fix(auth): recover from SSO provider lookup errors

[BillLeoutsakosvl346]

Summary

Fix the global SSO form so Better Auth HTTP failures returned through result.error restore an idle, retryable state instead of leaving the submit button stuck on “Redirecting to SSO provider…”. All initiation failures now use the same generic client message, while the existing non-disclosing backend 404 and successful redirect flow remain unchanged.

Related: Slack thread and security discussion

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: N/A

Testing

• NEXT_PUBLIC_APP_URL=http://localhost:3000 bunx vitest run ee/sso/components/sso-form.test.tsx — 7 tests passed
• bunx biome check apps/sim/ee/sso/components/sso-form.tsx apps/sim/ee/sso/components/sso-form.test.tsx — passed with no fixes required
• bun run --cwd apps/sim type-check — passed

Reviewers should focus on the resolved-error path, generic non-disclosing copy, and restoration of the enabled submit state for retry. Focused tests also cover rejected requests and verify raw provider/domain errors are never rendered.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA) — left unchecked for the contributor to confirm personally

Screenshots/Videos

Not applicable: this changes error-state behavior and copy without changing layout; the regression is covered by focused interaction tests. The original stuck-state screenshot is available in the linked Slack thread.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 22, 2026 2:41am

[cursor]

PR Summary

Medium Risk
Touches auth error handling and user-visible SSO failure copy; the change is small and reduces information leakage, but incorrect handling could still strand users or hide real failures.

Overview
Fixes the SSO form getting stuck on “Redirecting to SSO provider…” when Better Auth returns a resolved result.error (e.g. 404 / no provider) instead of throwing.

onSubmit now treats missing/error results like exceptions, always clears loading in finally, and shows one generic retryable message so provider/domain details never reach the UI. Interaction tests cover the 404 path, retries, and rejected requests.

^{Reviewed by Cursor Bugbot for commit 823b2f2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR makes SSO initiation failures recoverable and non-disclosing by handling both resolved Better Auth errors and rejected requests, restoring the enabled submit state after completion.

• Adds a generic client-facing SSO failure message and handles errors returned through result.error.
• Moves loading-state cleanup into finally so failed requests can be retried.
• Adds interaction tests for resolved 404 responses, rejected requests, generic copy, and retry behavior.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or non-blocking defects identified in the changed behavior.

The form now handles both resolved Better Auth errors and rejected requests without exposing backend details, and the focused tests verify that users can retry after either failure mode.

Important Files Changed

Filename	Overview
apps/sim/ee/sso/components/sso-form.tsx	Handles resolved and rejected SSO initiation failures uniformly, prevents raw backend error disclosure, and restores the retryable form state.
apps/sim/ee/sso/components/sso-form.test.tsx	Adds focused interaction coverage for resolved and rejected failures, generic error presentation, button recovery, and retry.

_{Reviews (1): Last reviewed commit: "fix(auth): recover from SSO provider loo..." | Re-trigger Greptile}