feature(nitrate): sso tests

[tdelatorre]

Done Definition Checks

Description

This PR resolves the automation of the 3 Qase cases under Admin Console > Sidebar Menu > Organization SSO (PENPOT-3527, PENPOT-3535, PENPOT-3587), which existed only as test.skip stubs with no locators or page object.

What problem are you trying to solve?

organization-sso.spec.ts had 3 manual test cases sitting as unimplemented stubs, and there was no page object for the Admin Console's SSO Config screen at all. The 3 cases also share a real dependency chain — both "existing session cutoff" (3535) and "deactivate SSO" (3587) require SSO to already be active, which PENPOT-3527 sets up — so automating them independently would mean paying 3x for the same expensive setup (Stripe checkout, a real Gmail-alias invitee, a live Auth0 test-connection).

Solution

How did you solve the problem?

• Added pages/admin-console/organization-sso-page.ts, a new page object covering the SSO Config tab: provider selection (Generic OpenID Connect / Azure AD / Google), the config form, activate/deactivate + their confirmation dialogs, and the resulting toast notifications. Includes self-healing retries for a couple of hydration races confirmed live (the config form occasionally lagging behind the provider radio's checked state, and an Activate SSO locator accidentally substring-matching Deactivate SSO).
• Wired the new ssoPage fixture into tests/enterprise/fixtures/enterprise-fixtures.ts.
• Merged the 3 Qase cases into one sequential test (qase([3527, 3535, 3587], ...)) using ownerAndInviteeTest — a real Gmail-alias invitee is required (not a demo account) since accepting a team invite needs a readable inbox, and the invitee must be an actual signed-in team member for their session to be the one that gets cut off.
• Added isRedirectedToSsoLogin() to pages/dashboard/organization-page.ts to assert the live-push redirect to the identity provider's login page.
• Added getMessageText(), checkSsoActivatedEmailSubject(), and checkSsoActivatedEmailText() to helpers/gmail.js to verify the "SSO enabled" notification email sent to the invitee.
• Moved the Auth0 test-tenant credentials out of the spec into ENTERPRISE_SSO_ISSUER_URL / ENTERPRISE_SSO_CLIENT_ID / ENTERPRISE_SSO_CLIENT_SECRET env vars, documented in .env.example and README.md.

How to test

• Check the code
• Update the test case in Qase (Automation Status field or steps changed)
• It complies with the test conventions
• There are no missing snapshots
• The tests run OK

Screenshots 📸

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical CI configuration and test setup issues must be resolved before approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 3

Open (3)

• Export Enterprise SSO secrets in test workflows · New
• Provide Enterprise SSO credentials to test jobs · New
• Set baseURL for the invitee browser context · New

What changed in this PR

Automates the enterprise Organization SSO scenarios with shared setup, page-object coverage, Gmail validation, and environment configuration.

Changes:

• Adds SSO activation, cutoff, and deactivation coverage.
• Adds SSO page object, fixture, redirect assertion, and Gmail helpers.
• Documents required SSO credentials.

Unresolved findings include missing CI secret mappings, invitee context setup, invite-flow settling, and stale fixture documentation.

File	Description
tests/​enterprise/​fixtures/​enterprise-fixtures.ts	Registers the SSO page fixture.
tests/​enterprise/​admin-console/​organization-sso.spec.ts	Automates the three SSO scenarios.
README.md	Documents SSO environment variables.
pages/​dashboard/​organization-page.ts	Adds SSO redirect validation.
pages/​admin-console/​organization-sso-page.ts	Adds SSO configuration interactions and assertions.
helpers/​gmail.js	Adds SSO email helpers and checks.
.env.example	Documents SSO environment variables.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[daniel-herrero]

LGTM