security(auth): gate SSO settings page + API by enterprise edition

app/e2e/sso-gating.spec.ts

@@ -0,0 +1,81 @@
+import { test, expect, ALICE } from "./fixtures";
+
+/**
+ * Verifies SSO gating on community edition (the default global-setup state —
+ * NEOBOARD_EDITION is not set).
+ *
+ * The inverse (enterprise mode exposing the SSO management UI) is tracked
+ * in #933 — it requires a second Next.js server with NEOBOARD_EDITION=enterprise,
+ * which is a substantial global-setup overhaul.
+ */
+test.describe("SSO gating — community edition", () => {
+  test.beforeEach(async ({ authPage, sidebarPage }) => {
+    await authPage.login(ALICE.email, ALICE.password);
+    await sidebarPage.navigateTo("Settings");
+  });
+
+  test("Authentication tab is NOT visible in settings nav", async ({
+    page,
+  }) => {
+    await expect(page.getByRole("button", { name: "Profile" })).toBeVisible();
+    await expect(page.getByRole("button", { name: "API Keys" })).toBeVisible();
+    await expect(
+      page.getByRole("button", { name: "Authentication" }),
+    ).toHaveCount(0);
+  });
+
+  test("/settings/authentication shows Enterprise-required empty state", async ({
+    page,
+  }) => {
+    await page.goto("/settings/authentication");
+    // The empty state component renders the feature title and description
+    await expect(page.getByText(/Single Sign-On/i)).toBeVisible({
+      timeout: 10_000,
+    });
+    await expect(page.getByText(/Enterprise feature/i)).toBeVisible();
+    await expect(
+      page.getByRole("link", { name: /Learn about Enterprise/i }),
+    ).toBeVisible();
+    // Critical: the SSO management UI is NOT rendered
+    await expect(
+      page.getByRole("button", { name: /Add Provider/i }),
+    ).toHaveCount(0);
+  });
+
+  test("/api/sso-providers returns 402 ENTERPRISE_REQUIRED", async ({
+    page,
+  }) => {
+    // Use page.request so this rides the authenticated session set up in
+    // beforeEach + the page's connection pool (avoids the global request
+    // context occasionally racing with server startup → ECONNRESET on first
+    // call). The route gates on requireFeature("sso") before auth checks,
+    // so this 402 is independent of the session identity.
+    const res = await page.request.get("/api/sso-providers");
+    expect(res.status()).toBe(402);
+    const body = await res.json();
+    expect(body.error?.code).toBe("ENTERPRISE_REQUIRED");
+  });
+});
+
+test.describe("SSO gating — login page (community)", () => {
+  test("login page renders no SSO buttons", async ({ page }) => {
+    await page.goto("/login");
+    // Standard email/password form is present
+    await expect(page.getByLabel(/email/i)).toBeVisible();
+    await expect(page.getByLabel(/password/i)).toBeVisible();
+    // No "Sign in with X" SSO buttons (no providers configured + edition gates)
+    await expect(
+      page.getByRole("button", { name: /Sign in with/i }),
+    ).toHaveCount(0);
+  });
+
+  test("/api/auth/sso-providers returns empty array (no auth required)", async ({
+    request,
+  }) => {
+    const res = await request.get("/api/auth/sso-providers");
+    expect(res.status()).toBe(200);
+    const body = await res.json();
+    expect(body.data).toEqual([]);
+    expect(body.meta?.enforceSso).toBe(false);
+  });
+});

app/src/app/(dashboard)/settings/authentication/__tests__/page.test.tsx

@@ -25,6 +25,31 @@ vi.mock("@/hooks/use-sso-providers", () => ({
   }),
 }));
 
