feat(plugin-auth): an SSO sign-in grants the permission set its IdP group is mapped to (#31657)

<!-- claude-projects-attribution: {"github_login":"os-steve"} -->
_Requested by **Steve** · [project
thread](https://claude.ai/code/project/chan_01FdL1XeUyvVNxLreh3F4Qi9?thread=cmsg_01FdL1XeUyvVNxLreh3F4Qi98qy3EtdY1M87bPE16diw6k)_

Fixes #30967

Clause-②: yes (widening)
Metadata-protocol: none

## 维护者速读

- 改了什么：企业 SSO（OIDC / SAML）登录时，IdP 发来的组会按 `sys_idp_group_mapping`
映射授予普通权限集，和 SCIM 共用同一个映射对象、同一道保存门和同一套边界判断；平台管理员用现有的 `set-group-mapping`
门加 `providerId` 保存映射。
- 为什么改：#30967 第 3 项（最后一项），按裁决 A（记录 6718355623）「同一个映射对象，不建第二套模型」，在 #30959
已落地的映射上补 SSO 一半。
- 风险与回滚：只放宽「组 →
普通权限集」；管理员集与组织边界外的集在保存和每次授予时都被拒，没有安全服务时一律不授予；登录不会因为映射失败而失败（只记 error
日志）。回滚即 revert 本 PR，已授予的行带 `sso-group-projection` 标记，可按标记清理。
-
先看：`packages/plugins/plugin-auth/src/sso-group-projection.ts`（登录时读组、匹配、调用共享对账）、`packages/plugins/plugin-auth/src/idp-group-mapping-admin.ts`（`providerId`
分支与删除即撤销）、`packages/plugins/plugin-auth/src/scim-group-projection.ts`（抽出共享的准入与对账，SCIM
行为不变）。
- 两分钟验证：`cd packages/plugins/plugin-auth && pnpm exec vitest run
src/sso-oidc-refusal-cause.test.ts -t "IdP group is mapped"`，预期 10
个用例全绿。
- 需要你做的：无，席位落地。

## What changes

Item 3 of #30967 (IdP group → permission set on SSO sign-in), the last
open item, under maintainer ruling A (record 6718355623): it follows
#30959's ruled model, the same `sys_idp_group_mapping` object, no second
model. Built on what PR #31443 landed; nothing in it is duplicated.

- **Shared projection, two sources** (`scim-group-projection.ts`). The
boundary admission and the reconcile are lifted into
`createMappingAdmission(deps, kind)` and `reconcileMappedGrants(engine,
{ userId, reason, mappingIds }, admits)`; the SCIM projection now calls
them (its own behaviour, refusal text and marker are unchanged, and its
suite passes unchanged). A `sourceMappings(engine, kind, sourceId)` read
and an SSO marker `ssoGroupProjectionReason(providerId)`
(`sso-group-projection: provider 'ID'`) are added.
- **The sign-in hook** (`sso-group-projection.ts`, wired in
`auth-manager-plugin-list.ts`). `sso({ provisionUser,
provisionUserOnEveryLogin: true })`: every sign-in reads
`userInfo.groups`, which the provider's own `mapping.extraFields.groups`
fills (a string or a list), matches each value against the provider's
rows with the SCIM half's matcher (`group_external_id` when the row
names one, else exact `group_display_name`), and reconciles the user's
grants carrying this provider's marker. A sign-in with no groups desires
nothing: it removes only grants this provider made. Writes go through
the engine, so the break-glass guard judges them. A failure never fails
the sign-in; it is logged at `error` once, naming the consequence and
the remedy.
- **The save door** (`idp-group-mapping-admin.ts`). `POST
/admin/scim/set-group-mapping` accepts `providerId` in place of
`connectionId` (exactly one). The organization is the provider row's
`organization_id`; unknown provider → `reference_not_found`, provider
with no organization → `rule_violation`, both on `providerId`; SSO off →
`503`. The same boundary judgement and the same `503` without a security
service. An SSO save applies at each member's next sign-in
(`reprojected: false`). `delete-group-mapping` is source-aware: deleting
an SSO mapping removes at once the grants its provider made of that set
in that organization, unless another of its mappings still names it.
- **The object** (`platform-objects`).
`sys_idp_group_mapping.source_kind` gains the option `sso` (`source_id`
= the provider id); three field descriptions name both sources;
translations for all nine locales (the `en` bundle regenerated, the
eight others translated by hand).
- **Route ledger.** The set row's note describes both sources and drops
`requires: 'scim'` (the mount is unconditional, and the door now serves
SSO with SCIM off); the delete row's note describes the SSO revoke.
- **Tenant-audit census**
(`content/docs/permissions/tenant-audit-census.mdx`,
`docs/audits/2026-08-tenant-audit-write-call-sites.counts.md`). The
delete-revoke is one new engine write site (275 → 276); the generated
regions are regenerated and the page's prose figures updated to the
census. Gate-required, not a behaviour change.

