+ {/* Seats — shown on every tier. */}
+
+
+
Seats
+
+ {seatsLabel(access.seatsUsed, access.seatLimit)}
+
+
+ {access.seatLimit === null ? (
+
+ Your plan includes unlimited seats.
+
+ ) : (
+
+ )}
+
+
+ {/* Pro+: MFA + sessions self-service. */}
+ {access.mfaAvailable && (
+
+ Authentication
+
+
+ {
+ setMfaEnforced(v);
+ // TODO(backend): PATCH /v1/users/access { mfaEnforced }
+ }}
+ label="Require MFA"
+ description={
+ access.mfaEnforced
+ ? "Enforced org-wide on this plan."
+ : "Members must set up a second factor to sign in."
+ }
+ disabled={access.mfaEnforced}
+ />
+
+
+ {
+ setShortSessions(v);
+ // TODO(backend): PATCH /v1/users/access { sessionTimeout }
+ }}
+ label="Short-lived sessions"
+ description={`Sign members out after inactivity (currently ${access.sessionTimeout}).`}
+ />
+
+
+
+ )}
+
+ {/* Enterprise: SSO. */}
+ {access.sso && (
+
+
+
SSO / SAML
+
+ {access.sso.status === "connected"
+ ? "Connected"
+ : "Not configured"}
+
+
+
+
+
+
+
+
+ )}
+
+ {/* Enterprise: SCIM provisioning. */}
+ {access.scim && (
+
+
+
+ SCIM provisioning
+
+
+ {access.scim.enabled ? "Active" : "Off"}
+
+
+
+
+
+
+
+ Members are created, updated and deactivated automatically from
+ your identity provider.
+
+
+ )}
+
+
+ {/* Free: upgrade nudge spans the section. */}
+ {access.upgradeHint && (
+