{"record":{"id":"0d79a401b6e5065e","repo":"different-ai/openwork","slug":"failed-to-load-sso-settings-response-status","errorCode":null,"errorMessage":"Failed to load SSO settings (${response.status}).","messagePattern":"Failed to load SSO settings \\((.+?)\\)\\.","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx","lineNumber":70,"sourceCode":"    [orgContext?.currentMember.isOwner, orgContext?.currentMember.role, orgContext?.roles],\n  );\n\n  async function loadSsoConfig(isCurrent = () => true) {\n    if (!orgId || !access.canViewSettings) {\n      if (isCurrent()) {\n        setConnection(null);\n      }\n      return;\n    }\n\n    if (isCurrent()) {\n      setBusy(true);\n      setError(null);\n    }\n    try {\n      const { response, payload } = await requestJson(\"/v1/sso\", { method: \"GET\", headers: getOrgScopedHeaders() }, 12000);\n      if (!response.ok) {\n        throw getRequestError(payload, response, `Failed to load SSO settings (${response.status}).`);\n      }\n\n      const parsed = parseOrgSsoPayload(payload);\n      if (isCurrent()) {\n        setConnection(parsed.connection);\n        syncFormFromConnection(parsed.connection);\n        setEditing(false);\n      }\n    } catch (nextError) {\n      if (isReauthRequiredError(nextError)) {\n        throw nextError;\n      }\n\n      if (isCurrent()) {\n        setError(nextError instanceof Error ? nextError.message : \"Failed to load SSO settings.\");\n      }\n    } finally {\n      if (isCurrent()) {","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx#L52-L88","documentation":"Thrown by loadSsoConfig when GET /v1/sso returns a non-ok status. This query loads the organization's SSO connection, form state, and domain verification token; on success it populates connection state via parseOrgSsoPayload. The request uses getOrgScopedHeaders() so an invalid/missing org scope or expired session commonly causes rejection. getRequestError may raise ReauthRequiredError for 403 error:'reauth'.","triggerScenarios":"GET /v1/sso with org-scoped headers returns 401 (session expired), 403 (user lacks org admin/read SSO settings permission, or reauth challenge; also wrong/unset org scope header), 404 (SSO not configured for this org — depends on server semantics), 429, or 5xx. 12s timeout.","commonSituations":"Member (non-admin) opens the SSO settings screen; org header points to an org the user doesn't belong to; long-idle tab with expired token; Den server returning HTML error pages through a proxy.","solutions":["Check the status and appended server message in the thrown error.","If 403 with reauth, wrap loadSsoConfig in runReauthableAction (the handlers already do; direct callers may not).","Verify getOrgScopedHeaders() contains a valid, current organization id and that the user is an org admin.","Re-authenticate on 401 and reload; the UI's setError path should prompt sign-in.","For 5xx/HTML payloads, check Den server/proxy health and retry."],"exampleFix":"// before: load without guard\nawait loadSsoConfig();\n// after\ntry {\n  await runReauthableAction(\"load-sso\", () => loadSsoConfig());\n} catch (err) {\n  setError(isReauthRequiredError(err) ? \"Sign in again to view SSO settings.\" : getErrorMessage(err, \"Failed to load SSO settings.\"));\n}","handlingStrategy":"try-catch","validationCode":"const headers = getOrgScopedHeaders();\nif (!headers || !orgId) throw new Error(\"Select an organization before loading SSO settings.\");","typeGuard":"function isReauthRequiredError(e: unknown): e is ReauthRequiredError {\n  return e instanceof ReauthRequiredError;\n}","tryCatchPattern":"try {\n  await loadSsoConfig();\n} catch (err) {\n  if (isReauthRequiredError(err)) { promptSignIn(); return; }\n  if (/\\b403\\b/.test(err.message)) { setError(\"Org admin access required.\"); return; }\n  setError(err.message);\n}","preventionTips":["Ensure getOrgScopedHeaders() always carries a current, valid organization id.","Gate the SSO screen on org-admin role to avoid predictable 403s.","Reload config after sign-in; don't rely on long-lived idle tabs keeping a valid token.","Use runReauthableAction for direct loadSsoConfig calls, mirroring the mutation handlers.","Distinguish 404 (SSO not configured) from 5xx (server issue) before showing error UI."],"tags":["http","sso","auth","den-web"],"backgroundTag":"http-request-failed","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}