Attached settings URL to email, actor no longer a recipient, removed error handling for email send, used read replica node for findOrgMembersByRole

backend/src/services/auth/auth-login-service.ts

@@ -450,26 +450,25 @@ export const authLoginServiceFactory = ({
         }
       });
 
-      // Notify all admins via email
+      // Notify all admins via email (besides the actor)
       const orgAdmins = await orgDAL.findOrgMembersByRole(organizationId, OrgMembershipRole.Admin);
-      const adminEmails = orgAdmins.map((admin) => admin.user?.email).filter(Boolean) as string[];
+      const adminEmails = orgAdmins
+        .filter((admin) => admin.user.id !== user.id)
+        .map((admin) => admin.user.email)
+        .filter(Boolean) as string[];
 
-      try {
+      if (adminEmails.length > 0) {
-        if (adminEmails.length > 0) {
+        await smtpService.sendMail({
-          await smtpService.sendMail({
+          recipients: adminEmails,
-            recipients: adminEmails,
+          subjectLine: "Security Alert: Admin SSO Bypass",
-            subjectLine: "Security Alert: Admin SSO Bypass",
+          substitutions: {
-            substitutions: {
+            email: user.email,
-              email: user.email,
+            timestamp: new Date().toISOString(),
-              timestamp: new Date().toISOString(),
+            ip: ipAddress,
-              ip: ipAddress,
+            userAgent
-              userAgent
+          },
-            },
+          template: SmtpTemplates.OrgAdminBreakglassAccess
-            template: SmtpTemplates.OrgAdminBreakglassAccess
+        });
-          });
-        }
-      } catch (error) {
-        logger.error(error, `Failed to send SSO bypass notification emails for user ${user.email}`);
       }
     }
 

backend/src/services/org/org-dal.ts

@@ -254,7 +254,7 @@ export const orgDALFactory = (db: TDbClient) => {
 
   const findOrgMembersByRole = async (orgId: string, role: OrgMembershipRole, tx?: Knex) => {
     try {
-      const conn = tx || db;
+      const conn = tx || db.replicaNode();
       const members = await conn(TableName.OrgMembership)
         .where(`${TableName.OrgMembership}.orgId`, orgId)
         .where(`${TableName.OrgMembership}.role`, role)

backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars

@@ -8,11 +8,11 @@
 
   <body>
     <h2>Infisical</h2>
-    <p>The organization admin {{email}} has just bypassed enforced SSO login.</p>
+    <p>The organization admin {{email}} has bypassed enforced SSO login.</p>
     <p><strong>Timestamp</strong>: {{timestamp}}</p>
     <p><strong>IP address</strong>: {{ip}}</p>
     <p><strong>User agent</strong>: {{userAgent}}</p>
-    <p>If you'd like to disable Admin SSO Bypass, please visit Organization Settings > Security.</p>
+    <p>If you'd like to disable Admin SSO Bypass, please visit <a href="https://app.infisical.com/organization/settings">Organization Settings</a> > Security.</p>
 
     {{emailFooter}}
   </body>