fix(sso): check providers array instead of provider for SSO auth

supabase/functions/_backend/private/sso/check-enforcement.ts

@@ -30,13 +30,17 @@ app.post('/', middlewareAuth, async (c) => {
     return quickError(400, 'no_email', 'Email not found in authentication token')
   }
 
-  // Determine auth type from JWT app_metadata.provider
+  // Determine auth type from JWT app_metadata — check both provider (singular, last login)
+  // and providers[] (array, cumulative). After an account merge Supabase resets provider='email'
+  // while providers[] retains the sso:X entry, so providers[] is the reliable source of truth.
   const provider = claims?.app_metadata?.provider
-  const isSsoAuth = !!provider && provider !== 'email'
+  const providers: string[] = Array.isArray(claims?.app_metadata?.providers) ? claims.app_metadata.providers as string[] : []
+  const isSsoProvider = (p: string) => p === 'sso' || p.startsWith('sso:')
+  const isSsoAuth = isSsoProvider(provider ?? '') || providers.some(isSsoProvider)
 
   // SSO authentication is always allowed
   if (isSsoAuth) {
-    cloudlog({ requestId, context: 'check_enforcement - SSO auth always allowed', email, provider })
+    cloudlog({ requestId, context: 'check_enforcement - SSO auth always allowed', email, provider, providers })
     return c.json({ allowed: true })
   }
 

supabase/functions/_backend/private/sso/provision-user.ts

@@ -116,13 +116,15 @@ app.post('/', async (c: Context<MiddlewareKeyVariables>) => {
     }
 
     const userProvider = userAuth.user.app_metadata?.provider
-    if (!userProvider || (userProvider !== 'sso' && !userProvider.startsWith('sso:'))) {
-      cloudlog({ requestId, message: 'User did not authenticate via SSO, rejecting provisioning', userId, provider: userProvider })
+    const userProviders: string[] = userAuth.user.app_metadata?.providers ?? []
+    const isSsoProvider = (p: string) => p === 'sso' || p.startsWith('sso:')
+    if (!isSsoProvider(userProvider ?? '') && !userProviders.some(isSsoProvider)) {
+      cloudlog({ requestId, message: 'User did not authenticate via SSO, rejecting provisioning', userId, provider: userProvider, providers: userProviders })
       return quickError(403, 'sso_auth_required', 'User must authenticate via SSO to be provisioned')
     }
 
     const userIdentities = userAuth.user.identities ?? []
-    const trustedSsoProviders = getTrustedSsoProviders(userProvider, userIdentities)
+    const trustedSsoProviders = getTrustedSsoProviders(userProvider ?? '', userIdentities)
     if (trustedSsoProviders.length === 0) {
       cloudlog({ requestId, message: 'User has no SSO identity, rejecting provisioning', userId })
       return quickError(403, 'sso_identity_required', 'User must have an SSO identity to be provisioned')