|
| 1 | +import { Team } from "generatedApi"; |
| 2 | +import { Sheet } from "@ui/Sheet"; |
| 3 | +import { Callout } from "@ui/Callout"; |
| 4 | +import { Checkbox } from "@ui/Checkbox"; |
| 5 | +import { Spinner } from "@ui/Spinner"; |
| 6 | +import { TextInput } from "@ui/TextInput"; |
| 7 | +import { Button } from "@ui/Button"; |
| 8 | +import { useIsCurrentMemberTeamAdmin } from "api/roles"; |
| 9 | +import { |
| 10 | + useTeamEntitlements, |
| 11 | + useGetSSO, |
| 12 | + useEnableSSO, |
| 13 | + useUpdateSSODomain, |
| 14 | + useDisableSSO, |
| 15 | +} from "api/teams"; |
| 16 | +import { useState, useMemo } from "react"; |
| 17 | +import { Tooltip } from "@ui/Tooltip"; |
| 18 | +import { useProfileEmails } from "api/profile"; |
| 19 | + |
| 20 | +export function TeamSSO({ team }: { team: Team }) { |
| 21 | + const hasAdminPermissions = useIsCurrentMemberTeamAdmin(); |
| 22 | + const entitlements = useTeamEntitlements(team.id); |
| 23 | + const ssoOrganization = useGetSSO(team.id); |
| 24 | + const enableSSO = useEnableSSO(team.id); |
| 25 | + const updateSSODomain = useUpdateSSODomain(team.id); |
| 26 | + const disableSSO = useDisableSSO(team.id); |
| 27 | + const profileEmails = useProfileEmails(); |
| 28 | + |
| 29 | + const [isSubmitting, setIsSubmitting] = useState(false); |
| 30 | + const [showDomainForm, setShowDomainForm] = useState(false); |
| 31 | + const [domain, setDomain] = useState(""); |
| 32 | + const [domainError, setDomainError] = useState<React.ReactNode>(null); |
| 33 | + |
| 34 | + const ssoEnabled = entitlements?.ssoEnabled ?? false; |
| 35 | + const isSSOConfigured = !!ssoOrganization; |
| 36 | + const currentDomain = ssoOrganization?.domains?.[0]?.domain; |
| 37 | + |
| 38 | + // Extract verified domains from team member emails |
| 39 | + const verifiedDomains = useMemo(() => { |
| 40 | + if (!profileEmails) return new Set<string>(); |
| 41 | + const domains = new Set<string>(); |
| 42 | + profileEmails.forEach(({ email, isVerified }) => { |
| 43 | + const emailDomain = email.split("@")[1]; |
| 44 | + if (emailDomain && isVerified) { |
| 45 | + domains.add(emailDomain.toLowerCase()); |
| 46 | + } |
| 47 | + }); |
| 48 | + return domains; |
| 49 | + }, [profileEmails]); |
| 50 | + |
| 51 | + const handleDomainFormSubmit = async (e: React.FormEvent) => { |
| 52 | + e.preventDefault(); |
| 53 | + const trimmedDomain = domain.trim().toLowerCase(); |
| 54 | + |
| 55 | + if (!trimmedDomain) { |
| 56 | + setDomainError("Domain is required"); |
| 57 | + return; |
| 58 | + } |
| 59 | + |
| 60 | + // Validate that domain matches a verified email domain |
| 61 | + if (!verifiedDomains.has(trimmedDomain)) { |
| 62 | + setDomainError( |
| 63 | + <div> |
| 64 | + The domain "{trimmedDomain}" does not match any verified email |
| 65 | + addresses on your account.{" "} |
| 66 | + <a |
| 67 | + href="/profile" |
| 68 | + target="_blank" |
| 69 | + rel="noopener noreferrer" |
| 70 | + className="text-content-link underline" |
| 71 | + > |
| 72 | + Add a verified email |
| 73 | + </a>{" "} |
| 74 | + with this domain before setting up SSO. |
| 75 | + </div>, |
| 76 | + ); |
| 77 | + return; |
| 78 | + } |
| 79 | + |
| 80 | + setDomainError(null); |
| 81 | + setIsSubmitting(true); |
| 82 | + try { |
| 83 | + if (isSSOConfigured) { |
| 84 | + await updateSSODomain({ domain: trimmedDomain }); |
| 85 | + } else { |
| 86 | + await enableSSO({ domain: trimmedDomain }); |
| 87 | + } |
| 88 | + setShowDomainForm(false); |
| 89 | + setDomain(""); |
| 90 | + } finally { |
| 91 | + setIsSubmitting(false); |
| 92 | + } |
| 93 | + }; |
| 94 | + |
| 95 | + return ( |
| 96 | + <> |
| 97 | + <h2>Single Sign-On (SSO)</h2> |
| 98 | + |
| 99 | + {!ssoEnabled && ( |
| 100 | + <Callout variant="upsell"> |
