feat(auth): surface features.sso in public /auth/config

getPublicConfig() advertised every other auth capability flag (oidcProvider,
twoFactor, multiOrgEnabled, …) but omitted enterprise SSO, even though the
manager already computes whether @better-auth/sso is wired (OS_SSO_ENABLED /
plugins.sso). The login UI therefore had nothing to gate on and rendered the
"Sign in with SSO" button unconditionally; on a deployment without SSO wired,
clicking it only then surfaced "No SSO provider is configured for this email
domain."

features.sso is now resolved with the EXACT logic that decides whether the
plugin is mounted in buildPlugins(), so the advertised capability can never
disagree with the actual /sign-in/sso route. Tests cover default-off, config-on,
and OS_SSO_ENABLED env override.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

.changeset/auth-config-sso-feature-flag.md

@@ -0,0 +1,18 @@
+---
+"@objectstack/plugin-auth": patch
+---
+
+feat(auth): surface `features.sso` in the public `/auth/config` response
+
+`getPublicConfig()` reported every other auth capability flag (`oidcProvider`,
+`twoFactor`, `multiOrgEnabled`, …) but omitted enterprise SSO, even though the
+manager already computes whether the domain-routed `@better-auth/sso` plugin is
+wired (`OS_SSO_ENABLED` / `plugins.sso`). Without it the login UI had no signal
+to gate on, so it rendered a "Sign in with SSO" button unconditionally — and on
+a self-hosted / local deployment where SSO isn't wired, clicking it only then
+surfaced "No SSO provider is configured for this email domain."
+
+The config now includes `features.sso`, resolved with the EXACT logic that
+decides whether the plugin is mounted in `buildPlugins()`, so the advertised
+capability can never disagree with the actual `/sign-in/sso` route. The console
+login form consumes this to hide the button when SSO is off (objectui side).

packages/plugins/plugin-auth/src/auth-manager.test.ts

@@ -1046,6 +1046,7 @@ describe('AuthManager', () => {
         magicLink: false,
         organization: true,
         oidcProvider: false,
+        sso: false,
         deviceAuthorization: false,
         admin: false,
         multiOrgEnabled: false,
@@ -1054,6 +1055,48 @@ describe('AuthManager', () => {
       });
     });
 
+    // Enterprise SSO (@better-auth/sso) is opt-in: the plugin is only wired
+    // when `plugins.sso` / `OS_SSO_ENABLED` is on. The public config MUST
+    // report the same value so the login UI can hide the "Sign in with SSO"
+    // button when the `/sign-in/sso` route isn't mounted (otherwise the
+    // button only fails at click time with "No SSO provider is configured").
+    it('should report features.sso=false by default', () => {
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      const manager = new AuthManager({
+        secret: 'test-secret-at-least-32-chars-long',
+      });
+      warnSpy.mockRestore();
+
+      expect(manager.getPublicConfig().features.sso).toBe(false);
+    });
+
+    it('should report features.sso=true when enabled via plugins config', () => {
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      const manager = new AuthManager({
+        secret: 'test-secret-at-least-32-chars-long',
+        plugins: { sso: true } as any,
+      });
+      warnSpy.mockRestore();
+
+      expect(manager.getPublicConfig().features.sso).toBe(true);
+    });
+
+    it('should let OS_SSO_ENABLED env override the config (matches buildPlugins wiring)', () => {
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      const prev = process.env.OS_SSO_ENABLED;
+      process.env.OS_SSO_ENABLED = 'true';
+      try {
+        const manager = new AuthManager({
+          secret: 'test-secret-at-least-32-chars-long',
+        });
+        expect(manager.getPublicConfig().features.sso).toBe(true);
+      } finally {
+        if (prev === undefined) delete process.env.OS_SSO_ENABLED;
+        else process.env.OS_SSO_ENABLED = prev;
+        warnSpy.mockRestore();
+      }
+    });
+
     it('should filter out disabled providers', () => {
       const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
       const manager = new AuthManager({

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -1462,6 +1462,14 @@ export class AuthManager {
     // frontend will render UI for endpoints that 404.
     const oidcEnv = (globalThis as any)?.process?.env?.OS_OIDC_PROVIDER_ENABLED;
     const oidcFromEnv = oidcEnv != null ? String(oidcEnv).toLowerCase() === 'true' : undefined;
+    // Enterprise SSO (@better-auth/sso, domain-routed). Resolve it with the
+    // EXACT logic that decides whether the plugin is wired in `buildPlugins()`
+    // (`sso: ssoFromEnv ?? pluginConfig.sso ?? false`) so the two can never
+    // disagree. Surfacing it lets the login UI hide the "Sign in with SSO"
+    // button when `/sign-in/sso` isn't mounted, instead of rendering a button
+    // that only reveals "no SSO provider configured" at click time.
+    const ssoEnv = (globalThis as any)?.process?.env?.OS_SSO_ENABLED;
+    const ssoFromEnv = ssoEnv != null ? String(ssoEnv).toLowerCase() === 'true' : undefined;
     const twoFactorFromEnv = readBooleanEnv('OS_AUTH_TWO_FACTOR');
 
     const features = {
@@ -1471,6 +1479,7 @@ export class AuthManager {
       organization: pluginConfig.organization ?? true,
       multiOrgEnabled,
       oidcProvider: oidcFromEnv ?? pluginConfig.oidcProvider ?? false,
+      sso: ssoFromEnv ?? (pluginConfig as any).sso ?? false,
       deviceAuthorization: pluginConfig.deviceAuthorization ?? false,
       admin: pluginConfig.admin ?? false,
       ...(termsUrl ? { termsUrl } : {}),