dubinc · steven-tey · Sep 29, 2025 · Sep 19, 2025 · Sep 23, 2025 · Sep 23, 2025
diff --git a/apps/web/app/api/workspaces/[idOrSlug]/route.ts b/apps/web/app/api/workspaces/[idOrSlug]/route.ts
@@ -6,6 +6,7 @@ import { deleteWorkspace } from "@/lib/api/workspaces/delete-workspace";
 import { prefixWorkspaceId } from "@/lib/api/workspaces/workspace-id";
 import { withWorkspace } from "@/lib/auth";
 import { getFeatureFlags } from "@/lib/edge-config";
+import { jackson } from "@/lib/jackson";
 import { storage } from "@/lib/storage";
 import z from "@/lib/zod";
 import {
@@ -32,6 +33,7 @@ const updateWorkspaceSchema = createWorkspaceSchema
         z.null(),
       ])
       .optional(),
+    ssoEmailDomain: z.string().nullish(),
   })
   .partial();
 
@@ -75,14 +77,15 @@ export const GET = withWorkspace(
 
 // PATCH /api/workspaces/[idOrSlug] – update a specific workspace by id or slug
 export const PATCH = withWorkspace(
-  async ({ req, workspace }) => {
+  async ({ req, workspace, session }) => {
     const {
       name,
       slug,
       logo,
       conversionEnabled,
       allowedHostnames,
       publishableKey,
+      ssoEmailDomain,
     } = await updateWorkspaceSchema.parseAsync(await parseRequestBody(req));
 
     if (["free", "pro"].includes(workspace.plan) && conversionEnabled) {
@@ -103,6 +106,30 @@ export const PATCH = withWorkspace(
         )
       : null;
 
+    if (ssoEmailDomain) {
+      if (workspace.plan !== "enterprise") {
+        throw new DubApiError({
+          code: "forbidden",
+          message: "SAML SSO is only available on enterprise plans.",
+        });
+      }
+
+      // Check if SAML is configured before enforcing ssoEmailDomain
+      const { apiController } = await jackson();
+
+      const connections = await apiController.getConnections({
+        tenant: workspace.id,
+        product: "Dub",
+      });
+
+      if (connections.length === 0) {
+        throw new DubApiError({
+          code: "forbidden",
+          message: "SAML SSO is not configured for this workspace.",
+        });
+      }
+    }
+
     try {
       const response = await prisma.project.update({
         where: {
@@ -117,6 +144,7 @@ export const PATCH = withWorkspace(
             allowedHostnames: validHostnames,
           }),
           ...(publishableKey !== undefined && { publishableKey }),
+          ...(ssoEmailDomain !== undefined && { ssoEmailDomain }),
         },
         include: {
           domains: {
@@ -184,7 +212,7 @@ export const PATCH = withWorkspace(
       if (error.code === "P2002") {
         throw new DubApiError({
           code: "conflict",
-          message: `The slug "${slug}" is already in use.`,
+          message: `The ${ssoEmailDomain ? "email domain" : "slug"} "${ssoEmailDomain || slug}" is already in use.`,
         });
       } else {
         throw new DubApiError({

diff --git a/apps/web/app/api/workspaces/[idOrSlug]/saml/route.ts b/apps/web/app/api/workspaces/[idOrSlug]/saml/route.ts
@@ -1,6 +1,7 @@
 import { withWorkspace } from "@/lib/auth";
 import { jackson, samlAudience } from "@/lib/jackson";
 import z from "@/lib/zod";
+import { prisma } from "@dub/prisma";
 import { APP_DOMAIN_WITH_NGROK } from "@dub/utils";
 import { NextResponse } from "next/server";
 
@@ -76,7 +77,7 @@ export const POST = withWorkspace(
 
 // DELETE /api/workspaces/[idOrSlug]/saml – delete all SAML connections
 export const DELETE = withWorkspace(
-  async ({ searchParams }) => {
+  async ({ searchParams, workspace }) => {
     const { clientID, clientSecret } =
       deleteSAMLConnectionSchema.parse(searchParams);
 
@@ -87,7 +88,18 @@ export const DELETE = withWorkspace(
       clientSecret,
     });
 
-    return NextResponse.json({ response: "removed SAML connection" });
+    await prisma.project.update({
+      where: {
+        id: workspace.id,
+      },
+      data: {
+        ssoEmailDomain: null,
+      },
+    });
+
+    return NextResponse.json({
+      response: "Successfully removed SAML connection",
+    });
   },
   {
     requiredPermissions: ["workspaces.write"],