## Tests

New top-level describe in the existing OIDC SSO harness,
`sso-oidc-refusal-cause.test.ts` ("an SSO sign-in grants the permission
set its IdP group is mapped to"): the real `AuthManager` with the real
`sso()` plugin, driven `/sign-in/sso` → a stubbed IdP → `/sso/callback`,
on a real ObjectQL engine over better-sqlite3 with the break-glass guard
registered, the mapping saved through the door's own function, judged by
plugin-security's real `organizationBoundaryFailure`.

1. A mapped group grants the set in the provider's organization, by
display name and by external id (a list claim and a string claim).
2. Leaving the group revokes the projected grant at the next sign-in; a
grant made by hand stays.
3. CONTROL: an unmapped group grants nothing.
4. CONTROL: a sign-in with no groups claim lands as before, writes
nothing to the grant table and logs nothing.
5. A mapping naming an administrator set, or a set outside the
organization boundary, is refused at save (`400 VALIDATION_FAILED`,
`permissionSet`, `rule_violation`) and stores nothing.
6. A set redefined outside the boundary after its mapping was saved
grants nothing at sign-in.
7. With no security service, the save is refused `503`, and a stored
mapping grants nothing at sign-in (fail closed).
8. The break-glass guard still refuses through the sign-in: the last
administrator's grant is not removed, and the sign-in still lands (one
`error` line).
9. Deleting the mapping removes the grants it projected at once.
10. The door names exactly one source; an SSO source must be a provider
that belongs to an organization.

Forced test edits: none. The only edit to existing harness code is
additive: `TokenShape` gains an optional `claims` member that
`idToken()` spreads into the signed claims.

## Acceptance notes

- Group membership changes reach the platform only at a sign-in: an SSO
provider pushes nothing between sign-ins, so a user removed from an IdP
group keeps the set until their next sign-in through that provider (SCIM
is the push channel for prompt revocation). A deleted mapping's grants
are removed at once.
- An absent groups claim is read as "no groups": the provider's own
earlier grants are removed. A provider whose mapping does not fill
`groups` therefore never grants and never removes anything but its own
marked rows, of which it has none.
- A set held through any other row (by hand, by SCIM) is not written
again; whichever source wrote first owns the row.
- The door's path keeps the `scim` segment while now serving both
sources (seat ruling: no `/admin/sso/*` mounts); listed in open
questions as a naming note.
- `content/docs/permissions/sso.mdx` does not yet describe group mapping
(outside this card's file surface); the changeset and the route-ledger
notes carry the operator-facing text.
- SAML: the vendor fills `userInfo` from `mapping.extraFields` the same
way (SAML attribute values may be lists, which the reader takes); the
end-to-end pins drive OIDC only.

## Verification

Head: `70db6d0601c6ca0f3d64750fcd93c9ce95b87a19` (origin/main `8784ccbc`
merged in, no rebase).