| 101 | + SSO is not available on your plan. Upgrade your plan to use SSO. |
| 102 | + </Callout> |
| 103 | + )} |
| 104 | + |
| 105 | + <Sheet> |
| 106 | + <h3 className="mb-2">Configuration</h3> |
| 107 | + <p className="mb-4 text-xs text-content-secondary"> |
| 108 | + Configure Single Sign-On (SSO) for your team to enable secure |
| 109 | + authentication through your identity provider. |
| 110 | + </p> |
| 111 | + |
| 112 | + <Tooltip |
| 113 | + tip={ |
| 114 | + !hasAdminPermissions |
| 115 | + ? "You do not have permission to change SSO settings." |
| 116 | + : !ssoEnabled |
| 117 | + ? "SSO is not available on your plan." |
| 118 | + : undefined |
| 119 | + } |
| 120 | + > |
| 121 | + <label className="flex items-center gap-2 text-sm"> |
| 122 | + <Checkbox |
| 123 | + checked={isSSOConfigured || showDomainForm} |
| 124 | + disabled={isSubmitting || !hasAdminPermissions || !ssoEnabled} |
| 125 | + onChange={async () => { |
| 126 | + if (isSSOConfigured) { |
| 127 | + setIsSubmitting(true); |
| 128 | + try { |
| 129 | + await disableSSO(); |
| 130 | + setShowDomainForm(false); |
| 131 | + setDomain(""); |
| 132 | + } finally { |
| 133 | + setIsSubmitting(false); |
| 134 | + } |
| 135 | + } else if (showDomainForm) { |
| 136 | + setShowDomainForm(false); |
| 137 | + setDomain(""); |
| 138 | + } else { |
| 139 | + setShowDomainForm(true); |
| 140 | + setDomain(""); |
| 141 | + } |
| 142 | + }} |
| 143 | + /> |
| 144 | + Enable SSO |
| 145 | + {isSubmitting && ( |
| 146 | + <div> |
| 147 | + <Spinner /> |
| 148 | + </div> |
| 149 | + )} |
| 150 | + </label> |
| 151 | + </Tooltip> |
| 152 | + |
| 153 | + {(showDomainForm || isSSOConfigured) && ( |
| 154 | + <div className="mt-6 space-y-4"> |
| 155 | + {isSSOConfigured && !showDomainForm && ( |
| 156 | + <div className="flex flex-col gap-2"> |
| 157 | + {currentDomain && ( |
| 158 | + <span> |
| 159 | + Current domain:{" "} |
| 160 | + <span className="font-semibold">{currentDomain}</span> |
| 161 | + </span> |
| 162 | + )} |
| 163 | + <Button |
| 164 | + variant="neutral" |
| 165 | + className="w-fit" |
| 166 | + size="sm" |
| 167 | + onClick={() => { |
| 168 | + setShowDomainForm(true); |
| 169 | + setDomain(currentDomain || ""); |
| 170 | + }} |
| 171 | + disabled={isSubmitting || !hasAdminPermissions} |
| 172 | + > |
| 173 | + {currentDomain ? "Change SSO Domain" : "Set SSO Domain"} |
| 174 | + </Button> |
| 175 | + </div> |
| 176 | + )} |
| 177 | + |
| 178 | + {showDomainForm && ( |
| 179 | + <form |
| 180 | + className="max-w-[30rem] space-y-4" |
| 181 | + onSubmit={handleDomainFormSubmit} |
| 182 | + > |
| 183 | + <TextInput |
| 184 | + autoFocus |
| 185 | + id="sso-domain" |
| 186 | + label="Domain" |
| 187 | + value={domain} |
| 188 | + onChange={(e) => { |
| 189 | + setDomain(e.target.value); |
| 190 | + setDomainError(null); |
| 191 | + }} |
| 192 | + placeholder={currentDomain || "example.com"} |
| 193 | + disabled={isSubmitting} |
| 194 | + description="Enter the domain your team's members will use to login with SSO." |
| 195 | + error={domainError} |
| 196 | + /> |
| 197 | + <div className="flex gap-2"> |
| 198 | + <Button |
| 199 | + variant="neutral" |
| 200 | + onClick={() => { |
| 201 | + setShowDomainForm(false); |
| 202 | + setDomain(""); |
| 203 | + setDomainError(null); |
| 204 | + }} |
| 205 | + disabled={isSubmitting} |
| 206 | + > |
| 207 | + Cancel |
| 208 | + </Button> |
| 209 | + <Button |
| 210 | + type="submit" |
| 211 | + variant="primary" |
| 212 | + disabled={!domain.trim() || isSubmitting} |
| 213 | + > |
| 214 | + Save |
| 215 | + </Button> |
| 216 | + </div> |
| 217 | + </form> |
| 218 | + )} |
| 219 | + </div> |
| 220 | + )} |
| 221 | + </Sheet> |
| 222 | + </> |
| 223 | + ); |
| 224 | +} |
0 commit comments