fix: requested changes

2026-09-22 13:39:35 +00:00 · 2025-07-04 04:51:14 +04:00
parent 13d2cbd8b0
commit cda8579ca4
9 changed files with 60 additions and 73 deletions
--- a/backend/src/ee/routes/v1/oidc-router.ts
+++ b/backend/src/ee/routes/v1/oidc-router.ts
@@ -165,7 +165,7 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
        }
      ],
      querystring: z.object({
-        orgSlug: z.string().trim().describe(OidcSSo.GET_CONFIG.orgSlug)
+        organizationId: z.string().trim().describe(OidcSSo.GET_CONFIG.organizationId)
      }),
      response: {
        200: SanitizedOidcConfigSchema.pick({
@@ -189,9 +189,8 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
      }
    },
    handler: async (req) => {
-      const { orgSlug } = req.query;
      const oidc = await server.services.oidc.getOidc({
-        orgSlug,
+        organizationId: req.query.organizationId,
        type: "external",
        actor: req.permission.type,
        actorId: req.permission.id,
@@ -252,7 +251,7 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
            .describe(OidcSSo.UPDATE_CONFIG.jwtSignatureAlgorithm)
        })
        .partial()
-        .merge(z.object({ orgSlug: z.string() })),
+        .merge(z.object({ organizationId: z.string().describe(OidcSSo.UPDATE_CONFIG.organizationId) })),
      response: {
        200: SanitizedOidcConfigSchema.pick({
          id: true,
@@ -329,7 +328,7 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
          clientId: z.string().trim().describe(OidcSSo.CREATE_CONFIG.clientId),
          clientSecret: z.string().trim().describe(OidcSSo.CREATE_CONFIG.clientSecret),
          isActive: z.boolean().describe(OidcSSo.CREATE_CONFIG.isActive),
-          orgSlug: z.string().trim().describe(OidcSSo.CREATE_CONFIG.orgSlug),
+          organizationId: z.string().trim().describe(OidcSSo.CREATE_CONFIG.organizationId),
          manageGroupMemberships: z
            .boolean()
            .optional()
--- a/backend/src/ee/services/oidc/oidc-config-service.ts
+++ b/backend/src/ee/services/oidc/oidc-config-service.ts
@@ -107,34 +107,26 @@ export const oidcConfigServiceFactory = ({
  kmsService
 }: TOidcConfigServiceFactoryDep) => {
  const getOidc = async (dto: TGetOidcCfgDTO) => {
-    const org = await orgDAL.findOne({ slug: dto.orgSlug });
-    if (!org) {
+    const oidcCfg = await oidcConfigDAL.findOne({
+      orgId: dto.organizationId
+    });
+    if (!oidcCfg) {
      throw new NotFoundError({
-        message: `Organization with slug '${dto.orgSlug}' not found`,
-        name: "OrgNotFound"
+        message: `OIDC configuration for organization with ID '${dto.organizationId}' not found`
      });
    }
+
    if (dto.type === "external") {
      const { permission } = await permissionService.getOrgPermission(
        dto.actor,
        dto.actorId,
-        org.id,
+        dto.organizationId,
        dto.actorAuthMethod,
        dto.actorOrgId
      );
      ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
    }

-    const oidcCfg = await oidcConfigDAL.findOne({
-      orgId: org.id
-    });
-
-    if (!oidcCfg) {
-      throw new NotFoundError({
-        message: `OIDC configuration for organization with slug '${dto.orgSlug}' not found`
-      });
-    }
-
    const { decryptor } = await kmsService.createCipherPairWithDataKey({
      type: KmsDataKey.Organization,
      orgId: oidcCfg.orgId
@@ -465,7 +457,7 @@ export const oidcConfigServiceFactory = ({
  };

  const updateOidcCfg = async ({
-    orgSlug,
+    organizationId,
    allowedEmailDomains,
    configurationType,
    discoveryURL,
@@ -484,13 +476,11 @@ export const oidcConfigServiceFactory = ({
    manageGroupMemberships,
    jwtSignatureAlgorithm
  }: TUpdateOidcCfgDTO) => {
-    const org = await orgDAL.findOne({
-      slug: orgSlug
-    });
+    const org = await orgDAL.findOne({ id: organizationId });

    if (!org) {
      throw new NotFoundError({
-        message: `Organization with slug '${orgSlug}' not found`
+        message: `Organization with ID '${organizationId}' not found`
      });
    }

