-  rbac_roles AS (
-    SELECT rb.org_id, r.name, r.priority_rank
-    FROM public.role_bindings rb
-    JOIN public.roles r ON rb.role_id = r.id
-    WHERE rb.principal_type = public.rbac_principal_user()
-      AND rb.principal_id = userid
-      AND rb.scope_type = public.rbac_scope_org()
-      AND rb.org_id IS NOT NULL
-      AND (rb.expires_at IS NULL OR rb.expires_at > now())
-    UNION ALL
-    SELECT rb.org_id, r.name, r.priority_rank
-    FROM public.role_bindings rb
-    JOIN public.group_members gm ON gm.group_id = rb.principal_id
-    JOIN public.roles r ON rb.role_id = r.id
-    WHERE rb.principal_type = public.rbac_principal_group()
-      AND gm.user_id = userid
-      AND rb.scope_type = public.rbac_scope_org()
-      AND rb.org_id IS NOT NULL
-      AND (rb.expires_at IS NULL OR rb.expires_at > now())
-  ),
-  rbac_org_roles AS (
-    SELECT org_id, (ARRAY_AGG(rbac_roles.name ORDER BY rbac_roles.priority_rank DESC))[1] AS role_name
-    FROM rbac_roles
-    GROUP BY org_id
-  ),
-  user_orgs AS (
-    SELECT ou.org_id
-    FROM public.org_users ou
-    WHERE ou.user_id = userid
-    UNION
-    SELECT rbac_org_roles.org_id
-    FROM rbac_org_roles
-  ),
-  time_constants AS (
-    SELECT
-      NOW() AS current_time,
-      date_trunc('MONTH', NOW()) AS current_month_start, -- NOSONAR: migration-local billing anchor
-      '0 DAYS'::INTERVAL AS zero_day_interval
-  ),
-  paying_orgs_ordered AS (
-    SELECT
-      o.id,
-      ROW_NUMBER() OVER (ORDER BY o.id ASC) - 1 AS preceding_count
-    FROM public.orgs o
-    JOIN public.stripe_info si ON o.customer_id = si.customer_id
-    CROSS JOIN time_constants tc
-    WHERE (
-      (si.status = 'succeeded' -- NOSONAR: existing stripe_info status contract
-        AND (si.canceled_at IS NULL OR si.canceled_at > tc.current_time)
-        AND si.subscription_anchor_end > tc.current_time)
-      OR si.trial_at > tc.current_time
-    )
-  ),
-  billing_cycles AS (
-    SELECT
-      o.id AS org_id,
-      CASE
-        WHEN COALESCE(si.subscription_anchor_start - date_trunc('MONTH', si.subscription_anchor_start), tc.zero_day_interval)
-             > tc.current_time - tc.current_month_start
-        THEN date_trunc('MONTH', tc.current_time - INTERVAL '1 MONTH')
-             + COALESCE(si.subscription_anchor_start - date_trunc('MONTH', si.subscription_anchor_start), tc.zero_day_interval)
-        ELSE tc.current_month_start
-             + COALESCE(si.subscription_anchor_start - date_trunc('MONTH', si.subscription_anchor_start), tc.zero_day_interval)
-      END AS cycle_start
-    FROM public.orgs o
-    CROSS JOIN time_constants tc
-    LEFT JOIN public.stripe_info si ON o.customer_id = si.customer_id
-  ),
-  two_fa_access AS (
-    SELECT
-      o.id AS org_id,
-      o.enforcing_2fa,
-      CASE
-        WHEN o.enforcing_2fa = false THEN true
-        ELSE public.has_2fa_enabled(userid)
-      END AS "2fa_has_access",
-      (o.enforcing_2fa = true AND NOT public.has_2fa_enabled(userid)) AS should_redact_2fa
-    FROM public.orgs o
-    JOIN user_orgs uo ON uo.org_id = o.id
-  ),
-  password_policy_access AS (
-    SELECT
-      o.id AS org_id,
-      o.password_policy_config,
-      public.user_meets_password_policy(userid, o.id) AS password_has_access,
-      NOT public.user_meets_password_policy(userid, o.id) AS should_redact_password
-    FROM public.orgs o
-    JOIN user_orgs uo ON uo.org_id = o.id
-  )
-  SELECT
-    o.id AS gid,
-    o.created_by,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
-      ELSE o.created_at
-    END AS created_at,
-    o.logo,
-    o.website,
-    o.name,
-    CASE
-      WHEN o.use_new_rbac AND ou.user_right::text LIKE 'invite_%' THEN ou.user_right::varchar
