[stefan-ernst]

Summary

• Use “Allow account creation” for both internal users and portal-only customers, with helper text explaining first-sign-in creation and existing-account-only mode.
• Make customer organisation optional in GitHub provider configuration and customer provisioning. New customers without an assignment are stored with a null organisation; existing customers keep their organisation.
• Preserve scoped-provider membership checks, deactivated-account denials, portal registration rules, and backend/customer account separation. Providers without an organisation are available only on public customer surfaces, not organisation-restricted ones.
• Add explicit optional/unassigned UI and translations for the required locales. GitHub organisation restrictions remain independent.

No schema or API route changes are needed.

Validation

Tests are in the companion PR: https://github.com/Windshiftapp/core-tests-internal/pull/49.

• Confirmed the new provider-creation and public-surface regression tests failed on the old implementation for the expected reasons.
• Passed: ../core-tests-optional/overlay.sh . -- -tags=test -count=1 ./internal/handlers/... ./internal/repository/... ./internal/sso/...
• Passed on SQLite: ../core-tests-optional/overlay.sh . -- -tags=test -count=1 -run 'TestCustomer|TestUnscoped|TestGitHub' ./internal/handlers/... ./internal/repository/...
• Passed on PostgreSQL: the same focused command with TEST_DB_TYPE=postgres and a local TEST_POSTGRES_DSN.
• Passed: VITEST_RUNTIME=bun ../core-tests-optional/run-overlay-script.sh . scripts/run-frontend-tests.sh src/lib/settings/SSOSettings.test.js src/lib/settings/SSOSettingsSignup.test.js (17 tests).
• Passed from frontend/: bun run check, bun run typecheck, bun run build:app.
• Passed production pre-commit guards, including golangci-lint, deprecated-v1 checks, frontend checks, and type checking. Go files formatted with gofmt; frontend test files checked/formatted with Biome, excluding Svelte.

Not run: full application Go/frontend suites, browser tests, or live GitHub OAuth.

[github-actions]

Size Change: 0 B 🆕

Total Size: 0 B

_{compressed-size-action}