From 0a0e722c68d9c372c6524d6090656c4a8675d658 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Tue, 24 Feb 2026 09:03:55 +0100
Subject: [PATCH] Remove noisy SAML verification domain error

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/iam/saml_domain_verifier.go | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/pkg/iam/saml_domain_verifier.go b/pkg/iam/saml_domain_verifier.go
index b5f294533..234c9ad2d 100644
--- a/pkg/iam/saml_domain_verifier.go
+++ b/pkg/iam/saml_domain_verifier.go
@@ -16,6 +16,7 @@ package iam
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -42,6 +43,11 @@ const (
 	txtRecordValuePrefix = "probo-verification="
 )
 
+var (
+	errDomainTXTRecordNotFound = errors.New("domain TXT record not found")
+	errDomainTXTRecordMismatch = errors.New("domain TXT record mismatch")
+)
+
 func NewSAMLDomainVerifier(
 	pgClient *pg.Client,
 	logger *log.Logger,
@@ -108,10 +114,17 @@ func (v *SAMLDomainVerifier) checkUnverifiedDomains(ctx context.Context) error {
 		}
 
 		if err := v.tryVerifyDomain(ctx, config.ID); err != nil {
-			v.logger.ErrorCtx(ctx, "cannot verify domain",
-				log.String("config_id", config.ID.String()),
-				log.Error(err),
-			)
+			if errors.Is(err, errDomainTXTRecordNotFound) || errors.Is(err, errDomainTXTRecordMismatch) {
+				v.logger.InfoCtx(ctx, "domain verification pending",
+					log.String("config_id", config.ID.String()),
+					log.Error(err),
+				)
+			} else {
+				v.logger.ErrorCtx(ctx, "cannot verify domain",
+					log.String("config_id", config.ID.String()),
+					log.Error(err),
+				)
+			}
 
 			continue
 		}
@@ -187,7 +200,7 @@ func (v *SAMLDomainVerifier) checkDNSTXTRecord(emailDomain string, expectedValue
 	}
 
 	if len(resp.Answer) == 0 {
-		return fmt.Errorf("cannot find TXT record for %q", emailDomain)
+		return fmt.Errorf("%w for %q", errDomainTXTRecordNotFound, emailDomain)
 	}
 
 	for _, answer := range resp.Answer {
@@ -203,5 +216,5 @@ func (v *SAMLDomainVerifier) checkDNSTXTRecord(emailDomain string, expectedValue
 		}
 	}
 
-	return fmt.Errorf("cannot find matching TXT record for %q", emailDomain)
+	return fmt.Errorf("%w for %q", errDomainTXTRecordMismatch, emailDomain)
 }