feat(EE): implement SSO group sync for SAML and OIDC (#1452)

* feat: implement SSO group synchronization for SAML and OIDC

- Add group_sync column to auth_providers table
- Extract groups from SAML attributes (memberOf, groups, roles)
- Extract groups from OIDC claims (groups, roles)
- Implement case-insensitive group matching with auto-creation
- Sync user groups on each SSO login
- Ensure only one provider can have group sync enabled at a time
- Add group sync toggle to SAML and OIDC configuration forms

* rename column

apps/server/src/database/migrations/20250831T191600-add-group-sync-to-auth-providers.ts

@@ -3,15 +3,13 @@ import { type Kysely } from 'kysely';
 export async function up(db: Kysely<any>): Promise<void> {
   await db.schema
     .alterTable('auth_providers')
-    .addColumn('is_group_sync_enabled', 'boolean', (col) =>
-      col.defaultTo(false).notNull(),
-    )
+    .addColumn('group_sync', 'boolean', (col) => col.defaultTo(false).notNull())
     .execute();
 }
 
 export async function down(db: Kysely<any>): Promise<void> {
   await db.schema
     .alterTable('auth_providers')
-    .dropColumn('is_group_sync_enabled')
+    .dropColumn('group_sync')
     .execute();
-}
+}

apps/server/src/database/types/db.d.ts

@@ -62,6 +62,7 @@ export interface AuthProviders {
   deletedAt: Timestamp | null;
   id: Generated<string>;
   isEnabled: Generated<boolean>;
+  groupSync: Generated<boolean>;
   name: string;
   oidcClientId: string | null;
   oidcClientSecret: string | null;