SSO User Deduplication Plugin

[flvndvd]

Description

This PR adds a Poke plugin that handles duplicate user accounts created when SSO is enabled for a workspace. The plugin focuses on access consolidation rather than content migration.

🚗 also fixed https://github.com/dust-tt/tasks/issues/2400.

Plugin Behavior

For each email with duplicate active memberships in a workspace:

1. Identifies the SSO-authenticated account (newer) and the original account (older)
2. Archives and revokes the SSO account's membership
3. Updates the original account to use SSO credentials
4. Preserves all existing resources and permissions on the original account

Safety Features

• Dry-run mode (execute=false) displays a detailed diff of planned changes
• Only processes accounts with active memberships
• Only processes duplicates where one account uses SSO authentication
• Preserves original account's creation date and resources
• Archives SSO accounts with timestamped auth0Sub for audit trail

Example Output (Dry Run)

{
  "changes": [
    {
      "email": "[email protected]",
      "ssoUser": {
        "id": 6,
        "createdAt": "2024-08-05T10:19:24.385Z",
        "auth0Sub": "okta|workspace-AgtPVuhCPc|00ufij23if7tzNmBU5d7",
        "provider": "okta"
      },
      "oldestUser": {
        "id": 1,
        "createdAt": "2024-07-16T07:53:54.824Z",
        "auth0Sub": "google-oauth2|110529292044773145778",
        "provider": "google"
      }
    }
  ]
}

Tests

Risk

Deploy Plan

[aubin-tchoi]

LGTM

[aubin-tchoi]

nit: we could want to know that the even in dry mode

[aubin-tchoi]

question: do we want to be informed if there are more than 1 other membership? There could be a case where for some reason we have 2 other ones and the auth0 sub is put on the wrong one

[flvndvd]

I could push it in changes, but here we make the assumptions that it can exist and the script on purpose ignores it.