SSO Phase 4c: Block non-SSO logins

[GregorShear]

Summary

• Intercept sso_required:<domain> errors from Supabase auth to redirect users to their organization's SSO provider
• Wraps all supabase fetch requests (specifically auth requests - both login and token refresh) and looks for sso-required errors
• Adds a full-page interstitial (FullPageSSONotSatisfied) that explains SSO is required and provides a one-click redirect to the tenant's identity provider via signInWithSSO({ domain })

Test plan

• Trigger sso_required error on OAuth login → interstitial appears, SSO redirect works
• Trigger sso_required error on token refresh → interstitial appears
• Normal login flows (no SSO requirement) are unaffected

[travjenkins]

A few more tweaks

[GregorShear]

Really struggled to hide the avatar in the upper right - my understanding is that setUserDetails(null) should do it, but I think the authStateChange listener defined in User/index.tsx was restoring that value.

So anyway, I'm punting on that and using this FullPageDialog wrapper component that omits the top bar entirely. Let me know what you think.

@travjenkins

[travjenkins]

Yup - this is fine and what I expected the faster solution to be :D

[GregorShear]

some more weirdness - need to remove the session from local storage to prevent retrying the token refresh request. Normally we'd do that with supabaseClient.auth.signOut(), but calling that in this function hangs, i think because supabase already has a lock on the session during the refresh cycle (which we are interrupting here).

another option would be to call signOut() in a useEffect in the SsoRequired component. I kinda like having the logic centralized here, though.

[GregorShear]

talked to travis - moving this to the SsoRequired useEffect and calling the actual signout() function

[travjenkins]

lgtm - we'll wanna keep an eye on 401 GQL calls but doubt that'll be an issue in prod