feat(auth): surface SSO membership and gate team management

.gitignore

@@ -49,3 +49,4 @@ next-env.d.ts
 
 # tooling
 /template
+.env*

src/core/modules/auth/models.ts

@@ -9,4 +9,7 @@ export type AuthUser = {
   providers: string[]
   canChangeEmail: boolean
   canChangePassword: boolean
+  // Ory organization id when the identity signed in via org SSO, else null.
+  organizationId: string | null
+  isSso: boolean
 }

src/core/server/auth/ory/identity.ts

@@ -71,11 +71,14 @@ export function fromKratosSessionIdentity(identity: {
   external_id?: string | null
   traits?: unknown
   metadata_public?: unknown
+  organization_id?: string | null
 }): AuthUser {
   const traits = parseOryTraits(identity.traits, {
     identityId: identity.id,
     source: 'kratos_session',
   })
+  const organizationId = identity.organization_id || null
+
   return {
     id: requireExternalId(identity),
     identityId: identity.id,
@@ -85,6 +88,8 @@ export function fromKratosSessionIdentity(identity: {
     providers: [],
     canChangeEmail: false,
     canChangePassword: false,
+    organizationId,
+    isSso: organizationId !== null,
   }
 }
 
@@ -105,6 +110,7 @@ export function fromOryIdentity(identity: Identity): AuthUser {
   )
   const hasOidcCredential = hasLinkedOidcCredential(identity.credentials?.oidc)
   const canChangePassword = hasPasswordCredential && !hasOidcCredential
+  const organizationId = identity.organization_id || null
 
   return {
     id: requireExternalId(identity),
@@ -117,6 +123,8 @@ export function fromOryIdentity(identity: Identity): AuthUser {
     // settings/verification flows instead of patching traits directly.
     canChangeEmail: false,
     canChangePassword,
+    organizationId,
+    isSso: organizationId !== null,
   }
 }
 

src/features/dashboard/sidebar/menu.tsx

@@ -31,7 +31,7 @@ import DashboardSidebarMenuTeams from './menu-teams'
 import { TeamAvatar } from './team-avatar'
 
 export default function DashboardSidebarMenu() {
-  const { team } = useDashboard()
+  const { team, user } = useDashboard()
   const { enabled: postHogEnabled } = useAppPostHogProvider()
   const posthog = usePostHog()
   const [createTeamOpen, setCreateTeamOpen] = useState(false)
@@ -83,12 +83,14 @@ export default function DashboardSidebarMenu() {
           >
             <DashboardSidebarMenuTeams />
 
-            <DropdownMenuItem
-              className="h-9 gap-2.5 [&_svg]:size-5 font-sans prose-body-highlight"
-              onSelect={() => setCreateTeamOpen(true)}
-            >
-              <AddIcon className="ml-0.5" /> Create new team
-            </DropdownMenuItem>
+            {!user.isSso && (
+              <DropdownMenuItem
+                className="h-9 gap-2.5 [&_svg]:size-5 font-sans prose-body-highlight"
+                onSelect={() => setCreateTeamOpen(true)}
+              >
+                <AddIcon className="ml-0.5" /> Create new team
+              </DropdownMenuItem>
+            )}
 
             <DropdownMenuSeparator className="-mx-2" />