From ac31edab14b5f83617583b73f2b8497479116002 Mon Sep 17 00:00:00 2001 From: Juanfran Date: Tue, 7 Jul 2026 12:22:17 +0200 Subject: [PATCH] :bug: Skip end-user SSO gate on nitrate org management endpoints (#10559) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit get-teams-detail, get-org-invitations and delete-org-invitations lacked ::rpc/auth false, so wrap-nitrate-sso ran on them whenever params carried an organization-id. For SSO-active orgs this rejected the org owner's admin-console reads with a 401, since their Penpot session has no SSO grant for the org. These are shared-key protected management calls made on the org owner's behalf and never use profile-id, so they should not require an end-user SSO session — matching their sibling endpoints. --- backend/src/app/rpc/management/nitrate.clj | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/backend/src/app/rpc/management/nitrate.clj b/backend/src/app/rpc/management/nitrate.clj index 7438d1f563..b2b8ec4c95 100644 --- a/backend/src/app/rpc/management/nitrate.clj +++ b/backend/src/app/rpc/management/nitrate.clj @@ -509,7 +509,8 @@ RETURNING id, deleted_at;") "Get valid invitations for an organization, returning at most one invitation per email." {::doc/added "2.16" ::sm/params schema:get-org-invitations-params - ::sm/result schema:get-org-invitations-result} + ::sm/result schema:get-org-invitations-result + ::rpc/auth false} [cfg {:keys [organization-id]}] (let [team-ids (noh/get-org-team-ids cfg organization-id)] (db/run! cfg (fn [{:keys [::db/conn]}] @@ -535,7 +536,8 @@ RETURNING id, deleted_at;") (sv/defmethod ::delete-org-invitations "Delete all invitations for one email in an organization scope (org + org teams)." {::doc/added "2.16" - ::sm/params schema:delete-org-invitations-params} + ::sm/params schema:delete-org-invitations-params + ::rpc/auth false} [cfg {:keys [organization-id email]}] (let [clean-email (profile/clean-email email) team-ids (noh/get-org-team-ids cfg organization-id)] @@ -866,7 +868,8 @@ RETURNING id, deleted_at;") including owner info and project/file/member counts." {::doc/added "2.20" ::sm/params schema:get-teams-detail-params - ::sm/result schema:get-teams-detail-result} + ::sm/result schema:get-teams-detail-result + ::rpc/auth false} [cfg {:keys [organization-id]}] (let [org-summary (nitrate/call cfg :get-org-summary {:organization-id organization-id}) team-ids (into [] (comp d/xf:map-id (filter uuid?)) (:teams org-summary))]