Feat/Security: Missing Default Organization Assignment for OIDC Accounts & Lack of User/Team Management API Endpoints

Feature Description/Problem

When provisioning new users via OIDC, Documenso creates a standalone user account with a personal workspace by default. There is currently no way to specify a default organization or team for newly provisioned SSO accounts to join automatically.

This creates both an administrative headache and a security/brand-risk issue in enterprise or self-hosted environments:

• Brand / Security Risk: Because a user provisioned via OIDC receives a personal workspace, they can create their own teams and start sending documents. These documents are issued from the company’s domain and signed using the instance’s configured signing certificate.
  • Risk Scenario A: An employee uses the company's self-hosted instance to run side-business operations or personal documents using corporate signing authority.
  • Risk Scenario B: A rogue or departing employee creates official-looking documents or contracts under the company's domain without organizational oversight.

Additionally, when attempting to automate user provisioning via the API, the current REST API (v2) lacks administrative endpoints for managing accounts, organizations, or team invitations.

Proposed Solution

1. OIDC Organization Assignment (Phased Roadmap?)

• Phase 1 (Quick Fix / Short Term): Add an environment variable (e.g., NEXT_PRIVATE_OIDC_DEFAULT_TEAM_ID or NEXT_PRIVATE_OIDC_DEFAULT_ORG_ID) that automatically places any user logged in via OIDC into a designated default team/organization upon JIT account creation.

• Phase 2 (Medium Term): Support OIDC Group Claims Mapping. Allow administrators to map incoming OIDC claim groups (e.g., groups, roles) to specific Documenso Teams automatically during login.

• Phase 3 (Long Term): Implement SCIM 2.0 support to enable full identity-provider lifecycle management (creation, team mapping, and deprovisioning) from IdPs like Kanidm, Okta, Microsoft Entra, etc.

2. Administrative REST API Endpoints

Expose public REST API endpoints (or global administrative API tokens) for platform and team management operations:

• POST /api/v2/teams/{teamId}/invites or POST /api/v2/organization/invites (Invite users to a team/organization)
• GET /api/v2/users / GET /api/v2/teams (Retrieve platform or team user listings)
• DELETE /api/v2/teams/{teamId}/members/{userId} (Remove members programmatically)

Note on Real-World Impact: While administrative APIs are often treated as an "enterprise-only" feature, the lack of management endpoints heavily impacts small-to-medium teams, non-profits, and volunteer groups. For instance, a regional non-profit with 50–100 members may need 15 distinct team spaces corresponding to local counties/districts, with 2–5 members assigned per district. Manually creating 15 teams and inviting dozens of users through the web UI consumes valuable administrative hours. Exposing basic team-management API endpoints allows simple orchestration tools (like n8n or Python scripts) to automate this setup.

Additional Context

Context / Reproduction Steps

1. Configure environment variables for generic OIDC provider.
2. Log in with a new user through OIDC.
3. Observe that the user account is provisioned into an isolated personal workspace with no organizational bounding or team assignment.
4. Check API Documentation (v2) or attempt API calls for user/team provisioning; observe that all current endpoints are scoped exclusively to documents, templates, and envelopes.

---

Additional Context

• Documenso Version: v2.18.0 / Self-hosted
• Authentication Method: OIDC via kanidm

Please check the boxes that apply to this feature request.

• I have searched the existing feature requests to make sure this is not a duplicate.
• I have provided a detailed description of the requested feature.
• I have explained the use case or scenario for this feature.
• I have included any relevant technical details or design suggestions.
• I understand that this is a suggestion and that there is no guarantee of implementation.