calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-13 16:00:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev' into aig

Browse Source
This commit is contained in:
Owen
2026-08-12 16:34:52 -04:00
parent 860fa47b7c 71d9d8f010
commit 3cfbd66a80
9 changed files with 128 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
messages/en-US.json
+2
View File
@@ -43,6 +43,8 @@
"inviteLoginUser": "Please make sure you're logged in as the correct user.",
"inviteErrorNoUser": "We're sorry, but it looks like the invite you're trying to access is not for a user that exists.",
"inviteCreateUser": "Please create an account first.",
"inviteErrorOidcNotAllowed": "Invites can only be accepted by internal accounts. Sign out and log in with your password for this email.",
"inviteLoginInternalOnly": "Invites require an internal account with a password. Create an account or sign in with your password.",
"goHome": "Go Home",
"inviteLogInOtherUser": "Log In as a Different User",
"createAnAccount": "Create an Account",
server/lib/idp/idpExistsForOrg.ts
+2 -1
View File
@@ -1,8 +1,9 @@
import { db, idp, idpOrg, Transaction } from "@server/db";
import { and, eq } from "drizzle-orm";
import { build } from "@server/build";
export function isOrgIdentityProviderMode(): boolean {
return process.env.IDENTITY_PROVIDER_MODE === "org";
return build === "saas" || process.env.IDENTITY_PROVIDER_MODE === "org";
}
/**
server/routers/user/acceptInvite.ts
+24 -10
View File
@@ -22,6 +22,7 @@ import { calculateUserClientsForOrgs } from "@server/lib/calculateUserClientsFor
import { build } from "@server/build";
import { assignUserToOrg } from "@server/lib/userOrg";
import { isOrgRebuildRateLimited } from "@server/lib/rebuildClientAssociations";
import { UserType } from "@server/types/UserTypes";
const acceptInviteBodySchema = z.strictObject({
token: z.string(),
@@ -66,12 +67,17 @@ export async function acceptInvite(
);
}
const existingUser = await db
const [existingInternalUser] = await db
.select()
.from(users)
.where(eq(users.email, existingInvite.email))
.where(
and(
eq(users.email, existingInvite.email),
eq(users.type, UserType.Internal)
)
)
.limit(1);
if (!existingUser.length) {
if (!existingInternalUser) {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
@@ -80,9 +86,8 @@ export async function acceptInvite(
);
}
const { user, session } = await verifySession(req);
const { user } = await verifySession(req);
// at this point we know the user exists
if (!user) {
return next(
createHttpError(
@@ -92,7 +97,7 @@ export async function acceptInvite(
);
}
if (user && user.email !== existingInvite.email) {
if (user.email !== existingInvite.email) {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
@@ -101,6 +106,15 @@ export async function acceptInvite(
);
}
if (user.type !== UserType.Internal) {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
"Invites can only be accepted by internal users."
