feat(auth): add admin SSO provider management

[spydon]

Summary

Adds SAML single sign-on identity provider management to the admin client as client.auth.admin.sso, covering the auth.sso_admin capability group.

final provider = await supabase.auth.admin.sso.createProvider(
  CreateSSOProviderOptions(
    metadata: SAMLMetadata.url(Uri.parse('https://idp.example.com/metadata')),
    domains: ['example.com'],
    attributeMapping: SAMLAttributeMapping({
      'email': SAMLAttribute(name: 'mail'),
    }),
    nameIdFormat: SAMLNameIdFormat.persistent,
    resourceId: 'acme',
  ),
);

await supabase.auth.admin.sso.updateProvider(
  'resource_acme',
  UpdateSSOProviderOptions(
    nameIdFormat: provider.saml!.nameIdFormat,
    disabled: true,
  ),
);

• AuthAdminSSOApi with listProviders, createProvider, getProvider, updateProvider and deleteProvider, against /admin/sso/providers.
• SAMLMetadata is a sealed class with .url and .xml constructors, so a request carries exactly one metadata source.
• SAMLNameIdFormat is an enum of the four formats the server accepts, encoded as their URNs.
• SSOProvider, SAMLProvider, SAMLAttributeMapping and SAMLAttribute model the response. SAMLProvider.metadataXml is nullable because listProviders leaves it out.
• Provider ids are not validated as UUIDs, so resource_<resourceId> addressing works, and they are URL encoded.

Update semantics

The server applies a partial update, and UpdateSSOProviderOptions follows its rules:

• A null domains or attributeMapping keeps the stored value. An empty list removes every domain and a mapping with no keys clears the mapping.
• nameIdFormat is the exception: the server clears it when it is not sent. The field is therefore required (nullable), so a caller passes the current format to keep it rather than wiping it by accident.

Compliance matrix

auth.sso_admin.create_provider, get_provider, list_providers, update_provider and delete_provider are registered as implemented. The IDs were added in capability-matrix/v1.15.0, so the validation workflow pin moves from v1.14.0 to v1.15.0. That release also defines auth.admin.update_mfa_factor, which stays undeclared here and is reported as not implemented.

Tests

• test/admin_sso_test.dart: request and response serialization, and the requests each method sends, with MockSupabaseHttpClient.
• test/admin_test.dart: create, get (by resource id), list, update and delete against the local stack, including the keep and clear behavior of partial updates. SAML sign-in does not need to be enabled for the admin endpoints.

Resolves SDK-2257

Summary by CodeRabbit

• New Features
  • Added administrative support for SAML single sign-on providers, including listing, creating, retrieving, updating, and deleting providers.
  • Added options for provider metadata, domains, attribute mappings, resource IDs, and NameID formats.
• Documentation
  • Updated the SDK capability matrix to include SSO provider administration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: supabase/supabase-flutter/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: ed7479b8-a9a7-420d-b141-e929e73948ee

📥 Commits

Reviewing files that changed from the base of the PR and between 256c3da and 2974b9f.

📒 Files selected for processing: 2

• packages/supabase_auth/test/admin_test.dart
• sdk-compliance.yaml

🚧 Files skipped from review as they are similar to previous changes: 1

• sdk-compliance.yaml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Walkthrough

The change adds SAML SSO provider models and admin operations to the Flutter Auth client. It exposes provider listing, creation, retrieval, updates, and deletion. Tests cover model serialization, API requests, and provider lifecycle behavior. SDK capability entries and the capability validation workflow are also updated.

Changes: SAML SSO Admin

Layer / File(s)	Summary
SAML provider models and serialization packages/supabase_auth/lib/src/types/sso_provider.dart, packages/supabase_auth/test/admin_sso_test.dart	Adds models for SAML metadata, attribute mappings, providers, and create and update options. Tests cover JSON parsing and serialization, including omitted and explicitly empty values.
Admin API operations and exposure packages/supabase_auth/lib/src/auth_admin_api.dart, packages/supabase_auth/lib/src/auth_admin_sso_api.dart, packages/supabase_auth/lib/supabase_auth.dart, packages/supabase_auth/test/admin_sso_test.dart, packages/supabase_auth/test/admin_test.dart	Exposes AuthAdminSSOApi through AuthAdminApi and the library barrel. Adds list, create, retrieve, update, and delete operations. Tests cover requests and provider lifecycle behavior.
Capability declarations and validation sdk-compliance.yaml, .github/workflows/validate-capabilities.yml	Adds implemented SDK capability entries for SSO provider operations and updates the validation workflow reference to the v1.15.0 capability matrix.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant AuthAdminApi
  participant AuthAdminSSOApi
  participant AuthAPI
  Client->>AuthAdminApi: Access sso
  AuthAdminApi->>AuthAdminSSOApi: Provide shared URL, headers, and fetch
  AuthAdminSSOApi->>AuthAPI: Send provider request
  AuthAPI-->>AuthAdminSSOApi: Return provider response
  AuthAdminSSOApi-->>Client: Return parsed result

Loading

Suggested reviewers: grdsdev

Merge Risk: ⚪ Minimal · up to 2974b

No identified issue blocks merging after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding administrative SSO provider management to authentication.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}