Promote foss-sandbox to foss-main: corporate-id, SSO UX, org provisioning - #35
Merged
Conversation
…min login Extend the existing per-user Askii LiteLLM auto-provisioning so the shared SMB/Organization search space also gets a key automatically, the first time its is_owner admin logs in. The whole team then has AI features in the shared space with no manual config. Mirrors the personal flow as a direct analogue: - New SearchSpace.litellm_auto_provisioned_at one-shot marker (migration moneta_002), the SearchSpace-scoped counterpart of the per-user marker. - ensure_org_litellm_keys / ensure_org_litellm_keys_for_admin in litellm_provisioning.py: find the SMB space by name, gate on is_owner (is_search_space_owner), mint a fresh Askii key, wire the 4 SearchSpace LLM FKs, stamp the marker -- all under a begin_nested() SAVEPOINT with SELECT ... FOR UPDATE for exactly-once under concurrent logins. - Reuses should_auto_provision / _provision_via_askii / _build_config_rows unchanged; personal path untouched. - smb_auto_join: extracted reusable find_smb_search_space(session) + _smb_workspace_slug(); auto_join now reuses them. - on_after_login wires the org call after the personal one, reading the mPass token once and committing the two steps on independent boundaries. Best-effort + retry: any failure (transient Askii error, missing token, no SMB space yet, not-yet-admin) leaves the marker NULL and retries on the admin's next login. One-shot once stamped. Tests: 21 new org cases (core + wrapper) + updated on_after_login commit tests + new org-wiring test. 52 passing; ruff clean; alembic single head (143 -> moneta_001 -> moneta_002). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Address Copilot review on #29: ensure_org_litellm_keys_for_admin did the SMB space lookup + ownership query before discovering it had no mPass access token to mint with. Return early on a None token (after the feature gate, before any DB round-trip) — provisioning can't succeed without it anyway, and non-mPass logins (fastapi-users JWT, Google OAuth, dev hitting the backend directly) hit this every request. The core ensure_org_litellm_keys keeps its own None-token check as defense-in-depth; the marker stays NULL so the admin's next mPass login retries. Adds a wrapper test asserting no DB calls when the token is None. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Resolves F821 ruff errors on lines 883, 893, 942 where SECRET was used but never imported into app.py (it lives in app.users).
Suppress the DownloadButton on the hero section and the download CTA in the sidebar user profile when isSSOAuth() is true, so managed/SSO deployments don't surface desktop-download prompts. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Address Copilot review on #29: on_after_login ran the org provisioning call and a second COMMIT even when access_token was None. The org wrapper now early-returns without DB work in that case, so the commit was an empty no-op on a hook that fires on every authenticated request. Guard the org call + commit on `access_token is not None` (fastapi-users JWT, Google OAuth, dev-direct flows reach this hook without an mPass token). Behavior-preserving — org provisioning cannot run without the token anyway. Adds a hook test asserting the org step is skipped and only the personal step commits when no token. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- ruff-format: reformat surfsense_backend/app/app.py (trailing newline after the new SECRET import) - biome check --write: fix import ordering and formatting violations across 28 files in surfsense_web/ (atoms, components/ui, components/ tool-ui, lib/apis, svgr.d.ts) — these pre-existing issues caused the TypeScript/JavaScript Quality check to fail on every PR
Extract downloadAllowed = !isDesktop && !isSSOAuth() and apply it to all four download surfaces, including the two profile dropdown items that were missed in the original commit. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@rocicorp/zero-sqlite3 requires readline/readline.h to compile its native extension. The GitHub Actions Ubuntu runner doesn't include libreadline-dev by default, causing pnpm install to fail with a gyp build error before biome can even run.
…y name Soft navigation (router.replace) preserved the React tree after the SSO cookie handoff, leaving currentUserAtom stuck with enabled:false for the entire session. A full page reload ensures the token is in localStorage before any atom evaluates. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…oning feat(surfsense): auto-provision org-space LiteLLM key on first SMB admin login
chore(ci): diagnose failing checks — fix SECRET import
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update PR template to standard format
feat(web): hide download UI when SSO auth is active
…first-login fix(surfsense): use hard redirect on SSO callback to fix blank display name
Add corporate_id check to ProxyAuth middleware
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Promotes foss-sandbox changes to production. Key changes:
X-Auth-Request-Access-Tokenheader and validatescustom:corporate_idagainstSMB_CORPORATE_IDenv var. Returns 403 on mismatch. Closes the Bearer token bypass that skips mpass-auth-proxy.Testing