<details><summary>Red first on main</summary>

The new describe run against the base before any source change: 10 of 10
red (the door refused `providerId` as an unknown field, and no sign-in
granted anything).
</details>

<details><summary>Tests on the head</summary>

- `pnpm exec vitest run src/sso-oidc-refusal-cause.test.ts`
(plugin-auth): 1 file, 32 passed.
- plugin-auth full suite under the verify lock: Test Files 244 passed
(244), Tests 4372 passed, 10 skipped.
- platform-objects full suite: Test Files 120 passed, Tests 1886 passed.
- `tsc --noEmit` for plugin-auth and platform-objects: exit 0. `eslint
--no-inline-config` on both packages: exit 0.
- `pnpm install --frozen-lockfile && pnpm build` under the verify lock:
exit 0.
</details>

<details><summary>Ablation: each pin goes red when its behaviour is
removed</summary>

Each mutation was applied on disk to the source, the describe run, then
restored (`git diff HEAD` empty after each).

| Mutation | Red tests |
| :--- | ---: |
| group matcher always matches | 3 |
| sign-in admission always admits | 2 |
| save-time boundary refusal removed | 1 |
| save-time fail-closed (no security service) removed | 1 |
| reconcile removes grants outside the engine's guard | 1 |
| a projection failure fails the sign-in | 1 |
| reconcile ignores the provider marker | 1 |
| `provisionUserOnEveryLogin` off | 2 |
| delete does not remove the projected grants | 1 |

One first run was a no-op (its replacement still contained the anchor,
so nothing changed); it was re-run with a mutation that moved the
anchor, which went red. It is the "a projection failure fails the
sign-in" row.
</details>

<details><summary>Derived gates</summary>

`node scripts/pm/dispatch-gates.mjs --commands` on the head derived 108
commands; all 108 ran with exit 0, and `--ran` reconciled: 108 derived,
108 run, 0 NOT-MEASURED, 0 UNRUN. On the first pass
`check-tenant-audit-census` found the new delete-revoke write without a
tenant context: it now carries the grant's organization as its tenant,
and the census page and ledger counts are regenerated
(`tenant-audit-census.mjs --write`) with the page's prose figures
updated to match (276 sites; the provable no-context figure stays 3).
`check:i18n` and `check:i18n-stale-fill` pass with the regenerated `en`
bundle.
</details>

---
_Generated by [Claude
Code](https://claude.ai/code/session_01ADHkmNwrm1hJ9e7eLARM7n)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/30967-sso-group-permission-set-mapping.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/plugin-auth': patch
+'@objectstack/platform-objects': patch
+---
+
+feat(plugin-auth): an SSO sign-in grants the ordinary permission set its IdP group is mapped to
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+An enterprise SSO provider (OIDC or SAML, through `@better-auth/sso`) can now drive what its users may do from the groups the identity provider sends at sign-in, through the same `sys_idp_group_mapping` mappings a SCIM connection uses. There is no second mapping model.
+
+- **Where the groups come from.** Set the provider's own claim mapping to fill `groups`: `mapping.extraFields: { groups: 'groups' }` for an OIDC claim named `groups`, or the attribute name an IdP uses for SAML (for example Entra ID's groups claim URI). The value may be one string or a list of strings. A provider whose mapping fills no `groups` behaves as before.
+- **Saving a mapping.** `POST /api/v1/auth/admin/scim/set-group-mapping` now also takes `providerId` in place of `connectionId` (exactly one of the two; both is `400 VALIDATION_FAILED` on `providerId`). The grant's organization is the provider's own `organization_id`; a provider that names none, or an unknown provider, is refused `400 VALIDATION_FAILED` on `providerId`. With SSO off the save is refused `503`. The same platform-admin gate and the same organization-boundary judgement apply: administrator sets and every set outside the organization boundary are refused, and without a security service the save is refused `503`. The row is stored with `source_kind: 'sso'` (a new option on `sys_idp_group_mapping.source_kind`) and `source_id` = the provider id.
+- **At each sign-in.** Every sign-in through the provider matches each group value against the provider's mappings (by `groupExternalId` when the mapping names one, which suits Entra ID's group object ids, else by exact `groupDisplayName`) and makes the user's grants follow them: a mapped group grants its set in the provider's organization, and a group the user has left loses the set at their next sign-in. A sign-in with no groups removes the grants that provider made earlier. The boundary is asked again before every grant, so a set that becomes an administrator set after its mapping was saved grants nothing, and with no security service nothing is granted. Only grants the provider made (their `reason` names the provider) are ever removed: a grant made by hand, or by SCIM, is never touched. Every write goes through the engine, so the break-glass last-administrator guard still refuses what it refuses elsewhere. If applying the mappings fails, the sign-in still succeeds and the failure is logged at `error`.
+- **Deleting a mapping.** `POST /api/v1/auth/admin/scim/delete-group-mapping` removes an SSO mapping and, at once, the grants its provider made of that set in that organization, unless another of the provider's mappings still names that set (then each user's next sign-in decides).

content/docs/permissions/tenant-audit-census.mdx

@@ -132,7 +132,7 @@ are reported as `undecidable` rather than assumed either way.
 
 The same holds twice over for the context. An options argument spelled as a
 literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
-forwarding shim cannot, and **57 of the 275 sites are spelled that way**. A
+forwarding shim cannot, and **57 of the 276 sites are spelled that way**. A
 context resolved from an inline literal or a local `const` can be tested for
 `isSystem`; one arriving from a helper call cannot.
 
@@ -197,10 +197,10 @@ reproduce them. Where it disagrees, it disagrees on the page:
 
 | carried figure | where it survives | this census |
 | :--- | :--- | ---: |
-| 175 write call sites | quoted in the merged changeset | **275** |
+| 175 write call sites | quoted in the merged changeset | **276** |
 | 24 carrying no tenant context | quoted in the merged changeset | **3** provable and tenancy-enabled; **30** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **195 of 275** decidable, **80** undecidable |
-| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 152 decidably elevated, 0 decidably not, 113 undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **196 of 276** decidable, **80** undecidable |
+| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 153 decidably elevated, 0 decidably not, 113 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
 **The differences are not reconciled, and deliberately so.** The old census's
@@ -211,17 +211,17 @@ at any commit.
 
 Two structural facts do plausibly widen this reading against any hand or regex
 one, and both are counted in the generated tables below: the 62 sites reached
-through an erased (`any`) receiver, and the 71 that name their object through a
+through an erased (`any`) receiver, and the 72 that name their object through a
 `const` rather than inline. An instrument that read either the way a person does
 would report a smaller number and would not say so.
 
 The fourth row is the one worth flagging to anyone citing it. **The 135 / 77%
 figure has no surviving corroboration anywhere in the tree.** This census reads
-152 of 275 (55%) as decidably elevated, with 113 more whose elevation is a
+153 of 276 (55%) as decidably elevated, with 113 more whose elevation is a
 run-time fact — so the claim is neither confirmed nor refuted, and the honest
 answer is that a static reading cannot settle it.
 
-⇒ **Cite `3 / 275`, and say what it is**: the sites whose options argument was
+⇒ **Cite `3 / 276`, and say what it is**: the sites whose options argument was
 READ and holds no tenant context, against a decidably tenancy-enabled object.
 That is the control's provable yield surface. ⛔ Do not cite it as "the sites
 without tenant context" — **30 further sites** have an options argument this
@@ -233,29 +233,29 @@ cannot read, and they are neither in nor out.
 
 | what | count |
 | :--- | ---: |
-| write call sites on the application surface | **275** |
-| …whose object name is statically decidable | 195 |
+| write call sites on the application surface | **276** |
+| …whose object name is statically decidable | 196 |
 | …whose object name is chosen at run time | 80 |
-| …against an object with tenancy ENABLED | 189 |
+| …against an object with tenancy ENABLED | 190 |
 | …against an object that declares tenancy off | 6 |
-| threading a tenant context | 208 |
+| threading a tenant context | 209 |
 | PROVABLY carrying none (options read, no context key) | **10** |
 | …of those, against a decidably tenancy-enabled object | **3** |
 | options argument UNREADABLE — may or may not carry one | 57 |
 | …of those, against a decidably tenancy-enabled object | 30 |
-| threading a decidably ELEVATED (`isSystem`) context | 152 |
+| threading a decidably ELEVATED (`isSystem`) context | 153 |
 | threading a context that is decidably NOT elevated | 0 |
 | threading a context whose elevation is a run-time fact | 113 |
 
