misc: only bypass when from admin login

frontend/src/pages/auth/LoginPage/Login.utils.tsx

@@ -33,14 +33,21 @@ export const useNavigateToSelectOrganization = () => {
   const { config } = useServerConfig();
   const navigate = useNavigate();
 
-  const navigateToSelectOrganization = async (cliCallbackPort?: string) => {
+  const navigateToSelectOrganization = async (
+    cliCallbackPort?: string,
+    isFromAdminLogin?: boolean
+  ) => {
     if (!config.defaultAuthOrgId) {
       queryClient.invalidateQueries({ queryKey: userKeys.getUser });
     }
 
     navigate({
       to: "/login/select-organization",
-      search: { callback_port: cliCallbackPort, org_id: config.defaultAuthOrgId }
+      search: {
+        callback_port: cliCallbackPort,
+        org_id: config.defaultAuthOrgId,
+        is_admin_login: isFromAdminLogin
+      }
     });
   };
 

frontend/src/pages/auth/LoginPage/components/InitialStep/InitialStep.tsx

@@ -130,7 +130,7 @@ export const InitialStep = ({
 
         if (isLoginSuccessful && isLoginSuccessful.success) {
           // case: login was successful
-          navigateToSelectOrganization();
+          navigateToSelectOrganization(undefined, isAdmin);
           createNotification({
             text: "Successfully logged in",
             type: "success"

frontend/src/pages/auth/SelectOrgPage/SelectOrgPage.tsx

@@ -54,6 +54,7 @@ export const SelectOrganizationPage = () => {
   const queryParams = new URLSearchParams(window.location.search);
   const orgId = queryParams.get("org_id");
   const callbackPort = queryParams.get("callback_port");
+  const isAdminLogin = queryParams.get("is_admin_login") === "true";
   const defaultSelectedOrg = organizations.data?.find((org) => org.id === orgId);
 
   const logout = useLogoutUser(true);
@@ -70,7 +71,9 @@ export const SelectOrganizationPage = () => {
   const handleSelectOrganization = useCallback(
     async (organization: Organization) => {
       const canBypassOrgAuth =
-        organization.enableBypassOrgAuth && organization.userRole === OrgMembershipRole.Admin;
+        organization.enableBypassOrgAuth &&
+        organization.userRole === OrgMembershipRole.Admin &&
+        isAdminLogin;
 
       if (organization.authEnforced && !canBypassOrgAuth) {
         // org has an org-level auth method enabled (e.g. SAML)

frontend/src/pages/auth/SelectOrgPage/route.tsx

@@ -6,13 +6,16 @@ import { SelectOrganizationPage } from "./SelectOrgPage";
 
 export const SelectOrganizationPageQueryParams = z.object({
   org_id: z.string().optional().catch(""),
-  callback_port: z.coerce.number().optional().catch(undefined)
+  callback_port: z.coerce.number().optional().catch(undefined),
+  is_admin_login: z.boolean().optional().catch(false)
 });
 
 export const Route = createFileRoute("/_restrict-login-signup/login/select-organization")({
   component: SelectOrganizationPage,
   validateSearch: zodValidator(SelectOrganizationPageQueryParams),
   search: {
-    middlewares: [stripSearchParams({ org_id: "", callback_port: undefined })]
+    middlewares: [
+      stripSearchParams({ org_id: "", callback_port: undefined, is_admin_login: false })
+    ]
   }
 });