feat(den): support Entra SSO auto-join

ee/apps/den-api/src/auth.ts

@@ -1,5 +1,6 @@
 import { getInitialActiveOrganizationIdForUser } from "./active-organization.js";
 import { db } from "./db.js";
+import { isEntraSsoEnabled, mapEntraProfileToUser, normalizeEntraTenantId } from "./entra-sso.js";
 import { env } from "./env.js";
 import { deriveDenMcpResource } from "./mcp/resource.js";
 import { getDenAuthIssuer, getDenJwtOptions } from "./mcp/jwt-policy.js";
@@ -42,6 +43,7 @@ import {
   ORGANIZATION_SAML_REQUIRE_TIMESTAMPS,
 } from "./sso-saml-policy.js";
 import {
+  ensureEntraSsoMembershipForAccount,
   getOrganizationContextForUser,
   seedDefaultOrganizationRoles,
   validateOrganizationMemberRemovalForHook,
@@ -117,6 +119,18 @@ const socialProviders = {
         },
       }
     : {}),
+  ...(isEntraSsoEnabled(env.entra)
+    ? {
+        microsoft: {
+          clientId: env.entra.clientId!,
+          clientSecret: env.entra.clientSecret!,
+          tenantId: normalizeEntraTenantId(env.entra.tenantId),
+          authority: "https://login.microsoftonline.com",
+          scope: ["openid", "profile", "email"],
+          mapProfileToUser: mapEntraProfileToUser,
+        },
+      }
+    : {}),
 };
 
 function hasRole(roleValue: string, roleName: string) {
@@ -155,6 +169,10 @@ function buildInvitationLink(invitationId: string) {
   ).toString();
 }
 
+export function getSignUpEmailRateLimitMax(devMode = env.devMode) {
+  return devMode ? 100 : 3;
+}
+
 function hasMcpScope(scopes: readonly string[]) {
   return scopes.some((scope) => scope.startsWith("mcp:"));
 }
@@ -224,6 +242,30 @@ export const auth = betterAuth({
     freshAge: 15 * 60,
   },
   databaseHooks: {
+    account: {
+      create: {
+        after: async (account) => {
+          if (account.providerId === "microsoft") {
+            await ensureEntraSsoMembershipForAccount({
+              idToken: account.idToken,
+              providerId: account.providerId,
+              userId: normalizeDenTypeId("user", account.userId),
+            });
+          }
+        },
+      },
+      update: {
+        after: async (account) => {
+          if (account.providerId === "microsoft") {
+            await ensureEntraSsoMembershipForAccount({
+              idToken: account.idToken,
+              providerId: account.providerId,
+              userId: normalizeDenTypeId("user", account.userId),
+            });
+          }
+        },
+      },
+    },
     member: {
       delete: {
         before: async (member: AuthMemberHookRow) => {
@@ -369,7 +411,7 @@ export const auth = betterAuth({
       },
       "/sign-up/email": {
         window: 3600,
-        max: env.devMode ? 100 : 5,
+        max: getSignUpEmailRateLimitMax(),
       },
       "/email-otp/send-verification-otp": {
         window: 3600,