Vendor-neutral plugin contract plus the host
wiring that consumes it. With no SSO plugin installed, everything degrades
to a no-op fallback, so OSS deployments are unaffected.
- Plugin contract (@trigger.dev/plugins) + lazy loader/fallback in
internal-packages/sso: status, portal-link, enforce/JIT config,
route-decision, begin/complete authorization, identity resolution, JIT
evaluation, and periodic session validation. All methods return
neverthrow Results; the fallback is fail-open.
- Login: 'Sign in with SSO' entry + dedicated /login/sso flow and
/auth/sso(.callback) routes, plus auto-discovery from magic-link/OAuth.
- Org settings -> SSO page: plan-tier upsell, connection status,
verified-domain list, enforcement + JIT provisioning + default-role
configuration, and an admin-portal link dialog.
- AuthUser carries an optional signed 'sso' marker; SSO-established
sessions are periodically re-validated against the identity provider on
a single-flight, throttled, fail-open basis and logged out only on an
explicit invalid result.
- SSO_ENABLED gate (default off) so the feature ships dark until its
backing plugin is available; SSO_SESSION_REVALIDATION_INTERVAL_SECONDS
controls the cadence.
Oskar Otwinowski
b7511390e5