fix(auth): keep Microsoft sign-in accounts keyed by the ID token subject

Better Auth 1.7 keys Microsoft accounts by oid where every existing row was
stored under sub. An existing user's account was no longer found, and sign-in
fell back to email linking, which Microsoft passes only for verified domains:
the rest landed on account_not_linked. A plugin keeps the provider on sub.

Author: waleedlatif1

apps/sim/lib/auth/auth.ts

@@ -163,6 +163,7 @@ import {
   getMicrosoftRefreshTokenExpiry,
   isMicrosoftProvider,
   mapMicrosoftProfileToUser,
+  microsoftAccountSubjectPlugin,
 } from '@/lib/oauth/microsoft'
 import {
   assertMicrosoftDataverseOAuthLinkRequest,
@@ -1409,6 +1410,7 @@ export const auth = betterAuth({
           }),
         ]
       : []),
+    microsoftAccountSubjectPlugin(),
     admin(),
     oneTimeToken({
       /**
@@ -1483,13 +1485,10 @@ export const auth = betterAuth({
         }
       },
       /**
-       * Without this, /sign-in/email-otp auto-registers any unknown email —
-       * bypassing the signup gate entirely (no captcha, no /sign-up path).
-       * Gated by the same DISABLE_EMAIL_SIGNUP flag as the signup form (and by
-       * DISABLE_REGISTRATION, whose /sign-up path check has the same blind
-       * spot); when set, better-auth also silently skips sending OTPs to
-       * unknown emails (enumeration-safe) while existing users keep OTP
-       * sign-in.
+       * Keeps the plugin from creating users under the same DISABLE_EMAIL_SIGNUP and
+       * DISABLE_REGISTRATION flags as the signup form (the auth route also refuses
+       * `sign-in/email-otp`). When set, better-auth silently skips sending OTPs to
+       * unknown emails (enumeration-safe).
        */
       disableSignUp: isEmailSignupDisabled || isRegistrationDisabled,
       sendVerificationOnSignUp: false,

