Oskar Otwinowski
9f01e315c1
SSO settings page: resolve plan before the role check. A non-Enterprise org now renders the upsell state for every role instead of showing a "permission denied" panel to non-Owners for a feature their org can't use yet. manage:sso is only enforced once the org is actually entitled. Extracts EMPTY_SSO_STATUS and uses throwPermissionDenied(). Also removes the client-side SSO session fetch guard. It monkeypatched global window.fetch, which made it the initiator of every request and obfuscated the real call site on any 4xx/5xx. Session revocation is still enforced server-side on every authenticated request and surfaces as a logout redirect on the next navigation/refresh, so the client guard was UX-only and not worth the cross-cutting cost.
10 lines
401 B
TypeScript
10 lines
401 B
TypeScript
// Shared (server + client) constants for the SSO session-revalidation flow.
|
|
|
|
export const SSO_SESSION_EXPIRED_REASON = "session_expired";
|
|
|
|
// The reason rides as its own `?reason=` param, not `?redirectTo=/login...`,
|
|
// because the redirect sanitizer rejects /login and would drop it.
|
|
export function ssoSessionExpiredLogoutPath(): string {
|
|
return `/logout?reason=${SSO_SESSION_EXPIRED_REASON}`;
|
|
}
|