gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-09 02:12:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(sso): split SSO providers by delivery model across tiers (#754)

Browse Source 
Custom OIDC stays on Community so self-hosters can wire any spec-compliant
OIDC identity provider (Authelia, Keycloak, Authentik, Zitadel, and others).
Google, GitHub, and Okta one-click presets move to Skipper. LDAP / Active
Directory and scoped RBAC are Admiral-only.

Backend enforces the split via a new requireTierForSsoProvider helper in
middleware/tierGates.ts, applied after requireAdmin in all four ssoConfig
mutation handlers. GET /sso/config (list) stays ungated so downgraded
admins can still see previously-configured providers. Invalid provider ids
now 400 before the tier check to avoid leaking tier information.

Frontend adds a compact mode to PaidGate and AdmiralGate for inline
list-item locks, and SSOSection reorders the provider cards as
Custom OIDC > Google > GitHub > Okta > LDAP to reinforce the
free-to-paid progression.

Stale 'SSO is Admiral' copy in AdmiralGate, PaidGate, and the Admiral
upgrade card on the License settings page has been replaced to reflect the
new split. User-facing licensing, SSO, overview, quickstart, and security
docs have been updated with the per-tier provider matrix.
This commit is contained in:
Anso
2026-04-24 15:48:03 -04:00
committed by GitHub
parent 3a20e37625
commit a502da54ee
12 changed files with 256 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/__tests__/sso.test.ts
+146 -1
View File
@@ -410,7 +410,18 @@ describe('LDAP Filter Escaping', () => {
});
describe('SSO Config Validation on PUT', () => {
// SSO config routes require admin role but no longer require Admiral tier
// Validation tests exercise the required-field checks inside PUT. Per-provider
// tier gates run before validation, so mock the license to Admiral here to keep
// these tests focused on validation logic; tier-gate coverage lives in its own block.
beforeAll(async () => {
const { LicenseService } = await import('../services/LicenseService');
vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue('paid');
vi.spyOn(LicenseService.getInstance(), 'getVariant').mockReturnValue('admiral');
});
afterAll(() => {
vi.restoreAllMocks();
});
it('rejects enabled LDAP config without Server URL', async () => {
const res = await supertest(app)
@@ -623,3 +634,137 @@ describe('SSO OIDC Callback - Additional Error Handling', () => {
expect(res.headers.location).toContain('User');
});
});
describe('SSO Config Tier Gating (per-provider)', () => {
// Per-provider tier rules: Custom OIDC = admin only, preset OIDC (Google/GitHub/Okta) = Skipper+, LDAP = Admiral.
// The matrix below covers mutations only; GET /sso/config (list) intentionally stays tier-ungated so
// downgraded admins can still see previously-configured providers.
let tierSpy: ReturnType<typeof vi.spyOn>;
let variantSpy: ReturnType<typeof vi.spyOn>;
beforeAll(async () => {
const { LicenseService } = await import('../services/LicenseService');
tierSpy = vi.spyOn(LicenseService.getInstance(), 'getTier');
variantSpy = vi.spyOn(LicenseService.getInstance(), 'getVariant');
});
afterAll(() => {
vi.restoreAllMocks();
});
const setTier = (tier: 'community' | 'paid', variant: 'skipper' | 'admiral' | null): void => {
tierSpy.mockReturnValue(tier);
variantSpy.mockReturnValue(variant);
};
describe('community tier', () => {
beforeAll(() => setTier('community', null));
it('PUT oidc_custom succeeds (no tier gate)', async () => {
const res = await supertest(app)
