From ecfc8b5f873a28c566361638a7b77787c094c98b Mon Sep 17 00:00:00 2001 From: Carlos Monastyrski Date: Tue, 2 Sep 2025 18:26:33 -0300 Subject: [PATCH 1/2] Fix blocking issue for auth admin bypass on selectOrganization --- backend/src/services/auth/auth-login-service.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts index 0e5ed2ad9..4793058e9 100644 --- a/backend/src/services/auth/auth-login-service.ts +++ b/backend/src/services/auth/auth-login-service.ts @@ -457,7 +457,8 @@ export const authLoginServiceFactory = ({ if ( selectedOrg.authEnforced && !isAuthMethodSaml(decodedToken.authMethod) && - decodedToken.authMethod !== AuthMethod.OIDC + decodedToken.authMethod !== AuthMethod.OIDC && + !(selectedOrg.bypassOrgAuthEnabled && selectedOrgMembership.userRole === OrgMembershipRole.Admin) ) { throw new BadRequestError({ message: "Login with the auth method required by your organization." From e666409026e737fa0d6b81f3b3bc2e058bd7c536 Mon Sep 17 00:00:00 2001 From: Carlos Monastyrski Date: Tue, 2 Sep 2025 18:33:44 -0300 Subject: [PATCH 2/2] Lint fix --- backend/src/services/auth/auth-login-service.ts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts index 4793058e9..ede9e29e3 100644 --- a/backend/src/services/auth/auth-login-service.ts +++ b/backend/src/services/auth/auth-login-service.ts @@ -453,6 +453,12 @@ export const authLoginServiceFactory = ({ const selectedOrg = await orgDAL.findById(organizationId); + if (!selectedOrgMembership) { + throw new ForbiddenRequestError({ + message: `User does not have access to the organization named ${selectedOrg?.name}` + }); + } + // Check if authEnforced is true and the current auth method is not an enforced method if ( selectedOrg.authEnforced && @@ -465,12 +471,6 @@ export const authLoginServiceFactory = ({ }); } - if (!selectedOrgMembership) { - throw new ForbiddenRequestError({ - message: `User does not have access to the organization named ${selectedOrg?.name}` - }); - } - if (selectedOrg.googleSsoAuthEnforced && decodedToken.authMethod !== AuthMethod.GOOGLE) { const canBypass = selectedOrg.bypassOrgAuthEnabled && selectedOrgMembership.userRole === OrgMembershipRole.Admin;