The SSO controller is built with forceFallback: !SSO_ENABLED || SSO_FORCE_FALLBACK,
so ssoController.isUsingPlugin() is true only when SSO_ENABLED is on AND a real
plugin is loaded — it already encodes 'env var on + plugin available'. The UI
gates were leading on isManagedCloud instead, which is neither necessary nor
the intended signal (per review).
- login button: gate purely on isUsingPlugin(); drop the isManagedCloud host
check and the hasSso global-flag check (login is pre-auth — plugin presence
is the source of truth). Still short-circuits before any flag fetch.
- SSO settings page: drop isManagedCloud from both the loader and action gates;
key both on isUsingPlugin() so config mutations require an active plugin too.
Addresses PR #3911 review (Matt).
Oskar Otwinowski
0b2dc49279