[fix] SSO 登入撞既有 Google 帳號回 error=UNKNOWN：開 domainVerification、補 domain_verified - #57
Merged
Merged
Conversation
YJack0000
enabled auto-merge (squash)
August 28, 2026 10:54
YJack0000
force-pushed
the
claude/sso-domain-verified-hotfix
branch
from
August 28, 2026 10:57
bc21504 to
8439a1f
Compare
✅ SonarQube Quality Gate passed — pathorsAI_internal0 open issues on this PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR #56 上線後第一個實地回報：已用 Google 登入過的員工改走「Continue with SSO」，callback 被踢回
/?error=UNKNOWN。根因：@better-auth/sso 的 OIDC callback 只在
provider.domainVerified === true且登入者 email 網域與 provider 註冊網域相符時，才把這次登入視為 trusted provider；不 trusted 就拒絕 link 到既有的同 email user（better-auth link-account 的安全規則）。我們的sso_provider表沒建domain_verified欄（該欄只在開domainVerification選項時屬於 schema），所以永遠不信任 → 同 email 既有帳號一律連結失敗。修法（語意上也是對的信任模型——「網域已驗證 + email 網域相符」，不用硬編 provider 名單）：
sso({ domainVerification: { enabled: true } })migrations/0021_sso_domain_verified.sql：加domain_verified boolean NOT NULL DEFAULT false，既有 row 補 true（全部都是腳本註冊的）scripts/register-sso-provider.ts註冊時直接寫domainVerified: true（我們封死了 HTTP 註冊、不用 DNS TXT 驗證流程；腳本註冊即驗證）migration 已於 2026-08-28 先行套用到 prod（
pathorsprovider 已domain_verified = t），merge 部署後即刻生效。lint / tsc / build 全過。