feat(auth): SSO-only ("enforced") login primitive + identity-source provenance (ADR-0024 D5.2/D4)#2349
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📓 Docs Drift CheckThis PR changes 3 package(s): 94 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
…rovenance (ADR-0024 D5.2/D4) Open mechanism (ADR-0002) for per-deployment SSO-only login — drives the cloud's per-env enforced mode AND self-host OSS/EE (via OS_AUTH_SSO_ONLY). Generic over the IdP (cloud-as-IdP or a customer's own OIDC/SAML). - AuthConfig.ssoOnlyMode + AuthFeatures.ssoEnforced (spec). When on: emailAndPassword.disableSignUp is forced true + /auth/config emits features.ssoEnforced so the login UI hides the local password form + self-registration. `enabled` stays true → the env owner keeps a break-glass password escape hatch (managed users simply hold no credential). - sys_user.source (idp-provisioned|env-native, ADR-0024 D4 provenance), stamped by a framework-generic account.create.after hook composed with any host databaseHooks. Break-glass safe + idempotent: a user holding a local credential stays env-native; a credential gained after an SSO link flips a previously-managed owner back. - Managed-vs-native gating: change_my_password / change_my_email / delete_my_account hide for idp-provisioned users (can't self-mint a local password that bypasses enforced SSO). - Break-glass guard: refuse to delete/ban the LAST holder of a local credential (LAST_LOCAL_CREDENTIAL) so an IdP outage can never lock the org out. Inert until a consumer sets ssoOnlyMode (cloud per-env / OS_AUTH_SSO_ONLY). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
os-zhuang
force-pushed
the
feat/sso-enforced-mode
branch
from
June 26, 2026 14:08
106b478 to
1ce8963
Compare
os-zhuang
added a commit
to objectstack-ai/objectui
that referenced
this pull request
Jun 26, 2026
…R-0024 D5.2) (#2012) Consumes the framework's new `/auth/config` `features.ssoEnforced` signal (objectstack-ai/objectstack#2349). When the server locks the team login to the IdP, LoginForm now: - hides the local email/password form + the sign-up link, - shows the federated button(s) only (SocialSignInButtons — e.g. "Continue with ObjectStack" for cloud-as-IdP, or an external OIDC/SAML provider), - offers an understated **break-glass** "Use a password instead" link that reveals the password form for the env owner / local admin (e.g. during an IdP outage), with a "Back to single sign-on" toggle. `emailPassword.enabled === false` is honored as a belt-and-suspenders enforced signal for older servers. Default-off: a failed `/auth/config` fetch never hides the form. New i18n labels (usePasswordText / backToSsoText / ssoOnlyDescription). 4 new LoginForm tests; full auth suite green (115). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Open mechanism (ADR-0002) for per-deployment SSO-only ("enforced") login — drives the cloud per-env enforced mode AND self-host OSS/EE (via
OS_AUTH_SSO_ONLY). Generic over the IdP (cloud-as-IdP or a customer's own OIDC/SAML). Inert until a consumer setsssoOnlyMode.What
AuthConfig.ssoOnlyMode+AuthFeatures.ssoEnforced(spec). When on:emailAndPassword.disableSignUpforcedtrue+/auth/configemitsfeatures.ssoEnforcedso the login UI hides the local password form + self-registration.enabledstaystrue→ the env owner keeps a break-glass password escape hatch (managed users simply hold no credential). Self-host knobOS_AUTH_SSO_ONLYmirrors the existingOS_DISABLE_SIGNUPpattern.sys_user.source(idp-provisioned|env-native, ADR-0024 D4 provenance), stamped by a framework-genericaccount.create.afterhook composed with any hostdatabaseHooks. Break-glass safe + idempotent: a user holding a local credential staysenv-native; a credential gained after an SSO link flips a previously-managed owner back (covers the owner-set-password-after-first-SSO timing).change_my_password/change_my_email/delete_my_accounthide foridp-provisionedusers (can't self-mint a local password that bypasses enforced SSO).LAST_LOCAL_CREDENTIAL) so an IdP outage can never lock the org out.Open-core
Framework = the mechanism (open). The cloud drives
ssoOnlyModeper-env + Business+ plan-gating + Free/Team=enforced default (separate cloud PR). Self-host configures viaOS_AUTH_SSO_ONLY.Verify
turbo run buildgreen across all 68 packages (dts/typecheck clean). Browser E2E of the enforced login + managed-vs-native surface lands with the cloud wiring.🤖 Generated with Claude Code