gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-19 14:56:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(sso): split SSO providers by delivery model across tiers (#754)

Browse Source 
Custom OIDC stays on Community so self-hosters can wire any spec-compliant
OIDC identity provider (Authelia, Keycloak, Authentik, Zitadel, and others).
Google, GitHub, and Okta one-click presets move to Skipper. LDAP / Active
Directory and scoped RBAC are Admiral-only.

Backend enforces the split via a new requireTierForSsoProvider helper in
middleware/tierGates.ts, applied after requireAdmin in all four ssoConfig
mutation handlers. GET /sso/config (list) stays ungated so downgraded
admins can still see previously-configured providers. Invalid provider ids
now 400 before the tier check to avoid leaking tier information.

Frontend adds a compact mode to PaidGate and AdmiralGate for inline
list-item locks, and SSOSection reorders the provider cards as
Custom OIDC > Google > GitHub > Okta > LDAP to reinforce the
free-to-paid progression.

Stale 'SSO is Admiral' copy in AdmiralGate, PaidGate, and the Admiral
upgrade card on the License settings page has been replaced to reflect the
new split. User-facing licensing, SSO, overview, quickstart, and security
docs have been updated with the per-tier provider matrix.
This commit is contained in:
Anso
2026-04-24 15:48:03 -04:00
committed by GitHub
parent 3a20e37625
commit a502da54ee
12 changed files with 256 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/routes/ssoConfig.ts
+23 -11
View File
@@ -1,12 +1,19 @@
import { Router, type Request, type Response } from 'express';
import { DatabaseService } from '../services/DatabaseService';
import { SSOService, type SSOProviderConfig } from '../services/SSOService';
import { requireAdmin } from '../middleware/tierGates';
import { requireAdmin, requireTierForSsoProvider } from '../middleware/tierGates';
import { rejectApiTokenScope } from '../middleware/apiTokenScope';
const VALID_SSO_PROVIDERS = ['ldap', 'oidc_google', 'oidc_github', 'oidc_okta', 'oidc_custom'] as const;
const SSO_SCOPE_MESSAGE = 'API tokens cannot access SSO configuration.';
/** Reject unknown provider ids before any tier check so invalid inputs 400 rather than leaking a tier-specific 403. */
function rejectInvalidProvider(provider: string, res: Response): boolean {
if ((VALID_SSO_PROVIDERS as readonly string[]).includes(provider)) return false;
res.status(400).json({ error: 'Invalid SSO provider' });
return true;
}
function stripSecrets<T extends object>(config: T): Partial<T> {
const copy: Partial<T> = { ...config };
delete (copy as { ldapBindPassword?: unknown }).ldapBindPassword;
@@ -35,8 +42,11 @@ ssoConfigRouter.get('/', (req: Request, res: Response): void => {
ssoConfigRouter.get('/:provider', (req: Request, res: Response): void => {
if (rejectApiTokenScope(req, res, SSO_SCOPE_MESSAGE)) return;
if (!requireAdmin(req, res)) return;
const provider = String(req.params.provider);
if (rejectInvalidProvider(provider, res)) return;
if (!requireTierForSsoProvider(provider, req, res)) return;
try {
const config = SSOService.getInstance().getProviderConfig(String(req.params.provider));
const config = SSOService.getInstance().getProviderConfig(provider);
if (!config) {
res.status(404).json({ error: 'Provider not configured' });
return;
@@ -51,12 +61,10 @@ ssoConfigRouter.get('/:provider', (req: Request, res: Response): void => {
ssoConfigRouter.put('/:provider', (req: Request, res: Response): void => {
if (rejectApiTokenScope(req, res, SSO_SCOPE_MESSAGE)) return;
if (!requireAdmin(req, res)) return;
const provider = String(req.params.provider);
if (rejectInvalidProvider(provider, res)) return;
if (!requireTierForSsoProvider(provider, req, res)) return;
try {
const provider = String(req.params.provider);
if (!(VALID_SSO_PROVIDERS as readonly string[]).includes(provider)) {
res.status(400).json({ error: 'Invalid SSO provider' });
return;
}
const config = { ...req.body, provider } as SSOProviderConfig;
if (config.enabled) {
@@ -88,10 +96,12 @@ ssoConfigRouter.put('/:provider', (req: Request, res: Response): void => {
ssoConfigRouter.delete('/:provider', (req: Request, res: Response): void => {
if (rejectApiTokenScope(req, res, SSO_SCOPE_MESSAGE)) return;
if (!requireAdmin(req, res)) return;
const provider = String(req.params.provider);
if (rejectInvalidProvider(provider, res)) return;
if (!requireTierForSsoProvider(provider, req, res)) return;
try {
const deletedProvider = String(req.params.provider);
SSOService.getInstance().deleteProviderConfig(deletedProvider);
console.log(`[SSO] Config deleted: ${deletedProvider}`);
SSOService.getInstance().deleteProviderConfig(provider);
console.log(`[SSO] Config deleted: ${provider}`);
res.json({ success: true, message: 'SSO configuration deleted' });
} catch (error) {
console.error('[SSO] Failed to delete SSO config:', error);
@@ -102,8 +112,10 @@ ssoConfigRouter.delete('/:provider', (req: Request, res: Response): void => {
ssoConfigRouter.post('/:provider/test', async (req: Request, res: Response): Promise<void> => {
if (rejectApiTokenScope(req, res, SSO_SCOPE_MESSAGE)) return;
if (!requireAdmin(req, res)) return;
const provider = String(req.params.provider);
if (rejectInvalidProvider(provider, res)) return;
if (!requireTierForSsoProvider(provider, req, res)) return;
try {
const provider = String(req.params.provider);
if (provider === 'ldap') {
const result = await SSOService.getInstance().testLdapConnection();
res.json(result);