fix bug causing auto provision to override manually created users

server/routers/idp/validateOidcCallback.ts

@@ -352,14 +352,22 @@ export async function validateOidcCallback(
 
             if (!userOrgInfo.length) {
                 if (existingUser) {
-                    // delete the user
+                    // get existing user orgs
-                    // cascade will also delete org users
+                    const existingUserOrgs = await db
+                        .select()
+                        .from(userOrgs)
+                        .where(
+                            and(
+                                eq(userOrgs.userId, existingUser.userId),
+                                eq(userOrgs.autoProvisioned, false)
+                            )
+                        );
 
+                    if (!existingUserOrgs.length) {
+                        // delete the user
                         await db
                             .delete(users)
                             .where(eq(users.userId, existingUser.userId));
-                }
-
                         return next(
                             createHttpError(
                                 HttpCode.UNAUTHORIZED,
@@ -367,6 +375,16 @@ export async function validateOidcCallback(
                             )
                         );
                     }
+                } else {
+                    // no orgs to provision and user doesn't exist
+                    return next(
+                        createHttpError(
+                            HttpCode.UNAUTHORIZED,
+                            `No policies matched for ${userIdentifier}. This user must be added to an organization before logging in.`
+                        )
+                    );
+                }
+            }
 
             const orgUserCounts: { orgId: string; userCount: number }[] = [];