 | how the instrument reached the site | count |
 | :--- | ---: |
-| receiver carried a readable engine type | 213 |
+| receiver carried a readable engine type | 214 |
 | receiver erased, placed by the object NAME | 52 |
 | receiver erased, placed by an `object: string` PARAMETER | 5 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 5 |
 
 | object name spelled inline | 124 |
-| object name spelled through a `const` | 71 |
+| object name spelled through a `const` | 72 |
 | object name is an `object: string` parameter | 7 |
 | object name is some other run-time expression | 73 |
 
@@ -307,12 +307,12 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-11-08 at `fe3aea79c`.
+Measured on 2026-11-08 at `da13e5987`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 1063 |
-| engine-shaped types recognised | 114 |
+| tracked non-test sources scanned | 1068 |
+| engine-shaped types recognised | 115 |
 | declared objects in the registry | 132 |
 | same-named calls subtracted as non-engine | 243 |
 

docs/audits/2026-08-tenant-audit-write-call-sites.counts.md

@@ -33,17 +33,17 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 
 | Measure | Value |
 |---|---:|
-| Write call sites | 275 |
-| Object name statically decidable | 195 |
+| Write call sites | 276 |
+| Object name statically decidable | 196 |
 | Object name chosen at run time | 80 |
-| Against a tenancy-enabled object | 189 |
+| Against a tenancy-enabled object | 190 |
 | Against an object declaring tenancy off | 6 |
-| Threading a tenant context | 208 |
+| Threading a tenant context | 209 |
 | Provably carrying none | 10 |
 | …and decidably tenancy-enabled | 3 |
 | Options argument unreadable | 57 |
 | …and decidably tenancy-enabled | 30 |
-| Threading a decidably elevated context | 152 |
+| Threading a decidably elevated context | 153 |
 | Threading a decidably non-elevated context | 0 |
 | Threading a context of undecidable elevation | 113 |
 
@@ -90,12 +90,12 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-11-08 at `fe3aea79c`.
+Measured on 2026-11-08 at `da13e5987`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 1063 |
-| engine-shaped types recognised | 114 |
+| tracked non-test sources scanned | 1068 |
+| engine-shaped types recognised | 115 |
 | declared objects in the registry | 132 |
 | same-named calls subtracted as non-engine | 243 |
 
@@ -158,6 +158,7 @@ Measured on 2026-11-08 at `fe3aea79c`.
 | `packages/plugins/plugin-auth/src/idp-group-mapping-admin.ts` | `delete` | `IDP_GROUP_MAPPING_OBJECT` | undecidable | PROVABLY NONE | 1 |
 | `packages/plugins/plugin-auth/src/idp-group-mapping-admin.ts` | `insert` | `IDP_GROUP_MAPPING_OBJECT` | undecidable | options unreadable | 1 |
 | `packages/plugins/plugin-auth/src/idp-group-mapping-admin.ts` | `insert` | `sys_audit_log` | enabled | elevated | 1 |
+| `packages/plugins/plugin-auth/src/idp-group-mapping-admin.ts` | `delete` | `sys_user_permission_set` | enabled | elevated | 1 |
 | `packages/plugins/plugin-auth/src/idp-locale-claim.ts` | `update` | `sys_user` | enabled | elevated | 1 |
 | `packages/plugins/plugin-auth/src/mcp-client-last-use.ts` | `update` | `sys_oauth_consent` | enabled | elevated | 1 |
 | `packages/plugins/plugin-auth/src/member-role-canonical.ts` | `update` | `MEMBER_OBJECT` | undecidable | elevated | 1 |

