feat(mgmt): load external groups scoped to a specific SSO config

[dorsha]

Related Issues

Required for:
https://github.com/descope/etc/issues/17382

Related PRs

Upstream PRs

• https://github.com/descope/backend/pull/2072

In a Nutshell

• Optional sso_id param on the three group-loading methods (sync + async)
• Sent only when provided, so older backends are unaffected

Description

Adds SSO-config scoping to load_all_groups, load_all_groups_for_members and load_all_group_members, matching the new backend ssoId filter. The reserved id default_ssoid targets the tenant's default SSO configuration; responses now include an ssoId field per group identifying its origin SSO configuration.

Must

• Tests
• Documentation (if applicable)

🤖 Generated with Claude Code

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Suggested Reviewers

The review assignment targets contributors with substantial and varied coverage of the core group management modules, including both sync and async components, to ensure thorough review of the new SSO scope features.

Reviewer	Reason
itaihanski	itaihanski has contributed extensively to descope/management/group.py and testing files, providing a broad coverage of the main implementation and its tests.
tebeka	tebeka also has significant contributions to descope/management/group.py and related tests, making them suitable for review.
LioriE	LioriE focuses on the async version of the group management code, ensuring the new async logic works correctly with scope filtering.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot]

🐕 Shuni's Review

Adds an optional sso_id filter to the three group-loading methods (sync + async), sent only when provided so older backends keep working.

Sniffed out 1 issue:

• 1 🟢 LOW: ssoId response field documented in only one of the three docstrings; README group section still lacks a sso_id example

Logic is correct and sync/async stay in lockstep; the conditional-body idiom matches the rest of descope/management. Only load_all_groups got an sso_id test — the other two methods are identical in shape, so that's a judgment call, but worth a copy-paste. Good bones! Woof!

---

Declared coverage: FULL — 3/3 changed files reviewed.

[github-actions]

Coverage report

The coverage rate went from 98.26% to 98.21% ⬇️

77.77% of new lines are covered.

Diff Coverage details (click to unfold)

descope/management/group_async.py

77.77% of new lines are covered (92% of the complete file).
Missing lines: 108, 158

descope/management/group.py

77.77% of new lines are covered (91.66% of the complete file).
Missing lines: 104, 154

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Shuni's Review

Re-review of the new push: docstrings for all three group loaders (sync + async) now document source and ssoId, README gained an sso_id example, and a bundled pyproject/uv.lock fix restores the mypy>=1.11.2,<1.12 bound for Python 3.9.

No new issues. My earlier note about ssoId missing from two of the three return-format docstrings is fixed.

The mypy pin mirrors the existing pytest>=8.4,<9 guard convention and realigns pyproject with the lock (they had drifted on main), and the lock specifier ordering matches the coverage[toml]>=7.3.1,<8 style, so uv lock --check stays happy. Only load_all_groups has an sso_id test — still a copy-paste away for the other two. Clean scent! Woof!

---

Declared coverage: PARTIAL — 5/6 changed files reviewed.