gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-30 03:59:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sso): preserve admin-assigned roles across SSO sign-in (#1862)

Browse Source 
* fix(sso): preserve admin-assigned roles across SSO sign-in

An SSO/OIDC/LDAP user's role was overwritten by the IdP-derived role on
every sign-in, so a role an admin assigned in Settings > Users reverted to
the provider default on the next login. Gate role re-sync behind an opt-in
sso_role_sync setting (default off), so manual role edits persist unless the
operator explicitly enables IdP-authoritative sync. Email continues to sync
unconditionally.

Adds human-session-only GET/PUT /api/sso/config/role-sync endpoints with a
hub-side API-token rejection in the remote proxy, a frontend toggle, a
regenerated SSO settings screenshot, and matching docs.

Closes #1851

* fix(sso): satisfy CodeQL on role-sync log and test token hashing

Route three inline API-token creation blocks through the shared
createTestApiToken helper so the sha256 hashing lives in one place, and
log the role-sync toggle as a word instead of a raw boolean. No behavior
change; resolves the CodeQL js/insecure-hashing and log-injection alerts.

* fix(sso): harden role-sync gate, name the toggle, fix screenshot

Addresses pre-merge review findings on the SSO role-sync feature:
- Make the hub-side SSO config authz guard case-insensitive to match
  Express routing semantics, closing a case-variant API-token bypass.
- Give the IdP role-sync switch an accessible name.
- Capture the SSO settings screenshot at desktop size with the scroll
  area expanded so the role-sync control is fully visible.
This commit is contained in:
Anso
2026-08-28 13:26:22 +00:00
committed by GitHub
parent cc4a6571c7
commit 7cd42699d1
16 changed files with 852 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
e2e/screenshots.spec.ts
+31
View File
@@ -52,6 +52,37 @@ test('resources', async ({ page }) => {
await page.screenshot({ path: path.join(DOCS_IMAGES, 'resources.png'), fullPage: true });
});
test('sso settings', async ({ page }) => {
await page.setViewportSize({ width: 1920, height: 1080 });
await loginAs(page);
await page.getByRole('button', { name: /profile/i }).click();
await page.getByRole('button', { name: 'Settings', exact: true }).click();
await page.getByText('SSO', { exact: true }).first().click();
// The role-sync switch confirms the SSO panel (admin-only) has loaded; it
// only renders once GET /sso/config/role-sync resolves, so wait for the
// switch itself, not just the adjacent label text.
const roleSyncSwitch = page.getByRole('switch', { name: 'IdP role synchronization' });
await expect(roleSyncSwitch).toBeVisible();
await roleSyncSwitch.scrollIntoViewIfNeeded();
// The SSO panel lives in a fixed-height Radix scroll area, so a plain
// fullPage capture clips content below the fold. Expand the viewport (and
// its overflow-hidden root) so the whole panel, including the role-sync
// control, is captured.
await roleSyncSwitch.evaluate((el) => {
const viewport = el.closest<HTMLElement>('[data-radix-scroll-area-viewport]');
if (!viewport) return;
viewport.style.height = 'auto';
viewport.style.overflow = 'visible';
const root = viewport.parentElement;
if (root) {
root.style.height = 'auto';
root.style.overflow = 'visible';
}
});
await page.waitForTimeout(300);
await page.screenshot({ path: path.join(DOCS_IMAGES, 'sso', 'sso-settings.png'), fullPage: true });
});
function emptyCounts() {
return {
add: 0, modify: 0, delete: 0, rename: 0, unchanged: 0,