-      WHEN o.use_new_rbac THEN COALESCE(ror.role_name, ou.rbac_role_name, ou.user_right::varchar)
-      ELSE COALESCE(ou.user_right::varchar, ror.role_name)
-    END AS role,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
-      ELSE COALESCE(si.status = 'succeeded', false) -- NOSONAR: existing stripe_info status contract
-    END AS paying,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN 0
-      ELSE GREATEST(COALESCE((si.trial_at::date - NOW()::date), 0), 0)::integer
-    END AS trial_left,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
-      ELSE COALESCE((si.status = 'succeeded' AND si.is_good_plan = true) -- NOSONAR: existing stripe_info status contract
-        OR (si.trial_at::date - NOW()::date > 0)
-        OR COALESCE(ucb.available_credits, 0) > 0, false)
-    END AS can_use_more,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
-      ELSE COALESCE(si.status = 'canceled', false)
-    END AS is_canceled,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN 0::bigint
-      ELSE COALESCE(ac.cnt, 0)
-    END AS app_count,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
-      ELSE bc.cycle_start
-    END AS subscription_start,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
-      ELSE (bc.cycle_start + INTERVAL '1 MONTH')
-    END AS subscription_end,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::text
-      ELSE o.management_email
-    END AS management_email,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN false
-      ELSE COALESCE(si.price_id = p.price_y_id, false)
-    END AS is_yearly,
-    o.stats_updated_at,
-    o.stats_refresh_requested_at,
-    CASE
-      WHEN poo.id IS NOT NULL THEN
-        public.get_next_cron_time('0 3 * * *', NOW()) + make_interval(mins => poo.preceding_count::int * 4)
-      ELSE NULL
-    END AS next_stats_update_at,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::numeric
-      ELSE COALESCE(ucb.available_credits, 0)
-    END AS credit_available,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::numeric
-      ELSE COALESCE(ucb.total_credits, 0)
-    END AS credit_total,
-    CASE
-      WHEN tfa.should_redact_2fa OR ppa.should_redact_password THEN NULL::timestamptz
-      ELSE ucb.next_expiration
-    END AS credit_next_expiration,
-    tfa.enforcing_2fa,
-    tfa."2fa_has_access",
-    o.enforce_hashed_api_keys,
-    ppa.password_policy_config,
-    ppa.password_has_access,
-    o.require_apikey_expiration,
-    o.max_apikey_expiration_days,
-    o.enforce_encrypted_bundles,
-    o.required_encryption_key,
-    o.use_new_rbac
-  FROM public.orgs o
-  JOIN user_orgs uo ON uo.org_id = o.id
-  LEFT JOIN public.org_users ou ON ou.user_id = userid AND o.id = ou.org_id
-  LEFT JOIN rbac_org_roles ror ON ror.org_id = o.id
-  LEFT JOIN two_fa_access tfa ON tfa.org_id = o.id
-  LEFT JOIN password_policy_access ppa ON ppa.org_id = o.id
-  LEFT JOIN public.stripe_info si ON o.customer_id = si.customer_id
-  LEFT JOIN public.plans p ON si.product_id = p.stripe_id
-  LEFT JOIN app_counts ac ON ac.owner_org = o.id
-  LEFT JOIN public.usage_credit_balances ucb ON ucb.org_id = o.id
-  LEFT JOIN paying_orgs_ordered poo ON poo.id = o.id
-  LEFT JOIN billing_cycles bc ON bc.org_id = o.id;
-END;
-$$;
-
-ALTER FUNCTION public.get_orgs_v7(userid uuid) OWNER TO postgres;
-REVOKE ALL ON FUNCTION public.get_orgs_v7(userid uuid) FROM PUBLIC;
-REVOKE ALL ON FUNCTION public.get_orgs_v7(userid uuid) FROM anon;
-REVOKE ALL ON FUNCTION public.get_orgs_v7(userid uuid) FROM authenticated;
-GRANT EXECUTE ON FUNCTION public.get_orgs_v7(userid uuid) TO postgres;
-GRANT EXECUTE ON FUNCTION public.get_orgs_v7(userid uuid) TO service_role;
-
--- 5) Drop the column — functions no longer reference it
-ALTER TABLE public.orgs DROP COLUMN sso_enabled;

