refactor(dashboard-api): flatten wrappers, fold sso handler tests into team tests

- identity is now a required value param of bootstrapUser (production always
  has one since the OIDC-only path); the nil-identity guards, the
  setOIDCIdentityExternalID wrapper, and the test-only nil-identity
  concurrency test go away — s.idp.SetIdentityExternalID is called directly
- inline the one-expression creatorContextFromSignupMetadata
- drop zero-value test constructors (newTestIdentityProvider et al)
- rename provisioning_error.go -> utils_provisioning.go per handlers convention
- move the two PostTeamsTeamIDMembers SSO-guard tests from sso_test.go into
  team_handlers_test.go where the other member tests live

Author: ben-fornefeld

packages/dashboard-api/internal/handlers/sso_test.go

@@ -127,7 +127,7 @@ func TestPostTeamsTeamIDMembers_DuplicateMemberReturnsBadRequest(t *testing.T) {
 	store := &APIStore{
 		db:     testDB.SqlcClient,
 		authDB: testDB.AuthDB,
-		idp:    newHandlerTestIdentityProvider(),
+		idp:    handlerTestIdentityProvider{},
 	}
 	store.PostTeamsTeamIDMembers(ginCtx, teamID)
 
@@ -166,7 +166,7 @@ func TestPostTeamsTeamIDMembers_CreatesPublicUserAnchorForInvitee(t *testing.T)
 		db:          testDB.SqlcClient,
 		authDB:      testDB.AuthDB,
 		authService: noopAuthService{},
-		idp:         newHandlerTestIdentityProvider(),
+		idp:         handlerTestIdentityProvider{},
 	}
 	store.PostTeamsTeamIDMembers(ginCtx, teamID)
 
@@ -186,6 +186,92 @@ func TestPostTeamsTeamIDMembers_CreatesPublicUserAnchorForInvitee(t *testing.T)
 	}
 }
 
+// ssoIdentityProvider is a Provider whose organization lookups are configurable, so
+// tests can simulate identities that belong to an Ory organization.
+type ssoIdentityProvider struct {
+	handlerTestIdentityProvider
+
+	orgByUser map[uuid.UUID]uuid.UUID
+}
+
+func (p ssoIdentityProvider) GetUserOrganizationID(_ context.Context, userID uuid.UUID) (uuid.UUID, error) {
+	return p.orgByUser[userID], nil
+}
+
+func TestPostTeamsTeamIDMembers_RejectsInviteOutsideSSOOrg(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+	teamID := uuid.New()
+	orgID := uuid.New()
+	actingUserID := uuid.New()
+	inviteeID := uuid.New()
+
+	recorder := httptest.NewRecorder()
+	ginCtx, _ := gin.CreateTestContext(recorder)
+	auth.SetUserIDForTest(t, ginCtx, actingUserID)
+	auth.SetTeamInfoForTest(t, ginCtx, &authtypes.Team{
+		Team: &authqueries.Team{ID: teamID, SsoOrganizationID: &orgID},
+	})
+	ginCtx.Request = httptest.NewRequestWithContext(ctx, http.MethodPost, "/", strings.NewReader(`{"email":"`+handlerTestUserEmail(inviteeID)+`"}`))
+	ginCtx.Request.Header.Set("Content-Type", "application/json")
+
+	// invitee belongs to no org (orgByUser empty) → outside the team's org.
+	store := &APIStore{
+		idp:          ssoIdentityProvider{},
+		provisioning: provisioning.New(nil, ssoIdentityProvider{}, nil, ""),
+	}
+	store.PostTeamsTeamIDMembers(ginCtx, teamID)
+
+	if recorder.Code != http.StatusForbidden {
+		t.Fatalf("expected 403 for an invite outside the SSO org, got %d: %s", recorder.Code, recorder.Body.String())
+	}
+}
+
+func TestPostTeamsTeamIDMembers_AllowsInviteFromSSOOrg(t *testing.T) {
+	t.Parallel()
+
+	testDB := testutils.SetupDatabase(t)
+	ctx := t.Context()
+
+	orgID := uuid.New()
+	teamID := testutils.CreateTestTeam(t, testDB)
+	actingUserID := createHandlerTestUser(t, testDB)
+	inviteeID := uuid.New()
+
+	recorder := httptest.NewRecorder()
+	ginCtx, _ := gin.CreateTestContext(recorder)
+	auth.SetUserIDForTest(t, ginCtx, actingUserID)
+	auth.SetTeamInfoForTest(t, ginCtx, &authtypes.Team{
+		Team: &authqueries.Team{ID: teamID, SsoOrganizationID: &orgID},
+	})
+	ginCtx.Request = httptest.NewRequestWithContext(ctx, http.MethodPost, "/", strings.NewReader(`{"email":"`+handlerTestUserEmail(inviteeID)+`"}`))
+	ginCtx.Request.Header.Set("Content-Type", "application/json")
+
+	// invitee belongs to the same org as the team → allowed.
+	profiles := ssoIdentityProvider{orgByUser: map[uuid.UUID]uuid.UUID{inviteeID: orgID}}
+	store := &APIStore{
+		db:           testDB.SqlcClient,
+		authDB:       testDB.AuthDB,
+		authService:  noopAuthService{},
+		idp:          profiles,
+		provisioning: provisioning.New(testDB.AuthDB, profiles, nil, ""),
+	}
+	store.PostTeamsTeamIDMembers(ginCtx, teamID)
+
+	if ginCtx.Writer.Status() != http.StatusCreated {
+		t.Fatalf("expected 201 for an in-org invite, got %d: %s", ginCtx.Writer.Status(), recorder.Body.String())
+	}
+
+	memberships, err := testDB.AuthDB.Read.GetTeamsWithUsersTeams(ctx, inviteeID)
+	if err != nil {
+		t.Fatalf("failed to read memberships: %v", err)
+	}
+	if len(memberships) != 1 || memberships[0].Team.ID != teamID {
+		t.Fatalf("expected invitee to be a member of %s, got %v", teamID, memberships)
+	}
+}
+
 func TestDeleteTeamsTeamIDMembersUserId_NonMemberReturnsBadRequest(t *testing.T) {
 	t.Parallel()
 
