feat(mgmt): load external groups scoped to a specific SSO config

[dorsha]

Related Issues

Required for:
https://github.com/descope/etc/issues/17382

Related PRs

Upstream PRs

• https://github.com/descope/backend/pull/2072

In a Nutshell

• Optional trailing ssoId param on the three group-loading methods
• Group type gains ssoId
• ssoId is dropped from the JSON body when undefined

Description

Adds SSO-config scoping to loadAllGroups, loadAllGroupsForMember and loadAllGroupMembers, matching the new backend ssoId filter. The reserved id default_ssoid targets the tenant's default SSO configuration.

Must

• Tests
• Documentation (if applicable)

🤖 Generated with Claude Code

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Suggested Reviewers

The review assignment prioritizes breadth of file coverage and contributor expertise, selecting contributors who have engaged with different parts of the codebase affected by this PR to ensure thorough review.

Reviewer	Reason
itaihanski	itaihanski has the most extensive involvement with 6 commits covering both lib/management/group.test.ts and lib/management/group.ts, making them well-suited to review the overall changes and their impact.
talaharoni	talaharoni contributed to lib/management/types.ts, which is directly related to the type modifications in the PR, providing valuable insight into type-related changes.
aviadl	aviadl also worked on lib/management/types.ts, bringing additional expertise on type definitions and ensuring correctness.
orius123	orius123 contributed to lib/management/types.ts, offering a different perspective on the type changes and overall integration.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot]

🐕 Shuni's Review

Adds an optional trailing ssoId filter to the three group-loading management methods and declares source/ssoId on the Group type.

Sniffed out 0 issues. Good bones! 🦴

Checked the things that could actually break: the new trailing optional params are backwards compatible, ssoId: undefined is dropped by JSON serialization (and matches the existing pattern in lib/management/user.ts), and the pre-existing toHaveBeenCalledWith assertions still pass since Jest uses toEqual semantics that ignore undefined properties.

Two non-blocking notes, no action required: only loadAllGroups got an ssoId test, and the README group section still shows the pre-ssoId signatures. Woof!

---

Declared coverage: FULL — 3/3 changed files reviewed.