feat(auth): surface "SSO Providers" in the Setup nav when SSO is enabled (ADR-0024 / cloud#551) (#2389)

The sys_sso_provider admin object (register/list/delete external OIDC IdPs) had
no nav entry — reachable only by direct URL. AuthPlugin now contributes an
"SSO Providers" entry into the Setup app's Access Control group, gated on
AuthManager.isSsoWired() (captures self-host OS_SSO_ENABLED + cloud per-env
planAllowsSso via plugins.sso) so it never renders when the RP is off.
Owning-plugin-contributes pattern (ADR-0029 K2), mirrors plugin-security.
isSsoWired() made public for the gate.

Verified: entry appears under Setup → Access Control when SSO on; the register
form renders all fields (incl. discoveryEndpoint/scopes/mapping) and posts to
the bridge (200). (The list view shows empty for now — a pre-existing platform
behavior shared by all better-auth-managed objects, e.g. OAuth Applications /
Identity Links already in nav read 0 via the data API; separate follow-up.)

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

.changeset/adr-0024-sso-nav.md

@@ -0,0 +1,7 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+Auth: surface "SSO Providers" in the Setup app nav when SSO is enabled (ADR-0024 / cloud#551)
+
+The `sys_sso_provider` admin object (register / list / delete external OIDC IdPs) had no navigation entry, so an admin could only reach it by direct URL. `AuthPlugin` now contributes an **"SSO Providers"** entry into the Setup app's **Access Control** group — but only when the external-IdP RP is wired (`AuthManager.isSsoWired()`, which captures both self-host `OS_SSO_ENABLED` and the cloud per-env `planAllowsSso` arriving via `plugins.sso`). Owning-plugin-contributes pattern (ADR-0029 K2), mirroring `plugin-security`. `isSsoWired()` is made public for this gate.

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -1981,8 +1981,11 @@ export class AuthManager {
    * in `buildPlugins()` (`ssoFromEnv ?? pluginConfig.sso ?? false`) so the
    * advertised capability can never disagree with the actual `/sign-in/sso`
    * route. `OS_SSO_ENABLED` (when set) wins over the config-file setting.
+   * Public so `AuthPlugin` can gate the Setup-nav "SSO Providers" entry on it
+   * (captures both self-host `OS_SSO_ENABLED` and the cloud per-env
+   * `planAllowsSso` config, since that arrives via `plugins.sso`).
    */
-  private isSsoWired(): boolean {
+  public isSsoWired(): boolean {
     const ssoEnv = (globalThis as any)?.process?.env?.OS_SSO_ENABLED;
     const ssoFromEnv = ssoEnv != null ? String(ssoEnv).toLowerCase() === 'true' : undefined;
     return ssoFromEnv ?? (this.config.plugins as any)?.sso ?? false;

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -200,6 +200,34 @@ export class AuthPlugin implements Plugin {
       dashboards: [SystemOverviewDashboard],
       // ADR-0021 — datasets backing the System Overview dashboard's widgets.
       datasets: SystemOverviewDatasets,
+      // ADR-0024 / cloud#551 — surface "SSO Providers" (sys_sso_provider) in the
+      // Setup app's Access Control group, but ONLY when the external-IdP RP is
+      // wired (self-host `OS_SSO_ENABLED`, or the cloud per-env `planAllowsSso`
+      // arriving via `plugins.sso`). Without the gate the entry would render an
+      // empty list + a "Register" button whose endpoint 404s when SSO is off.
+      // Owning-plugin-contributes pattern (ADR-0029 K2), mirroring plugin-security.
+      ...(this.authManager.isSsoWired()
+        ? {
+            navigationContributions: [
+              {
+                app: 'setup',
+                group: 'group_access_control',
+                // After Roles/Permission-Sets (100) and Sharing (200), near API Keys (300).
+                priority: 250,
+                items: [
+                  {
+                    id: 'nav_sso_providers',
+                    type: 'object',
+                    label: 'SSO Providers',
+                    objectName: 'sys_sso_provider',
+                    icon: 'log-in',
+                    requiredPermissions: ['manage_platform_settings'],
+                  },
+                ],
+              },
+            ],
+          }
+        : {}),
     });
 
     ctx.logger.info('Auth Plugin initialized successfully');