.put('/api/sso/config/oidc_custom')
.set('Authorization', `Bearer ${adminToken}`)
.send({ enabled: false });
expect(res.status).toBe(200);
});
it('PUT oidc_google returns 403 PAID_REQUIRED', async () => {
const res = await supertest(app)
.put('/api/sso/config/oidc_google')
.set('Authorization', `Bearer ${adminToken}`)
.send({ enabled: false });
expect(res.status).toBe(403);
expect(res.body.code).toBe('PAID_REQUIRED');
});
it('PUT ldap returns 403 PAID_REQUIRED (tier check precedes variant check)', async () => {
const res = await supertest(app)
.put('/api/sso/config/ldap')
.set('Authorization', `Bearer ${adminToken}`)
.send({ enabled: false });
expect(res.status).toBe(403);
expect(res.body.code).toBe('PAID_REQUIRED');
});
it('DELETE oidc_github returns 403 PAID_REQUIRED', async () => {
const res = await supertest(app)
.delete('/api/sso/config/oidc_github')
.set('Authorization', `Bearer ${adminToken}`);
expect(res.status).toBe(403);
expect(res.body.code).toBe('PAID_REQUIRED');
});
it('POST oidc_okta/test returns 403 PAID_REQUIRED', async () => {
const res = await supertest(app)
.post('/api/sso/config/oidc_okta/test')
.set('Authorization', `Bearer ${adminToken}`);
expect(res.status).toBe(403);
expect(res.body.code).toBe('PAID_REQUIRED');
});
it('GET /sso/config (list) still returns 200 — list is tier-ungated', async () => {
const res = await supertest(app)
.get('/api/sso/config')
.set('Authorization', `Bearer ${adminToken}`);
expect(res.status).toBe(200);
expect(Array.isArray(res.body)).toBe(true);
});
});
describe('skipper tier', () => {
beforeAll(() => setTier('paid', 'skipper'));
it('PUT oidc_custom succeeds', async () => {
const res = await supertest(app)
.put('/api/sso/config/oidc_custom')
.set('Authorization', `Bearer ${adminToken}`)
.send({ enabled: false });
expect(res.status).toBe(200);
});
it('PUT oidc_google succeeds', async () => {
const res = await supertest(app)
.put('/api/sso/config/oidc_google')
.set('Authorization', `Bearer ${adminToken}`)
.send({ enabled: false });
expect(res.status).toBe(200);
});
it('PUT ldap returns 403 ADMIRAL_REQUIRED', async () => {
const res = await supertest(app)
.put('/api/sso/config/ldap')
.set('Authorization', `Bearer ${adminToken}`)
.send({ enabled: false });
expect(res.status).toBe(403);
expect(res.body.code).toBe('ADMIRAL_REQUIRED');
});
it('DELETE ldap returns 403 ADMIRAL_REQUIRED', async () => {
const res = await supertest(app)
.delete('/api/sso/config/ldap')
.set('Authorization', `Bearer ${adminToken}`);
expect(res.status).toBe(403);
expect(res.body.code).toBe('ADMIRAL_REQUIRED');
});
});
describe('admiral tier', () => {
beforeAll(() => setTier('paid', 'admiral'));
it('PUT ldap succeeds', async () => {
const res = await supertest(app)
.put('/api/sso/config/ldap')
.set('Authorization', `Bearer ${adminToken}`)
.send({ enabled: false });
expect(res.status).toBe(200);
});
it('PUT oidc_okta succeeds', async () => {
const res = await supertest(app)
.put('/api/sso/config/oidc_okta')
.set('Authorization', `Bearer ${adminToken}`)
.send({ enabled: false });
expect(res.status).toBe(200);
});
});
});
backend/src/middleware/tierGates.ts
+11
View File
@@ -64,6 +64,17 @@ export const requireScheduledTaskTier = (action: string, req: Request, res: Resp
return requireAdmiral(req, res);
};
/**
* Tier gate for SSO providers. The split is by delivery (turnkey vs self-configured), not by
* protocol: Custom OIDC stays free so self-hosters can wire any OIDC IdP (Authelia, Keycloak,
* Authentik, Zitadel); paid tiers get one-click presets and LDAP/AD.
