From a37f1eb1f8a20dc307c7b1f2ada4e3371e4e8a3d Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Thu, 14 Aug 2025 06:53:57 +0400 Subject: [PATCH] requested changes & frontend lint --- backend/src/@types/fastify.d.ts | 2 +- .../20250813214709_enforce-google-sso.ts | 3 ++- backend/src/db/schemas/organizations.ts | 2 +- backend/src/services/org/org-service.ts | 20 +++++++------------ .../components/NavBar/Navbar.tsx | 4 +++- .../auth/SelectOrgPage/SelectOrgSection.tsx | 5 ----- .../OrgSsoTab/OrgGeneralAuthSection.tsx | 4 ++-- 7 files changed, 16 insertions(+), 24 deletions(-) diff --git a/backend/src/@types/fastify.d.ts b/backend/src/@types/fastify.d.ts index f65f8a4fa..c25d8d4d1 100644 --- a/backend/src/@types/fastify.d.ts +++ b/backend/src/@types/fastify.d.ts @@ -148,7 +148,7 @@ declare module "fastify" { interface Session { callbackPort: string; isAdminLogin: boolean; - orgSlug: string; + orgSlug?: string; } interface FastifyRequest { diff --git a/backend/src/db/migrations/20250813214709_enforce-google-sso.ts b/backend/src/db/migrations/20250813214709_enforce-google-sso.ts index ce77a8141..2346c91a4 100644 --- a/backend/src/db/migrations/20250813214709_enforce-google-sso.ts +++ b/backend/src/db/migrations/20250813214709_enforce-google-sso.ts @@ -15,7 +15,8 @@ export async function up(knex: Knex): Promise { ); await knex.schema.alterTable(TableName.Organization, (table) => { - if (!hasGoogleSsoAuthEnforcedColumn) table.boolean(GOOGLE_SSO_AUTH_ENFORCED_COLUMN_NAME).defaultTo(false); + if (!hasGoogleSsoAuthEnforcedColumn) + table.boolean(GOOGLE_SSO_AUTH_ENFORCED_COLUMN_NAME).defaultTo(false).notNullable(); if (!hasGoogleSsoAuthLastUsedColumn) table.timestamp(GOOGLE_SSO_AUTH_LAST_USED_COLUMN_NAME).nullable(); }); } diff --git a/backend/src/db/schemas/organizations.ts b/backend/src/db/schemas/organizations.ts index 449e6c493..afc9e2b73 100644 --- a/backend/src/db/schemas/organizations.ts +++ b/backend/src/db/schemas/organizations.ts @@ -37,7 +37,7 @@ export const OrganizationsSchema = z.object({ shareSecretsProductEnabled: z.boolean().default(true).nullable().optional(), maxSharedSecretLifetime: z.number().default(2592000).nullable().optional(), maxSharedSecretViewLimit: z.number().nullable().optional(), - googleSsoAuthEnforced: z.boolean().default(false).nullable().optional(), + googleSsoAuthEnforced: z.boolean().default(false), googleSsoAuthLastUsed: z.date().nullable().optional() }); diff --git a/backend/src/services/org/org-service.ts b/backend/src/services/org/org-service.ts index d3312bca7..610dac4d1 100644 --- a/backend/src/services/org/org-service.ts +++ b/backend/src/services/org/org-service.ts @@ -431,6 +431,12 @@ export const orgServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Sso); } + if (authEnforced && googleSsoAuthEnforced) { + throw new BadRequestError({ + message: "SAML/OIDC auth enforcement and Google SSO auth enforcement cannot be enabled at the same time." + }); + } + if (authEnforced) { const samlCfg = await samlConfigDAL.findOne({ orgId, @@ -461,25 +467,13 @@ export const orgServiceFactory = ({ } } - if (googleSsoAuthEnforced || authEnforced) { - if (googleSsoAuthEnforced && authEnforced) { - throw new BadRequestError({ - message: "Google SSO and SAML/OIDC auth enforcement cannot be enabled at the same time." - }); - } - + if (googleSsoAuthEnforced) { if (googleSsoAuthEnforced && currentOrg.authEnforced) { throw new BadRequestError({ message: "Google SSO auth enforcement cannot be enabled when SAML/OIDC auth enforcement is enabled." }); } - if (authEnforced && currentOrg.googleSsoAuthEnforced) { - throw new BadRequestError({ - message: "SAML/OIDC auth enforcement cannot be enabled when Google SSO auth enforcement is enabled." - }); - } - if (!currentOrg.googleSsoAuthLastUsed) { throw new BadRequestError({ message: diff --git a/frontend/src/layouts/OrganizationLayout/components/NavBar/Navbar.tsx b/frontend/src/layouts/OrganizationLayout/components/NavBar/Navbar.tsx index 301632860..5c37d4404 100644 --- a/frontend/src/layouts/OrganizationLayout/components/NavBar/Navbar.tsx +++ b/frontend/src/layouts/OrganizationLayout/components/NavBar/Navbar.tsx @@ -238,7 +238,9 @@ export const Navbar = () => { } window.close(); return; - } else if (org.googleSsoAuthEnforced) { + } + + if (org.googleSsoAuthEnforced) { await logout.mutateAsync(); window.open(`/api/v1/sso/redirect/google?org_slug=${org.slug}`); window.close(); diff --git a/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx b/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx index f978dd632..9e6850f82 100644 --- a/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx +++ b/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx @@ -85,8 +85,6 @@ export const SelectOrganizationSection = () => { if ((organization.authEnforced || organization.googleSsoAuthEnforced) && !canBypassOrgAuth) { const authToken = jwtDecode(getAuthToken()) as { authMethod: AuthMethod }; - await new Promise((resolve) => setTimeout(resolve, 5_000)); - // org has an org-level auth method enabled (e.g. SAML) // -> logout + redirect to SAML SSO let url = ""; @@ -215,8 +213,6 @@ export const SelectOrganizationSection = () => { handleCliRedirect(); setIsInitialOrgCheckLoading(false); } else { - console.log(organizations.data); - console.log("Calling this with single org?!??!?!::::", organizations.data.length); handleSelectOrganization(organizations.data[0]); } } else { @@ -226,7 +222,6 @@ export const SelectOrganizationSection = () => { useEffect(() => { if (defaultSelectedOrg) { - console.log("Calling this with default org?!??!?!::::", defaultSelectedOrg); handleSelectOrganization(defaultSelectedOrg); } }, [defaultSelectedOrg]); diff --git a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx index 406da5992..262f9e2c0 100644 --- a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx +++ b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx @@ -135,7 +135,7 @@ export const OrgGeneralAuthSection = ({ {(isAllowed) => ( handleEnforceOrgAuthToggle(value, EnforceAuthType.SAML) } @@ -158,7 +158,7 @@ export const OrgGeneralAuthSection = ({ {(isAllowed) => ( handleEnforceOrgAuthToggle(value, EnforceAuthType.OIDC)