gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-28 11:17:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(sso): split SSO providers by delivery model across tiers (#754)

Browse Source 
Custom OIDC stays on Community so self-hosters can wire any spec-compliant
OIDC identity provider (Authelia, Keycloak, Authentik, Zitadel, and others).
Google, GitHub, and Okta one-click presets move to Skipper. LDAP / Active
Directory and scoped RBAC are Admiral-only.

Backend enforces the split via a new requireTierForSsoProvider helper in
middleware/tierGates.ts, applied after requireAdmin in all four ssoConfig
mutation handlers. GET /sso/config (list) stays ungated so downgraded
admins can still see previously-configured providers. Invalid provider ids
now 400 before the tier check to avoid leaking tier information.

Frontend adds a compact mode to PaidGate and AdmiralGate for inline
list-item locks, and SSOSection reorders the provider cards as
Custom OIDC > Google > GitHub > Okta > LDAP to reinforce the
free-to-paid progression.

Stale 'SSO is Admiral' copy in AdmiralGate, PaidGate, and the Admiral
upgrade card on the License settings page has been replaced to reflect the
new split. User-facing licensing, SSO, overview, quickstart, and security
docs have been updated with the per-tier provider matrix.
This commit is contained in:
Anso
2026-04-24 15:48:03 -04:00
committed by GitHub
parent 3a20e37625
commit a502da54ee
12 changed files with 256 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/components/AdmiralGate.tsx
+6 -3
View File
@@ -6,6 +6,9 @@ import { useLicense } from '@/context/LicenseContext';
interface AdmiralGateProps {
children: ReactNode;
featureName?: string;
// Inline compact lock for list items (e.g. a single SSO provider card). Skips
// the full-page upsell and dismiss timer; always renders the blurred + pill style.
compact?: boolean;
}
const DISMISS_KEY = 'sencho-admiral-upgrade-prompt-dismissed';
@@ -16,13 +19,13 @@ function isDismissedFromStorage(): boolean {
return !!dismissedAt && Date.now() - parseInt(dismissedAt, 10) < DISMISS_DURATION_MS;
}
export function AdmiralGate({ children, featureName = 'This feature' }: AdmiralGateProps) {
export function AdmiralGate({ children, featureName = 'This feature', compact = false }: AdmiralGateProps) {
const { isPaid, license } = useLicense();
const [dismissed, setDismissed] = useState(isDismissedFromStorage);
if (isPaid && license?.variant === 'admiral') return <>{children}</>;
if (dismissed) {
if (compact || dismissed) {
return (
<div className="relative">
<div className="opacity-40 pointer-events-none select-none blur-[2px]">
@@ -46,7 +49,7 @@ export function AdmiralGate({ children, featureName = 'This feature' }: AdmiralG
<div className="text-center max-w-md">
<h3 className="text-lg font-semibold mb-2">{featureName} requires Sencho Admiral</h3>
<p className="text-sm text-muted-foreground">
Unlock team features like SSO authentication, audit logging, API tokens, and unlimited user accounts with a Sencho Admiral license.
Unlock team features like LDAP / Active Directory, audit logging, API tokens, and unlimited user accounts with a Sencho Admiral license.
For enterprise pricing or questions, contact{' '}
<a href="mailto:licensing@sencho.io" className="text-brand hover:underline">licensing@sencho.io</a>.
</p>