@@ -555,7 +545,7 @@ export const oidcConfigServiceFactory = ({
  };

  const createOidcCfg = async ({
-    orgSlug,
+    organizationId,
    allowedEmailDomains,
    configurationType,
    discoveryURL,
@@ -574,12 +564,10 @@ export const oidcConfigServiceFactory = ({
    manageGroupMemberships,
    jwtSignatureAlgorithm
  }: TCreateOidcCfgDTO) => {
-    const org = await orgDAL.findOne({
-      slug: orgSlug
-    });
+    const org = await orgDAL.findOne({ id: organizationId });
    if (!org) {
      throw new NotFoundError({
-        message: `Organization with slug '${orgSlug}' not found`
+        message: `Organization with ID '${organizationId}' not found`
      });
    }

@@ -639,7 +627,7 @@ export const oidcConfigServiceFactory = ({

    const oidcCfg = await getOidc({
      type: "internal",
-      orgSlug
+      organizationId: org.id
    });

    if (!oidcCfg || !oidcCfg.isActive) {
--- a/backend/src/ee/services/oidc/oidc-config-types.ts
+++ b/backend/src/ee/services/oidc/oidc-config-types.ts
@@ -26,11 +26,11 @@ export type TOidcLoginDTO = {
 export type TGetOidcCfgDTO =
  | ({
      type: "external";
-      orgSlug: string;
+      organizationId: string;
    } & TGenericPermission)
  | {
      type: "internal";
-      orgSlug: string;
+      organizationId: string;
    };

 export type TCreateOidcCfgDTO = {
@@ -45,7 +45,7 @@ export type TCreateOidcCfgDTO = {
  clientId: string;
  clientSecret: string;
  isActive: boolean;
-  orgSlug: string;
+  organizationId: string;
  manageGroupMemberships: boolean;
  jwtSignatureAlgorithm: OIDCJWTSignatureAlgorithm;
 } & TGenericPermission;
@@ -62,7 +62,7 @@ export type TUpdateOidcCfgDTO = Partial<{
  clientId: string;
  clientSecret: string;
  isActive: boolean;
-  orgSlug: string;
+  organizationId: string;
  manageGroupMemberships: boolean;
  jwtSignatureAlgorithm: OIDCJWTSignatureAlgorithm;
 }> &
--- a/backend/src/lib/api-docs/constants.ts
+++ b/backend/src/lib/api-docs/constants.ts
@@ -2656,30 +2656,30 @@ export const SecretScanningConfigs = {

