Summary

The SSO service (mcpgateway/services/sso_service.py:892) still uses the dict format for the teams JWT claim, while /tokens and /auth/login now use a list of string IDs.

Current Behavior

# sso_service.py:892
token_data["teams"] = [
    {"id": team.id, "name": team.name, "slug": team.slug, "is_personal": team.is_personal, "role": user.get_team_role(team.id)} 
    for team in teams
]

Expected Behavior

token_data["teams"] = [team.id for team in teams]

Context

This was identified during PR #2191 which fixed the same inconsistency in /auth/login. The SSO path wasn't updated because:

1. _normalize_token_teams() in main.py handles both formats
2. get_team_from_token() in auth.py has fallback logic for dict format
3. The namespaces claim is computed before the teams format conversion

Why This Matters

• Consistency across all token generation paths
• Smaller JWT payload size (IDs only vs full team objects)
• Simpler token structure matching the documented format

Files to Update

• mcpgateway/services/sso_service.py - Line 892

Related

• Closes consistency gap from [BUG][AUTH]: team_id from token can be a dict #1486
• Follow-up to Fixed inconsistent teams claim structure in Auth tokens #2191