Merge branch 'dev' into aig

messages/en-US.json

@@ -43,6 +43,8 @@
     "inviteLoginUser": "Please make sure you're logged in as the correct user.",
     "inviteErrorNoUser": "We're sorry, but it looks like the invite you're trying to access is not for a user that exists.",
     "inviteCreateUser": "Please create an account first.",
+    "inviteErrorOidcNotAllowed": "Invites can only be accepted by internal accounts. Sign out and log in with your password for this email.",
+    "inviteLoginInternalOnly": "Invites require an internal account with a password. Create an account or sign in with your password.",
     "goHome": "Go Home",
     "inviteLogInOtherUser": "Log In as a Different User",
     "createAnAccount": "Create an Account",

server/lib/idp/idpExistsForOrg.ts

@@ -1,8 +1,9 @@
 import { db, idp, idpOrg, Transaction } from "@server/db";
 import { and, eq } from "drizzle-orm";
+import { build } from "@server/build";
 
 export function isOrgIdentityProviderMode(): boolean {
-    return process.env.IDENTITY_PROVIDER_MODE === "org";
+    return build === "saas" || process.env.IDENTITY_PROVIDER_MODE === "org";
 }
 
 /**

server/routers/user/acceptInvite.ts

@@ -22,6 +22,7 @@ import { calculateUserClientsForOrgs } from "@server/lib/calculateUserClientsFor
 import { build } from "@server/build";
 import { assignUserToOrg } from "@server/lib/userOrg";
 import { isOrgRebuildRateLimited } from "@server/lib/rebuildClientAssociations";
+import { UserType } from "@server/types/UserTypes";
 
 const acceptInviteBodySchema = z.strictObject({
     token: z.string(),
@@ -66,12 +67,17 @@ export async function acceptInvite(
             );
         }
 
-        const existingUser = await db
+        const [existingInternalUser] = await db
             .select()
             .from(users)
-            .where(eq(users.email, existingInvite.email))
+            .where(
+                and(
+                    eq(users.email, existingInvite.email),
+                    eq(users.type, UserType.Internal)
+                )
+            )
             .limit(1);
-        if (!existingUser.length) {
+        if (!existingInternalUser) {
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
@@ -80,9 +86,8 @@ export async function acceptInvite(
             );
         }
 
-        const { user, session } = await verifySession(req);
+        const { user } = await verifySession(req);
 
-        // at this point we know the user exists
         if (!user) {
             return next(
                 createHttpError(
@@ -92,7 +97,7 @@ export async function acceptInvite(
             );
         }
 
-        if (user && user.email !== existingInvite.email) {
+        if (user.email !== existingInvite.email) {
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
@@ -101,6 +106,15 @@ export async function acceptInvite(
             );
         }
 
+        if (user.type !== UserType.Internal) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Invites can only be accepted by internal users."
+                )
+            );
+        }
+
         if (build == "saas") {
             const usage = await usageService.getUsage(
                 existingInvite.orgId,
@@ -195,7 +209,7 @@ export async function acceptInvite(
             await assignUserToOrg(
                 org,
                 {
-                    userId: existingUser[0].userId,
+                    userId: user.userId,
                     orgId: existingInvite.orgId
                 },
                 inviteRoleIds,
@@ -208,13 +222,13 @@ export async function acceptInvite(
                 .where(eq(userInvites.inviteId, inviteId));
 
             logger.debug(
-                `User ${existingUser[0].userId} accepted invite to org ${existingInvite.orgId}`
+                `User ${user.userId} accepted invite to org ${existingInvite.orgId}`
             );
         });
 
-        calculateUserClientsForOrgs(existingUser[0].userId).catch((e) => {
+        calculateUserClientsForOrgs(user.userId).catch((e) => {
             logger.error(
-                `Failed to calculate user clients after accepting invite for user ${existingUser[0].userId}: ${e}`
+                `Failed to calculate user clients after accepting invite for user ${user.userId}: ${e}`
             );
         });
 

server/routers/user/createOrgUser.ts

@@ -20,6 +20,7 @@ import { TierFeature, tierMatrix } from "@server/lib/billing/tierMatrix";
 import { assignUserToOrg } from "@server/lib/userOrg";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { isOrgRebuildRateLimited } from "@server/lib/rebuildClientAssociations";
+import { idpExistsForOrg } from "@server/lib/idp/idpExistsForOrg";
 
 const paramsSchema = z.strictObject({
     orgId: z.string().nonempty()
@@ -239,6 +240,16 @@ export async function createOrgUser(
                 );
             }
 