 export const OidcSSo = {
  GET_CONFIG: {
-    orgSlug: "The slug of the organization to get the OIDC config for."
+    organizationId: "The ID of the organization to get the OIDC config for."
  },
  UPDATE_CONFIG: {
-    orgSlug: "The slug of the organization to update the OIDC config for.",
+    organizationId: "The ID of the organization to update the OIDC config for.",
    allowedEmailDomains:
-      "A list of allowed email domains that users can use to authenticate with. This field is comma separated.",
+      "A list of allowed email domains that users can use to authenticate with. This field is comma separated. Example: 'example.com,acme.com'",
    discoveryURL: "The URL of the OIDC discovery endpoint.",
    configurationType: "The configuration type to use for the OIDC configuration.",
    issuer:
      "The issuer for the OIDC configuration. This is only supported when the OIDC configuration type is set to 'custom'.",
    authorizationEndpoint:
-      "The authorization endpoint to use for OIDC authorization. This is only supported when the OIDC configuration type is set to 'custom'.",
+      "The endpoint to use for OIDC authorization. This is only supported when the OIDC configuration type is set to 'custom'.",
    jwksUri: "The URL of the OIDC JWKS endpoint.",
    tokenEndpoint: "The token endpoint to use for OIDC token exchange.",
    userinfoEndpoint: "The userinfo endpoint to get user information from the OIDC provider.",
    clientId: "The client ID to use for OIDC authentication.",
    clientSecret: "The client secret to use for OIDC authentication.",
-    isActive: "Whether the OIDC configuration is active.",
+    isActive: "Whether to enable or disable this OIDC configuration.",
    manageGroupMemberships:
-      "Whether to manage group memberships for the OIDC configuration. If enabled, users will automatically be assigned groups when they sign in or are added to a group in the OIDC provider.",
+      "Whether to manage group memberships for the OIDC configuration. If enabled, users will automatically be assigned groups when they sign in, based on which groups they are a member of in the OIDC provider.",
    jwtSignatureAlgorithm: "The algorithm to use for JWT signature verification."
  },
  CREATE_CONFIG: {
-    orgSlug: "The slug of the organization to create the OIDC config for.",
+    organizationId: "The ID of the organization to create the OIDC config for.",
    allowedEmailDomains:
      "A list of allowed email domains that users can use to authenticate with. This field is comma separated.",
    discoveryURL: "The URL of the OIDC discovery endpoint.",
@@ -2693,9 +2693,9 @@ export const OidcSSo = {
    userinfoEndpoint: "The userinfo endpoint to get user information from the OIDC provider.",
    clientId: "The client ID to use for OIDC authentication.",
    clientSecret: "The client secret to use for OIDC authentication.",
-    isActive: "Whether the OIDC configuration is active.",
+    isActive: "Whether to enable or disable this OIDC configuration.",
    manageGroupMemberships:
-      "Whether to manage group memberships for the OIDC configuration. If enabled, users will automatically be assigned groups when they sign in or are added to a group in the OIDC provider.",
+      "Whether to manage group memberships for the OIDC configuration. If enabled, users will automatically be assigned groups when they sign in, based on which groups they are a member of in the OIDC provider.",
    jwtSignatureAlgorithm: "The algorithm to use for JWT signature verification."
  }
 };
@@ -2707,7 +2707,7 @@ export const SamlSso = {
  UPDATE_CONFIG: {
    organizationId: "The ID of the organization to update the SAML config for.",
    authProvider: "The authentication provider to use for SAML authentication.",
-    isActive: "Whether the SAML configuration is active.",
+    isActive: "Whether to enable or disable this SAML configuration.",
    entryPoint:
      "The entry point for the SAML authentication. This is the URL that the user will be redirected to after they have authenticated with the SAML provider.",
    issuer: "The SAML provider issuer URL or entity ID.",
@@ -2716,7 +2716,7 @@ export const SamlSso = {
  CREATE_CONFIG: {
    organizationId: "The ID of the organization to create the SAML config for.",
    authProvider: "The authentication provider to use for SAML authentication.",
-    isActive: "Whether the SAML configuration is active.",
+    isActive: "Whether to enable or disable this SAML configuration.",
    entryPoint:
      "The entry point for the SAML authentication. This is the URL that the user will be redirected to after they have authenticated with the SAML provider.",
    issuer: "The SAML provider issuer URL or entity ID.",
@@ -2730,24 +2730,24 @@ export const LdapSso = {
  },
  CREATE_CONFIG: {
    organizationId: "The ID of the organization to create the LDAP config for.",
-    isActive: "Whether the LDAP configuration is active.",
+    isActive: "Whether to enable or disable this LDAP configuration.",
    url: "The LDAP server to connect to such as `ldap://ldap.your-org.com`, `ldaps://ldap.myorg.com:636` (for connection over SSL/TLS), etc.",
    bindDN:
-      "The distinguished name of object to bind when performing the user search such as `cn=infisical,ou=Users,dc=acme,dc=com`",
+      "The distinguished name of the object to bind when performing the user search such as `cn=infisical,ou=Users,dc=acme,dc=com`",
    bindPass: "The password to use along with Bind DN when performing the user search.",
    searchBase: "The base DN to use for the user search such as `ou=Users,dc=acme,dc=com`",
    uniqueUserAttribute:
      "The attribute to use as the unique identifier of LDAP users such as `sAMAccountName`, `cn`, `uid`, `objectGUID`. If left blank, defaults to uidNumber",
    searchFilter:
-      "Template used to construct the LDAP user search filter such as `(uid={{username}})` uses literal `{{username}}` to have the given username used in the search. The default is `(uid={{username}})` which is compatible with several common directory schemas.",
+      "The template used to construct the LDAP user search filter such as `(uid={{username}})` uses literal `{{username}}` to have the given username used in the search. The default is `(uid={{username}})` which is compatible with several common directory schemas.",
    groupSearchBase: "LDAP search base to use for group membership search such as `ou=Groups,dc=acme,dc=com`",
    groupSearchFilter:
-      " Template used when constructing the group membership query such as `(&(objectClass=posixGroup)(memberUid={{.Username}}))`. The template can access the following context variables: `[UserDN, UserName]`. The default is `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))` which is compatible with several common directory schemas.",
+      "The template used when constructing the group membership query such as `(&(objectClass=posixGroup)(memberUid={{.Username}}))`. The template can access the following context variables: `[UserDN, UserName]`. The default is `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))` which is compatible with several common directory schemas.",
    caCert: "The CA certificate to use when verifying the LDAP server certificate."
  },
  UPDATE_CONFIG: {
    organizationId: "The ID of the organization to update the LDAP config for.",
-    isActive: "Whether the LDAP configuration is active.",
+    isActive: "Whether to enable or disable this LDAP configuration.",
    url: "The LDAP server to connect to such as `ldap://ldap.your-org.com`, `ldaps://ldap.myorg.com:636` (for connection over SSL/TLS), etc.",
    bindDN:
      "The distinguished name of object to bind when performing the user search such as `cn=infisical,ou=Users,dc=acme,dc=com`",
@@ -2755,11 +2755,11 @@ export const LdapSso = {
    uniqueUserAttribute:
      "The attribute to use as the unique identifier of LDAP users such as `sAMAccountName`, `cn`, `uid`, `objectGUID`. If left blank, defaults to uidNumber",
    searchFilter:
-      "Template used to construct the LDAP user search filter such as `(uid={{username}})` uses literal `{{username}}` to have the given username used in the search. The default is `(uid={{username}})` which is compatible with several common directory schemas.",
+      "The template used to construct the LDAP user search filter such as `(uid={{username}})` uses literal `{{username}}` to have the given username used in the search. The default is `(uid={{username}})` which is compatible with several common directory schemas.",
    searchBase: "The base DN to use for the user search such as `ou=Users,dc=acme,dc=com`",
    groupSearchBase: "LDAP search base to use for group membership search such as `ou=Groups,dc=acme,dc=com`",
    groupSearchFilter:
-      " Template used when constructing the group membership query such as `(&(objectClass=posixGroup)(memberUid={{.Username}}))`. The template can access the following context variables: `[UserDN, UserName]`. The default is `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))` which is compatible with several common directory schemas.",
+      "The template used when constructing the group membership query such as `(&(objectClass=posixGroup)(memberUid={{.Username}}))`. The template can access the following context variables: `[UserDN, UserName]`. The default is `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))` which is compatible with several common directory schemas.",
    caCert: "The CA certificate to use when verifying the LDAP server certificate."
  }
 };
--- a/frontend/src/hooks/api/oidcConfig/mutations.tsx
+++ b/frontend/src/hooks/api/oidcConfig/mutations.tsx
@@ -21,7 +21,7 @@ export const useUpdateOIDCConfig = () => {
      clientId,
      clientSecret,
      isActive,
-      orgSlug,
+      organizationId,
      manageGroupMemberships,
      jwtSignatureAlgorithm
    }: {
@@ -36,7 +36,7 @@ export const useUpdateOIDCConfig = () => {
      clientSecret?: string;
      isActive?: boolean;
      configurationType?: string;
-      orgSlug: string;
+      organizationId: string;
      manageGroupMemberships?: boolean;
      jwtSignatureAlgorithm?: OIDCJWTSignatureAlgorithm;
    }) => {
@@ -50,7 +50,7 @@ export const useUpdateOIDCConfig = () => {
        tokenEndpoint,
        userinfoEndpoint,
        clientId,
-        orgSlug,
+        organizationId,
        clientSecret,
        isActive,
        manageGroupMemberships,
@@ -60,7 +60,7 @@ export const useUpdateOIDCConfig = () => {
      return data;
    },
    onSuccess(_, dto) {
-      queryClient.invalidateQueries({ queryKey: oidcConfigKeys.getOIDCConfig(dto.orgSlug) });
+      queryClient.invalidateQueries({ queryKey: oidcConfigKeys.getOIDCConfig(dto.organizationId) });
      queryClient.invalidateQueries({ queryKey: organizationKeys.getUserOrganizations });
    }
  });
@@ -81,7 +81,7 @@ export const useCreateOIDCConfig = () => {
      clientId,
      clientSecret,
      isActive,
-      orgSlug,
+      organizationId,
      manageGroupMemberships,
      jwtSignatureAlgorithm
    }: {
@@ -95,7 +95,7 @@ export const useCreateOIDCConfig = () => {
      clientId: string;
      clientSecret: string;
      isActive: boolean;
-      orgSlug: string;
+      organizationId: string;
      allowedEmailDomains?: string;
      manageGroupMemberships?: boolean;
      jwtSignatureAlgorithm?: OIDCJWTSignatureAlgorithm;
@@ -112,7 +112,7 @@ export const useCreateOIDCConfig = () => {
        clientId,
        clientSecret,
        isActive,
-        orgSlug,
+        organizationId,
        manageGroupMemberships,
        jwtSignatureAlgorithm
      });
@@ -120,7 +120,7 @@ export const useCreateOIDCConfig = () => {
      return data;
    },
    onSuccess(_, dto) {
-      queryClient.invalidateQueries({ queryKey: oidcConfigKeys.getOIDCConfig(dto.orgSlug) });
+      queryClient.invalidateQueries({ queryKey: oidcConfigKeys.getOIDCConfig(dto.organizationId) });
    }
  });
 };
--- a/frontend/src/hooks/api/oidcConfig/queries.tsx
+++ b/frontend/src/hooks/api/oidcConfig/queries.tsx
@@ -5,18 +5,18 @@ import { apiRequest } from "@app/config/request";
 import { OIDCConfigData } from "./types";