packages/platform-objects/src/apps/translations/ar.objects.generated.ts

@@ -2660,14 +2660,15 @@ export const arObjects: NonNullable<TranslationData['objects']> = {
       },
       source_kind: {
         label: "نوع المصدر",
-        help: "ما يرسل المجموعة: اتصال SCIM.",
+        help: "ما يرسل المجموعة: اتصال SCIM، أو مزوّد SSO عند تسجيل الدخول.",
         options: {
-          scim: "اتصال SCIM"
+          scim: "اتصال SCIM",
+          sso: "مزوّد SSO"
         }
       },
       source_id: {
         label: "معرّف المصدر",
-        help: "معرّف اتصال SCIM الذي تصل عبره المجموعة، مثل \"okta-prod\"."
+        help: "معرّف اتصال SCIM أو معرّف مزوّد SSO الذي تصل عبره المجموعة، مثل \"okta-prod\"."
       },
       group_external_id: {
         label: "المعرّف الخارجي للمجموعة",
@@ -2683,7 +2684,7 @@ export const arObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "المؤسسة",
-        help: "المؤسسة التي يتم المنح فيها: المؤسسة المالكة لاتصال SCIM."
+        help: "المؤسسة التي يتم المنح فيها: المؤسسة المالكة لاتصال SCIM أو لمزوّد SSO."
       },
       created_at: {
         label: "تاريخ الإنشاء"

packages/platform-objects/src/apps/translations/de.objects.generated.ts

@@ -2660,14 +2660,15 @@ export const deObjects: NonNullable<TranslationData['objects']> = {
       },
       source_kind: {
         label: "Quellart",
-        help: "Was die Gruppe überträgt: eine SCIM-Verbindung.",
+        help: "Was die Gruppe überträgt: eine SCIM-Verbindung oder ein SSO-Anbieter bei der Anmeldung.",
         options: {
-          scim: "SCIM-Verbindung"
+          scim: "SCIM-Verbindung",
+          sso: "SSO-Anbieter"
         }
       },
       source_id: {
         label: "Quell-ID",
-        help: "Die ID der SCIM-Verbindung, über die die Gruppe eintrifft, z. B. \"okta-prod\"."
+        help: "Die ID der SCIM-Verbindung oder des SSO-Anbieters, über die die Gruppe eintrifft, z. B. \"okta-prod\"."
       },
       group_external_id: {
         label: "Externe Gruppen-ID",
@@ -2683,7 +2684,7 @@ export const deObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "Organisation",
-        help: "Die Organisation, in der die Berechtigung erteilt wird: die Organisation, der die SCIM-Verbindung gehört."
+        help: "Die Organisation, in der die Berechtigung erteilt wird: die Organisation, der die SCIM-Verbindung oder der SSO-Anbieter gehört."
       },
       created_at: {
         label: "Erstellt am"

packages/platform-objects/src/apps/translations/en.objects.generated.ts

@@ -2660,14 +2660,15 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       source_kind: {
         label: "Source Kind",
-        help: "What pushes the group: a SCIM connection.",
+        help: "What sends the group: a SCIM connection, or an SSO provider at sign-in.",
         options: {
-          scim: "SCIM Connection"
+          scim: "SCIM Connection",
+          sso: "SSO Provider"
         }
       },
       source_id: {
         label: "Source ID",
-        help: "The SCIM connection ID the group arrives through, e.g. \"okta-prod\"."
+        help: "The SCIM connection ID or the SSO provider ID the group arrives through, e.g. \"okta-prod\"."
       },
       group_external_id: {
         label: "Group External ID",
@@ -2683,7 +2684,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "Organization",
-        help: "The organization the grant is made in: the organization that owns the SCIM connection."
+        help: "The organization the grant is made in: the organization that owns the SCIM connection or the SSO provider."
       },
       created_at: {
         label: "Created At"

packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts

@@ -2660,14 +2660,15 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       source_kind: {
         label: "Tipo de origen",
-        help: "Qué envía el grupo: una conexión SCIM.",
+        help: "Qué envía el grupo: una conexión SCIM o un proveedor SSO al iniciar sesión.",
         options: {
-          scim: "Conexión SCIM"
+          scim: "Conexión SCIM",
+          sso: "Proveedor SSO"
         }
       },
       source_id: {
         label: "ID de origen",
-        help: "El ID de la conexión SCIM por la que llega el grupo, p. ej. \"okta-prod\"."
+        help: "El ID de la conexión SCIM o del proveedor SSO por el que llega el grupo, p. ej. \"okta-prod\"."
       },
       group_external_id: {
         label: "ID externo del grupo",
@@ -2683,7 +2684,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "Organización",
-        help: "La organización en la que se concede: la organización propietaria de la conexión SCIM."
+        help: "La organización en la que se concede: la organización propietaria de la conexión SCIM o del proveedor SSO."
       },
       created_at: {
         label: "Creado el"

packages/platform-objects/src/apps/translations/fr.objects.generated.ts

@@ -2660,14 +2660,15 @@ export const frObjects: NonNullable<TranslationData['objects']> = {
       },
       source_kind: {
         label: "Type de source",
-        help: "Ce qui envoie le groupe : une connexion SCIM.",
+        help: "Ce qui envoie le groupe : une connexion SCIM, ou un fournisseur SSO à la connexion.",
         options: {
-          scim: "Connexion SCIM"
+          scim: "Connexion SCIM",
+          sso: "Fournisseur SSO"
         }
       },
       source_id: {
         label: "ID de source",
-        help: "L’ID de la connexion SCIM par laquelle le groupe arrive, p. ex. \"okta-prod\"."
+        help: "L’ID de la connexion SCIM ou du fournisseur SSO par lequel le groupe arrive, p. ex. \"okta-prod\"."
       },
       group_external_id: {
         label: "ID externe du groupe",
@@ -2683,7 +2684,7 @@ export const frObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "Organisation",
-        help: "L’organisation dans laquelle l’attribution est faite : celle qui possède la connexion SCIM."
+        help: "L’organisation dans laquelle l’attribution est faite : celle qui possède la connexion SCIM ou le fournisseur SSO."
       },
       created_at: {
         label: "Créé le"

packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts

@@ -2660,14 +2660,15 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       source_kind: {
         label: "ソース種別",
-        help: "グループを送信するもの：SCIM 接続。",
+        help: "グループを送信するもの：SCIM 接続、またはサインイン時の SSO プロバイダー。",
         options: {
-          scim: "SCIM 接続"
+          scim: "SCIM 接続",
+          sso: "SSO プロバイダー"
         }
       },
       source_id: {
         label: "ソース ID",
-        help: "グループが届く SCIM 接続の ID（例：\"okta-prod\"）。"
+        help: "グループが届く SCIM 接続の ID または SSO プロバイダーの ID（例：\"okta-prod\"）。"
       },
       group_external_id: {
         label: "グループ外部 ID",
@@ -2683,7 +2684,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "組織",
-        help: "付与が行われる組織：SCIM 接続を所有する組織。"
+        help: "付与が行われる組織：SCIM 接続または SSO プロバイダーを所有する組織。"
       },
       created_at: {
         label: "作成日時"

packages/platform-objects/src/apps/translations/pt-BR.objects.generated.ts

@@ -2660,14 +2660,15 @@ export const ptBRObjects: NonNullable<TranslationData['objects']> = {
       },
       source_kind: {
         label: "Tipo de origem",
-        help: "O que envia o grupo: uma conexão SCIM.",
+        help: "O que envia o grupo: uma conexão SCIM ou um provedor SSO no login.",
         options: {
-          scim: "Conexão SCIM"
+          scim: "Conexão SCIM",
+          sso: "Provedor SSO"
         }
       },
       source_id: {
         label: "ID de origem",
-        help: "O ID da conexão SCIM pela qual o grupo chega, por exemplo \"okta-prod\"."
+        help: "O ID da conexão SCIM ou do provedor SSO pelo qual o grupo chega, por exemplo \"okta-prod\"."
       },
       group_external_id: {
         label: "ID externo do grupo",
@@ -2683,7 +2684,7 @@ export const ptBRObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "Organização",
-        help: "A organização em que a concessão é feita: a organização proprietária da conexão SCIM."
+        help: "A organização em que a concessão é feita: a organização proprietária da conexão SCIM ou do provedor SSO."
       },
       created_at: {
         label: "Criado em"