Merge pull request #3531 from Infisical/feat/githubSsoDefaultOrganizationSetting

Add Github SSO users to default organization on signup

backend/src/services/auth/auth-login-service.ts

@@ -2,7 +2,7 @@ import bcrypt from "bcrypt";
 import jwt from "jsonwebtoken";
 import { Knex } from "knex";
 
-import { OrgMembershipRole, TUsers, UserDeviceSchema } from "@app/db/schemas";
+import { OrgMembershipRole, OrgMembershipStatus, TableName, TUsers, UserDeviceSchema } from "@app/db/schemas";
 import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { isAuthMethodSaml } from "@app/ee/services/permission/permission-fns";
@@ -20,6 +20,8 @@ import { getServerCfg } from "@app/services/super-admin/super-admin-service";
 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
 import { TokenType } from "../auth-token/auth-token-types";
 import { TOrgDALFactory } from "../org/org-dal";
+import { getDefaultOrgMembershipRole } from "../org/org-role-fns";
+import { TOrgMembershipDALFactory } from "../org-membership/org-membership-dal";
 import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
 import { LoginMethod } from "../super-admin/super-admin-types";
 import { TTotpServiceFactory } from "../totp/totp-service";
@@ -48,6 +50,7 @@ type TAuthLoginServiceFactoryDep = {
   smtpService: TSmtpService;
   totpService: Pick<TTotpServiceFactory, "verifyUserTotp" | "verifyWithUserRecoveryCode">;
   auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
+  orgMembershipDAL: TOrgMembershipDALFactory;
 };
 
 export type TAuthLoginFactory = ReturnType<typeof authLoginServiceFactory>;
@@ -56,6 +59,7 @@ export const authLoginServiceFactory = ({
   tokenService,
   smtpService,
   orgDAL,
+  orgMembershipDAL,
   totpService,
   auditLogService
 }: TAuthLoginServiceFactoryDep) => {
@@ -719,6 +723,35 @@ export const authLoginServiceFactory = ({
         authMethods: [authMethod],
         isGhost: false
       });
+
+      if (authMethod === AuthMethod.GITHUB && serverCfg.defaultAuthOrgId && !appCfg.isCloud) {
+        let orgId = "";
+        const defaultOrg = await orgDAL.findOrgById(serverCfg.defaultAuthOrgId);
+        if (!defaultOrg) {
+          throw new BadRequestError({
+            message: `Failed to find default organization with ID ${serverCfg.defaultAuthOrgId}`
+          });
+        }
+        orgId = defaultOrg.id;
+        const [orgMembership] = await orgDAL.findMembership({
+          [`${TableName.OrgMembership}.userId` as "userId"]: user.id,
+          [`${TableName.OrgMembership}.orgId` as "id"]: orgId
+        });
+
+        if (!orgMembership) {
+          const { role, roleId } = await getDefaultOrgMembershipRole(defaultOrg.defaultMembershipRole);
+
+          await orgMembershipDAL.create({
+            userId: user.id,
+            inviteEmail: email,
+            orgId,
+            role,
+            roleId,
+            status: OrgMembershipStatus.Accepted,
+            isActive: true
+          });
+        }
+      }
     } else {
       const isLinkingRequired = !user?.authMethods?.includes(authMethod);
       if (isLinkingRequired) {

backend/src/services/auth/auth-signup-service.ts

@@ -9,7 +9,7 @@ import { isAuthMethodSaml } from "@app/ee/services/permission/permission-fns";
 import { getConfig } from "@app/lib/config/env";
 import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { generateUserSrpKeys, getUserPrivateKey } from "@app/lib/crypto/srp";
-import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { getMinExpiresIn } from "@app/lib/fn";
 import { isDisposableEmail } from "@app/lib/validator";
 import { TGroupProjectDALFactory } from "@app/services/group-project/group-project-dal";
@@ -150,7 +150,8 @@ export const authSignupServiceFactory = ({
     encryptedPrivateKeyTag,
     ip,
     userAgent,
-    authorization
+    authorization,
+    useDefaultOrg
   }: TCompleteAccountSignupDTO) => {
     const appCfg = getConfig();
     const serverCfg = await getServerCfg();
@@ -293,15 +294,24 @@ export const authSignupServiceFactory = ({
     });
 
     if (!organizationId) {
-      const newOrganization = await orgService.createOrganization({
-        userId: user.id,
-        userEmail: user.email ?? user.username,
-        orgName: organizationName
-      });
+      let orgId = "";
+      if (useDefaultOrg && serverCfg.defaultAuthOrgId && !appCfg.isCloud) {
+        const defaultOrg = await orgDAL.findOrgById(serverCfg.defaultAuthOrgId);
+        if (!defaultOrg) throw new BadRequestError({ message: "Failed to find default organization" });
+        orgId = defaultOrg.id;
+      } else {
+        if (!organizationName) throw new BadRequestError({ message: "Organization name is required" });
+        const newOrganization = await orgService.createOrganization({
+          userId: user.id,
+          userEmail: user.email ?? user.username,
+          orgName: organizationName
+        });
 
-      if (!newOrganization) throw new Error("Failed to create organization");
+        if (!newOrganization) throw new Error("Failed to create organization");
+        orgId = newOrganization.id;
+      }
 
-      organizationId = newOrganization.id;
+      organizationId = orgId;
     }
 
     const updatedMembersips = await orgDAL.updateMembership(

backend/src/services/auth/auth-signup-type.ts

@@ -12,12 +12,13 @@ export type TCompleteAccountSignupDTO = {
   encryptedPrivateKeyTag: string;
   salt: string;
   verifier: string;
-  organizationName: string;
+  organizationName?: string;
   providerAuthToken?: string | null;
   attributionSource?: string | undefined;
   ip: string;
   userAgent: string;
   authorization: string;
+  useDefaultOrg?: boolean;
 };
 
 export type TCompleteAccountInviteDTO = {