From 6d49fb2be0f0ccd14e36cac4a1a63d79906c4f32 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mar=C3=ADa=20Valderrama?= <mavalroot@gmail.com>
Date: Wed, 12 Aug 2026 16:52:27 +0200
Subject: [PATCH 1/3] :bug: Fix organization dropdown alignment (#11216)

---
 frontend/src/app/main/ui/dashboard/sidebar.scss | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/frontend/src/app/main/ui/dashboard/sidebar.scss b/frontend/src/app/main/ui/dashboard/sidebar.scss
index 836e6b6e93..3dcc3b8ba8 100644
--- a/frontend/src/app/main/ui/dashboard/sidebar.scss
+++ b/frontend/src/app/main/ui/dashboard/sidebar.scss
@@ -699,12 +699,13 @@
   grid-template-columns: 1fr auto auto;
   gap: var(--sp-s);
   height: 100%;
-  padding: 0 px2rem(10);
+  padding: 0 0 0 px2rem(10);
   width: 100%;
 }
 
 .current-organization-no-options {
   gap: 0;
+  padding: 0 px2rem(8) 0 px2rem(10);
 }
 
 .current-organization .arrow-icon {
@@ -734,11 +735,15 @@
   display: flex;
   justify-content: center;
   align-items: center;
-  width: $sz-48;
-  height: $sz-48;
+  width: $sz-28;
+  height: 100%;
+  padding: 0;
+  border-radius: 0 $br-8 $br-8 0;
 
   &:hover {
     --icon-stroke: var(--color-accent-primary);
+
+    cursor: pointer;
   }
 }
 

From 93f02ea0b4e1701d42829556bfa022b4eeb54fc9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mar=C3=ADa=20Valderrama?= <mavalroot@gmail.com>
Date: Wed, 12 Aug 2026 16:55:20 +0200
Subject: [PATCH 2/3] :bug: Fix send-invitations policy not enforced in backend
 RPC (#11206)

---
 .../src/app/rpc/commands/teams_invitations.clj    | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/backend/src/app/rpc/commands/teams_invitations.clj b/backend/src/app/rpc/commands/teams_invitations.clj
index 0ba235a444..93b15df5c2 100644
--- a/backend/src/app/rpc/commands/teams_invitations.clj
+++ b/backend/src/app/rpc/commands/teams_invitations.clj
@@ -460,6 +460,10 @@
   [cfg {:keys [::rpc/profile-id team-id role emails] :as params}]
   (let [perms    (teams/get-permissions cfg profile-id team-id)
         profile  (db/get-by-id cfg :profile profile-id)
+        team     (db/get-by-id cfg :team team-id)
+        team-with-org (when (contains? cf/flags :admin-console)
+                        (nitrate/add-organization-info-to-team cfg team {}))
+        organization (:organization team-with-org)
         ;; Determine which format is being used
         using-emails-format? (and emails role)
         ;; Handle both parameter formats
@@ -475,6 +479,17 @@
       (ex/raise :type :validation
                 :code :insufficient-permissions))
 
+    (when (and (contains? cf/flags :admin-console)
+               organization
+               (not (cto/allowed? :send-invitations
+                                  {:organization-perms {:owner-id    (:owner-id organization)
+                                                        :permissions (:permissions organization)}
+                                   :profile-id profile-id
+                                   :team-perms perms})))
+      (ex/raise :type :validation
+                :code :insufficient-permissions
+                :hint "Organization policy does not allow you to send invitations"))
+
     (when (> invitation-count max-invitations-by-request-threshold)
       (ex/raise :type :validation
                 :code :max-invitations-by-request

From ef26231b8f73a5659a2f590907409e85695a17a6 Mon Sep 17 00:00:00 2001
From: Pablo Alba <pablo.alba@kaleidos.net>
Date: Wed, 12 Aug 2026 17:53:02 +0200
Subject: [PATCH 3/3] :bug: Fix nitrate organization sso expiration (#11227)

---
 backend/src/app/auth/oidc.clj | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/backend/src/app/auth/oidc.clj b/backend/src/app/auth/oidc.clj
index c32f3bbf75..715661b234 100644
--- a/backend/src/app/auth/oidc.clj
+++ b/backend/src/app/auth/oidc.clj
@@ -620,9 +620,6 @@
       (some? (:external-session-id state))
       (assoc :external-session-id (:external-session-id state))
 
-      (some? (:token/expires-in tdata))
-      (assoc :sso-token-exp (ct/in-future {:seconds (:token/expires-in tdata)}))
-
       ;; If state token comes with props, merge them. The state token
       ;; props can contain pm_ and utm_ prefixed query params.
       (map? (:props state))
@@ -904,9 +901,9 @@
       (let [organization-id (:organization-id state)
             sso             (nitrate/call cfg :get-organization-sso {:organization-id organization-id})
             provider        (prepare-organization-sso-provider cfg sso)
-            info            (get-info cfg provider state code)
+            _info           (get-info cfg provider state code)
             session         (session/get-session request)
-            exp             (or (:sso-token-exp info) (ct/in-future {:hours 48}))]
+            exp             (ct/in-future {:minutes 15})]
         (when (and session organization-id)
           (let [props (-> (or (:props session) {})
                           (update :sso assoc organization-id exp))]