🐛 Fix sso error message (#11225)

backend/src/app/auth/oidc.clj

@@ -651,10 +651,12 @@
      (redirect-response uri))))
 
 (defn- redirect-with-organization-sso-error
-  [{:keys [dest-url organization-id]}]
+  [{:keys [dest-url organization-id organization-name]}]
   (-> (str (or dest-url (cf/get :public-uri)))
       (u/append-query-param :sso-error true)
       (u/append-query-param :organization-id organization-id)
+      (cond-> organization-name
+        (u/append-query-param :organization-name organization-name))
       (redirect-response)))
 
 (defn- redirect-to-register
@@ -923,9 +925,12 @@
               (l/err :hint "unexpected error on organization sso callback"
                      :organization-id (:organization-id state)
                      :cause cause))))
-        (redirect-with-organization-sso-error
-         {:dest-url dest-url
-          :organization-id (:organization-id state)})))))
+        (let [organization-id   (:organization-id state)
+              organization-name (:name (nitrate/call cfg :get-organization-summary {:organization-id organization-id}))]
+          (redirect-with-organization-sso-error
+           {:dest-url dest-url
+            :organization-id organization-id
+            :organization-name organization-name}))))))
 
 (defn- callback-handler
   [cfg {:keys [params] :as request}]

frontend/src/app/main/ui/routes.cljs

@@ -149,22 +149,24 @@
 
 (defn- handle-sso-error-and-navigate
   "Check if the current route has an SSO error marker. If so, assign an
-  exception with type :sso-error and organization-id from query params,
+  exception with type :sso-error and organization-id/name from query params,
   and deliberately do NOT proceed with normal navigation: emitting
   `rt/navigated` would clear the exception that was just assigned.
   Otherwise, delegate to `check-sso-and-navigate`."
   [match send-event-info? url]
-  (let [route-name      (name (get-in match [:data :name]))
-        sso-error?      (some? (get-in match [:query-params :sso-error]))
-        organization-id (some-> (get-in match [:query-params :organization-id]) uuid/parse*)
-        team-id-str     (or (get-in match [:query-params :team-id])
-                            (get-in match [:params :path :team-id])) ;; Fallback: team-id may be in path params for workspace routes
-        team-id         (some-> team-id-str uuid/parse*)
-        is-workspace?   (str/starts-with? route-name "workspace")
-        is-dashboard?   (str/starts-with? route-name "dashboard")]
+  (let [route-name        (name (get-in match [:data :name]))
+        sso-error?        (some? (get-in match [:query-params :sso-error]))
+        organization-id   (some-> (get-in match [:query-params :organization-id]) uuid/parse*)
+        organization-name (some-> (get-in match [:query-params :organization-name]) str/trim)
+        team-id-str       (or (get-in match [:query-params :team-id])
+                              (get-in match [:params :path :team-id])) ;; Fallback: team-id may be in path params for workspace routes
+        team-id           (some-> team-id-str uuid/parse*)
+        is-workspace?     (str/starts-with? route-name "workspace")
+        is-dashboard?     (str/starts-with? route-name "dashboard")]
     (if sso-error?
       (st/emit! (rt/assign-exception {:type :sso-error
                                       :organization-id organization-id
+                                      :organization-name organization-name
                                       :team-id team-id
                                       :is-workspace is-workspace?
                                       :is-dashboard is-dashboard?}))

frontend/src/app/main/ui/static.cljs

@@ -484,7 +484,7 @@
   `request-dialog*` used by the no-permission dialogs) when the organization
   SSO exchange with the identity provider fails."
   {::mf/private true}
-  [{:keys [organization-id team-id profile is-workspace is-dashboard]}]
+  [{:keys [organization-id team-id profile is-workspace is-dashboard organization-name]}]
   (let [clean-url
         (mf/with-memo []
           (-> (rt/get-current-href)
@@ -520,7 +520,7 @@
     [:> context-wrapper* {:is-dashboard (or is-dashboard (not is-workspace))
                           :is-workspace is-workspace
                           :profile profile}
-     [:> request-dialog* {:title (tr "labels.sso-error.title")
+     [:> request-dialog* {:title (tr "labels.sso-error.title", organization-name)
                           :content [(tr "labels.sso-error.desc-message")]
                           :button-text (tr "labels.sso-error.retry")
                           :on-button-click on-retry
@@ -532,7 +532,6 @@
   [{:keys [data] :as props}]
   (let [type   (get data :type)
         cause  (get data ::errors/instance)
-        organization-id (get data :organization-id)
 
         report (mf/with-memo [cause]
                  (when (ex/exception? cause)
@@ -564,7 +563,8 @@
       [:> nitrate-unavailable*]
 
       :sso-error
-      [:> sso-error-section* {:organization-id organization-id
+      [:> sso-error-section* {:organization-id (get data :organization-id)
+                              :organization-name (get data :organization-name)
                               :team-id (get data :team-id)
                               :profile (mf/deref refs/profile)
                               :is-workspace (get data :is-workspace false)

frontend/translations/en.po

@@ -10341,10 +10341,10 @@ msgid "notifications.invitation-canceled"
 msgstr "This invitation is no longer available."
 
 msgid "labels.sso-error.title"
-msgstr "We couldn't sign you in to your organization"
+msgstr "We couldn't sign you in to %s"
 
 msgid "labels.sso-error.desc-message"
-msgstr "Sign-in with your organization's identity provider didn't complete. The provider may be unavailable, or your account may not be in its directory yet. Your Penpot account isn't affected."
+msgstr "Sign-in with your organization's identity provider didn't complete. The provider may be unavailable, or your account may not be in its directory yet."
 
 msgid "labels.sso-error.retry"
 msgstr "Try again"

frontend/translations/es.po

@@ -9991,10 +9991,10 @@ msgid "notifications.invitation-canceled"
 msgstr "Esta invitación ya no está disponible."
 
 msgid "labels.sso-error.title"
-msgstr "No pudimos iniciar sesión en tu organización"
+msgstr "No pudimos iniciar sesión en %s"
 
 msgid "labels.sso-error.desc-message"
-msgstr "El inicio de sesión con el proveedor de identidad de tu organización no se completó. Es posible que el proveedor no esté disponible o que tu cuenta aún no esté en su directorio. Tu cuenta de Penpot no se ha visto afectada."
+msgstr "El inicio de sesión con el proveedor de identidad de tu organización no se completó. Es posible que el proveedor no esté disponible o que tu cuenta aún no esté en su directorio."
 
 msgid "labels.sso-error.retry"
 msgstr "Intentar de nuevo"