**6 issues found** across 21 files

Prompt for AI agents (unresolved issues)

```text Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately. P1: Upsert silently resets `enforced` to `false` when the field is omitted. Since `enforced` is optional, `undefined ? 1 : 0` evaluates to `0`, disabling SSO enforcement whenever config fields are updated without explicitly re-passing `enforced: true`. The onConflict update path should preserve the existing value when `enforced` is not provided. P0: **Rules of Hooks violation**: `useOrgSsoStatus` is called after two early returns, so it won't execute on every render. React requires hooks to be called unconditionally and in the same order every time. This will throw a runtime error when the component re-renders after `projectContext` changes between null/non-null. Since the hook already supports `enabled: !!orgId`, move it above the early returns and derive `orgId` inline: P1: Mounting `/api/org-sso` before the MeshContext middleware leaves every SSO handler without `meshContext`, causing 500s on the first `ctx.auth` access. P2: After deleting SSO config, the form re-appears with stale values instead of empty fields. `handleDelete` calls `setIsEditing(false)` but never resets `formState`, so the new-config form renders pre-filled with the just-deleted configuration. P1: The SSO callback verifies the ID token email matches the logged-in user but never checks that the email belongs to `ssoConfig.domain`. A user with any email domain can complete SSO as long as they can authenticate at the IdP, making the `domain` configuration field unenforced. Add a domain check after the email comparison, e.g. `if (!tokenEmail.endsWith('@' + ssoConfig.domain.toLowerCase()))`. P1: Server-Side Request Forgery (SSRF): `discoverOIDC` fetches from user-controlled `issuer`/`discoveryEndpoint` URLs without any URL validation or allowlisting. In cloud environments, an org owner could set `discoveryEndpoint` to an internal metadata endpoint (e.g., `http://169.254.169.254/...`). Consider validating that the URL scheme is HTTPS and the host resolves to a public IP address before making the request. ```

_{Reply with feedback, questions, or to request a fix. Tag `@cubic-dev-ai` to re-run a review.}