apps/sim/lib/auth/microsoft-sign-in.integration.ts

@@ -0,0 +1,125 @@
+import { db } from '@sim/db'
+import { account, user } from '@sim/db/schema'
+import { emailMailerMock } from '@sim/testing/mocks/email-mailer.mock'
+import { emailTemplatesMock } from '@sim/testing/mocks/email-templates.mock'
+import { posthogServerMock } from '@sim/testing/mocks/posthog-server.mock'
+import { generateId } from '@sim/utils/id'
+import { eq } from 'drizzle-orm'
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.hoisted(() => {
+  process.env.MICROSOFT_CLIENT_ID = 'microsoft-sign-in-fixture-client'
+  process.env.MICROSOFT_CLIENT_SECRET = 'microsoft-sign-in-fixture-secret'
+})
+
+vi.mock('@/lib/messaging/email/mailer', () => emailMailerMock)
+vi.mock('@/components/emails', () => emailTemplatesMock)
+vi.mock('@/lib/posthog/server', () => posthogServerMock)
+
+const MICROSOFT_TOKEN_ENDPOINT = 'https://login.microsoftonline.com/common/oauth2/v2.0/token'
+const APP_ORIGIN = 'http://localhost:3000'
+
+function unsignedJwt(claims: Record<string, unknown>) {
+  const encode = (value: object) => Buffer.from(JSON.stringify(value)).toString('base64url')
+  return `${encode({ alg: 'none', typ: 'JWT' })}.${encode(claims)}.`
+}
+
+describe('Microsoft sign-in for an existing account', () => {
+  let auth: typeof import('@/lib/auth/auth').auth
+  let userId: string
+  let email: string
+  let subject: string
+  let objectId: string
+
+  beforeAll(async () => {
+    ;({ auth } = await import('@/lib/auth/auth'))
+  }, 90_000)
+
+  beforeEach(async () => {
+    userId = generateId()
+    email = `${userId}@microsoft-sign-in.test`
+    subject = `sub-${generateId()}`
+    objectId = generateId()
+    const now = new Date()
+    await db.insert(user).values({
+      id: userId,
+      name: 'Microsoft sign-in fixture',
+      email,
+      emailVerified: true,
+      createdAt: now,
+      updatedAt: now,
+    })
+    await db.insert(account).values({
+      id: generateId(),
+      accountId: subject,
+      providerId: 'microsoft',
+      userId,
+      createdAt: now,
+      updatedAt: now,
+    })
+
+    const realFetch = globalThis.fetch
+    vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {
+      const url = input instanceof Request ? input.url : String(input)
+      if (url === MICROSOFT_TOKEN_ENDPOINT) {
+        return Response.json({
+          access_token: 'microsoft-fixture-access-token',
+          token_type: 'Bearer',
+          expires_in: 3600,
+          scope: 'openid profile email',
+          id_token: unsignedJwt({
+            iss: 'https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0',
+            aud: process.env.MICROSOFT_CLIENT_ID,
+            tid: '9188040d-6c67-4c5b-b112-36a304b66dad',
+            sub: subject,
+            oid: objectId,
+            email,
+            name: 'Microsoft sign-in fixture',
+          }),
+        })
+      }
+      if (url.startsWith('https://graph.microsoft.com/')) return new Response(null, { status: 404 })
+      return realFetch(input, init)
+    })
+  })
+
+  afterEach(async () => {
+    vi.restoreAllMocks()
+    await db.delete(user).where(eq(user.id, userId))
+  })
+
+  it('signs in through the account stored under the ID token subject without a duplicate link', async () => {
+    const start = await auth.handler(
+      new Request(`${APP_ORIGIN}/api/auth/sign-in/social`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', origin: APP_ORIGIN },
+        body: JSON.stringify({ provider: 'microsoft', callbackURL: '/workspace' }),
+      })
+    )
+    expect(start.status).toBe(200)
+    const { url } = (await start.json()) as { url: string }
+    const state = new URL(url).searchParams.get('state')
+    const stateCookies = start.headers
+      .getSetCookie()
+      .map((value) => value.split(';')[0])
+      .join('; ')
+
+    const callback = await auth.handler(
+      new Request(
+        `${APP_ORIGIN}/api/auth/callback/microsoft?code=microsoft-fixture-code&state=${state}`,
+        { headers: { cookie: stateCookies } }
+      )
+    )
+
+    expect(callback.status).toBe(302)
+    expect(callback.headers.get('location')).toMatch(/\/workspace$/)
+    expect(callback.headers.getSetCookie().some((value) => value.includes('session_token='))).toBe(
+      true
+    )
+    const accounts = await db
+      .select({ accountId: account.accountId })
+      .from(account)
+      .where(eq(account.userId, userId))
+    expect(accounts).toEqual([{ accountId: subject }])
+  })
+})

apps/sim/lib/oauth/microsoft.ts

@@ -1,5 +1,8 @@
 import { createLogger } from '@sim/logger'
+import { toStringOrNull } from '@sim/utils/coerce'
 import { generateId } from '@sim/utils/id'
+import { toRecord } from '@sim/utils/object'
+import type { BetterAuthPlugin } from 'better-auth'
 
 /**
  * Scoped `'Auth'` because these lines are emitted from the OAuth callback path
@@ -86,6 +89,30 @@ export function mapMicrosoftProfileToUser(
   return isMicrosoftEmailDomainVerified(profile) ? { emailVerified: true } : {}
 }
 
+/**
+ * Keeps Microsoft sign-in accounts keyed by the ID token's `sub`, the key every existing
+ * `microsoft` account row was stored under. Better Auth's provider keys by `oid` instead, so
+ * without this an existing user's account would not be found and sign-in would fall back to
+ * email linking, which {@link mapMicrosoftProfileToUser} allows only for verified domains.
+ */
+export function microsoftAccountSubjectPlugin() {
+  return {
+    id: 'sim-microsoft-account-subject',
+    init: (context) => ({
+      context: {
+        socialProviders: context.socialProviders.map((provider) =>
+          provider.id === 'microsoft'
+            ? {
+                ...provider,
+                accountSubject: ({ profile }) => toStringOrNull(toRecord(profile).sub) ?? '',
+              }
+            : provider
+        ),
+      },
+    }),
+  } satisfies BetterAuthPlugin
+}
+
 /**
  * Extracts user info from a Microsoft ID token JWT instead of calling Graph API /me.
  * This avoids 403 errors for external tenant users whose admin hasn't consented to Graph API scopes.