)
);
}
if (build == "saas") {
const usage = await usageService.getUsage(
existingInvite.orgId,
@@ -195,7 +209,7 @@ export async function acceptInvite(
await assignUserToOrg(
org,
{
userId: existingUser[0].userId,
userId: user.userId,
orgId: existingInvite.orgId
},
inviteRoleIds,
@@ -208,13 +222,13 @@ export async function acceptInvite(
.where(eq(userInvites.inviteId, inviteId));
logger.debug(
`User ${existingUser[0].userId} accepted invite to org ${existingInvite.orgId}`
`User ${user.userId} accepted invite to org ${existingInvite.orgId}`
);
});
calculateUserClientsForOrgs(existingUser[0].userId).catch((e) => {
calculateUserClientsForOrgs(user.userId).catch((e) => {
logger.error(
`Failed to calculate user clients after accepting invite for user ${existingUser[0].userId}: ${e}`
`Failed to calculate user clients after accepting invite for user ${user.userId}: ${e}`
);
});
server/routers/user/createOrgUser.ts
+11
View File
@@ -20,6 +20,7 @@ import { TierFeature, tierMatrix } from "@server/lib/billing/tierMatrix";
import { assignUserToOrg } from "@server/lib/userOrg";
import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
import { isOrgRebuildRateLimited } from "@server/lib/rebuildClientAssociations";
import { idpExistsForOrg } from "@server/lib/idp/idpExistsForOrg";
const paramsSchema = z.strictObject({
orgId: z.string().nonempty()
@@ -239,6 +240,16 @@ export async function createOrgUser(
);
}
const providerExists = await idpExistsForOrg(idpId, orgId);
if (!providerExists) {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
"Identity provider not found in this organization"
)
);
}
const [idpRes] = await db
.select()
.from(idp)
src/app/[orgId]/settings/access/users/create/page.tsx
+5 -3
View File
@@ -237,10 +237,13 @@ export default function Page() {
return;
}
const useOrgIdps =
build === "saas" || env.app.identityProviderMode === "org";
const res = await api
.get<
AxiosResponse<ListIdpsResponse>
>(build === "saas" ? `/org/${orgId}/idp` : "/idp")
>(useOrgIdps ? `/org/${orgId}/idp` : "/idp")
.catch((e) => {
console.error(e);
toast({
@@ -301,8 +304,7 @@ export default function Page() {
);
const [isSubmittingExternal, setIsSubmittingExternal] = useState(false);
const loading =
isSubmittingInternal || isSubmittingExternal;
const loading = isSubmittingInternal || isSubmittingExternal;
async function onSubmitInternal() {
const isValid = await internalForm.trigger();
src/app/auth/login/page.tsx
+5 -2
View File
@@ -193,7 +193,10 @@ export default async function Page(props: {
redirect={redirectUrl}
forceLogin={forceLogin}
defaultUser={defaultUser}
lastUsedIdp={lastUsedIdpForSmartLogin}
inviteMode={isInvite}
lastUsedIdp={
isInvite ? null : lastUsedIdpForSmartLogin
}
orgSignIn={
!isInvite &&
(build === "saas" ||
@@ -213,7 +216,7 @@ export default async function Page(props: {
) : (
<DashboardLoginForm
redirect={redirectUrl}
idps={loginIdps}
idps={isInvite ? [] : loginIdps}
forceLogin={forceLogin}
showOrgLogin={
!isInvite &&
src/components/InviteStatusCard.tsx
+19
View File
@@ -44,6 +44,7 @@ export default function InviteStatusCard({
| "user_does_not_exist"
| "not_logged_in"
| "user_limit_exceeded"
| "oidc_not_allowed"
>("rejected");
useEffect(() => {
@@ -69,6 +70,12 @@ export default function InviteStatusCard({
function cardType() {
if (error.includes("Invite is not for this user")) {
return "wrong_user";
} else if (
error.includes(
"Invites can only be accepted by internal users."
)
) {
return "oidc_not_allowed";
} else if (
error.includes(
"User does not exist. Please create an account first."
