gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-21 07:36:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(sso): split SSO providers by delivery model across tiers (#754)

Browse Source 
Custom OIDC stays on Community so self-hosters can wire any spec-compliant
OIDC identity provider (Authelia, Keycloak, Authentik, Zitadel, and others).
Google, GitHub, and Okta one-click presets move to Skipper. LDAP / Active
Directory and scoped RBAC are Admiral-only.

Backend enforces the split via a new requireTierForSsoProvider helper in
middleware/tierGates.ts, applied after requireAdmin in all four ssoConfig
mutation handlers. GET /sso/config (list) stays ungated so downgraded
admins can still see previously-configured providers. Invalid provider ids
now 400 before the tier check to avoid leaking tier information.

Frontend adds a compact mode to PaidGate and AdmiralGate for inline
list-item locks, and SSOSection reorders the provider cards as
Custom OIDC > Google > GitHub > Okta > LDAP to reinforce the
free-to-paid progression.

Stale 'SSO is Admiral' copy in AdmiralGate, PaidGate, and the Admiral
upgrade card on the License settings page has been replaced to reflect the
new split. User-facing licensing, SSO, overview, quickstart, and security
docs have been updated with the per-tier provider matrix.
This commit is contained in:
Anso
2026-04-24 15:48:03 -04:00
committed by GitHub
parent 3a20e37625
commit a502da54ee
12 changed files with 256 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/components/PaidGate.tsx
+7 -4
View File
@@ -6,6 +6,9 @@ import { useLicense } from '@/context/LicenseContext';
interface PaidGateProps {
children: ReactNode;
featureName?: string;
// Inline compact lock for list items (e.g. a single SSO provider card). Skips
// the full-page upsell and dismiss timer; always renders the blurred + pill style.
compact?: boolean;
}
const DISMISS_KEY = 'sencho-upgrade-prompt-dismissed';
@@ -16,13 +19,13 @@ function isDismissedFromStorage(): boolean {
return !!dismissedAt && Date.now() - parseInt(dismissedAt, 10) < DISMISS_DURATION_MS;
}
export function PaidGate({ children, featureName = 'This feature' }: PaidGateProps) {
export function PaidGate({ children, featureName = 'This feature', compact = false }: PaidGateProps) {
const { isPaid } = useLicense();
const [dismissed, setDismissed] = useState(isDismissedFromStorage);
if (isPaid) return <>{children}</>;
if (dismissed) {
if (compact || dismissed) {
return (
<div className="relative">
<div className="opacity-40 pointer-events-none select-none blur-[2px]">
@@ -31,7 +34,7 @@ export function PaidGate({ children, featureName = 'This feature' }: PaidGatePro
<div className="absolute inset-0 flex items-start justify-center pt-8">
<div className="flex items-center gap-2 px-3 py-1.5 rounded-full bg-muted/80 border border-border text-muted-foreground text-xs">
<Compass className="w-3 h-3" />
Upgrade to unlock more features
Upgrade to unlock {featureName}
</div>
</div>
</div>
@@ -46,7 +49,7 @@ export function PaidGate({ children, featureName = 'This feature' }: PaidGatePro
<div className="text-center max-w-md">
<h3 className="text-lg font-semibold mb-2">{featureName} requires a paid license</h3>
<p className="text-sm text-muted-foreground">
Unlock features like fleet management, viewer accounts, and more with a Skipper or Admiral license.
Unlock features like fleet management, viewer accounts, one-click Google / GitHub / Okta SSO, and more with a Skipper or Admiral license.
For enterprise pricing or questions, contact{' '}
<a href="mailto:licensing@sencho.io" className="text-brand hover:underline">licensing@sencho.io</a>.
</p>