 export const oidcConfigKeys = {
-  getOIDCConfig: (orgSlug: string) => [{ orgSlug }, "organization-oidc"] as const,
+  getOIDCConfig: (orgId: string) => [{ orgId }, "organization-oidc"] as const,
  getOIDCManageGroupMembershipsEnabled: (orgId: string) =>
    ["oidc-manage-group-memberships", orgId] as const
 };

-export const useGetOIDCConfig = (orgSlug: string) => {
+export const useGetOIDCConfig = (orgId: string) => {
  return useQuery({
-    queryKey: oidcConfigKeys.getOIDCConfig(orgSlug),
+    queryKey: oidcConfigKeys.getOIDCConfig(orgId),
    queryFn: async () => {
      try {
        const { data } = await apiRequest.get<OIDCConfigData>(
-          `/api/v1/sso/oidc/config?orgSlug=${orgSlug}`
+          `/api/v1/sso/oidc/config?organizationId=${orgId}`
        );

        return data;
--- a/frontend/src/pages/organization/SsoPage/components/OrgSsoTab/OIDCModal.tsx
+++ b/frontend/src/pages/organization/SsoPage/components/OrgSsoTab/OIDCModal.tsx
@@ -105,7 +105,7 @@ export const OIDCModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDele
  const { mutateAsync: updateMutateAsync, isPending: updateIsLoading } = useUpdateOIDCConfig();
  const [isDeletePopupOpen, setIsDeletePopupOpen] = useToggle(false);

-  const { data } = useGetOIDCConfig(currentOrg?.slug ?? "");
+  const { data } = useGetOIDCConfig(currentOrg?.id ?? "");

  const { control, handleSubmit, reset, setValue, watch } = useForm<OIDCFormData>({
    resolver: zodResolver(schema),
@@ -134,7 +134,7 @@ export const OIDCModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDele
        clientId: "",
        clientSecret: "",
        isActive: false,
-        orgSlug: currentOrg.slug
+        organizationId: currentOrg.id
      });

      createNotification({
@@ -196,7 +196,7 @@ export const OIDCModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDele
          clientId,
          clientSecret,
          isActive: true,
-          orgSlug: currentOrg.slug,
+          organizationId: currentOrg.id,
          jwtSignatureAlgorithm
        });
      } else {
@@ -212,7 +212,7 @@ export const OIDCModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDele
          clientId,
          clientSecret,
          isActive: true,
-          orgSlug: currentOrg.slug,
+          organizationId: currentOrg.id,
          jwtSignatureAlgorithm
        });
      }
--- a/frontend/src/pages/organization/SsoPage/components/OrgSsoTab/OrgOIDCSection.tsx
+++ b/frontend/src/pages/organization/SsoPage/components/OrgSsoTab/OrgOIDCSection.tsx
@@ -21,7 +21,7 @@ export const OrgOIDCSection = (): JSX.Element => {
  const { currentOrg } = useOrganization();
  const { subscription } = useSubscription();

-  const { data, isPending } = useGetOIDCConfig(currentOrg?.slug ?? "");
+  const { data, isPending } = useGetOIDCConfig(currentOrg?.id ?? "");
  const { mutateAsync } = useUpdateOIDCConfig();
  const { mutateAsync: updateOrg } = useUpdateOrg();

@@ -41,7 +41,7 @@ export const OrgOIDCSection = (): JSX.Element => {
      }

      await mutateAsync({
-        orgSlug: currentOrg?.slug,
+        organizationId: currentOrg?.id,
        isActive: value
      });

@@ -114,7 +114,7 @@ export const OrgOIDCSection = (): JSX.Element => {
      }

      await mutateAsync({
-        orgSlug: currentOrg?.slug,
+        organizationId: currentOrg?.id,
        manageGroupMemberships: value
      });

--- a/frontend/src/pages/organization/SsoPage/components/OrgSsoTab/OrgSsoTab.tsx
+++ b/frontend/src/pages/organization/SsoPage/components/OrgSsoTab/OrgSsoTab.tsx
@@ -38,7 +38,7 @@ export const OrgSsoTab = withPermission(
    const { subscription } = useSubscription();

    const { data: oidcConfig, isPending: isLoadingOidcConfig } = useGetOIDCConfig(
-      currentOrg?.slug ?? ""
+      currentOrg?.id ?? ""
    );
    const { data: samlConfig, isPending: isLoadingSamlConfig } = useGetSSOConfig(
      currentOrg?.id ?? ""