+// FeatureGate: default to rendering children (feature enabled). Override
+// `mockSsoEnabled = false` to test the disabled path.
+let mockSsoEnabled: boolean | undefined = true;
+vi.mock("@/components/feature-gate", () => ({
+  FeatureGate: ({
+    children,
+    fallback,
+  }: {
+    feature: string;
+    children: React.ReactNode;
+    fallback?: React.ReactNode;
+  }) => {
+    if (mockSsoEnabled === true) return <>{children}</>;
+    return <>{fallback ?? null}</>;
+  },
+}));
+
+vi.mock("@/components/enterprise-required-empty-state", () => ({
+  EnterpriseRequiredEmptyState: ({ feature }: { feature: string }) => (
+    <div data-testid="enterprise-required" data-feature={feature}>
+      Enterprise feature required: {feature}
+    </div>
+  ),
+}));
+
 vi.mock("next/navigation", () => ({
   useRouter: () => ({ push: vi.fn() }),
   usePathname: () => "/settings/authentication",
@@ -181,6 +206,23 @@ vi.mock("@neoboard/components", () => ({
 describe("AuthenticationPage", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    mockSsoEnabled = true;
+  });
+
+  it("renders enterprise-required empty state on community edition", async () => {
+    mockSsoEnabled = false;
+    mockUseSsoProviders.mockReturnValue({ data: undefined, isLoading: false });
+
+    const { default: Page } = await import("../page");
+    render(<Page />);
+
+    expect(screen.getByTestId("enterprise-required")).toBeInTheDocument();
+    expect(screen.getByTestId("enterprise-required")).toHaveAttribute(
+      "data-feature",
+      "sso",
+    );
+    // The community page must NOT render the SSO management UI
+    expect(screen.queryByText("Add SSO Provider")).not.toBeInTheDocument();
   });
 
   it("shows loading spinner when fetching", async () => {

app/src/app/(dashboard)/settings/authentication/page.tsx

@@ -40,6 +40,8 @@ import type {
   SsoProviderListItem,
   CreateSsoProviderInput,
 } from "@/hooks/use-sso-providers";
+import { FeatureGate } from "@/components/feature-gate";
+import { EnterpriseRequiredEmptyState } from "@/components/enterprise-required-empty-state";
 
 // ---------------------------------------------------------------------------
 // Add Provider Dialog
@@ -388,6 +390,21 @@ function ProviderRow({
 // ---------------------------------------------------------------------------
 
 export default function AuthenticationPage() {
+  return (
+    <FeatureGate
+      feature="sso"
+      fallback={
+        <div className="p-6">
+          <EnterpriseRequiredEmptyState feature="sso" />
+        </div>
+      }
+    >
+      <AuthenticationPageContent />
+    </FeatureGate>
+  );
+}
+
+function AuthenticationPageContent() {
   const [createOpen, setCreateOpen] = useState(false);
   const { data: providers = [], isLoading } = useSsoProviders();
   const deleteMutation = useDeleteSsoProvider();

app/src/app/(dashboard)/settings/layout.tsx

@@ -2,11 +2,25 @@
 
 import { useRouter, usePathname } from "next/navigation";
 import { User, KeyRound, Shield } from "lucide-react";
+import { useFeature, type FeatureId } from "@/hooks/use-features";
 
-const tabs = [
+interface Tab {
+  href: string;
+  label: string;
+  icon: typeof User;
+  /** When set, the tab is only rendered if this feature is enabled. */
+  requiresFeature?: FeatureId;
+}
+
+const tabs: Tab[] = [
   { href: "/settings/profile", label: "Profile", icon: User },
   { href: "/settings/api-keys", label: "API Keys", icon: KeyRound },
-  { href: "/settings/authentication", label: "Authentication", icon: Shield },
+  {
+    href: "/settings/authentication",
+    label: "Authentication",
+    icon: Shield,
+    requiresFeature: "sso",
+  },
 ];
 
 export default function SettingsLayout({
@@ -16,12 +30,23 @@ export default function SettingsLayout({
 }) {
   const router = useRouter();
   const pathname = usePathname();
+  // Subscribe to features once at layout level; useFeature returns undefined
+  // during the initial load — we hide gated tabs in that window to avoid a
+  // flicker of enterprise UI on community installs.
+  const ssoEnabled = useFeature("sso");
+
+  const visibleTabs = tabs.filter((t) => {
+    if (!t.requiresFeature) return true;
+    if (t.requiresFeature === "sso") return ssoEnabled === true;
+    // Unknown feature gate: hide by default (safer than leak).
+    return false;
+  });
 
