{"record":{"id":"e31dc4ead11f880b","repo":"different-ai/openwork","slug":"could-not-resolve-workspace-sso-response-status","errorCode":null,"errorMessage":"Could not resolve workspace SSO (${response.status}).","messagePattern":"Could not resolve workspace SSO \\((.+?)\\)\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ee/apps/den-web/app/(den)/_providers/den-flow-provider.tsx","lineNumber":441,"sourceCode":"    setVerificationCode(\"\");\n    setAuthInfo(message ?? `Enter the 6-digit code we sent to ${targetEmail}.`);\n    setAuthError(null);\n    setSignupPasswordFeedback([]);\n  }\n\n  function cancelVerification() {\n    setVerificationRequired(false);\n    setVerificationCode(\"\");\n    setAuthInfo(getAuthInfoForMode(authMode));\n    setAuthError(null);\n    setSignupPasswordFeedback([]);\n  }\n\n  async function redirectToRequiredSso(trimmedEmail: string) {\n    const { response, payload } = await requestJson(`/v1/orgs/sso/resolve?email=${encodeURIComponent(trimmedEmail)}`, { method: \"GET\" }, 12000);\n\n    if (!response.ok) {\n      throw new Error(getErrorMessage(payload, response.status === 403 ? \"We could not verify this sign-in attempt. Please refresh and try again.\" : `Could not resolve workspace SSO (${response.status}).`));\n    }\n\n    const method = typeof (payload as { method?: unknown } | null)?.method === \"string\"\n      ? (payload as { method: string }).method\n      : \"\";\n    if (method !== \"sso\") {\n      return false;\n    }\n\n    const signInUrl = typeof (payload as { signInUrl?: unknown } | null)?.signInUrl === \"string\"\n      ? (payload as { signInUrl: string }).signInUrl\n      : \"\";\n    if (!signInUrl) {\n      return false;\n    }\n\n    const nextUrl = new URL(signInUrl, window.location.origin);\n    nextUrl.searchParams.set(\"callbackURL\", getSocialCallbackUrl());","sourceCodeStart":423,"sourceCodeEnd":459,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-web/app/(den)/_providers/den-flow-provider.tsx#L423-L459","documentation":"den-flow-provider.tsx throws this as the generic fallback when `GET /v1/orgs/sso/resolve` returns any non-ok status other than 403, embedding the status code. It covers timeouts, 4xx client errors, and 5xx server errors during SSO resolution.","triggerScenarios":"The 12-second request to `/v1/orgs/sso/resolve?email=...` returns 400 (malformed email), 401 (no session), 404 (no org for the email domain), 429 (rate limited), or 5xx, and the payload has no extractable message.","commonSituations":"Typo'd or personal-email domain with no SSO mapping (404); identity provider (Okta/Entra) outage causing upstream 502; user hammering the endpoint and getting rate limited; Den server unreachable.","solutions":["Verify the email domain is configured for SSO in the org settings","Check the interpolated status code and the corresponding server logs","Retry after confirming the identity provider is healthy (5xx is often upstream)","Check for rate limiting (429) and back off before retrying"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"const email = trimmedEmail;\nif (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email)) {\n  setError(\"Enter a valid work email.\");\n  return;\n}","typeGuard":null,"tryCatchPattern":"try {\n  await redirectToRequiredSso(email);\n} catch (err) {\n  const m = err.message.match(/\\((\\d{3})\\)/);\n  const status = m ? Number(m[1]) : 0;\n  if (status === 429) showError(\"Too many attempts. Wait a minute and try again.\");\n  else if (status >= 500) retryWithBackoff(() => redirectToRequiredSso(email));\n  else showError(\"No workspace SSO found for this email. Check the address or contact your admin.\");\n}","preventionTips":["Validate email format before calling the resolve endpoint","Map known org domains client-side to skip doomed lookups","Add automatic retry with backoff for 5xx/timeout on the resolve call","Monitor identity provider (Okta/Entra) health for upstream SSO failures"],"tags":["sso","http","den-web","auth"],"backgroundTag":"sso-resolution-failed","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}