fix(sso): mark self-hosted owner as verified when SSO is configured

apps/dokploy/server/api/routers/proprietary/sso.ts

@@ -5,6 +5,7 @@ import { member, ssoProvider, user } from "@dokploy/server/db/schema";
 import { ssoProviderBodySchema } from "@dokploy/server/db/schema/sso";
 import {
 	getOrganizationOwnerId,
+	markOrganizationOwnerVerified,
 	requestToHeaders,
 } from "@dokploy/server/index";
 import { auth } from "@dokploy/server/lib/auth";
@@ -212,6 +213,7 @@ export const ssoRouter = createTRPCRouter({
 				body: updateBody,
 				headers: requestToHeaders(ctx.req),
 			});
+			await markOrganizationOwnerVerified(ctx.session.activeOrganizationId);
 			return { success: true };
 		}),
 	deleteProvider: enterpriseProcedure
@@ -292,6 +294,7 @@ export const ssoRouter = createTRPCRouter({
 				},
 				headers: requestToHeaders(ctx.req),
 			});
+			await markOrganizationOwnerVerified(organizationId);
 			return { success: true };
 		}),
 	addTrustedOrigin: enterpriseProcedure

apps/dokploy/server/api/routers/settings.ts

@@ -19,6 +19,7 @@ import {
 	getUpdateData,
 	getWebServerSettings,
 	IS_CLOUD,
+	markOrganizationOwnerVerified,
 	parseRawConfig,
 	paths,
 	prepareEnvironmentVariables,
@@ -467,6 +468,9 @@ export const settingsRouter = createTRPCRouter({
 			await updateWebServerSettings({
 				enforceSSO: input.enforceSSO,
 			});
+			if (input.enforceSSO) {
+				await markOrganizationOwnerVerified(ctx.session.activeOrganizationId);
+			}
 
 			await audit(ctx, {
 				action: "update",

packages/server/src/services/proprietary/sso.ts

@@ -1,5 +1,6 @@
+import { IS_CLOUD } from "@dokploy/server/constants";
 import { db } from "@dokploy/server/db";
-import { organization } from "@dokploy/server/db/schema";
+import { organization, user } from "@dokploy/server/db/schema";
 import { eq } from "drizzle-orm";
 
 export const getSSOProviders = async () => {
@@ -44,3 +45,14 @@ export const getOrganizationOwnerId = async (organizationId: string) => {
 	if (!org) return null;
 	return org.ownerId;
 };
+
+// better-auth won't link SSO to an unverified user; self-hosted owners never verify
+export const markOrganizationOwnerVerified = async (organizationId: string) => {
+	if (IS_CLOUD) return;
+	const ownerId = await getOrganizationOwnerId(organizationId);
+	if (!ownerId) return;
+	await db
+		.update(user)
+		.set({ emailVerified: true })
+		.where(eq(user.id, ownerId));
+};