improvement(settings): document organization security settings

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/index.mdx

@@ -11,6 +11,7 @@ Sim Enterprise adds organization controls for access, provisioning, operations,
 | [Single sign-on](/platform/enterprise/sso) | Connect a SAML or OIDC identity provider |
 | [Verified domains](/platform/enterprise/verified-domains) | Prove domain ownership for SSO and provisioning |
 | [Directory provisioning](/platform/enterprise/scim) | Sync users and group-based access from your directory |
+| [Security](/platform/enterprise/security) | Manage session policies and view configured outbound IP addresses |
 | [Session policies](/platform/enterprise/session-policies) | Set session lifetimes and revoke member sessions |
 | [Audit logs](/platform/enterprise/audit-logs) | Investigate configuration and security events |
 | [Usage tracking](/platform/enterprise/usage-tracking) | Review usage by member, workspace, model, and source |

apps/docs/content/docs/platform/enterprise/meta.json

@@ -5,6 +5,7 @@
     "sso",
     "scim",
     "verified-domains",
+    "security",
     "session-policies",
     "access-control",
     "custom-blocks",

apps/docs/content/docs/platform/enterprise/security.mdx

@@ -0,0 +1,34 @@
+---
+title: Security
+description: Manage organization session policies and view configured outbound IP addresses
+---
+
+import { Callout } from 'fumadocs-ui/components/callout'
+
+Organization owners and admins open **Settings → Security** to manage session policies and view outbound IP addresses. [Single sign-on](/platform/enterprise/sso) remains a separate settings page for identity providers, verified domains, and provisioning.
+
+## Session policies
+
+Set **Max session lifetime** and **Idle timeout** in hours, then select **Save**. Leave either field empty to use its default behavior. **Discard** restores your saved values.
+
+**Sign out all members** opens a confirmation before revoking the organization's browser sessions, except your current session. It does not revoke API keys.
+
+See [Session policies](/platform/enterprise/session-policies) for limits, defaults, and how changes affect existing sessions.
+
+## Outbound IP addresses
+
+When an outbound gateway has been configured for your organization, this section lists the IPv4 addresses published by your deployment administrator. Use the copy button beside each address to copy it in `/32` format. Allowlist **every listed address** on the destination firewall.
+
+This section is read-only. Viewing or copying addresses does not provision a gateway or change routing. Contact Sim support for hosted deployments, or your deployment administrator for self-hosted installations, to arrange routing and confirm which connections it covers.
+
+If dedicated IPs are not configured, the page says so. If settings cannot be loaded, use **Try again**. A paused-routing message means your administrator has blocked outbound routing.
+
+<Callout type="warn">
+  The listed addresses describe configured routing, not a successful connectivity test. Verify each required connection from both Sim and its background jobs before relying on the allowlist. Browser traffic and traffic originating inside external services do not use this gateway. The current mandatory-gateway mode also blocks unsupported transports, including remote sandbox creation and raw database connections; it does not silently send them through another network.
+</Callout>
+
+## Availability
+
+On Sim Cloud, Security settings require an Enterprise organization and an owner or admin role. On self-hosted deployments, the outbound IP section is available to organization administrators; session controls appear only when session policies are enabled. See [self-hosted enterprise configuration](/platform/enterprise/self-hosted).
+
+Existing links to the former **Session policies** and **Network** pages continue to open Security settings.

apps/docs/content/docs/platform/enterprise/session-policies.mdx

@@ -11,7 +11,7 @@ Session Policies let organization owners and admins on Enterprise plans control
 
 ## Setup
 
-Go to **Settings → Organization → Session policies** in your organization settings.
+Go to **Settings → Security → Session policies** in your organization settings. The [Security page](/platform/enterprise/security) also shows configured outbound IP addresses; single sign-on remains a separate page.
 
 Both limits are optional. Leave a field empty to keep the default behavior: sessions last 30 days and extend automatically while a member stays active.
 

apps/docs/content/docs/search/gitlab.mdx

@@ -25,6 +25,8 @@ Use a self-managed GitLab instance reachable by Sim over HTTPS. The administrato
 
 The CSV path checks the token's identity and project access. It does not require administrator directory access or a custom admin role.
 
+If your GitLab instance restricts inbound traffic by source IP, coordinate the allowlist before connecting. When dedicated routing is configured, organization admins can copy its published addresses from [Settings → Security → Outbound IP addresses](/platform/enterprise/security#outbound-ip-addresses). Confirm access from both the application and background sync jobs; seeing the addresses in Settings does not verify connectivity.
+
 <Callout type="warn">
   CSV files define access in Sim. Each mapped user listed for the selected project can read all of that source's indexed, non-confidential content. Sim does not infer that user's GitLab role or feature restrictions in this path. Include only users who should have that access, and replace the files whenever memberships or email mappings change.
 </Callout>

apps/sim/components/settings/navigation.ts

@@ -702,6 +702,7 @@ export const SETTINGS_SECTION_REGISTRY: readonly SettingsSectionRegistryEntry[]
   {
     label: 'Security',
     icon: Lock,
+    docsLink: 'https://docs.sim.ai/platform/enterprise/security',
     unified: {
       id: 'security',
       description: 'Manage session policies and view outbound IP addresses.',

apps/sim/lib/copilot/generated/docs-manifest.ts

@@ -383,6 +383,7 @@ export const DOCS_MANIFEST: readonly string[] = [
   'platform/enterprise/scim.mdx',
   'platform/enterprise/scim/entra.mdx',
   'platform/enterprise/scim/okta.mdx',
+  'platform/enterprise/security.mdx',
   'platform/enterprise/self-hosted.mdx',
   'platform/enterprise/session-policies.mdx',
   'platform/enterprise/sso.mdx',

apps/sim/lib/oauth/refresh-token.server.ts

@@ -640,21 +640,17 @@ function buildAuthRequest(
     grant_type: 'refresh_token',
   }
 
-  // Handle refresh token placement
   if (config.refreshTokenInAuthHeader) {
     // Cal.com style: refresh token in Authorization header as Bearer token
     headers.Authorization = `Bearer ${refreshToken}`
   } else {
-    // Standard OAuth: refresh token in request body
     bodyParams.refresh_token = refreshToken
   }
 
   if (config.useBasicAuth) {
-    // Use Basic Authentication - credentials in Authorization header only
     const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString('base64')
     headers.Authorization = `Basic ${basicAuth}`
   } else {
-    // Use body credentials - include client credentials in request body
     bodyParams[config.clientIdParamName || 'client_id'] = config.clientId
     if (config.clientSecret) {
       bodyParams.client_secret = config.clientSecret