Summary

• ensure invitation accept and sign-in flows keep relay state plus org slug in query params
• update generated client types/services to match removed OAuth endpoints and add organization slug field
• drop SSO auto-provisioning toggle and gate backend provisioning to superadmin or pending invitations only
• tighten SAML authorization helper tests for invitations, pending selection, and superadmin allowance

Testing

• Not run (not requested)

Summary by cubic

Refines SAML invite handling and org access by preserving org context, enforcing domain allowlists, and removing auto‑provisioning. Updates auth discovery to default to the default org’s SAML in single‑tenant and to platform OIDC in multi‑tenant, with email selection that prefers pending invites.

• Bug Fixes

  • Preserve org context in invitation accept and auth flows via returnUrl and org slug.
  • Remove sign‑up CTA on invitation accept; always route to sign‑in with org preserved.
  • Prefer pending invitations when selecting the SAML assertion email; fall back to allowlisted domains. Reject when the org has no active domains, except for first‑user superadmin bootstrap in the default org.
  • Update auth discovery for unknown domains: single‑tenant defaults to the default org’s SAML; multi‑tenant falls back to platform OIDC.
  • Pass org slug to auth discovery; hide sign‑up links and password UI when basic auth is disabled.

• Refactors

  • Remove saml_auto_provisioning setting and UI; auto‑provision only for invitees or first superadmin bootstrap.
  • Require existing membership or pending invite for org access; no JIT membership (bootstrap allowed).
  • Add organization_slug to minimal invitation response and propagate through SignIn/SignUp.
  • Use /api/auth/oauth/authorize without client‑side scopes.
  • Remove unused SAML email policy helper.
  • Add tests for auth UI gating, discovery fallback, invitation selection, email authorization, superadmin bootstrap, and org access rules.

^{Written for commit ab0b07d. Summary will update on new commits.}