From c41b125510133c69b53f0e3cf61d3d3e33ec40aa Mon Sep 17 00:00:00 2001
From: Jordan Lorho <jordan.lorho@gmail.com>
Date: Sat, 2 May 2026 15:12:04 +0200
Subject: [PATCH 5/6] fix(migration): skip org creation for email users on SSO
 domains

Per CodeRabbit review: email signups on domains with an active SSO
provider are handled by provision-user.ts and should not receive an
auto-created personal org, same as genuine SAML SSO logins.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../migrations/20260501200000_remove_sso_enabled_flag.sql    | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/supabase/migrations/20260501200000_remove_sso_enabled_flag.sql b/supabase/migrations/20260501200000_remove_sso_enabled_flag.sql
index ff6f9014a3..fff8e9df82 100644
--- a/supabase/migrations/20260501200000_remove_sso_enabled_flag.sql
+++ b/supabase/migrations/20260501200000_remove_sso_enabled_flag.sql
@@ -76,8 +76,9 @@ BEGIN
       AND sp.status = 'active'
     ) INTO has_sso;
 
-    -- Skip org creation only for genuine SAML SSO logins on SSO-managed domains.
-    IF NOT (user_provider ~ '^sso:' AND has_sso) THEN
+    -- Skip org creation for SSO-managed domains: genuine SAML logins and email signups
+    -- on domains with an active SSO provider both get assigned via provision-user.ts.
+    IF NOT ((user_provider ~ '^sso:' OR user_provider = 'email') AND has_sso) THEN
       INSERT INTO public.orgs (created_by, name, management_email) values (NEW.id, format('%s organization', NEW.first_name), NEW.email) RETURNING * INTO org_record;
     END IF;
 

From d1467ae378482c72583f0cd17e1faff45ae86062 Mon Sep 17 00:00:00 2001
From: Jordan Lorho <jordan.lorho@gmail.com>
Date: Sat, 2 May 2026 15:15:13 +0200
Subject: [PATCH 6/6] Revert "fix(migration): skip org creation for email users
 on SSO domains"

This reverts commit c41b125510133c69b53f0e3cf61d3d3e33ec40aa.
---
 .../migrations/20260501200000_remove_sso_enabled_flag.sql    | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/supabase/migrations/20260501200000_remove_sso_enabled_flag.sql b/supabase/migrations/20260501200000_remove_sso_enabled_flag.sql
index fff8e9df82..ff6f9014a3 100644
--- a/supabase/migrations/20260501200000_remove_sso_enabled_flag.sql
+++ b/supabase/migrations/20260501200000_remove_sso_enabled_flag.sql
@@ -76,9 +76,8 @@ BEGIN
       AND sp.status = 'active'
     ) INTO has_sso;
 
-    -- Skip org creation for SSO-managed domains: genuine SAML logins and email signups
-    -- on domains with an active SSO provider both get assigned via provision-user.ts.
-    IF NOT ((user_provider ~ '^sso:' OR user_provider = 'email') AND has_sso) THEN
+    -- Skip org creation only for genuine SAML SSO logins on SSO-managed domains.
+    IF NOT (user_provider ~ '^sso:' AND has_sso) THEN
       INSERT INTO public.orgs (created_by, name, management_email) values (NEW.id, format('%s organization', NEW.first_name), NEW.email) RETURNING * INTO org_record;
     END IF;