OTWO-7707 Implemented OKTA AUTH for admins

[bd-vaibhav]

No description provided.

[Copilot]

Pull request overview

This PR introduces Okta SAML-based authentication for admin accounts, including an SSO redirect flow, Okta session-expiry enforcement, and a Global Token Revocation (GTR) endpoint.

Changes:

• Added OmniAuth SAML middleware/configuration and routes for SAML callback + GTR.
• Updated session handling to route admins through an Okta SSO redirect (with exclusions) and added an admin Okta-session expiry check in ApplicationController.
• Added controller/view/test coverage for the SAML callback flow, admin login redirect, and GTR endpoint behavior.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
app/controllers/sessions_controller.rb	Routes authenticated admins into Okta SSO flow or direct sign-in when excluded.
app/controllers/saml_controller.rb	Handles OmniAuth SAML callback and defines the GTR endpoint (plus bearer auth verification).
app/controllers/application_controller.rb	Adds a global before_action to enforce Okta session freshness for admins.
app/views/sessions/saml_redirect.html.erb	Adds the intermediate SSO “Continue” form that POSTs into OmniAuth.
config/initializers/omniauth.rb	Configures OmniAuth SAML provider and restricts request methods to POST.
config/routes.rb	Adds POST routes for SAML callback and GTR endpoint.
config/locales/en.yml	Adds flash strings for SAML mismatch and Okta session expiry.
Gemfile	Adds omniauth-saml and omniauth-rails_csrf_protection.
test/controllers/sessions_controller_test.rb	Adds coverage for admin login rendering SAML redirect and excluded-admin bypass.
test/controllers/saml_controller_test.rb	Adds coverage for SAML callback success/failure paths, session expiry behavior, and GTR authorization checks.

Suppressed comments (1)

test/controllers/saml_controller_test.rb:88

• This test stubs Rails.cache.read/delete without asserting the expected cache key. That can let regressions slip through (e.g., reading/deleting the wrong key) while the test still passes.

      Rails.cache.stubs(:read).returns(cache_data)
      Rails.cache.stubs(:delete).returns(true)

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.