feat(dashboard-api): map Ory SSO organizations to E2B teams

[ben-fornefeld]

What

Maps Ory SSO organizations → E2B teams in dashboard-api. When an enterprise user signs in through their org's SSO connection, Ory stamps identity.organization_id; on bootstrap we read that server-side and enroll the user into the team(s) mapped to that org instead of creating a personal team. SSO users are blocked from mutating team membership.

How it works

• Mapping lives on the team: teams.ory_organization_id (nullable, non-unique — one org may map to many teams). Set operationally when the enterprise team is provisioned.
• Signal read from Kratos (authoritative, no JWT/claim plumbing): userprofile.Provider.GetIdentitySSOOrganization / GetUserSSOOrganization.
• Bootstrap (assignSSOTeams): joins every mapped team, earliest-created becomes the default, emits no billing provisioning (SSO teams are provisioned out of band), and fails closed if the org maps to no usable team. Non-SSO identities fall through to the existing personal-team path.
• Server guards: SSO users can't create teams (ensureNotSSOManaged); SSO-managed teams reject member adds (rejectIfSSOManagedTeam, read from the authenticated team context).
• CreateTeamMembership made idempotent (ON CONFLICT DO NOTHING); sqlc regenerated.

Tests

sso_test.go: multi-team join + earliest-default, fail-closed + rollback, create-team blocked, add-member blocked. go build/vet/gofmt clean; go test -short green. DB-backed tests run via testcontainers in CI.

Out of scope / follow-ups

• Populating teams.ory_organization_id (no admin endpoint in this PR) and applying the migration are operational steps.
• No backfill of existing enterprise users (they keep their personal team; bootstrap short-circuits on re-login).
• Real org-SSO can't be exercised on the OSS self-hosted Kratos in the harness (Organizations are Ory Network / OEL only) — validate end-to-end against an Ory Network project.

Notes

Branched from the harness full-stack pin, which is ~2 commits behind main; rebase before merge if needed. Pairs with the dashboard PR (UI gating + AuthUser.isSso).

🤖 Generated with Claude Code

[cursor]

PR Summary

High Risk
Changes OIDC bootstrap, team membership, and invite authorization—security-sensitive auth paths that can block logins or wrongly grant access if org/team mapping is misconfigured.

Overview
Enterprise SSO sign-in now ties Ory organization_id on the identity to teams via sso_organization_id and sso_auto_join. On first OIDC bootstrap, org users are enrolled into all auto-join teams for that org (landing on the earliest-created), without creating a personal default team or billing provisioning; missing or manual-only mappings fail closed with 403. SSO-managed users cannot create teams, and invites to SSO-linked teams are limited to accounts in the same org. Ory lookups for org membership run outside the bootstrap transaction. Sandbox event retention now falls back to a default when team limits are nil.

^{Reviewed by Cursor Bugbot for commit 0ddac04. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

❌ 5 Tests Failed:

Tests completed	Failed	Passed	Skipped
3189	5	3184	6

View the top 3 failed test(s) by shortest run time

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_1_lists_root_directory

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_1_lists_root_directory
=== PAUSE TestListDir/depth_1_lists_root_directory
=== CONT  TestListDir/depth_1_lists_root_directory
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_1_lists_root_directory
--- FAIL: TestListDir/depth_1_lists_root_directory (0.01s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
=== PAUSE TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
=== CONT  TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
--- FAIL: TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory) (0.01s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_0_lists_only_root_directory

Stack Traces | 0.02s run time

=== RUN   TestListDir/depth_0_lists_only_root_directory
=== PAUSE TestListDir/depth_0_lists_only_root_directory
=== CONT  TestListDir/depth_0_lists_only_root_directory
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_0_lists_only_root_directory
--- FAIL: TestListDir/depth_0_lists_only_root_directory (0.02s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir

Stack Traces | 1.58s run time

=== RUN   TestListDir
=== PAUSE TestListDir
=== CONT  TestListDir
--- FAIL: TestListDir (1.58s)
Executing command cat in sandbox iwid2ljmo0fcttrwpa40d (user: root)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestCommandKillNextApp

Stack Traces | 212s run time

=== RUN   TestCommandKillNextApp
=== PAUSE TestCommandKillNextApp
=== CONT  TestCommandKillNextApp
    process_test.go:30: Build failed: {<nil> An internal error occurred. Please try again or contact support with the build ID. <nil>}
--- FAIL: TestCommandKillNextApp (212.37s)
Executing command cat in sandbox ie5oi5ks1tww0bz3dmmub (user: root)

View the full list of 1 ❄️ flaky test(s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_3_lists_all_directories_and_files

Flake rate in main: 30.77% (Passed 9 times, Failed 4 times)

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_3_lists_all_directories_and_files
=== PAUSE TestListDir/depth_3_lists_all_directories_and_files
=== CONT  TestListDir/depth_3_lists_all_directories_and_files
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_3_lists_all_directories_and_files
--- FAIL: TestListDir/depth_3_lists_all_directories_and_files (0.01s)

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[gemini-code-assist]

Code Review

Performing an external network call to Ory Kratos inside an active database transaction in assignSSOTeams holds database connections and locks open, which can lead to connection pool exhaustion; the SSO organization ID should be fetched before starting the transaction. Additionally, the rejectIfSSOManagedTeam check must be integrated into the member removal handler to prevent manual member deletions on SSO-managed teams.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 0ddac04. Configure here.}