feat(sso): add safe member provisioning

[waleedlatif1]

Summary

Add configurable Automatic and Invite-only SSO member provisioning. Route automatic joins through verified, seat-aware organization admission, preserve existing-member access in Invite-only mode, and upgrade Better Auth to the patched stable SSO release.

Fixes: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: ___________

Testing

• bun run lint
• bun run lint:check
• bun run check:audits
• bun run apps/sim/scripts/check-block-registry.ts origin/staging
• bun run check:migrations origin/staging
• bunx turbo run type-check --filter=@sim/app --filter=@sim/auth --filter=@sim/db
• 101 focused SSO tests after rebasing onto current staging

Review the fail-closed admission behavior, Team versus Enterprise seat handling, existing-member behavior in Invite-only mode, and the administrator/user error UX.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

Not included; the UI behavior is covered by component tests.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 31, 2026 9:51pm

[greptile-apps]

Greptile Summary

The PR adds configurable automatic and invite-only SSO member provisioning, routing automatic admission through organization membership, billing, and session-policy controls.

• Persists provisioning mode on SSO providers and exposes it through registration, provider listing, and administrator settings.
• Adds verified, deterministic, subscription-pinned admission with fixed-capacity checks and Team seat reconciliation.
• Preserves invitations, external workspace access, and existing membership while improving callback error handling and documentation.
• Upgrades Better Auth and adds focused coverage for admission, callbacks, settings, and rollback behavior.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/auth/sso/application/admit-sso-user.ts	Implements verified, lock-protected SSO admission and consistently pins billing decisions and seat reconciliation to the deterministically selected subscription.
apps/sim/lib/auth/auth.ts	Integrates application-owned SSO admission into callback processing, activates accepted organization sessions, and redirects denied callbacks with explicit errors.
apps/sim/lib/billing/organizations/membership.ts	Adds optional subscription pinning so capacity validation and paid-join behavior resolve the same entitled subscription.
apps/sim/lib/billing/organizations/seats.ts	Supports subscription-pinned Team seat reconciliation after successful automatic provisioning.
apps/sim/app/api/auth/sso/register/route.ts	Persists provisioning mode with domain trust and restores it during failed provider-update rollback.
apps/sim/ee/sso/components/sso-settings.tsx	Adds administrator controls and saved-state presentation for automatic versus invite-only provisioning.
packages/db/migrations/0314_superb_daimon_hellstrom.sql	Adds a non-null provisioning flag with a rollout-compatible default preserving existing automatic behavior.

Sequence Diagram

sequenceDiagram
    participant U as SSO User
    participant BA as Better Auth
    participant A as SSO Admission
    participant DB as Organization and Billing DB
    participant UI as SSO UI
    U->>BA: Complete IdP authentication
    BA->>A: Admit authenticated provider identity
    A->>DB: Verify provider and inspect existing access
    alt Existing member
        A-->>BA: Activate existing organization
    else Invite-only or preserved invitation/access
        A-->>BA: Authenticate without new membership
    else Automatic provisioning
        A->>DB: Select current subscription and enforce seats
        A->>DB: Create member and reconcile Team seats
        A-->>BA: Activate organization session
    else Admission denied
        BA->>DB: Delete newly created session
        BA-->>UI: Redirect with actionable error
    end

Loading

_{Reviews (2): Last reviewed commit: "fix(sso): harden provisioning edge cases" | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 25 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic
Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>

[waleedlatif1]

@greptile