Sso 01 schema

[jokabuyasina]

Consolidated SSO SAML schema migration.

Schema includes:

Tables: org_saml_connections, saml_domain_mappings, sso_audit_logs
Functions: check_org_sso_configured, lookup_sso_provider_, auto_join_
Triggers: auto_join_sso_user_trigger, check_sso_domain_on_signup_trigger
RLS policies for all tables
Indexes for performance
Single SSO per org constraint (UNIQUE org_id, entity_id)
auto_join_enabled flag for controlling enrollment
This is PR #1 of the SSO feature split (schema foundation only). No backend endpoints, no frontend, no tests included yet.

Related: feature/sso-saml-authentication

Summary by CodeRabbit

• New Features

  • Added SSO/SAML single sign-on support with configuration management
  • Implemented auto-enrollment of SSO users across organizations
  • Added domain-based SSO provider mapping

• Improvements

  • Organizations now filtered based on 2FA enforcement status
  • Sensitive organization data redacted for users non-compliant with password policies
  • Enhanced SSO audit logging for security tracking

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

This PR introduces comprehensive SSO/SAML authentication infrastructure with new database tables, helper functions, and auto-enrollment triggers for domain-based organization joining. Additionally, it refactors Vue component data handling to remove store dependencies and updates the get_orgs_v7 function to enforce 2FA and password policies with selective data redaction.

Changes

Cohort / File(s)	Summary
Frontend Data Handling src/components/dashboard/UsageCard.vue	Refactored component to eliminate external store dependency for demo-mode detection. Introduced internal computed properties (isDemoMode, effectiveData, effectiveDataByApp) that determine data selection based on real data presence and loading state. Updated numeric aggregation with explicit type guards and adjusted hasChartData logic to include zero values.
Backend Import Refactoring supabase/functions/_backend/private/groups.ts, role_bindings.ts, roles.ts	Changed schema module imports from named imports to namespace imports (e.g., import * as schema) across three backend private route files. No runtime behavior changes; all downstream usage remains valid.
Database Schema Definitions supabase/functions/_backend/utils/postgres_schema.ts	Added three new pgTable definitions: org_saml_connections (with org_id/entity_id unique constraints), saml_domain_mappings (with domain/sso_connection_id unique constraint), and sso_audit_logs. Introduced unique constraint import from drizzle-orm. Removed aggregate schema export object.
SSO/SAML Infrastructure supabase/migrations/20260107210800_sso_saml_complete.sql	Comprehensive migration establishing SSO/SAML foundation: creates three new tables (org_saml_connections, saml_domain_mappings, sso_audit_logs) with indexes and constraints. Implements lookup and validation helper functions. Adds auto-enrollment logic via internal/public functions and triggers on auth.users table to auto-join users based on provider or domain. Includes RLS policies and permission grants for authenticated and service roles.
SSO Audit Cleanup Scheduling supabase/migrations/20260108052411_add_sso_audit_cleanup_cron.sql	Schedules daily cron task at 3:00 AM UTC to execute cleanup_old_sso_audit_logs function, removing logs older than 90 days and anonymizing PII for deleted users.
Organization Access Control supabase/migrations/20260123203333_fix_get_orgs_v7_hide_denied_orgs.sql	Rewrites get_orgs_v7 function with expanded return table (adding enforcing_2fa, 2fa_has_access, password policy fields, etc.). Implements logic to completely hide orgs where 2FA is enforced and user lacks access; redacts sensitive fields for orgs with non-compliant password policies while retaining the org in results.

Sequence Diagram

sequenceDiagram
    participant User as User
    participant Auth as Auth Service
    participant DB as PostgreSQL
    participant Trigger as Trigger Function
    participant Enroll as Auto-Enroll Logic

    User->>Auth: Sign up / Update profile
    Auth->>DB: INSERT/UPDATE auth.users
    DB->>Trigger: Invoke trigger_auto_join_on_user_create()
    activate Trigger
    Trigger->>DB: Query lookup_sso_provider_for_email()
    alt Provider found
        Trigger->>Enroll: Call auto_join_user_to_orgs_by_email()
        activate Enroll
        Enroll->>DB: Query saml_domain_mappings by domain
        alt Domain mapping exists
            Enroll->>DB: Retrieve org by priority
            Enroll->>DB: INSERT into org_users (auto-join)
            Enroll->>DB: INSERT into sso_audit_logs (event: auto_joined)
        end
        Enroll->>DB: Return enrollment results
        deactivate Enroll
    end
    deactivate Trigger
    DB->>Auth: Complete user signup
    Auth->>User: Authentication successful (auto-joined to org)

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• Add reject_access_due_to_2fa_for_org function #1333: Adds 2FA enforcement rejection logic for org access control that complements the 2FA hiding logic in updated get_orgs_v7.
• feat: enforce encrypted bundles in organization security #1343: Modifies the same get_orgs_v7 database function with different return shape and behavior changes.
• Fix demo chart data consistency #1390: Refactors the same UsageCard.vue component's demo vs. real data selection and effectiveData logic.

Suggested labels

enhancement

Poem

🐰 Hop-hop, SSO's here!
Domains mapped with flair,
Auto-join we cheer,
2FA security fair,
Data flows crystal clear! ✨

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 SQLFluff (4.0.0)

supabase/migrations/20260108052411_add_sso_audit_cleanup_cron.sql

User Error: No dialect was specified. You must configure a dialect or specify one on the command line using --dialect after the command. Available dialects:
ansi, athena, bigquery, clickhouse, databricks, db2, doris, duckdb, exasol, flink, greenplum, hive, impala, mariadb, materialize, mysql, oracle, postgres, redshift, snowflake, soql, sparksql, sqlite, starrocks, teradata, trino, tsql, vertica

supabase/migrations/20260123203333_fix_get_orgs_v7_hide_denied_orgs.sql

User Error: No dialect was specified. You must configure a dialect or specify one on the command line using --dialect after the command. Available dialects:
ansi, athena, bigquery, clickhouse, databricks, db2, doris, duckdb, exasol, flink, greenplum, hive, impala, mariadb, materialize, mysql, oracle, postgres, redshift, snowflake, soql, sparksql, sqlite, starrocks, teradata, trino, tsql, vertica

supabase/migrations/20260107210800_sso_saml_complete.sql

User Error: No dialect was specified. You must configure a dialect or specify one on the command line using --dialect after the command. Available dialects:
ansi, athena, bigquery, clickhouse, databricks, db2, doris, duckdb, exasol, flink, greenplum, hive, impala, mariadb, materialize, mysql, oracle, postgres, redshift, snowflake, soql, sparksql, sqlite, starrocks, teradata, trino, tsql, vertica

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud