feat(plugin-auth): the SSO Providers form sets, shows and clears the groups claim

.changeset/31666-sso-form-groups-claim.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/plugin-auth': patch
+'@objectstack/platform-objects': patch
+---
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+The Setup → SSO Providers forms now set the groups claim an SSO sign-in grants permission sets from. It is stored where `POST /api/v1/auth/sso/register` stores it, the provider's `mapping.extraFields.groups`, and nowhere else.
+
+- **Register SSO Provider** takes **Map: Groups claim** and **Register SAML Provider** takes **Map: Groups attribute**. Left blank, the provider maps no groups, as before.
+- **Show Groups Claim** (`POST /api/v1/auth/admin/sso/get-groups-claim`) shows a provider's claim, including one the register door wrote.
+- **Edit Groups Claim** (`POST /api/v1/auth/admin/sso/set-groups-claim`) sets it, or removes it when blank. It writes through `/sso/update-provider` and keeps every other mapping member as stored.
+
+Both new routes run the platform-admin gate of the other `/admin/sso` bridges and answer only `{ providerId, groupsClaim }`.
+
+Fixed: `POST /api/v1/auth/sso/update-provider` with an `oidcConfig` was refused 400 "clientSecret is required" for any OIDC provider whose client secret is held in `sys_secret`. The vendor reads the provider through an adapter update, and that read now carries the client secret like every other provider read.

content/docs/permissions/sso.mdx

@@ -438,9 +438,21 @@ one mapping model, two sources.
 `groups`: `mapping.extraFields.groups` names the OIDC claim or the SAML attribute
 that carries the user's groups, for example `extraFields: { groups: 'groups' }`
 in `oidcConfig.mapping` (or `samlConfig.mapping`) when the provider is registered
-through `POST /api/v1/auth/sso/register`. The **Setup → SSO Providers** form does
-not set it. The value may be one string or a list of strings. A provider whose
-mapping fills no `groups` signs users in as before.
+through `POST /api/v1/auth/sso/register`. The claim's value may be one string or
+a list of strings. A provider whose mapping fills no `groups` signs users in as
+before.
+
+In **Setup → SSO Providers**, a platform administrator sets the same member
+without the API:
+
+- **Register SSO Provider** and **Register SAML Provider** take it as
+  **Map: Groups claim** (OIDC) or **Map: Groups attribute** (SAML). Leave it blank
+  to map no groups.
+- **Show Groups Claim** on a provider shows the claim it reads now, whichever way
+  it was set.
+- **Edit Groups Claim** changes it, and a blank value removes it. Every other
+  member of the provider's mapping is kept as stored. A provider without a
+  groups claim signs users in as one registered without it.
 
 **Saving a mapping.** A platform administrator saves one mapping per group and
 permission set through `POST /api/v1/auth/admin/scim/set-group-mapping`, naming

packages/platform-objects/src/apps/translations/ar.objects.generated.ts

@@ -2123,6 +2123,11 @@ export const arObjects: NonNullable<TranslationData['objects']> = {
             label: "التعيين: مطالبة الاسم",
             helpText: "اختياري. المطالبة المعيَّنة إلى اسم العرض. القيمة الافتراضية \"name\".",
             placeholder: "name"
+          },
+          mapGroups: {
+            label: "التعيين: مطالبة المجموعات",
+            helpText: "اختياري. المطالبة التي تحمل مجموعات المستخدم، مثل \"groups\". يمنح كل تسجيل دخول مجموعات الأذونات المعيَّنة لتلك المجموعات. اتركه فارغًا لعدم تعيين أي مجموعات.",
+            placeholder: "groups"
           }
         }
       },
@@ -2153,6 +2158,11 @@ export const arObjects: NonNullable<TranslationData['objects']> = {
             label: "تنسيق NameID",
             helpText: "اختياري. تنسيق NameID المطلوب في SAML. القيمة الافتراضية هي التنسيق المُهيَّأ لدى مزوّد الهوية.",
             placeholder: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+          },
+          mapGroups: {
+            label: "التعيين: سمة المجموعات",
+            helpText: "اختياري. سمة التأكيد التي تحمل مجموعات المستخدم. يمنح كل تسجيل دخول مجموعات الأذونات المعيَّنة لتلك المجموعات. اتركه فارغًا لعدم تعيين أي مجموعات.",
+            placeholder: "groups"
           }
         }
       },
@@ -2181,6 +2191,35 @@ export const arObjects: NonNullable<TranslationData['objects']> = {
       edit_sso_sign_in_options: {
         label: "تعديل خيارات تسجيل الدخول",
         successMessage: "تم حفظ خيارات تسجيل الدخول"
+      },
+      show_sso_groups_claim: {
+        label: "عرض مطالبة المجموعات",
+        resultDialog: {
+          title: "مطالبة المجموعات",
+          description: "مطالبة OIDC أو سمة SAML التي يقرأ منها هذا الموفّر مجموعات المستخدم عند كل تسجيل دخول. القيمة الفارغة تعني أن الموفّر لا يعيّن أي مجموعات. غيّرها عبر \"تعديل مطالبة المجموعات\".",
+          acknowledge: "تم",
+          fields: {
+            groupsClaim: "مطالبة المجموعات"
+          }
+        }
+      },
+      edit_sso_groups_claim: {
+        label: "تعديل مطالبة المجموعات",
+        params: {
+          groupsClaim: {
+            label: "مطالبة المجموعات",
+            helpText: "مطالبة OIDC أو سمة SAML التي تحمل مجموعات المستخدم. يمنح كل تسجيل دخول مجموعات الأذونات المعيَّنة لتلك المجموعات. اتركه فارغًا لإزالتها: عندها لا يعيّن الموفّر أي مجموعات.",
+            placeholder: "groups"
+          }
+        },
+        resultDialog: {
+          title: "تم حفظ مطالبة المجموعات",
+          description: "مطالبة المجموعات التي يقرأها هذا الموفّر الآن عند كل تسجيل دخول. القيمة الفارغة تعني عدم تعيين أي مجموعات.",
+          acknowledge: "تم",
+          fields: {
+            groupsClaim: "مطالبة المجموعات"
+          }
+        }
       }
     }
   },

packages/platform-objects/src/apps/translations/ar.source-hashes.generated.ts

@@ -31,8 +31,11 @@ export const arGeneratedSourceHashes: Readonly<Record<string, string>> = {
   "objects.sys_oauth_application.fields.jwks_uri.label": "2a4339df734ab269",
   "objects.sys_platform_setting_audit.fields.source.options.api": "4baeeff968e192d1",
   "objects.sys_setting_audit.fields.source.options.api": "4baeeff968e192d1",
+  "objects.sys_sso_provider._actions.edit_sso_groups_claim.params.groupsClaim.placeholder": "833cddda1a6e25f9",
   "objects.sys_sso_provider._actions.register_saml_provider.params.identifierFormat.placeholder": "5945ff9a6b644855",
+  "objects.sys_sso_provider._actions.register_saml_provider.params.mapGroups.placeholder": "833cddda1a6e25f9",
   "objects.sys_sso_provider._actions.register_sso_provider.params.mapEmail.placeholder": "66309c7adf5c9436",
+  "objects.sys_sso_provider._actions.register_sso_provider.params.mapGroups.placeholder": "833cddda1a6e25f9",
   "objects.sys_sso_provider._actions.register_sso_provider.params.mapName.placeholder": "a484c34aaf624bd6",
   "objects.sys_sso_provider._actions.register_sso_provider.params.scopes.placeholder": "58ac90cde28c764d",
 };

packages/platform-objects/src/apps/translations/de.objects.generated.ts

@@ -2123,6 +2123,11 @@ export const deObjects: NonNullable<TranslationData['objects']> = {
             label: "Zuordnung: Namens-Claim",
             helpText: "Optional. Claim, der dem Anzeigenamen zugeordnet wird. Standard ist „name“.",
             placeholder: "name"
+          },
+          mapGroups: {
+            label: "Zuordnung: Gruppen-Claim",
+            helpText: "Optional. Claim, der die Gruppen des Benutzers enthält, z. B. „groups“. Jede Anmeldung vergibt die diesen Gruppen zugeordneten Berechtigungssätze. Leer lassen, um keine Gruppen zuzuordnen.",
+            placeholder: "groups"
           }
         }
       },
@@ -2153,6 +2158,11 @@ export const deObjects: NonNullable<TranslationData['objects']> = {
             label: "NameID-Format",
             helpText: "Optional. Angefordertes SAML-NameID-Format. Standard ist das im IdP konfigurierte Format.",
             placeholder: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+          },
+          mapGroups: {
+            label: "Zuordnung: Gruppenattribut",
+            helpText: "Optional. Assertion-Attribut, das die Gruppen des Benutzers enthält. Jede Anmeldung vergibt die diesen Gruppen zugeordneten Berechtigungssätze. Leer lassen, um keine Gruppen zuzuordnen.",
+            placeholder: "groups"
           }
         }
       },
@@ -2181,6 +2191,35 @@ export const deObjects: NonNullable<TranslationData['objects']> = {
       edit_sso_sign_in_options: {
         label: "Anmeldeoptionen bearbeiten",
         successMessage: "Anmeldeoptionen gespeichert"
+      },
+      show_sso_groups_claim: {
+        label: "Gruppen-Claim anzeigen",
+        resultDialog: {
+          title: "Gruppen-Claim",
+          description: "Der OIDC-Claim oder das SAML-Attribut, aus dem dieser Anbieter bei jeder Anmeldung die Gruppen des Benutzers liest. Leer bedeutet, dass der Anbieter keine Gruppen zuordnet. Ändern Sie ihn mit „Gruppen-Claim bearbeiten“.",
+          acknowledge: "Fertig",
+          fields: {
+            groupsClaim: "Gruppen-Claim"
+          }
+        }
+      },
+      edit_sso_groups_claim: {
+        label: "Gruppen-Claim bearbeiten",
+        params: {
+          groupsClaim: {
+            label: "Gruppen-Claim",
+            helpText: "Der OIDC-Claim oder das SAML-Attribut, das die Gruppen des Benutzers enthält. Jede Anmeldung vergibt die diesen Gruppen zugeordneten Berechtigungssätze. Leer lassen, um ihn zu entfernen: Der Anbieter ordnet dann keine Gruppen zu.",
+            placeholder: "groups"
+          }
+        },
+        resultDialog: {
+          title: "Gruppen-Claim gespeichert",
+          description: "Der Gruppen-Claim, den dieser Anbieter jetzt bei jeder Anmeldung liest. Leer bedeutet, dass keine Gruppen zugeordnet werden.",
+          acknowledge: "Fertig",
+          fields: {
+            groupsClaim: "Gruppen-Claim"
+          }
+        }
       }
     }
   },

packages/platform-objects/src/apps/translations/de.source-hashes.generated.ts

@@ -163,8 +163,11 @@ export const deGeneratedSourceHashes: Readonly<Record<string, string>> = {
   "objects.sys_setting_audit.fields.source.options.import": "05c80d3a61ec3290",
   "objects.sys_setting_audit.fields.source.options.migration": "477a479630b97ad5",
   "objects.sys_setting_audit.fields.source.options.system": "d2c13a5a8c70ea8d",
+  "objects.sys_sso_provider._actions.edit_sso_groups_claim.params.groupsClaim.placeholder": "833cddda1a6e25f9",
   "objects.sys_sso_provider._actions.register_saml_provider.params.identifierFormat.placeholder": "5945ff9a6b644855",
+  "objects.sys_sso_provider._actions.register_saml_provider.params.mapGroups.placeholder": "833cddda1a6e25f9",
   "objects.sys_sso_provider._actions.register_sso_provider.params.mapEmail.placeholder": "66309c7adf5c9436",
+  "objects.sys_sso_provider._actions.register_sso_provider.params.mapGroups.placeholder": "833cddda1a6e25f9",
   "objects.sys_sso_provider._actions.register_sso_provider.params.mapName.placeholder": "a484c34aaf624bd6",
   "objects.sys_sso_provider._actions.register_sso_provider.params.scopes.placeholder": "58ac90cde28c764d",
   "objects.sys_sso_provider._actions.request_domain_verification.resultDialog.fields.dnsRecordName": "b9fb79397650d504",

packages/platform-objects/src/apps/translations/en.objects.generated.ts

@@ -2123,6 +2123,11 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
             label: "Map: Name claim",
             helpText: "Optional. Claim mapped to display name. Defaults to \"name\".",
             placeholder: "name"
+          },
+          mapGroups: {
+            label: "Map: Groups claim",
+            helpText: "Optional. Claim that carries the user’s groups, e.g. \"groups\". Each sign-in grants the permission sets mapped to those groups. Leave blank to map no groups.",
+            placeholder: "groups"
           }
         }
       },
@@ -2153,6 +2158,11 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
             label: "NameID Format",
             helpText: "Optional. Requested SAML NameID format. Defaults to the IdP’s configured format.",
             placeholder: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+          },
+          mapGroups: {
+            label: "Map: Groups attribute",
+            helpText: "Optional. Assertion attribute that carries the user’s groups. Each sign-in grants the permission sets mapped to those groups. Leave blank to map no groups.",
+            placeholder: "groups"
           }
         }
       },
@@ -2181,6 +2191,35 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       edit_sso_sign_in_options: {
         label: "Edit Sign-In Options",
         successMessage: "Sign-in options saved"
+      },
+      show_sso_groups_claim: {
+        label: "Show Groups Claim",
+        resultDialog: {
+          title: "Groups claim",
+          description: "The OIDC claim or SAML attribute this provider reads the user’s groups from at each sign-in. Empty means the provider maps no groups. Change it with “Edit Groups Claim”.",
+          acknowledge: "Done",
+          fields: {
+            groupsClaim: "Groups claim"
+          }
+        }
+      },
+      edit_sso_groups_claim: {
+        label: "Edit Groups Claim",
+        params: {
+          groupsClaim: {
+            label: "Groups claim",
+            helpText: "The OIDC claim or SAML attribute that carries the user’s groups. Each sign-in grants the permission sets mapped to those groups. Leave blank to remove it: the provider then maps no groups.",
+            placeholder: "groups"
+          }
+        },
+        resultDialog: {
+          title: "Groups claim saved",
+          description: "The groups claim this provider now reads at each sign-in. Empty means it maps no groups.",
+          acknowledge: "Done",
+          fields: {
+            groupsClaim: "Groups claim"
+          }
+        }
       }
     }
   },

packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts

@@ -2123,6 +2123,11 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
             label: "Mapeo: reclamo de nombre",
             helpText: "Opcional. Reclamo asignado al nombre visible. Valor predeterminado: «name».",
             placeholder: "name"
+          },
+          mapGroups: {
+            label: "Mapeo: reclamo de grupos",
+            helpText: "Opcional. Reclamo que contiene los grupos del usuario, p. ej. «groups». Cada inicio de sesión concede los conjuntos de permisos asignados a esos grupos. Déjelo en blanco para no asignar grupos.",
+            placeholder: "groups"
           }
         }
       },
@@ -2153,6 +2158,11 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
             label: "Formato de NameID",
             helpText: "Opcional. Formato de NameID SAML solicitado. Por defecto, el formato configurado en el IdP.",
             placeholder: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+          },
+          mapGroups: {
+            label: "Mapeo: atributo de grupos",
+            helpText: "Opcional. Atributo de la aserción que contiene los grupos del usuario. Cada inicio de sesión concede los conjuntos de permisos asignados a esos grupos. Déjelo en blanco para no asignar grupos.",
+            placeholder: "groups"
           }
         }
       },
@@ -2181,6 +2191,35 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       edit_sso_sign_in_options: {
         label: "Editar opciones de inicio de sesión",
         successMessage: "Opciones de inicio de sesión guardadas"
+      },
+      show_sso_groups_claim: {
+        label: "Mostrar reclamo de grupos",
+        resultDialog: {
+          title: "Reclamo de grupos",
+          description: "El reclamo OIDC o el atributo SAML del que este proveedor lee los grupos del usuario en cada inicio de sesión. Vacío significa que el proveedor no asigna grupos. Cámbielo con «Editar reclamo de grupos».",
+          acknowledge: "Hecho",
+          fields: {
+            groupsClaim: "Reclamo de grupos"
+          }
+        }
+      },
+      edit_sso_groups_claim: {
+        label: "Editar reclamo de grupos",
+        params: {
+          groupsClaim: {
+            label: "Reclamo de grupos",
+            helpText: "El reclamo OIDC o el atributo SAML que contiene los grupos del usuario. Cada inicio de sesión concede los conjuntos de permisos asignados a esos grupos. Déjelo en blanco para eliminarlo: el proveedor dejará de asignar grupos.",
+            placeholder: "groups"
+          }
+        },
+        resultDialog: {
+          title: "Reclamo de grupos guardado",
+          description: "El reclamo de grupos que este proveedor lee ahora en cada inicio de sesión. Vacío significa que no se asignan grupos.",
+          acknowledge: "Hecho",
+          fields: {
+            groupsClaim: "Reclamo de grupos"
+          }
+        }
       }
     }
   },

packages/platform-objects/src/apps/translations/es-ES.source-hashes.generated.ts

@@ -122,8 +122,11 @@ export const esESGeneratedSourceHashes: Readonly<Record<string, string>> = {
   "objects.sys_setting_audit.fields.id.label": "00b0385c9c152888",
   "objects.sys_setting_audit.fields.source.options.api": "4baeeff968e192d1",
   "objects.sys_setting_audit.fields.source.options.ui": "95caad102a5c97ba",
+  "objects.sys_sso_provider._actions.edit_sso_groups_claim.params.groupsClaim.placeholder": "833cddda1a6e25f9",
   "objects.sys_sso_provider._actions.register_saml_provider.params.identifierFormat.placeholder": "5945ff9a6b644855",
+  "objects.sys_sso_provider._actions.register_saml_provider.params.mapGroups.placeholder": "833cddda1a6e25f9",
   "objects.sys_sso_provider._actions.register_sso_provider.params.mapEmail.placeholder": "66309c7adf5c9436",
+  "objects.sys_sso_provider._actions.register_sso_provider.params.mapGroups.placeholder": "833cddda1a6e25f9",
   "objects.sys_sso_provider._actions.register_sso_provider.params.mapName.placeholder": "a484c34aaf624bd6",
   "objects.sys_sso_provider._actions.register_sso_provider.params.scopes.placeholder": "58ac90cde28c764d",
   "objects.sys_sso_provider.fields.id.label": "00b0385c9c152888",