[FEAT] Add DISABLE_SSO_IDP_AUTHORIZATION flag for SSO user mgmt

[johnyrahul]

What

• Adds a new Django setting DISABLE_SSO_IDP_AUTHORIZATION (default False).
• Exposes the flag in the GET /api/v1/session response (UserSessionInfo → UserSessionResponseSerializer).
• Hydrates it on the frontend (useSessionValid → getSessionData → sessionDetails.disableSsoIdpAuthorization).
• Updates Manage Users (Users.jsx) to gate the Actions menu and Invite button.

Why

When users are authenticated via an external provider (e.g. enterprise SSO via Auth0), the existing flow hides the entire Manage Users action surface. With this flag enabled, admins can still edit a user's role locally while invite/delete remain blocked — useful when SSO/IdP authorization is disabled and authorization is managed inside Unstract.

How

• backend/backend/settings/base.py — declare the new DISABLE_SSO_IDP_AUTHORIZATION setting (defaults to False).
• backend/account_v2/dto.py — add disable_sso_idp_authorization: bool = False to UserSessionInfo and propagate it through from_dict / to_dict.
• backend/account_v2/serializer.py — add the matching BooleanField on UserSessionResponseSerializer.
• backend/account_v2/views.py — pass settings.DISABLE_SSO_IDP_AUTHORIZATION into UserSessionInfo in make_session_response.
• frontend/src/hooks/useSessionValid.js — copy disable_sso_idp_authorization into userAndOrgDetails.
• frontend/src/helpers/GetSessionData.js — surface it as sessionDetails.disableSsoIdpAuthorization.
• frontend/src/components/settings/users/Users.jsx:
  • New isSsoLocalAuthz = !!provider && !!disableSsoIdpAuthorization derived value.
  • Actions column shows when !provider || isSsoLocalAuthz.
  • When isSsoLocalAuthz, the dropdown contains only the Edit item.
  • Invite User button stays gated on !provider (unchanged).

provider set	flag	Invite	Edit	Delete
no	any	yes	yes	yes
yes	False (default)	no	no	no
yes	True	no	yes	no

Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)

• No. Default value is False, which preserves the prior behavior (Actions column and Invite button hidden for any session with provider). Behavior only changes when an operator explicitly opts in by setting DISABLE_SSO_IDP_AUTHORIZATION=True.

Database Migrations

• None.

Env Config

• New optional Django setting: DISABLE_SSO_IDP_AUTHORIZATION (default False).

Relevant Docs

Related Issues or PRs

Dependencies Versions

• None changed.

Notes on Testing

• With flag False and an SSO-authenticated session: confirm Manage Users hides both Invite User and the Actions column (existing behavior).
• With flag True and an SSO-authenticated session: confirm Manage Users hides Invite User, shows the Actions column, and the row dropdown contains only Edit (no Delete).
• With no provider on the session: confirm the page is unchanged — Invite User visible, Actions dropdown contains both Edit and Delete.
• Verify GET /api/v1/session response now includes disable_sso_idp_authorization boolean.

Screenshots

Checklist

I have read and understood the Contribution Guidelines.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 49313b7c-c29d-4e4e-9f3c-a00c53758f80

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/disable-sso-idp-authorization

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud