feat(sso): expose XAA selected-IdP provider_id in management settings

Add provider_id to XAASettings and emit providerID on the XAA configure body
when set, mirroring SSO SAML/OIDC so the chosen IdP round-trips.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dorsha

descope/management/_sso_settings_base.py

@@ -225,6 +225,8 @@ def _compose_configure_xaa_settings_body(
         }
         if sso_id:
             body["ssoId"] = sso_id
+        if settings.provider_id:
+            body["providerID"] = settings.provider_id
         return body
 
     @staticmethod

descope/management/sso_settings.py

@@ -120,6 +120,7 @@ def __init__(
         groups_priority: Optional[List[str]] = None,  # list of group names in priority order (first = highest priority)
         group_priority_enabled: Optional[bool] = None,
         allow_override_roles: Optional[bool] = None,
+        provider_id: Optional[str] = None,  # selected IdP provider template id (mirrors SSO SAML providerID)
     ):
         self.enabled = enabled
         self.settings = settings
@@ -129,6 +130,7 @@ def __init__(
         self.groups_priority = groups_priority
         self.group_priority_enabled = group_priority_enabled
         self.allow_override_roles = allow_override_roles
+        self.provider_id = provider_id
 
 
 class OIDCAttributeMapping:

tests/management/test_sso_settings.py

@@ -326,6 +326,7 @@ async def test_configure_xaa_settings(self, client_factory):
                         groups_priority=["group1"],
                         group_priority_enabled=True,
                         allow_override_roles=True,
+                        provider_id="prov1",
                     ),
                     sso_id="sso-1",
                 )
@@ -376,6 +377,7 @@ async def test_configure_xaa_settings(self, client_factory):
                     "groupPriorityEnabled": True,
                     "allowOverrideRoles": True,
                     "ssoId": "sso-1",
+                    "providerID": "prov1",
                 },
                 follow_redirects=False,
             )