+            const providerExists = await idpExistsForOrg(idpId, orgId);
+            if (!providerExists) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Identity provider not found in this organization"
+                    )
+                );
+            }
+
             const [idpRes] = await db
                 .select()
                 .from(idp)

src/app/[orgId]/settings/access/users/create/page.tsx

@@ -237,10 +237,13 @@ export default function Page() {
                 return;
             }
 
+            const useOrgIdps =
+                build === "saas" || env.app.identityProviderMode === "org";
+
             const res = await api
                 .get<
                     AxiosResponse<ListIdpsResponse>
-                >(build === "saas" ? `/org/${orgId}/idp` : "/idp")
+                >(useOrgIdps ? `/org/${orgId}/idp` : "/idp")
                 .catch((e) => {
                     console.error(e);
                     toast({
@@ -301,8 +304,7 @@ export default function Page() {
     );
     const [isSubmittingExternal, setIsSubmittingExternal] = useState(false);
 
-    const loading =
+    const loading = isSubmittingInternal || isSubmittingExternal;
-        isSubmittingInternal || isSubmittingExternal;
 
     async function onSubmitInternal() {
         const isValid = await internalForm.trigger();

src/app/auth/login/page.tsx

@@ -193,7 +193,10 @@ export default async function Page(props: {
                                 redirect={redirectUrl}
                                 forceLogin={forceLogin}
                                 defaultUser={defaultUser}
-                                lastUsedIdp={lastUsedIdpForSmartLogin}
+                                inviteMode={isInvite}
+                                lastUsedIdp={
+                                    isInvite ? null : lastUsedIdpForSmartLogin
+                                }
                                 orgSignIn={
                                     !isInvite &&
                                     (build === "saas" ||
@@ -213,7 +216,7 @@ export default async function Page(props: {
             ) : (
                 <DashboardLoginForm
                     redirect={redirectUrl}
-                    idps={loginIdps}
+                    idps={isInvite ? [] : loginIdps}
                     forceLogin={forceLogin}
                     showOrgLogin={
                         !isInvite &&

src/components/InviteStatusCard.tsx

@@ -44,6 +44,7 @@ export default function InviteStatusCard({
         | "user_does_not_exist"
         | "not_logged_in"
         | "user_limit_exceeded"
+        | "oidc_not_allowed"
     >("rejected");
 
     useEffect(() => {
@@ -69,6 +70,12 @@ export default function InviteStatusCard({
             function cardType() {
                 if (error.includes("Invite is not for this user")) {
                     return "wrong_user";
+                } else if (
+                    error.includes(
+                        "Invites can only be accepted by internal users."
+                    )
+                ) {
+                    return "oidc_not_allowed";
                 } else if (
                     error.includes(
                         "User does not exist. Please create an account first."
@@ -166,6 +173,14 @@ export default function InviteStatusCard({
                     <p className="text-center">{t("inviteCreateUser")}</p>
                 </div>
             );
+        } else if (type === "oidc_not_allowed") {
+            return (
+                <div>
+                    <p className="text-center mb-4">
+                        {t("inviteErrorOidcNotAllowed")}
+                    </p>
+                </div>
+            );
         } else if (type === "user_limit_exceeded") {
             return (
                 <div>
@@ -199,6 +214,10 @@ export default function InviteStatusCard({
             );
         } else if (type === "user_does_not_exist") {
             return <Button onClick={goToSignup}>{t("createAnAccount")}</Button>;
+        } else if (type === "oidc_not_allowed") {
+            return (
+                <Button onClick={goToLogin}>{t("inviteLogInOtherUser")}</Button>
+            );
         } else if (type === "user_limit_exceeded") {
             return (
                 <Button

src/components/SmartLoginForm.tsx

@@ -56,6 +56,7 @@ type SmartLoginFormProps = {
     defaultUser?: string;
     orgSignIn?: OrgSignInConfig;
     lastUsedIdp?: (LoginFormIDP & { orgId?: string }) | null;
+    inviteMode?: boolean;
 };
 
 type ViewState =
@@ -93,7 +94,8 @@ export default function SmartLoginForm({
     forceLogin,
     defaultUser,
     orgSignIn,
-    lastUsedIdp
+    lastUsedIdp,
+    inviteMode = false
 }: SmartLoginFormProps) {
     const router = useRouter();
     const { env } = useEnvContext();
@@ -136,6 +138,10 @@ export default function SmartLoginForm({
             return;
         }
 
