From 65180f3fa0ae0316a917cd6c32c68f1c53c4d078 Mon Sep 17 00:00:00 2001
From: Jessica Lawshe <5312836+lawshe@users.noreply.github.com>
Date: Thu, 26 Feb 2026 08:34:57 -0600
Subject: [PATCH] Merge pull request #30988 from
 overleaf/jel-check-domain-matches-matcher-web

[web] Check if email domain from SAML callback matches domain matcher

GitOrigin-RevId: e29a7dc6a1b5f6db46ab4146626c9f1d6659b7ea
---
 services/web/app/src/Features/Errors/Errors.js         |  7 +++++++
 .../app/src/Features/Institutions/InstitutionsAPI.mjs  | 10 ++++++++++
 services/web/frontend/extracted-translations.json      |  1 +
 services/web/locales/en.json                           |  3 ++-
 4 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/services/web/app/src/Features/Errors/Errors.js b/services/web/app/src/Features/Errors/Errors.js
index fd912cedef..07f825c312 100644
--- a/services/web/app/src/Features/Errors/Errors.js
+++ b/services/web/app/src/Features/Errors/Errors.js
@@ -227,6 +227,12 @@ class SAMLSessionProviderDataMissing extends SAMLAuthenticationError {
   }
 }
 
+class SAMLDomainCaptureEmailDomainMismatchError extends SAMLDomainCaptureError {
+  get i18nKey() {
+    return 'invalid_organization_email'
+  }
+}
+
 class SAMLSessionDataMissing extends BackwardCompatibleError {
   constructor(arg) {
     super(arg)
@@ -388,6 +394,7 @@ module.exports = {
   SAMLAuthenticationRequiredError,
   SAMLCommonsUnavailable,
   SAMLDomainCaptureEmailExistsError,
+  SAMLDomainCaptureEmailDomainMismatchError,
   SAMLDomainCaptureError,
   SAMLDomainCaptureJoiningError,
   SAMLDomainCaptureMissingSessionDataError,
diff --git a/services/web/app/src/Features/Institutions/InstitutionsAPI.mjs b/services/web/app/src/Features/Institutions/InstitutionsAPI.mjs
index 590cfbe91b..c938783154 100644
--- a/services/web/app/src/Features/Institutions/InstitutionsAPI.mjs
+++ b/services/web/app/src/Features/Institutions/InstitutionsAPI.mjs
@@ -316,6 +316,15 @@ function sendUsersWithReconfirmationsLapsedProcessed(users, callback) {
   )
 }
 
+async function verifyDomainMatchesDomainMatcher(domain, institutionId) {
+  return await _affiliationRequestFetchJson({
+    method: 'POST',
+    path: `/api/v2/institutions/domain_matches_matcher`,
+    body: { domain, id: institutionId },
+    defaultErrorMessage: "Couldn't verify if domain matches matcher",
+  })
+}
+
 const InstitutionsAPI = {
   getInstitutionAffiliations,
 
@@ -431,6 +440,7 @@ InstitutionsAPI.promises = {
   sendUsersWithReconfirmationsLapsedProcessed: promisify(
     InstitutionsAPI.sendUsersWithReconfirmationsLapsedProcessed
   ),
+  verifyDomainMatchesDomainMatcher,
 }
 
 export default InstitutionsAPI
diff --git a/services/web/frontend/extracted-translations.json b/services/web/frontend/extracted-translations.json
index cdbc776ac6..c73ad484ac 100644
--- a/services/web/frontend/extracted-translations.json
+++ b/services/web/frontend/extracted-translations.json
@@ -927,6 +927,7 @@
   "invalid_email": "",
   "invalid_file_name": "",
   "invalid_filename": "",
+  "invalid_organization_email": "",
   "invalid_password_contains_email": "",
   "invalid_password_too_similar": "",
   "invalid_regular_expression": "",
diff --git a/services/web/locales/en.json b/services/web/locales/en.json
index 87caf2b005..fe187242b4 100644
--- a/services/web/locales/en.json
+++ b/services/web/locales/en.json
@@ -1165,7 +1165,8 @@
   "invalid_email": "An email address is invalid",
   "invalid_file_name": "Invalid File Name",
   "invalid_filename": "Upload failed: check that the file name doesn’t contain special characters, trailing/leading whitespace or more than __nameLimit__ characters",
-  "invalid_institutional_email": "Your institution’s SSO service returned your email address as __email__, which is at an unexpected domain that we do not recognise as belonging to it. You may be able to change your primary email address via your user profile at your institution to one at your institution’s domain. Please contact your IT department if you have any questions.",
+  "invalid_institutional_email": "Your institution’s SSO service returned your email address as __email__, which is an unexpected domain that we do not recognise as belonging to it. You may be able to change your primary email address via your user profile at your institution to one at your institution’s domain. Please contact your IT department if you have any questions.",
+  "invalid_organization_email": "Your organization’s SSO service returned your email address as <0>__institutionEmail__</0>, which is an unexpected domain that we do not recognise as belonging to it. Please <1>contact us</1> if you think this is in error.",
   "invalid_password": "Invalid Password.",
   "invalid_password_contains_email": "Password cannot contain parts of email address.",
   "invalid_password_invalid_character": "Password contains an invalid character.",