*/
export const requireTierForSsoProvider = (provider: string, req: Request, res: Response): boolean => {
if (provider === 'oidc_custom') return true;
if (provider === 'ldap') return requireAdmiral(req, res);
return requirePaid(req, res);
};
/** 400s when the request has no object body. Used by endpoints that always expect JSON input. */
export const requireBody = (req: Request, res: Response): boolean => {
if (!req.body || typeof req.body !== 'object') {
backend/src/routes/ssoConfig.ts
+23 -11
View File
@@ -1,12 +1,19 @@
import { Router, type Request, type Response } from 'express';
import { DatabaseService } from '../services/DatabaseService';
import { SSOService, type SSOProviderConfig } from '../services/SSOService';
import { requireAdmin } from '../middleware/tierGates';
import { requireAdmin, requireTierForSsoProvider } from '../middleware/tierGates';
import { rejectApiTokenScope } from '../middleware/apiTokenScope';
const VALID_SSO_PROVIDERS = ['ldap', 'oidc_google', 'oidc_github', 'oidc_okta', 'oidc_custom'] as const;
const SSO_SCOPE_MESSAGE = 'API tokens cannot access SSO configuration.';
/** Reject unknown provider ids before any tier check so invalid inputs 400 rather than leaking a tier-specific 403. */
function rejectInvalidProvider(provider: string, res: Response): boolean {
if ((VALID_SSO_PROVIDERS as readonly string[]).includes(provider)) return false;
res.status(400).json({ error: 'Invalid SSO provider' });
return true;
}
function stripSecrets<T extends object>(config: T): Partial<T> {
const copy: Partial<T> = { ...config };
delete (copy as { ldapBindPassword?: unknown }).ldapBindPassword;
@@ -35,8 +42,11 @@ ssoConfigRouter.get('/', (req: Request, res: Response): void => {
ssoConfigRouter.get('/:provider', (req: Request, res: Response): void => {
if (rejectApiTokenScope(req, res, SSO_SCOPE_MESSAGE)) return;
if (!requireAdmin(req, res)) return;
const provider = String(req.params.provider);
if (rejectInvalidProvider(provider, res)) return;
if (!requireTierForSsoProvider(provider, req, res)) return;
try {
const config = SSOService.getInstance().getProviderConfig(String(req.params.provider));
const config = SSOService.getInstance().getProviderConfig(provider);
if (!config) {
res.status(404).json({ error: 'Provider not configured' });
return;
@@ -51,12 +61,10 @@ ssoConfigRouter.get('/:provider', (req: Request, res: Response): void => {
ssoConfigRouter.put('/:provider', (req: Request, res: Response): void => {
if (rejectApiTokenScope(req, res, SSO_SCOPE_MESSAGE)) return;
if (!requireAdmin(req, res)) return;
const provider = String(req.params.provider);
if (rejectInvalidProvider(provider, res)) return;
if (!requireTierForSsoProvider(provider, req, res)) return;
try {
const provider = String(req.params.provider);
if (!(VALID_SSO_PROVIDERS as readonly string[]).includes(provider)) {
res.status(400).json({ error: 'Invalid SSO provider' });
return;
}
const config = { ...req.body, provider } as SSOProviderConfig;
if (config.enabled) {
@@ -88,10 +96,12 @@ ssoConfigRouter.put('/:provider', (req: Request, res: Response): void => {
ssoConfigRouter.delete('/:provider', (req: Request, res: Response): void => {
if (rejectApiTokenScope(req, res, SSO_SCOPE_MESSAGE)) return;
if (!requireAdmin(req, res)) return;
const provider = String(req.params.provider);
if (rejectInvalidProvider(provider, res)) return;
if (!requireTierForSsoProvider(provider, req, res)) return;
try {
const deletedProvider = String(req.params.provider);
SSOService.getInstance().deleteProviderConfig(deletedProvider);
console.log(`[SSO] Config deleted: ${deletedProvider}`);
SSOService.getInstance().deleteProviderConfig(provider);
console.log(`[SSO] Config deleted: ${provider}`);
res.json({ success: true, message: 'SSO configuration deleted' });
} catch (error) {
console.error('[SSO] Failed to delete SSO config:', error);
@@ -102,8 +112,10 @@ ssoConfigRouter.delete('/:provider', (req: Request, res: Response): void => {
ssoConfigRouter.post('/:provider/test', async (req: Request, res: Response): Promise<void> => {
if (rejectApiTokenScope(req, res, SSO_SCOPE_MESSAGE)) return;
if (!requireAdmin(req, res)) return;
const provider = String(req.params.provider);
if (rejectInvalidProvider(provider, res)) return;
if (!requireTierForSsoProvider(provider, req, res)) return;
try {
const provider = String(req.params.provider);
if (provider === 'ldap') {
const result = await SSOService.getInstance().testLdapConnection();
res.json(result);