feat(core): Make user role provisioning available on enterprise

[konstantintieber]

Summary

Removes the feature flag check for user role provsioning.

Full demo video of the feature: https://n8nio.slack.com/archives/C09TBR1FL22/p1763988437444049

Also fixes some duplicated code on the "enterprise license" banner in the SSO form.
Disables user role provisioning dropdown if scope provisioning:manage is missing (this is also enforced on the backend already).
Improves project role access csv export by only exporting the string value that should be used in the SSO config (we omit the project: role prefix on the SSO side for easier configuration).

Related Linear tickets, Github issues, and Community forum posts

Closes PAY-4168

Review / Merge checklist

• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• [] Tests included.
• PR Labeled with release/backport (if the PR is an urgent fix that needs to be backported)

[bundlemon]

BundleMon

Unchanged files (2)

Status	Path	Size	Limits
✅	WASM Dependencies tree-sitter-bash.wasm	181.26KB	-
✅	WASM Dependencies tree-sitter.wasm	74.47KB	-

No change in files bundle size

Groups updated (2)

Status	Path	Size	Limits
✅	**/*.js	11.38MB (+88.28KB +0.76%)	-
✅	**/*.css	231.5KB (+10.72KB +4.86%)	-

Final result: ✅

View report in BundleMon website ➡️

---

Current branch size history | Target branch size history

[codecov]

Codecov Report

❌ Patch coverage is 72.22222% with 10 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ui/src/features/settings/sso/views/SettingsSso.vue	72.00%	7 Missing ⚠️
...isioning/composables/useAccessSettingsCsvExport.ts	0.00%	2 Missing ⚠️
packages/@n8n/backend-common/src/license-state.ts	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

cubic analysis

4 issues found across 7 files

Prompt for AI agents (all 4 issues)

Understand the root cause of the following 4 issues and fix them.


<file name="packages/frontend/editor-ui/src/features/settings/sso/provisioning/components/UserRoleProvisioningDropdown.vue">

<violation number="1" location="packages/frontend/editor-ui/src/features/settings/sso/provisioning/components/UserRoleProvisioningDropdown.vue:24">
`canManageUserProvisioning` is computed once before RBAC scopes load, so the dropdown stays disabled even for authorized users. Make it reactive (e.g., via a computed ref bound to the RBAC store) so the select unlocks when scopes arrive. According to linked Linear issue PAY-4168, the dropdown must be usable once exposed.</violation>
</file>

<file name="packages/@n8n/backend-common/src/license-state.ts">

<violation number="1" location="packages/@n8n/backend-common/src/license-state.ts:178">
Removing `feat:ldap` from `isProvisioningLicensed()` blocks provisioning for LDAP-only enterprise tenants, because provisioning.controller still gates every request on this check and now permanently throws for those licenses.</violation>

<violation number="2" location="packages/@n8n/backend-common/src/license-state.ts:178">
Rule violated: **Tests**

Removing LDAP from the provisioning license gate changes core enterprise licensing logic but no backend-common test covers `isProvisioningLicensed`, violating the Community PR guideline that code changes ship with tests. Please add or update unit tests verifying the new gating behavior.</violation>
</file>

<file name="packages/frontend/editor-ui/src/features/settings/sso/views/SettingsSso.vue">

<violation number="1" location="packages/frontend/editor-ui/src/features/settings/sso/views/SettingsSso.vue:97">
Selecting an unlicensed protocol now renders an empty section because the upgrade action box only appears when both SAML and OIDC are disabled. Show the CTA whenever the currently selected protocol lacks a license so users still see an upgrade prompt.</violation>
</file>

Linked issue analysis

Linked issue: PAY-4168: Remove feature flag check

Status	Acceptance criteria	Notes
✅	The "User role provisioning" dropdown in our SSO settings is shown unconditionally	Removed feature-flag gating; dropdown always rendered in SSO forms

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[currents-bot]

⏳

E2E Tests: n8n tests timed out after 30m

🟢 70 · 🔴 0 · ⚪️ 5 · 🟣 1

View Run Details

Run Details

• Project: n8n

• Groups: 2

• Framework: Playwright

• Run Status: Timed out

• Commit: 847af49

• Spec files: 96

• Overall tests: 600

• Duration: 30m

• Parallelization: 1

Groups

GroupId	Results	Spec Files Progress
ui	🟢 70 · 🔴 0 · ⚪️ 5 · 🟣 1	10 / 90
ui:isolated	🟢 0 · 🔴 0 · ⚪️ 0	0 / 6

---

This message was posted automatically by currents.dev | Integration Settings

[n8n-assistant]

Got released with [email protected]