Fix SSO dataset error on site wide org

[vaimdevs]

Changelog

# Fix
- SSO: the blocking `sso_login()` poll loop no longer spins without sleeping or timing out when IPython is not installed; the notebook countdown is display-only and can't skip the per-iteration wait (follow-up to #1721).
- `switch_org()`: the cached-token swap-in fast path is now bound to the Hub `user_id` claim, so a token cached for one user is never reinstated after `login()`/`api_token()` switched to another; opaque tokens never qualify (follow-up to #1721).
- `refresh()` no longer carries an org's verified-switch grant onto the reissued token: the server resets the active org on every reissue, so the carried grant let `plot()` skip the required `/switch/` call and silently upload to the default org while `session.org_name` still showed the requested one. Once the token actually rotates, the stale cache entry for that org is dropped first so `switch_org()`'s same-user fast path can't swap the superseded pre-refresh token back in as active either (follow-up to #1721).
- **Organization switch validation is no longer skipped by memoization**: `ArrowUploader._switch_org` now validates t
he HTTP response and checks for SSO challenges before recording the switch in its memo. Previously, failed switches (
including SSO challenges) were unconditionally memoized, causing `_maybe_switch_org` to skip the validating `Graphist
ryClient.switch_org` call on subsequent attempts. A failed switch no longer poisons the memo, allowing the full valid
ation path to run and raise `OrgSwitchRequiresSsoException` when needed. This fixes a critical issue where SSO org sw
itches could silently fail on the automatic fallback-to-personal-org path without triggering proper error handling (#1721).

---

Summary

After SSO login on a site-wide SSO server, the session could end up bound to the reserved SITE org (or to no org at all), and subsequent dataset uploads failed because nothing can be created under SITE. This PR fixes that, and along the way hardens the surrounding org-switch and SSO-polling code that the fix depends on.

Changes

1. SSO org resolution (ArrowUploader.sso_get_token)

Four-layer fallback for deciding which org the session is bound to after SSO:

• Layer 1 — server returned active_organization: use it, but treat the reserved SITE sentinel as unbound (with a warning that the IdP org claim is likely mis-mapped server-side). Caller-supplied org_name must match or be absent.
• Layer 2 — caller passed org_name, server silent: preserve caller intent; membership validates lazily on later requests.
• Layer 3 — neither: new _personal_org_from_api() looks up the user's personal org via GET /api/v2/my/organizations/ filtered on is_personal. Replaces the earlier JWT-username-slugify reconstruction, which couldn't reproduce server-side slug-collision suffixing.
• Layer 4 — nothing found: log and complete with no org binding.

2. Unified org-switch request (graphistry/utils/requests.py)

GraphistryClient.switch_org and ArrowUploader._switch_org had duplicate POST-and-validate code. New switch_org_request() is the single source of truth and raises:

• OrgSwitchError — non-2xx HTTP status or non-OK body status.
• OrgSwitchIdpChallenge — server quirk: for a plain member (not owner/admin) of an org with its own IdP, the switch endpoint returns status: OK without actually switching and instead returns an SSO challenge in data['idp']. Previously this was silently treated as success, leaving the caller on their previous org.

3. Per-org verified-token cache (ClientSession)

Replaces the single _last_switched_org_token tuple with _verified_org_tokens: Dict[org_name -> (token, exp)] plus is_org_verified() / mark_org_verified() / get_verified_token(). Entries self-expire based on the JWT exp claim (read without signature verification — the token is already trusted, having come from the server via the auth flow just completed).

• A token just SSO-minted for org X is marked verified immediately so the follow-up _maybe_switch_org never re-triggers an IdP challenge.
• switch_org() gains two fast paths: already verified under the current token → skip the round trip; a still-unexpired older token was verified for that org → swap it back in as active.
• Failed or IdP-challenged switches are no longer memoized (the old code recorded success before checking the response).
• refresh() carries the org grant forward to the newly issued token.

4. SSO polling robustness (GraphistryClient.sso_login)

New SsoPendingException distinguishes "browser login not finished yet" from real failures. The poll loop now:

• keeps waiting on pending until sso_timeout;
• retries transient requests.RequestException / JSON ValueError up to SSO_POLL_MAX_CONSECUTIVE_ERRORS (3) consecutive times before giving up;
• propagates SsoStateInvalidException and other permanent errors immediately.

The per-poll log is demoted from error to debug so it stops printing once a second during a normal login.

5. Mid-switch org tracking

New session.sso_requested_org_name records the org an in-flight SSO login was initiated for, since session.org_name still holds the previous org until the switch is confirmed. _sso_get_token() passes it explicitly to ArrowUploader.

6. Cleanup

Removed dead commented-out code (sso_state/sso_auth_url stubs, api_token_refresh_ms, old polling loop), return-type annotations and mypy fixes in utils/requests.py / switch_org.

Tests

• tests/utils/test_requests.py (new) — switch_org_request success, HTTP error, non-OK body, and IdP-challenge branches.
• test_arrow_uploader.py — _switch_org memoization/no-memoization on failure, SITE sentinel handling, _personal_org_from_api fallback, SsoPendingException classification.
• test_client_session.py — verified-token cache and JWT exp expiry.
• test_pygraphistry.py — switch_org fast paths, poll-loop failure classification, refresh carrying the org grant.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TyjxnzaqeB3SeirofUQhSj