Harden enterprise SAML & SCIM GA path (rebased re-port of #92)#161

Open

Bobcatsfan33 wants to merge 10 commits into

mainfrom

Commits on Jul 14, 2026

Re-port #92 (SAML/SCIM GA hardening) onto refactored main — core modules
Bobcatsfan33
committed
Re-port #92: Dockerfile SAML libs, alembic + storage migrations for SAML/SCIM schemas
Bobcatsfan33
committed
Re-port #92: SAML replay/relay-state hardening + tenant middleware bearer-key auth
Bobcatsfan33
committed
Re-port #92: durable SCIM storage integrated with main's scim_filter/scim_patch + group role mapping
Bobcatsfan33
committed
Re-port #92: IdP GA validation harness + tenant middleware bearer test
Bobcatsfan33
committed
Re-port #92: SAML ACS relay-state + audit logging in enterprise router (routes moved from api.py)
Bobcatsfan33
committed
Re-port #92: preflight SAML gates (deps, https SP URLs, relay allowlist, idp-initiated off) + tests
Bobcatsfan33
committed
Re-port #92: SAML/SCIM tests (replay, relay-state, durable storage, role sync) + GA docs
Bobcatsfan33
committed
Fix middleware.py comment separator to match workspace (byte-exact re-port)
Bobcatsfan33
committed
Fix Dockerfile comment separator to match workspace (byte-exact re-port)
Bobcatsfan33
committed