@@ -357,10 +443,6 @@ func handlerTestUserEmail(userID uuid.UUID) string {
 
 type handlerTestIdentityProvider struct{}
 
-func newHandlerTestIdentityProvider() identity.Provider {
-	return handlerTestIdentityProvider{}
-}
-
 func (handlerTestIdentityProvider) GetProfilesByUserID(_ context.Context, userIDs []uuid.UUID) (map[uuid.UUID]identity.Profile, error) {
 	profiles := make(map[uuid.UUID]identity.Profile, len(userIDs))
 	for _, userID := range userIDs {
@@ -483,7 +565,7 @@ func TestPostTeams_LocalPolicyDeniedReturnsBadRequestWithoutCreatingTeam(t *test
 	store := &APIStore{
 		db:           testDB.SqlcClient,
 		authDB:       testDB.AuthDB,
-		provisioning: provisioning.New(testDB.AuthDB, newHandlerTestIdentityProvider(), sink, ""),
+		provisioning: provisioning.New(testDB.AuthDB, handlerTestIdentityProvider{}, sink, ""),
 	}
 	store.PostTeams(ginCtx)
 
@@ -521,7 +603,7 @@ func TestPostTeams_InvalidNameReturnsBadRequest(t *testing.T) {
 		store := &APIStore{
 			db:           testDB.SqlcClient,
 			authDB:       testDB.AuthDB,
-			provisioning: provisioning.New(testDB.AuthDB, newHandlerTestIdentityProvider(), sink, ""),
+			provisioning: provisioning.New(testDB.AuthDB, handlerTestIdentityProvider{}, sink, ""),
 		}
 		store.PostTeams(ginCtx)
 
@@ -551,7 +633,7 @@ func TestPostTeams_InvalidRequestBodyReturnsBadRequest(t *testing.T) {
 	store := &APIStore{
 		db:           testDB.SqlcClient,
 		authDB:       testDB.AuthDB,
-		provisioning: provisioning.New(testDB.AuthDB, newHandlerTestIdentityProvider(), sink, ""),
+		provisioning: provisioning.New(testDB.AuthDB, handlerTestIdentityProvider{}, sink, ""),
 	}
 	store.PostTeams(ginCtx)
 
@@ -583,7 +665,7 @@ func TestPostTeams_TrimsNameBeforeCreate(t *testing.T) {
 	store := &APIStore{
 		db:           testDB.SqlcClient,
 		authDB:       testDB.AuthDB,
-		provisioning: provisioning.New(testDB.AuthDB, newHandlerTestIdentityProvider(), sink, ""),
+		provisioning: provisioning.New(testDB.AuthDB, handlerTestIdentityProvider{}, sink, ""),
 	}
 	store.PostTeams(ginCtx)
 
@@ -634,7 +716,7 @@ func TestPostTeams_ProvisioningFailureRollsBackCreatedTeam(t *testing.T) {
 	store := &APIStore{
 		db:           testDB.SqlcClient,
 		authDB:       testDB.AuthDB,
-		provisioning: provisioning.New(testDB.AuthDB, newHandlerTestIdentityProvider(), sink, ""),
+		provisioning: provisioning.New(testDB.AuthDB, handlerTestIdentityProvider{}, sink, ""),
 	}
 	store.PostTeams(ginCtx)
 
@@ -692,7 +774,7 @@ func TestPostTeams_ProvisioningFailurePreservesProvisionErrorStatus(t *testing.T
 			store := &APIStore{
 				db:           testDB.SqlcClient,
 				authDB:       testDB.AuthDB,
-				provisioning: provisioning.New(testDB.AuthDB, newHandlerTestIdentityProvider(), sink, ""),
+				provisioning: provisioning.New(testDB.AuthDB, handlerTestIdentityProvider{}, sink, ""),
 			}
 			store.PostTeams(ginCtx)