fix(identity): streamline SSO settings and harden SCIM provisioning

[waleedlatif1]

Summary

• Split Single sign-on settings into Sign-in, Domains, and Provisioning using the shared settings tabs, standard typography, horizontal switches, shorter descriptions, and preserved drafts. Add Radix keyboard navigation to the shared segmented control.
• Qualify SCIM membership SQL and keep authentication, membership, and entitlement reads in their transaction. Database failures preserve directory restrictions.
• Correct SCIM PATCH, filtering, attribute projection, lifecycle, and reconciliation behavior. Preserve manual workspace access with an additive baseline column.
• Update setup, lifecycle, and rollout guides with screenshots from the running app. Add PostgreSQL and real HTTP coverage to both database provisioning paths in CI.

Type of Change

• Bug fix
• UI improvement
• Documentation and regression coverage

Testing

• 690 affected tests and 25 PostgreSQL tests passed in the first pass. The final revision passes 105 focused identity tests, all 203 shared-component tests, and 17 real HTTP scenarios covering 109 requests.
• Ran the app and exercised signup, SSO settings, tab history, drafts, domains, tokens, provisioning rules, group mappings, and reconciliation. Checked narrow and dark layouts and rendered all three updated guides. Verified saved/draft SAML callback overrides, switch label activation, and keyboard navigation.
• Cleanup, lint, type checking, all 46 repository audits, docs validation, and migration safety against staging and main passed.
• The HTTP suite emulates Okta and Entra payloads. Live provider tenant provisioning and SSO redirects remain unverified; the follow-up checklist is in apps/sim/ee/scim/TESTING.md.
• Migration 0325 adds a nullable column without a backfill. Keep SCIM disabled during a mixed-version rollout; reverting to pre-SCIM code after enabling directory enforcement is unsafe, as documented.

Screenshots

Sign-in	Domains	Provisioning

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 8, 2026 3:21am UTC

[greptile-apps]

Greptile Summary

This PR reorganizes enterprise SSO settings, hardens SCIM provisioning and reconciliation behavior, adds an additive manual-access baseline migration, and expands PostgreSQL and real-HTTP regression coverage.

• Splits SSO administration into Sign-in, Domains, and Provisioning views while preserving drafts.
• Corrects SCIM filtering, projection, lifecycle, membership, transaction, and reconciliation behavior.
• Adds deployment guidance, updated screenshots, migration artifacts, and broader CI coverage.
• The previously reported scalar-projection issue is fixed, and its thread was manually resolved.

Confidence Score: 5/5

The PR appears safe to merge, with the previous projection defect fixed and no actionable new failures identified in the subsequent changes.

SCIM projection now omits invalid scalar descendants without breaking valid complex, multi-valued, extension, or exclusion projections. The SSO navigation, SAML ACS display, and RadioGroup integration remain consistent with their contracts, and the sole previous finding was manually resolved after the fix.

Important Files Changed

Filename	Overview
apps/sim/ee/scim/lib/protocol/resources.ts	Correctly tightens recursive SCIM attribute projection so nonexistent scalar descendants no longer expose parent values.
apps/sim/ee/sso/components/sso-settings.tsx	Replaces Radix tabs with the shared radio-based tab control while preserving mounted draft state.
apps/sim/ee/sso/components/sso-provider-settings.tsx	Safely reads legacy provider JSON and displays custom SAML ACS overrides consistently in view and edit modes.
packages/emcn/src/components/chip-switch/chip-switch.tsx	Moves ChipSwitch to Radix RadioGroup semantics with controlled selection and keyboard navigation.
packages/db/migrations/0325_scim_manual_workspace_baseline.sql	Adds the nullable baseline needed to preserve pre-existing manual workspace access during SCIM reconciliation.
.github/workflows/test-build.yml	Extends PostgreSQL CI coverage and adds real-HTTP SCIM administration and provisioning checks.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    IdP[Identity provider] -->|SSO assertion| SignIn[SSO sign-in]
    IdP -->|SCIM requests| Provisioning[SCIM provisioning]
    Domains[Verified domains] --> SignIn
    Domains --> Provisioning
    Provisioning --> Membership[Organization membership]
    Provisioning --> Groups[Directory groups]
    Groups --> Grants[Workspace and permission-group grants]
    Membership --> Policy[Session and access policy]
    Grants --> Policy

Loading

_{Reviews (2): Last reviewed commit: "fix(identity): reuse settings controls a..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.