Merge remote-tracking branch 'origin/staging' into develop

backend/src/app/auth/oidc.clj

@@ -620,9 +620,6 @@
       (some? (:external-session-id state))
       (assoc :external-session-id (:external-session-id state))
 
-      (some? (:token/expires-in tdata))
-      (assoc :sso-token-exp (ct/in-future {:seconds (:token/expires-in tdata)}))
-
       ;; If state token comes with props, merge them. The state token
       ;; props can contain pm_ and utm_ prefixed query params.
       (map? (:props state))
@@ -906,9 +903,9 @@
       (let [organization-id (:organization-id state)
             sso             (nitrate/call cfg :get-organization-sso {:organization-id organization-id})
             provider        (prepare-organization-sso-provider cfg sso)
-            info            (get-info cfg provider state code)
+            _info           (get-info cfg provider state code)
             session         (session/get-session request)
-            exp             (or (:sso-token-exp info) (ct/in-future {:hours 48}))]
+            exp             (ct/in-future {:minutes 15})]
         (when (and session organization-id)
           (let [props (-> (or (:props session) {})
                           (update :sso assoc organization-id exp))]

backend/src/app/rpc/commands/teams_invitations.clj

@@ -460,6 +460,10 @@
   [cfg {:keys [::rpc/profile-id team-id role emails] :as params}]
   (let [perms    (teams/get-permissions cfg profile-id team-id)
         profile  (db/get-by-id cfg :profile profile-id)
+        team     (db/get-by-id cfg :team team-id)
+        team-with-org (when (contains? cf/flags :admin-console)
+                        (nitrate/add-organization-info-to-team cfg team {}))
+        organization (:organization team-with-org)
         ;; Determine which format is being used
         using-emails-format? (and emails role)
         ;; Handle both parameter formats
@@ -475,6 +479,17 @@
       (ex/raise :type :validation
                 :code :insufficient-permissions))
 
+    (when (and (contains? cf/flags :admin-console)
+               organization
+               (not (cto/allowed? :send-invitations
+                                  {:organization-perms {:owner-id    (:owner-id organization)
+                                                        :permissions (:permissions organization)}
+                                   :profile-id profile-id
+                                   :team-perms perms})))
+      (ex/raise :type :validation
+                :code :insufficient-permissions
+                :hint "Organization policy does not allow you to send invitations"))
+
     (when (> invitation-count max-invitations-by-request-threshold)
       (ex/raise :type :validation
                 :code :max-invitations-by-request

frontend/src/app/main/ui/dashboard/sidebar.scss

@@ -699,12 +699,13 @@
   grid-template-columns: 1fr auto auto;
   gap: var(--sp-s);
   height: 100%;
-  padding: 0 px2rem(10);
+  padding: 0 0 0 px2rem(10);
   width: 100%;
 }
 
 .current-organization-no-options {
   gap: 0;
+  padding: 0 px2rem(8) 0 px2rem(10);
 }
 
 .current-organization .arrow-icon {
@@ -734,11 +735,15 @@
   display: flex;
   justify-content: center;
   align-items: center;
-  width: $sz-48;
-  height: $sz-48;
+  width: $sz-28;
+  height: 100%;
+  padding: 0;
+  border-radius: 0 $br-8 $br-8 0;
 
   &:hover {
     --icon-stroke: var(--color-accent-primary);
+
+    cursor: pointer;
   }
 }