{"record":{"id":"c65c8556b228cbfa","repo":"different-ai/openwork","slug":"failed-to-delete-sso-settings-response-status","errorCode":null,"errorMessage":"Failed to delete SSO settings (${response.status}).","messagePattern":"Failed to delete SSO settings \\((.+?)\\)\\.","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx","lineNumber":228,"sourceCode":"\n  async function handleDelete() {\n    if (!access.canManageSso) {\n      setError(\"Only workspace owners and super-admins can delete SSO settings.\");\n      return;\n    }\n\n    if (!orgId || !window.confirm(\"Delete this SSO connection?\")) {\n      return;\n    }\n\n    setError(null);\n    try {\n      await runReauthableAction(\"delete-sso-settings\", async () => {\n        setDeleting(true);\n        try {\n          const { response, payload } = await requestJson(\"/v1/sso\", { method: \"DELETE\", headers: getOrgScopedHeaders() }, 12000);\n          if (response.status !== 204 && !response.ok) {\n            throw getRequestError(payload, response, `Failed to delete SSO settings (${response.status}).`);\n          }\n          setConnection(null);\n          setEditing(false);\n          await loadSsoConfig();\n        } finally {\n          setDeleting(false);\n        }\n      });\n    } catch (nextError) {\n      setError(nextError instanceof Error ? nextError.message : \"Failed to delete SSO settings.\");\n    }\n  }\n\n  async function handleRequestDomainToken() {\n    if (!access.canManageSso) {\n      setError(\"Only workspace owners and super-admins can request SSO domain verification tokens.\");\n      return;\n    }","sourceCodeStart":210,"sourceCodeEnd":246,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx#L210-L246","documentation":"Thrown by handleDelete when DELETE /v1/sso returns a status other than 204 or a generic non-ok. Note the guard accepts 204 specifically, so 200-with-body is also acceptable. It removes the org's SSO connection; on success it clears connection state, exits editing mode, and reloads the config. Wrapped in runReauthableAction for 403 reauth retry.","triggerScenarios":"DELETE /v1/sso with org-scoped headers returns 401 (expired token), 403 (not org admin, or reauth challenge), 404 (no SSO connection exists to delete), 409 (SSO connection is enforced by policy or is the only admin auth path — server refuses to remove it), 429, or 5xx. 12s timeout.","commonSituations":"Admin removes SSO while an org policy marks it mandatory; deleting the last admin auth method is blocked to avoid lockout; concurrent tab already deleted the connection; expired session inside a long-open settings screen.","solutions":["Read the appended server message — 409-style lockout policies usually explain themselves.","If 404, the connection is already gone: reload loadSsoConfig and reset UI state instead of showing the error.","Handle ReauthRequiredError (sign-in prompt) then retry the delete.","Confirm the org doesn't have a policy requiring SSO; disable the policy in Den first if so.","Retry on 429/5xx; investigate Den server health if persistent."],"exampleFix":"// before: any failure surfaces error\ntype status = response.status;\n// after: tolerate already-deleted\ntype=\"text\"\n// in handleDelete catch block:\ncatch (err) {\n  if (getErrorMessage(err, \"\").includes(\"404\")) {\n    setConnection(null); setEditing(false);\n    return;\n  }\n  if (!isReauthRequiredError(err)) setError(getErrorMessage(err, \"Failed to delete SSO settings.\"));\n}","handlingStrategy":"try-catch","validationCode":"if (!connection) return; // nothing to delete; skip the call entirely","typeGuard":"function isReauthRequiredError(e: unknown): e is ReauthRequiredError {\n  return e instanceof ReauthRequiredError;\n}","tryCatchPattern":"try {\n  await deleteSso();\n} catch (err) {\n  if (isReauthRequiredError(err)) { promptSignIn(); return; }\n  if (/\\b404\\b/.test(err.message)) { setConnection(null); setEditing(false); await loadSsoConfig(); return; }\n  if (/\\b409\\b/.test(err.message)) { setError(\"Org policy prevents removing SSO; disable the policy first.\"); return; }\n  setError(err.message);\n}","preventionTips":["Only render the delete action when a connection exists and the user is an admin.","Accept 204 (and 2xx) as success — the handler already checks status !== 204 && !ok.","Check org SSO-enforcement policy before attempting deletion to avoid 409 lockout.","Always reload loadSsoConfig after deletion so UI state matches the server.","Handle the 'last admin auth method' protection: warn users before deleting the only admin login path."],"tags":["http","sso","delete","den-web"],"backgroundTag":"http-request-failed","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}