fix(sso): SSO callback redirect for non-admin users with team memberships

[bogdanmariusc10]

🔗 Related Issue

Closes #4770

---

📝 Summary

Fixes SSO callback redirect that was blocking non-admin users from accessing the platform. The SSO callback handler was unconditionally redirecting all authenticated users to /admin without a team_id parameter, which prevented the AdminAuthMiddleware from resolving team-scoped admin permissions.

The fix implements intelligent redirect logic:

• Platform admins (is_admin=true): Redirect to /admin (unchanged behavior)
• Non-admin users with teams: Redirect to /admin?team_id=<first_team_id> (enables team-scoped admin access)
• Non-admin users without teams: Redirect to / (root page)
• Error handling: Falls back to /admin if team retrieval fails

This enables team members with admin.* permissions to access the admin UI in their team context, and provides appropriate landing pages for regular users (platform_viewer, developer, etc.).

---

🏷️ Type of Change

• Bug fix
• Feature / Enhancement
• Documentation
• Refactor
• Chore (deps, CI, tooling)
• Other (describe below)

---

🧪 Verification

Check	Command	Status
Lint suite	make lint	✅ Pass
Unit tests	make test	✅ Pass
Coverage ≥ 80%	make coverage	✅ Pass

---

✅ Checklist

• Code formatted (make black isort pre-commit)
• Tests added/updated for changes
• Documentation updated (if applicable)
• No secrets or credentials committed

---

📓 Notes

Implementation Details

Modified: mcpgateway/routers/sso.py (lines 402-440)

• Added JWT token decoding to determine user admin status
• Added TeamManagementService integration to retrieve user teams
• Implemented conditional redirect logic based on admin status and team membership
• Added comprehensive error handling with logging

Test Coverage: tests/unit/mcpgateway/routers/test_sso_router.py

• Updated 3 existing tests to use valid JWT tokens with admin status
• Added 4 new tests covering all redirect scenarios:
  • test_handle_sso_callback_non_admin_with_team_redirects_to_team - Non-admin user with team membership redirects to team-scoped admin
  • test_handle_sso_callback_non_admin_no_teams_redirects_to_root - Non-admin user without teams redirects to root page
  • test_handle_sso_callback_team_service_error_falls_back_to_admin - Team service error falls back to /admin redirect
  • test_handle_sso_callback_invalid_jwt_falls_back_to_user_info - Invalid JWT token triggers exception handler and falls back to user_info

Test Results: All 50 SSO router tests passing ✅

Impact

Before: Only platform admins could successfully use SSO login. Non-admin users were redirected to /admin without team_id, causing a 403 error.

After:

• ✅ Platform admins continue to work as before
• ✅ Team admins with admin.* permissions can now access via SSO
• ✅ Regular users are redirected to appropriate landing pages
• ✅ All SSO providers benefit (Okta, Google, GitHub, Keycloak, Entra, ADFS, Generic OIDC)

Backwards Compatibility

The fix is fully backwards compatible:

• Platform admins experience no change in behavior
• Non-admin users who previously couldn't log in via SSO can now do so
• Error handling ensures graceful degradation if team retrieval fails