feat(den): support Entra SSO auto-join#1895
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
@pascalandr is attempting to deploy a commit to the Different AI Team on Vercel. A member of the Team first needs to authorize it. |
Merge upstream/dev into pr/entra-sso-auto-join and preserve soft member removal behavior.
# Conflicts: # ee/apps/den-api/src/orgs.ts
Accept invite tokens as well as invitation IDs, claim placeholder invitation members without duplicates, run member-change hooks for new Entra SSO joins, and restore the high dev-mode sign-up rate limit.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 6 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="ee/apps/den-api/src/orgs.ts">
<violation number="1" location="ee/apps/den-api/src/orgs.ts:650">
P2: Post-member-change hooks are skipped when an invitation is accepted via the placeholder-claim path. Claiming a placeholder member sets `createdMember = false`, so downstream hooks (provisioning, audit, seat tracking) never fire for this common invitation acceptance path. Previously hooks ran unconditionally after any invitation acceptance.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| const member = await acceptInvitation(invitation, input.userId) | ||
| await runPostOrganizationMemberChangeHooks({ organizationId: invitation.organizationId, memberId: member.id, change: "added" }) | ||
| const accepted = await acceptInvitation(invitation, input.userId) | ||
| if (accepted.createdMember) { |
There was a problem hiding this comment.
P2: Post-member-change hooks are skipped when an invitation is accepted via the placeholder-claim path. Claiming a placeholder member sets createdMember = false, so downstream hooks (provisioning, audit, seat tracking) never fire for this common invitation acceptance path. Previously hooks ran unconditionally after any invitation acceptance.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At ee/apps/den-api/src/orgs.ts, line 650:
<comment>Post-member-change hooks are skipped when an invitation is accepted via the placeholder-claim path. Claiming a placeholder member sets `createdMember = false`, so downstream hooks (provisioning, audit, seat tracking) never fire for this common invitation acceptance path. Previously hooks ran unconditionally after any invitation acceptance.</comment>
<file context>
@@ -514,20 +646,17 @@ export async function acceptInvitationForUser(input: {
- const member = await acceptInvitation(invitation, input.userId)
- await runPostOrganizationMemberChangeHooks({ organizationId: invitation.organizationId, memberId: member.id, change: "added" })
+ const accepted = await acceptInvitation(invitation, input.userId)
+ if (accepted.createdMember) {
+ await runPostOrganizationMemberChangeHooks({ organizationId: invitation.organizationId, memberId: accepted.member.id, change: "added" })
+ }
</file context>
There was a problem hiding this comment.
Thanks — cubic correctly identified that the acceptance transition must run the post-member-change hooks. I tightened this in da92d43: placeholder invite creation no longer fires member-added hooks, and the placeholder-claim acceptance path still sets createdMember so provisioning/audit/seat hooks run exactly on acceptance. Regression: bun test --conditions development ee/apps/den-api/test/org-invitation-lifecycle.test.ts (4 pass). Typecheck: pnpm --filter @openwork-ee/den-api exec tsc --noEmit.
Annotate invitation member lookup helpers as nullable so the placeholder-claim flow typechecks while preserving duplicate-member prevention.
Add mocked Den API invitation lifecycle tests for preview by invite token, accept by invite token, placeholder-member claim without duplicate active members, and retained team association.
Run invitation placeholder claims through post member-change hooks, keep repeated removals idempotent with active-member guards, and fix nullable placeholder member typing surfaced by Den API typecheck.
Ensure placeholder invitation creation is not treated as a member-added lifecycle event while placeholder claim on acceptance still emits the post-member-change hook with regression coverage.
Add removedAt filters to active organization, Entra auto-join, and plugin grant target member lookups so stale removed rows cannot regain access.
|
Superseded by the clean replacement PR #2174. |
1 participant
Summary
Isolates Entra SSO auto-join hardening: Microsoft provider env/config, profile mapping, auto-join membership helper, auth/org integration, and tests.
Verification
bun test ee/apps/den-api/test/entra-sso.test.ts— passed, 14 tests.git diff --name-status upstream/dev...pr/entra-sso-auto-joinreviewed; notasks/**,docs/scrs/**, codemaps, or generated app-version included.Known risks
Linked issues