Merge pull request #4501 from Infisical/ENG-3677

improvement(google-oauth-enforcement): prevent conflicting sso enforcement configuration

backend/src/services/org/org-service.ts

@@ -9,11 +9,14 @@ import {
   ProjectMembershipRole,
   ProjectVersion,
   TableName,
+  TOidcConfigs,
   TProjectMemberships,
   TProjectUserMembershipRolesInsert,
+  TSamlConfigs,
   TUsers
 } from "@app/db/schemas";
 import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
+import { TLdapConfigDALFactory } from "@app/ee/services/ldap-config/ldap-config-dal";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TOidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
 import {
@@ -125,6 +128,7 @@ type TOrgServiceFactoryDep = {
   incidentContactDAL: TIncidentContactsDALFactory;
   samlConfigDAL: Pick<TSamlConfigDALFactory, "findOne">;
   oidcConfigDAL: Pick<TOidcConfigDALFactory, "findOne">;
+  ldapConfigDAL: Pick<TLdapConfigDALFactory, "findOne">;
   smtpService: TSmtpService;
   tokenService: TAuthTokenServiceFactory;
   permissionService: TPermissionServiceFactory;
@@ -165,6 +169,7 @@ export const orgServiceFactory = ({
   projectRoleDAL,
   samlConfigDAL,
   oidcConfigDAL,
+  ldapConfigDAL,
   projectUserMembershipRoleDAL,
   identityMetadataDAL,
   projectBotService,
@@ -446,16 +451,20 @@ export const orgServiceFactory = ({
       });
     }
 
-    if (authEnforced) {
-      const samlCfg = await samlConfigDAL.findOne({
+    let samlCfg: TSamlConfigs | undefined;
+    let oidcCfg: TOidcConfigs | undefined;
+    if (authEnforced || googleSsoAuthEnforced) {
+      samlCfg = await samlConfigDAL.findOne({
         orgId,
         isActive: true
       });
-      const oidcCfg = await oidcConfigDAL.findOne({
+      oidcCfg = await oidcConfigDAL.findOne({
         orgId,
         isActive: true
       });
+    }
 
+    if (authEnforced) {
       if (!samlCfg && !oidcCfg)
         throw new NotFoundError({
           message: `SAML or OIDC configuration for organization with ID '${orgId}' not found`
@@ -483,6 +492,32 @@ export const orgServiceFactory = ({
         });
       }
 
+      if (samlCfg) {
+        throw new BadRequestError({
+          message:
+            "Cannot enable Google OAuth enforcement while SAML SSO is configured. Disable SAML SSO to enforce Google OAuth."
+        });
+      }
+
+      if (oidcCfg) {
+        throw new BadRequestError({
+          message:
+            "Cannot enable Google OAuth enforcement while OIDC SSO is configured. Disable OIDC SSO to enforce Google OAuth."
+        });
+      }
+
+      const ldapCfg = await ldapConfigDAL.findOne({
+        orgId,
+        isActive: true
+      });
+
+      if (ldapCfg) {
+        throw new BadRequestError({
+          message:
+            "Cannot enable Google OAuth enforcement while LDAP SSO is configured. Disable LDAP SSO to enforce Google OAuth."
+        });
+      }
+
       if (!currentOrg.googleSsoAuthLastUsed) {
         throw new BadRequestError({
           message: