feat(enterprise): SSO OIDC providers — schema, API, auth flow

.github/sync-public-exclude

@@ -0,0 +1,7 @@
+# Paths excluded from the public mirror by sync-public.yml.
+# Each line maps to a --path argument passed to git filter-repo --invert-paths.
+#
+# To add a new exclusion:
+#   1. Add the path here
+#   2. Add a matching --path line in .github/workflows/sync-public.yml
+enterprise/

.github/workflows/ci.yml

@@ -8,6 +8,7 @@ on:
       - 'component/**'
       - 'connection/**'
       - 'cli/**'
+      - 'enterprise/**'
       - 'sonar-project.properties'
       - 'Dockerfile'
       - '.github/workflows/ci.yml'
@@ -20,6 +21,7 @@ on:
       - 'component/**'
       - 'connection/**'
       - 'cli/**'
+      - 'enterprise/**'
       - 'sonar-project.properties'
       - 'Dockerfile'
       - '.github/workflows/ci.yml'
@@ -126,12 +128,17 @@ jobs:
           CONN_PID=$!
           cd cli && npm run test:coverage &
           CLI_PID=$!
+          if [ -d enterprise ]; then
+            cd enterprise && npm run test &
+            ENT_PID=$!
+          fi
 
           FAIL=0
           wait $APP_PID  || FAIL=1
           wait $COMP_PID || FAIL=1
           wait $CONN_PID || FAIL=1
           wait $CLI_PID  || FAIL=1
+          [ -n "${ENT_PID:-}" ] && { wait $ENT_PID || FAIL=1; }
           exit $FAIL
         env:
           POSTGRES_HOST: localhost

.github/workflows/sync-public.yml

@@ -0,0 +1,37 @@
+name: Sync to Public Mirror
+
+# This workflow runs in the PRIVATE repo (neoboard-private) and pushes
+# a filtered copy (without enterprise/) to the public repo (neoboard).
+#
+# Required secret: PUBLIC_REPO_TOKEN — a GitHub PAT with repo push access
+# to alfredo1996/neoboard.
+
+on:
+  push:
+    branches: [main, dev]
+  workflow_dispatch:
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout private repo (full history)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install git-filter-repo
+        run: pip install git-filter-repo
+
+      - name: Remove enterprise/ from history
+        run: |
+          git filter-repo \
+            --force \
+            --invert-paths \
+            --path enterprise/
+
+      - name: Push to public mirror
+        run: |
+          git remote add public \
+            https://x-access-token:${{ secrets.PUBLIC_REPO_TOKEN }}@github.com/alfredo1996/neoboard.git
+          git push public HEAD:refs/heads/${{ github.ref_name }} --force

app/drizzle/migrations/0004_busy_champions.sql

@@ -0,0 +1,19 @@
+CREATE TYPE "public"."sso_protocol" AS ENUM('oidc');--> statement-breakpoint
+CREATE TABLE "sso_provider" (
+	"id" text PRIMARY KEY NOT NULL,
+	"tenant_id" text DEFAULT 'default' NOT NULL,
+	"name" text NOT NULL,
+	"protocol" "sso_protocol" DEFAULT 'oidc' NOT NULL,
+	"issuer" text NOT NULL,
+	"client_id" text NOT NULL,
+	"client_secret_encrypted" text NOT NULL,
+	"scopes" text DEFAULT 'openid profile email' NOT NULL,
+	"claim_mappings" jsonb,
+	"auto_provision" boolean DEFAULT true NOT NULL,
+	"default_role" "user_role" DEFAULT 'creator' NOT NULL,
+	"enforce_sso" boolean DEFAULT false NOT NULL,
+	"enabled" boolean DEFAULT true NOT NULL,
+	"created_at" timestamp DEFAULT now(),
+	"updated_at" timestamp DEFAULT now(),
+	CONSTRAINT "sso_provider_tenant_issuer_unique" UNIQUE("tenant_id","issuer")
+);