From a677191e473e087fa4f47b79a1552562c5bd951b Mon Sep 17 00:00:00 2001
From: Scott Wilson <scottraywilson@gmail.com>
Date: Wed, 10 Sep 2025 14:18:23 -0700
Subject: [PATCH] fix(sso): this PR corrects where plan identity limits are
 checked during sso login to prevent throwing limit error on users that
 already have a membership for email login

---
 .../services/ldap-config/ldap-config-service.ts | 17 +++++++++--------
 .../src/ee/services/oidc/oidc-config-service.ts |  9 +++++++++
 .../services/saml-config/saml-config-service.ts | 17 +++++++++--------
 3 files changed, 27 insertions(+), 16 deletions(-)

diff --git a/backend/src/ee/services/ldap-config/ldap-config-service.ts b/backend/src/ee/services/ldap-config/ldap-config-service.ts
index 4592cf003..3b1827480 100644
--- a/backend/src/ee/services/ldap-config/ldap-config-service.ts
+++ b/backend/src/ee/services/ldap-config/ldap-config-service.ts
@@ -417,14 +417,6 @@ export const ldapConfigServiceFactory = ({
         }
       });
     } else {
-      const plan = await licenseService.getPlan(orgId);
-      if (plan?.slug !== "enterprise" && plan?.identityLimit && plan.identitiesUsed >= plan.identityLimit) {
-        // limit imposed on number of identities allowed / number of identities used exceeds the number of identities allowed
-        throw new BadRequestError({
-          message: "Failed to create new member via LDAP due to member limit reached. Upgrade plan to add more members."
-        });
-      }
-
       userAlias = await userDAL.transaction(async (tx) => {
         let newUser: TUsers | undefined;
         newUser = await userDAL.findOne(
@@ -473,6 +465,15 @@ export const ldapConfigServiceFactory = ({
         );
 
         if (!orgMembership) {
+          const plan = await licenseService.getPlan(orgId);
+          if (plan?.slug !== "enterprise" && plan?.identityLimit && plan.identitiesUsed >= plan.identityLimit) {
+            // limit imposed on number of identities allowed / number of identities used exceeds the number of identities allowed
+            throw new BadRequestError({
+              message:
+                "Failed to create new member via LDAP due to member limit reached. Upgrade plan to add more members."
+            });
+          }
+
           const { role, roleId } = await getDefaultOrgMembershipRole(organization.defaultMembershipRole);
 
           await orgMembershipDAL.create(
diff --git a/backend/src/ee/services/oidc/oidc-config-service.ts b/backend/src/ee/services/oidc/oidc-config-service.ts
index fb1e70a85..11d9f2724 100644
--- a/backend/src/ee/services/oidc/oidc-config-service.ts
+++ b/backend/src/ee/services/oidc/oidc-config-service.ts
@@ -294,6 +294,15 @@ export const oidcConfigServiceFactory = ({
         );
 
         if (!orgMembership) {
+          const plan = await licenseService.getPlan(orgId);
+          if (plan?.slug !== "enterprise" && plan?.identityLimit && plan.identitiesUsed >= plan.identityLimit) {
+            // limit imposed on number of identities allowed / number of identities used exceeds the number of identities allowed
+            throw new BadRequestError({
+              message:
+                "Failed to create new member via OIDC due to member limit reached. Upgrade plan to add more members."
+            });
+          }
+
           const { role, roleId } = await getDefaultOrgMembershipRole(organization.defaultMembershipRole);
 
           await orgMembershipDAL.create(
diff --git a/backend/src/ee/services/saml-config/saml-config-service.ts b/backend/src/ee/services/saml-config/saml-config-service.ts
index 1cbe6a930..5a307f4f2 100644
--- a/backend/src/ee/services/saml-config/saml-config-service.ts
+++ b/backend/src/ee/services/saml-config/saml-config-service.ts
@@ -336,14 +336,6 @@ export const samlConfigServiceFactory = ({
         return foundUser;
       });
     } else {
-      const plan = await licenseService.getPlan(orgId);
-      if (plan?.slug !== "enterprise" && plan?.identityLimit && plan.identitiesUsed >= plan.identityLimit) {
-        // limit imposed on number of identities allowed / number of identities used exceeds the number of identities allowed
-        throw new BadRequestError({
-          message: "Failed to create new member via SAML due to member limit reached. Upgrade plan to add more members."
-        });
-      }
-
       user = await userDAL.transaction(async (tx) => {
         let newUser: TUsers | undefined;
         newUser = await userDAL.findOne(
@@ -391,6 +383,15 @@ export const samlConfigServiceFactory = ({
         );
 
         if (!orgMembership) {
+          const plan = await licenseService.getPlan(orgId);
+          if (plan?.slug !== "enterprise" && plan?.identityLimit && plan.identitiesUsed >= plan.identityLimit) {
+            // limit imposed on number of identities allowed / number of identities used exceeds the number of identities allowed
+            throw new BadRequestError({
+              message:
+                "Failed to create new member via SAML due to member limit reached. Upgrade plan to add more members."
+            });
+          }
+
           const { role, roleId } = await getDefaultOrgMembershipRole(organization.defaultMembershipRole);
 
           await orgMembershipDAL.create(