feat: enterprise SSO/SAML integration & calendar two-way sync (#553, #551)

[olathedev]

Summary

• Issue Build enterprise SSO/SAML integration with automatic provisioning #553 — Enterprise SSO/SAML Integration with Automatic Provisioning

  • SAML 2.0 SSO service with IdP-initiated and SP-initiated login flows
  • OpenID Connect (OIDC) enterprise provider support (Azure AD, Keycloak)
  • Just-In-Time (JIT) provisioning — auto-create user accounts on first SSO login
  • SCIM 2.0 REST endpoints for user lifecycle management (create, update, deactivate, group sync)
  • IdP metadata upload (XML) and URL-based configuration
  • Role mapping from IdP groups to SubTrackr roles (admin, viewer, billing)
  • IdP certificate rotation with graceful expiry handling
  • IP allowlist bypass codes for when IdP is unavailable
  • SSO Settings screen with provider management, role mapping UI, and SCIM user overview

• Issue Add calendar integration with two-way sync for billing events #551 — Calendar Integration with Two-Way Sync for Billing Events

  • Google Calendar and Outlook Calendar API integration via OAuth
  • iCal/ICS export for manual import into any calendar app
  • Five event types: payment due, payment received, trial ending, renewal, contract end
  • Real-time sync via webhooks with hourly poll fallback
  • User controls: sync direction (to calendar, from calendar, bidirectional) and event type selection
  • Two-way sync: calendar changes (reschedule, snooze, delete) reflected back in SubTrackr
  • Rate limiting (per-connection) and conflict resolution for concurrent edits
  • SyncWorker with configurable poll intervals and webhook queue processing
  • Enhanced CalendarIntegrationScreen with two-way sync settings UI

New Files

• backend/sso/ — SSO domain module (SSOService, SCIMService, controller, types, tests)
• backend/calendar/ — Calendar sync domain module (CalendarSyncService, SyncWorker, controller, types, tests)
• src/types/sso.ts — Frontend SSO types
• src/store/ssoStore.ts — SSO Zustand store
• src/screens/SSOSettingsScreen.tsx — SSO settings screen

Modified Files

• src/types/calendar.ts — Added two-way sync types (SyncDirection, CalendarEventType, CalendarSyncSettings)
• src/store/calendarStore.ts — Added sync direction, event type toggle, bidirectional sync methods
• src/screens/CalendarIntegrationScreen.tsx — Added two-way sync settings UI section

Test plan

• Verify SSO service tests pass: backend/sso/__tests__/SSOService.test.ts
• Verify SCIM service tests pass: backend/sso/__tests__/SCIMService.test.ts
• Verify calendar sync tests pass: backend/calendar/__tests__/CalendarSyncService.test.ts
• Verify existing calendar integration tests still pass
• Test SSO Settings screen renders with provider presets
• Test CalendarIntegrationScreen shows two-way sync controls when connected

Closes #553
Closes #551

🤖 Generated with Claude Code

[drips-wave]

@olathedev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits