Merge pull request #538 from luckyPipewrench/sso-upgrades

Multi-provider SSO with admin UI and SAML support

db/migrate/20251228181150_create_flipper_tables.rb

@@ -0,0 +1,22 @@
+class CreateFlipperTables < ActiveRecord::Migration[7.2]
+  def up
+    create_table :flipper_features do |t|
+      t.string :key, null: false
+      t.timestamps null: false
+    end
+    add_index :flipper_features, :key, unique: true
+
+    create_table :flipper_gates do |t|
+      t.string :feature_key, null: false
+      t.string :key, null: false
+      t.text :value
+      t.timestamps null: false
+    end
+    add_index :flipper_gates, [ :feature_key, :key, :value ], unique: true, length: { value: 255 }
+  end
+
+  def down
+    drop_table :flipper_gates
+    drop_table :flipper_features
+  end
+end

db/migrate/20251228181429_create_sso_providers.rb

@@ -0,0 +1,21 @@
+class CreateSsoProviders < ActiveRecord::Migration[7.2]
+  def change
+    create_table :sso_providers, id: :uuid do |t|
+      t.string :strategy, null: false
+      t.string :name, null: false
+      t.string :label, null: false
+      t.string :icon
+      t.boolean :enabled, null: false, default: true
+      t.string :issuer
+      t.string :client_id
+      t.string :client_secret
+      t.string :redirect_uri
+      t.jsonb :settings, null: false, default: {}
+
+      t.timestamps
+    end
+
+    add_index :sso_providers, :name, unique: true
+    add_index :sso_providers, :enabled
+  end
+end

db/migrate/20251228182113_add_issuer_to_oidc_identities.rb

@@ -0,0 +1,6 @@
+class AddIssuerToOidcIdentities < ActiveRecord::Migration[7.2]
+  def change
+    add_column :oidc_identities, :issuer, :string
+    add_index :oidc_identities, :issuer
+  end
+end

db/migrate/20260103170412_create_sso_audit_logs.rb

@@ -0,0 +1,18 @@
+class CreateSsoAuditLogs < ActiveRecord::Migration[7.2]
+  def change
+    create_table :sso_audit_logs, id: :uuid do |t|
+      t.references :user, type: :uuid, foreign_key: true, null: true
+      t.string :event_type, null: false
+      t.string :provider
+      t.string :ip_address
+      t.string :user_agent
+      t.jsonb :metadata, null: false, default: {}
+
+      t.timestamps
+    end
+
+    add_index :sso_audit_logs, :event_type
+    add_index :sso_audit_logs, :created_at
+    add_index :sso_audit_logs, [ :user_id, :created_at ]
+  end
+end

db/schema.rb

@@ -476,6 +476,22 @@ ActiveRecord::Schema[7.2].define(version: 2026_01_12_065106) do
     t.index ["merchant_id"], name: "index_family_merchant_associations_on_merchant_id"
   end
 
+  create_table "flipper_features", force: :cascade do |t|
+    t.string "key", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["key"], name: "index_flipper_features_on_key", unique: true
+  end
+
+  create_table "flipper_gates", force: :cascade do |t|
+    t.string "feature_key", null: false
+    t.string "key", null: false
+    t.text "value"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["feature_key", "key", "value"], name: "index_flipper_gates_on_feature_key_and_key_and_value", unique: true
+  end
+
   create_table "holdings", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
     t.uuid "account_id", null: false
     t.uuid "security_id", null: false
@@ -800,6 +816,8 @@ ActiveRecord::Schema[7.2].define(version: 2026_01_12_065106) do
     t.datetime "last_authenticated_at"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
+    t.string "issuer"
+    t.index ["issuer"], name: "index_oidc_identities_on_issuer"
     t.index ["provider", "uid"], name: "index_oidc_identities_on_provider_and_uid", unique: true
     t.index ["user_id"], name: "index_oidc_identities_on_user_id"
   end
@@ -1055,6 +1073,38 @@ ActiveRecord::Schema[7.2].define(version: 2026_01_12_065106) do
     t.index ["status"], name: "index_simplefin_items_on_status"
   end
 
+  create_table "sso_audit_logs", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "user_id"
+    t.string "event_type", null: false
+    t.string "provider"
+    t.string "ip_address"
+    t.string "user_agent"
+    t.jsonb "metadata", default: {}, null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["created_at"], name: "index_sso_audit_logs_on_created_at"
+    t.index ["event_type"], name: "index_sso_audit_logs_on_event_type"
+    t.index ["user_id", "created_at"], name: "index_sso_audit_logs_on_user_id_and_created_at"
+    t.index ["user_id"], name: "index_sso_audit_logs_on_user_id"
+  end
+
+  create_table "sso_providers", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.string "strategy", null: false
+    t.string "name", null: false
+    t.string "label", null: false
+    t.string "icon"
+    t.boolean "enabled", default: true, null: false
+    t.string "issuer"
+    t.string "client_id"
+    t.string "client_secret"
+    t.string "redirect_uri"
+    t.jsonb "settings", default: {}, null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["enabled"], name: "index_sso_providers_on_enabled"
+    t.index ["name"], name: "index_sso_providers_on_name", unique: true
+  end
+
   create_table "subscriptions", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
     t.uuid "family_id", null: false
     t.string "status", null: false
@@ -1289,6 +1339,7 @@ ActiveRecord::Schema[7.2].define(version: 2026_01_12_065106) do
   add_foreign_key "sessions", "users"
   add_foreign_key "simplefin_accounts", "simplefin_items"
   add_foreign_key "simplefin_items", "families"
+  add_foreign_key "sso_audit_logs", "users"
   add_foreign_key "subscriptions", "families"
   add_foreign_key "syncs", "syncs", column: "parent_id"
   add_foreign_key "taggings", "tags"