+        const signupUrl = redirect
+            ? `/auth/signup?email=${encodeURIComponent(identifier)}&redirect=${encodeURIComponent(redirect)}&fromSmartLogin=true`
+            : `/auth/signup?email=${encodeURIComponent(identifier)}&fromSmartLogin=true`;
+
         if (!result.found || result.accounts.length === 0) {
             // No accounts found
             if (!isEmail || forceLogin) {
@@ -147,13 +153,36 @@ export default function SmartLoginForm({
                 return;
             }
             // Valid email but no accounts and not forceLogin - redirect to signup
-            const signupUrl = redirect
-                ? `/auth/signup?email=${encodeURIComponent(identifier)}&redirect=${encodeURIComponent(redirect)}&fromSmartLogin=true`
-                : `/auth/signup?email=${encodeURIComponent(identifier)}&fromSmartLogin=true`;
             router.push(signupUrl);
             return;
         }
 
+        // Invite accept only supports internal (password) accounts
+        if (inviteMode) {
+            const internalAccount = result.accounts.find(
+                (acc) => acc.hasInternalAuth
+            );
+            if (internalAccount) {
+                setViewState({
+                    type: "password",
+                    identifier,
+                    account: internalAccount
+                });
+                return;
+            }
+
+            if (isEmail && !forceLogin) {
+                router.push(signupUrl);
+                return;
+            }
+
+            form.setError("identifier", {
+                type: "manual",
+                message: t("inviteLoginInternalOnly")
+            });
+            return;
+        }
+
         // Determine which view to show
         const account = result.accounts[0]; // Use first account for now
 

src/components/resource-launcher/LauncherOrgSelector.tsx

@@ -15,11 +15,14 @@ import {
 } from "@app/components/ui/popover";
 import { cn } from "@app/lib/cn";
 import { ListUserOrgsResponse } from "@server/routers/org";
-import { Check, ChevronDown, ChevronsUpDown } from "lucide-react";
+import { Check, ChevronDown, Plus } from "lucide-react";
 import { usePathname, useRouter } from "next/navigation";
 import { useMemo, useState } from "react";
 import { useTranslations } from "next-intl";
 import { Button } from "@app/components/ui/button";
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { useUserContext } from "@app/hooks/useUserContext";
+import { build } from "@server/build";
 
 type LauncherOrgSelectorProps = {
     orgId?: string;
@@ -31,9 +34,16 @@ export function LauncherOrgSelector({ orgId, orgs }: LauncherOrgSelectorProps) {
     const router = useRouter();
     const pathname = usePathname();
     const t = useTranslations();
+    const { env } = useEnvContext();
+    const { user } = useUserContext();
 
     const selectedOrg = orgs?.find((org) => org.orgId === orgId);
 
+    let canCreateOrg = !env.flags.disableUserCreateOrg || user.serverAdmin;
+    if (build === "saas" && user.type !== "internal") {
+        canCreateOrg = false;
+    }
+
     const sortedOrgs = useMemo(() => {
         if (!orgs?.length) {
             return orgs ?? [];
@@ -108,6 +118,22 @@ export function LauncherOrgSelector({ orgId, orgs }: LauncherOrgSelectorProps) {
                         </CommandGroup>
                     </CommandList>
                 </Command>
+                {canCreateOrg && (
+                    <div className="p-2 border-t border-border">
+                        <Button
+                            variant="ghost"
+                            size="sm"
+                            className="w-full justify-start h-8 font-normal text-muted-foreground"
+                            onClick={() => {
+                                setOpen(false);
+                                router.push("/setup");
+                            }}
+                        >
+                            <Plus className="h-3.5 w-3.5 mr-2" />
+                            {t("setupNewOrg")}
+                        </Button>
+                    </div>
+                )}
             </PopoverContent>
         </Popover>
     );