impl(#406): SSO 4a/4: Login SSO status - data layer (split from #355)

apps/admin/src/i18n/locales/en.json

@@ -128,7 +128,8 @@
     "resetPasswordTokenMissing": "This reset link is missing its token. Request a new one.",
     "resetPasswordTokenDead": "This reset link is invalid or has expired. Request a new one.",
     "requestNewResetLink": "Request a new reset link",
-    "newPassword": "New password"
+    "newPassword": "New password",
+    "signInWithSso": "Sign in with SSO"
   },
   "dashboard": {
     "title": "Dashboard",

apps/admin/src/i18n/locales/kk.json

@@ -128,7 +128,8 @@
     "resetPasswordTokenMissing": "Сілтемеде токен жоқ. Жаңасын сұраңыз.",
     "resetPasswordTokenDead": "Бұл сілтеме жарамсыз немесе мерзімі өтіп кетті. Жаңасын сұраңыз.",
     "requestNewResetLink": "Жаңа сілтеме сұрау",
-    "newPassword": "Жаңа құпиясөз"
+    "newPassword": "Жаңа құпиясөз",
+    "signInWithSso": "SSO арқылы кіру"
   },
   "dashboard": {
     "title": "Басқару тақтасы",

apps/admin/src/i18n/locales/ru.json

@@ -128,7 +128,8 @@
     "resetPasswordTokenMissing": "В ссылке для сброса отсутствует токен. Запросите новую.",
     "resetPasswordTokenDead": "Ссылка для сброса недействительна или истекла. Запросите новую.",
     "requestNewResetLink": "Запросить новую ссылку",
-    "newPassword": "Новый пароль"
+    "newPassword": "Новый пароль",
+    "signInWithSso": "Войти через SSO"
   },
   "dashboard": {
     "title": "Панель управления",

apps/admin/src/lib/api-constants.ts

@@ -22,6 +22,7 @@ export const API_ENDPOINTS = {
     magicLogin: () => `${API_VERSION}/auth/magic-login`,
     register: () => `${API_VERSION}/auth/register`,
     registrationStatus: () => `${API_VERSION}/auth/registration-status`,
+    ssoStatus: () => `${API_VERSION}/auth/sso-status`,
     me: () => `${API_VERSION}/auth/me`,
     verifyEmail: () => `${API_VERSION}/auth/verify-email`,
     resendVerification: () => `${API_VERSION}/auth/resend-verification`,

apps/admin/src/services/auth-service.ts

@@ -58,6 +58,17 @@ export const authService = {
     return response.data.data;
   },
 
+  /**
+   * Resolve whether the current tenant (by host/subdomain) has made SSO
+   * mandatory. Unauthenticated, same pre-auth shape as getRegistrationStatus().
+   */
+  getSsoStatus: async (): Promise<{ enforceSso: boolean }> => {
+    const response = await api.get<{ success: boolean; data: { enforceSso: boolean } }>(
+      API_ENDPOINTS.auth.ssoStatus()
+    );
+    return response.data.data;
+  },
+
   logout: async (): Promise<void> => {
     await api.post(API_ENDPOINTS.auth.logout());
   },

apps/admin/src/tests/services/auth-service.test.ts

@@ -131,6 +131,35 @@ describe('Auth Service', () => {
     });
   });
 
+  describe('getSsoStatus', () => {
+    it('should return enforceSso: true when SSO is mandatory for the tenant', async () => {
+      vi.mocked(api.get).mockResolvedValueOnce({
+        data: { success: true, data: { enforceSso: true } },
+      } as AxiosResponse);
+
+      const result = await authService.getSsoStatus();
+
+      expect(result).toEqual({ enforceSso: true });
+      expect(api.get).toHaveBeenCalledWith('/api/v1/auth/sso-status');
+    });
+
+    it('should return enforceSso: false when SSO is not mandatory for the tenant', async () => {
+      vi.mocked(api.get).mockResolvedValueOnce({
+        data: { success: true, data: { enforceSso: false } },
+      } as AxiosResponse);
+
+      const result = await authService.getSsoStatus();
+
+      expect(result).toEqual({ enforceSso: false });
+    });
+
+    it('should propagate API errors', async () => {
+      vi.mocked(api.get).mockRejectedValueOnce(new Error('Network error'));
+
+      await expect(authService.getSsoStatus()).rejects.toThrow('Network error');
+    });
+  });
+
   describe('login', () => {
     it('should login with email and password', async () => {
       const mockResponse = {