@@ -166,6 +173,14 @@ export default function InviteStatusCard({
<p className="text-center">{t("inviteCreateUser")}</p>
</div>
);
} else if (type === "oidc_not_allowed") {
return (
<div>
<p className="text-center mb-4">
{t("inviteErrorOidcNotAllowed")}
</p>
</div>
);
} else if (type === "user_limit_exceeded") {
return (
<div>
@@ -199,6 +214,10 @@ export default function InviteStatusCard({
);
} else if (type === "user_does_not_exist") {
return <Button onClick={goToSignup}>{t("createAnAccount")}</Button>;
} else if (type === "oidc_not_allowed") {
return (
<Button onClick={goToLogin}>{t("inviteLogInOtherUser")}</Button>
);
} else if (type === "user_limit_exceeded") {
return (
<Button
src/components/SmartLoginForm.tsx
+33 -4
View File
@@ -56,6 +56,7 @@ type SmartLoginFormProps = {
defaultUser?: string;
orgSignIn?: OrgSignInConfig;
lastUsedIdp?: (LoginFormIDP & { orgId?: string }) | null;
inviteMode?: boolean;
};
type ViewState =
@@ -93,7 +94,8 @@ export default function SmartLoginForm({
forceLogin,
defaultUser,
orgSignIn,
lastUsedIdp
lastUsedIdp,
inviteMode = false
}: SmartLoginFormProps) {
const router = useRouter();
const { env } = useEnvContext();
@@ -136,6 +138,10 @@ export default function SmartLoginForm({
return;
}
const signupUrl = redirect
? `/auth/signup?email=${encodeURIComponent(identifier)}&redirect=${encodeURIComponent(redirect)}&fromSmartLogin=true`
: `/auth/signup?email=${encodeURIComponent(identifier)}&fromSmartLogin=true`;
if (!result.found || result.accounts.length === 0) {
// No accounts found
if (!isEmail || forceLogin) {
@@ -147,13 +153,36 @@ export default function SmartLoginForm({
return;
}
// Valid email but no accounts and not forceLogin - redirect to signup
const signupUrl = redirect
? `/auth/signup?email=${encodeURIComponent(identifier)}&redirect=${encodeURIComponent(redirect)}&fromSmartLogin=true`
: `/auth/signup?email=${encodeURIComponent(identifier)}&fromSmartLogin=true`;
router.push(signupUrl);
return;
}
// Invite accept only supports internal (password) accounts
if (inviteMode) {
const internalAccount = result.accounts.find(
(acc) => acc.hasInternalAuth
);
if (internalAccount) {
setViewState({
type: "password",
identifier,
account: internalAccount
});
return;
}
if (isEmail && !forceLogin) {
router.push(signupUrl);
return;
}
form.setError("identifier", {
type: "manual",
message: t("inviteLoginInternalOnly")
});
return;
}
// Determine which view to show
const account = result.accounts[0]; // Use first account for now
src/components/resource-launcher/LauncherOrgSelector.tsx
+27 -1
View File
@@ -15,11 +15,14 @@ import {
} from "@app/components/ui/popover";
import { cn } from "@app/lib/cn";
import { ListUserOrgsResponse } from "@server/routers/org";
import { Check, ChevronDown, ChevronsUpDown } from "lucide-react";
import { Check, ChevronDown, Plus } from "lucide-react";
import { usePathname, useRouter } from "next/navigation";
import { useMemo, useState } from "react";
import { useTranslations } from "next-intl";
import { Button } from "@app/components/ui/button";
import { useEnvContext } from "@app/hooks/useEnvContext";
import { useUserContext } from "@app/hooks/useUserContext";
import { build } from "@server/build";
type LauncherOrgSelectorProps = {
orgId?: string;
@@ -31,9 +34,16 @@ export function LauncherOrgSelector({ orgId, orgs }: LauncherOrgSelectorProps) {
const router = useRouter();
const pathname = usePathname();
const t = useTranslations();
const { env } = useEnvContext();
const { user } = useUserContext();
const selectedOrg = orgs?.find((org) => org.orgId === orgId);
let canCreateOrg = !env.flags.disableUserCreateOrg || user.serverAdmin;
if (build === "saas" && user.type !== "internal") {
canCreateOrg = false;
}
const sortedOrgs = useMemo(() => {
if (!orgs?.length) {
return orgs ?? [];
@@ -108,6 +118,22 @@ export function LauncherOrgSelector({ orgId, orgs }: LauncherOrgSelectorProps) {
</CommandGroup>
</CommandList>
</Command>
{canCreateOrg && (
<div className="p-2 border-t border-border">
<Button
variant="ghost"
size="sm"
className="w-full justify-start h-8 font-normal text-muted-foreground"
onClick={() => {
setOpen(false);
router.push("/setup");
}}
>
<Plus className="h-3.5 w-3.5 mr-2" />
{t("setupNewOrg")}
</Button>
</div>
)}
</PopoverContent>
</Popover>
);