Repository: Infisical/infisical
File: backend/src/services/org/org-service.ts (TypeScript)

Code before:
          message: `SAML or OIDC configuration for organization with ID '${orgId}' not found`
        });

      if (samlCfg && !samlCfg.lastUsed) {
        throw new BadRequestError({
          message:
            "To apply the new SAML auth enforcement, please log in via SAML at least once. This step is required to enforce SAML-based authentication."
        });
      }

      if (oidcCfg && !oidcCfg.lastUsed) {
        throw new BadRequestError({
          message:
            "To apply the new OIDC auth enforcement, please log in via OIDC at least once. This step is required to enforce OIDC-based authentication."
        });
      }
    }

    if (googleSsoAuthEnforced) {
      if (googleSsoAuthEnforced && currentOrg.authEnforced) {
        throw new BadRequestError({
          message: "Google SSO auth enforcement cannot be enabled when SAML/OIDC auth enforcement is enabled."
        });
      }

      const samlCfg = await samlConfigDAL.findOne({
        orgId,
        isActive: true
      });

      if (samlCfg) {
        throw new BadRequestError({
          message:
            "Cannot enable Google OAuth enforcement while SAML SSO is configured. Disable SAML SSO to enforce Google OAuth."
        });
      }

      const oidcCfg = await oidcConfigDAL.findOne({
        orgId,
        isActive: true
      });

      if (oidcCfg) {
        throw new BadRequestError({
          message:
            "Cannot enable Google OAuth enforcement while OIDC SSO is configured. Disable OIDC SSO to enforce Google OAuth."
        });
      }

      const ldapCfg = await ldapConfigDAL.findOne({
        orgId,

Review comment (security):
we are retrieving these on the previous if block as well, shouldn't we just have an if to check if any of both conditions are set, initialize these only once and use them on both checks for authEnforced and googleAuthEnforced?

Code after:
      });
    }

    if (authEnforced) {
      if (!samlCfg && !oidcCfg)
        throw new NotFoundError({
          message: `SAML or OIDC configuration for organization with ID '${orgId}' not found`
        });

      if (samlCfg && !samlCfg.lastUsed) {
        throw new BadRequestError({
          message:
            "To apply the new SAML auth enforcement, please log in via SAML at least once. This step is required to enforce SAML-based authentication."
        });
      }

      if (oidcCfg && !oidcCfg.lastUsed) {
        throw new BadRequestError({
          message:
            "To apply the new OIDC auth enforcement, please log in via OIDC at least once. This step is required to enforce OIDC-based authentication."
        });
      }
    }

    if (googleSsoAuthEnforced) {
      if (googleSsoAuthEnforced && currentOrg.authEnforced) {
        throw new BadRequestError({
          message: "Google SSO auth enforcement cannot be enabled when SAML/OIDC auth enforcement is enabled."
        });
      }

      if (samlCfg) {
        throw new BadRequestError({
          message:
            "Cannot enable Google OAuth enforcement while SAML SSO is configured. Disable SAML SSO to enforce Google OAuth."
        });
      }

      if (oidcCfg) {
        throw new BadRequestError({
          message:
            "Cannot enable Google OAuth enforcement while OIDC SSO is configured. Disable OIDC SSO to enforce Google OAuth."
        });
      }

      const ldapCfg = await ldapConfigDAL.findOne({
        orgId,
        isActive: true
      });

      if (ldapCfg) {