Check if already signed in on sso callback

Avoid trashing an existing login unexpectedly.

Co-authored-by: Claude Code <noreply@anthropic.com>

Author: simonbaird

rails/app/controllers/sso_controller.rb

@@ -25,8 +25,6 @@ def authorize
   # GET /sso/callback?token=xyz
   # Runs on custom domain. Verifies token, creates session, redirects.
   def callback
-    # Clear any stale session before creating a new one (also prevents session fixation)
-    reset_session
     data = SsoToken.verify(params[:token], domain: request.host)
     unless data
       render plain: "Invalid or expired token", status: :forbidden
@@ -39,7 +37,12 @@ def callback
       return
     end
 
-    sign_in(:user, user)
+    unless current_user == user
+      # Clear any stale session before creating a new one (also prevents session fixation)
+      reset_session
+      sign_in(:user, user)
+    end
+
     redirect_to safe_return_to(data[:return_to]) || "/"
   end
 

rails/test/controllers/custom_domain_auth_test.rb

@@ -143,6 +143,24 @@ class CustomDomainAuthTest < ActionDispatch::IntegrationTest
     assert_response :not_found
   end
 
+  test 'sso callback when already signed in as correct user stays signed in' do
+    token = SsoToken.generate(user_id: @user.id, domain: 'customtest.example.com')
+    host! 'customtest.example.com'
+
+    # First SSO callback to establish session
+    get "/sso/callback?token=#{CGI.escape(token)}"
+    assert_response :redirect
+
+    # Second SSO callback should not disrupt existing session
+    token2 = SsoToken.generate(user_id: @user.id, domain: 'customtest.example.com')
+    get "/sso/callback?token=#{CGI.escape(token2)}"
+    assert_redirected_to '/'
+
+    # User should still be signed in
+    get '/'
+    assert_response :success
+  end
+
   # -- Subdomain redirect --
 
   test 'tiddlyhost subdomain redirects to custom domain' do