From 12c7c278ada2484e9ee2d75088fccfa2fdf669ed Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Wed, 24 Dec 2025 11:59:42 +0100
Subject: [PATCH] Fix 5xx when saml config already exist

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/coredata/saml_configuration.go       |  8 ++++++++
 pkg/iam/errors.go                        | 10 ++++++++++
 pkg/iam/organization_service.go          |  4 ++++
 pkg/server/api/connect/v1/v1_resolver.go |  5 +++++
 4 files changed, 27 insertions(+)

diff --git a/pkg/coredata/saml_configuration.go b/pkg/coredata/saml_configuration.go
index cc72c4281..568aecce0 100644
--- a/pkg/coredata/saml_configuration.go
+++ b/pkg/coredata/saml_configuration.go
@@ -24,6 +24,7 @@ import (
 	"time"
 
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/page"
@@ -317,6 +318,13 @@ INSERT INTO iam_saml_configurations (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "idx_saml_config_domain_org_unique" {
+				return ErrResourceAlreadyExists
+			}
+		}
+
 		return fmt.Errorf("cannot insert saml_configuration: %w", err)
 	}
 
diff --git a/pkg/iam/errors.go b/pkg/iam/errors.go
index de254d80a..078e0b57e 100644
--- a/pkg/iam/errors.go
+++ b/pkg/iam/errors.go
@@ -308,6 +308,16 @@ func (e *ErrSAMLAuthenticationRequired) Error() string {
 	return fmt.Sprintf("SAML authentication required: %s", e.Reason)
 }
 
+type ErrSAMLConfigurationEmailDomainAlreadyExists struct{ EmailDomain string }
+
+func NewSAMLConfigurationEmailDomainAlreadyExistsError(emailDomain string) error {
+	return &ErrSAMLConfigurationEmailDomainAlreadyExists{EmailDomain: emailDomain}
+}
+
+func (e ErrSAMLConfigurationEmailDomainAlreadyExists) Error() string {
+	return fmt.Sprintf("SAML configuration email domain %q already exists", e.EmailDomain)
+}
+
 // TenantAccessError is used by API recovery middleware to translate authorization/tenant failures
 // into a consistent client-facing error response.
 //
diff --git a/pkg/iam/organization_service.go b/pkg/iam/organization_service.go
index 0b9388b34..19d7aca56 100644
--- a/pkg/iam/organization_service.go
+++ b/pkg/iam/organization_service.go
@@ -1069,6 +1069,10 @@ func (s OrganizationService) CreateSAMLConfiguration(
 
 			err = config.Insert(ctx, tx, scope)
 			if err != nil {
+				if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+					return NewSAMLConfigurationEmailDomainAlreadyExistsError(req.EmailDomain)
+				}
+
 				return fmt.Errorf("cannot insert saml configuration: %w", err)
 			}
 
diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go
index 3f7d4bfbc..e129e3e6e 100644
--- a/pkg/server/api/connect/v1/v1_resolver.go
+++ b/pkg/server/api/connect/v1/v1_resolver.go
@@ -915,6 +915,11 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty
 	)
 
 	if err != nil {
+		var errSAMLConfigurationEmailDomainAlreadyExists *iam.ErrSAMLConfigurationEmailDomainAlreadyExists
+		if errors.As(err, &errSAMLConfigurationEmailDomainAlreadyExists) {
+			return nil, gqlutils.Conflict(err)
+		}
+
 		r.logger.ErrorCtx(ctx, "cannot create saml configuration", log.Error(err))
 		return nil, gqlutils.InternalServerError(ctx)
 	}