   return (
     <div className="flex flex-col">
       <nav className="border-b px-6">
         <div className="flex gap-4">
-          {tabs.map(({ href, label, icon: Icon }) => {
+          {visibleTabs.map(({ href, label, icon: Icon }) => {
             const active = pathname === href;
             return (
               <button

app/src/app/api/auth/sso-providers/__tests__/route.test.ts

@@ -26,6 +26,9 @@ describe("GET /api/auth/sso-providers", () => {
     vi.clearAllMocks();
     vi.doMock("@/lib/db", () => ({ db: mockDb }));
     vi.doMock("next/server", () => nextResponseMockFactory());
+    // Default tests assume enterprise (so DB path runs); community tests
+    // override before importing the route.
+    vi.stubEnv("NEOBOARD_EDITION", "enterprise");
     const mod = await import("../route");
     GET = mod.GET;
   });
@@ -61,4 +64,40 @@ describe("GET /api/auth/sso-providers", () => {
     const res = await GET();
     expect(res.status).toBe(200);
   });
+
+  it("returns empty array on community edition even when DB has rows", async () => {
+    vi.stubEnv("NEOBOARD_EDITION", "");
+    vi.resetModules();
+    vi.doMock("@/lib/db", () => ({ db: mockDb }));
+    vi.doMock("next/server", () => nextResponseMockFactory());
+    // Stub: even if DB has rows, community should not query/return them
+    mockDb.select.mockReturnValue(
+      makeSelectChain([
+        { id: "sso-1", name: "Stale Provider", enforceSso: false },
+      ]),
+    );
+    const mod = await import("../route");
+    const res = await mod.GET();
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.data).toEqual([]);
+    expect(body.meta?.enforceSso).toBe(false);
+    // Critical: community must not even hit the DB (defense in depth)
+    expect(mockDb.select).not.toHaveBeenCalled();
+  });
+
+  it("returns rows on enterprise edition", async () => {
+    vi.stubEnv("NEOBOARD_EDITION", "enterprise");
+    vi.resetModules();
+    vi.doMock("@/lib/db", () => ({ db: mockDb }));
+    vi.doMock("next/server", () => nextResponseMockFactory());
+    mockDb.select.mockReturnValue(
+      makeSelectChain([{ id: "sso-1", name: "Okta", enforceSso: false }]),
+    );
+    const mod = await import("../route");
+    const res = await mod.GET();
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.data).toEqual([{ id: "sso-1", name: "Okta" }]);
+  });
 });

app/src/app/api/auth/sso-providers/route.ts

@@ -4,15 +4,24 @@ import { ssoProviders } from "@/lib/db/schema";
 import { loadEnvSsoProvider } from "@/lib/auth/sso/env-provider";
 import { apiSuccess } from "@/lib/api/api-response";
 import { handleRouteError } from "@/lib/api/api-utils";
+import { hasFeature } from "@/lib/features/registry";
 
 /**
  * Public endpoint — returns only id + name of enabled SSO providers.
  * Merges the env-based provider (if configured) with DB-based providers.
  * Used by the login page to render SSO buttons.
  * No auth required (falls under /api/auth/ public prefix).
+ *
+ * Defense in depth: on community edition this short-circuits to an empty
+ * response even if the sso_provider table has rows (e.g. legacy data from
+ * an earlier enterprise install). The sign-in flow relies on enterprise
+ * code anyway, so listing them on community would be a dead-end.
  */
 export async function GET() {
   try {
+    if (!hasFeature("sso")) {
+      return apiSuccess([], 200, { enforceSso: false });
+    }
     const tenantId = process.env.TENANT_ID ?? "default";
 
     const rows = await db