quilt3.admin: SSO permissions mapping

api/python/quilt3-admin/queries.graphql

@@ -47,6 +47,13 @@ fragment OperationErrorSelection on OperationError {
   name
   context
 }
+fragment SsoConfigSelection on SsoConfig {
+  text
+  timestamp
+  uploader {
+    ...UserSelection
+  }
+}
 
 query rolesList {
   roles {
@@ -187,3 +194,21 @@ mutation usersRemoveRoles($name: String!, $roles: [String!]!, $fallback: String)
     }
   }
 }
+
+query ssoConfigGet {
+  admin {
+    ssoConfig {
+      ...SsoConfigSelection
+    }
+  }
+}
+
+mutation ssoConfigSet($config: String) {
+  admin {
+    setSsoConfig(config: $config) {
+      ...SsoConfigSelection
+      ...InvalidInputSelection
+      ...OperationErrorSelection
+    }
+  }
+}

api/python/quilt3/admin/__init__.py

@@ -4,6 +4,6 @@
 
 # This wraps code generated by aridne-codegen to provide a more user-friendly API.
 
-from . import roles, users
+from . import roles, sso_config, users
 from .exceptions import Quilt3AdminError, UserNotFoundError
-from .types import ManagedRole, UnmanagedRole, User
+from .types import ManagedRole, SSOConfig, UnmanagedRole, User

api/python/quilt3/admin/sso_config.py

@@ -0,0 +1,18 @@
+import typing as T
+
+from . import types, util
+
+
+def get() -> T.Optional[types.SSOConfig]:
+    """
+    Get the current SSO configuration.
+    """
+    result = util.get_client().sso_config_get()
+    return None if result is None else types.SSOConfig(**result.model_dump())
+
+
+def set(config: T.Optional[str]) -> types.SSOConfig:
+    """
+    Set the SSO configuration.
+    """
+    return types.SSOConfig(**util.handle_errors(util.get_client().sso_config_set(config)).model_dump())

api/python/quilt3/admin/types.py

@@ -37,3 +37,10 @@ class User:
     is_service: bool
     role: Optional[AnnotatedRole]
     extra_roles: List[AnnotatedRole]
+
+
+@pydantic.dataclasses.dataclass
+class SSOConfig:
+    text: str
+    timestamp: datetime
+    uploader: User