feat(SCIM): Frontend for SCIM configuration management

[talissoncosta]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Closes #7151.

Adds the frontend UI for the SCIM configuration management endpoints landed in #7512. The existing SAML tab in Organisation Settings is renamed to SSO and now hosts both SAML and SCIM as stacked sections gated by the same Enterprise plan check.

What's in:

• RTK Query service (common/services/useScimConfiguration.ts) — get / create / delete / regenerate-token, scoped per organisation, cache-tagged for invalidation.
• ScimSection component handles three states: loading, empty (404 from the server is the empty signal), and configured (shows created_at, token_rotated_at, copyable base_url, plus Regenerate / Delete actions).
• ScimTokenModal displays the bearer token exactly once on create or regeneration. Token is passed straight from the mutation result into the modal as a prop — never cached in Redux, never refetched.
• Enterprise gating via PlanBasedBanner at the SSO container level. SAML's previously-inline banner has been lifted out so both sections share one gate (no duplicate upgrade prompts).
• SSOTab container (tabs/SSOTab.tsx) composes SAML + SCIM as sibling sections.
• Tab URL param migrated from ?tab=saml to ?tab=sso (existing ?tab=saml bookmarks land on the default tab).
• SCIM added to the PaidFeature enum and featureDescriptions; gated at the scale-up plan (mirrors SAML).
• Empty-state rendering uses the existing EmptyState component so it sits visually as a peer to the SAML configurations block.

The configuration's base_url comes back from the server (built via request.build_absolute_uri(reverse("scim:root")) in flagsmith-private) — no client-side URL building needed, unlike SAML's ACS URL.

How did you test this code?

Manual end-to-end on a local dev environment with --extra scim installed:

1. Non-Enterprise org → Org Settings → SSO tab → upgrade prompt only, no SCIM section visible.
2. Enterprise org, no SCIM config → SSO tab shows SAML section + SCIM empty state with the Create SCIM configuration button.
3. Create flow → mutation fires → token modal appears with copyable token + warning → token copies via the Copy button → Done closes the modal → SCIM section now renders the configured state with the dates and base URL.
4. Refresh page → token modal does not reappear; configured state persists; token is not visible anywhere.
5. Regenerate token → confirm modal → mutation fires → token modal appears with the new token → token_rotated_at updates after close.
6. Delete → confirm (destructive) modal → mutation fires → section reverts to the empty state in place (RTK Query invalidation + 404 from refetch).
7. URL routing → /organisation/{id}/settings?tab=sso opens the SSO tab; ?tab=saml lands on the default tab.

Plus npm run typecheck and npx eslint --fix on all modified files — no new errors introduced (pre-existing type errors confirmed via git stash + retry to be unrelated to this change).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ready	Preview, Comment	May 15, 2026 7:41pm
flagsmith-frontend-staging	Ready	Preview, Comment	May 15, 2026 7:41pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Ignored		May 15, 2026 7:41pm