Chungus

src/app/auth/(private)/org/page.tsx

@@ -0,0 +1,193 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { formatAxiosError, priv } from "@app/lib/api";
+import { AxiosResponse } from "axios";
+import { authCookieHeader } from "@app/lib/api/cookies";
+import { cache } from "react";
+import { verifySession } from "@app/lib/auth/verifySession";
+import { redirect } from "next/navigation";
+import { pullEnv } from "@app/lib/pullEnv";
+import { LoginFormIDP } from "@app/components/LoginForm";
+import { ListOrgIdpsResponse } from "@server/routers/private/orgIdp";
+import { build } from "@server/build";
+import { headers } from "next/headers";
+import {
+    GetLoginPageResponse,
+    LoadLoginPageResponse
+} from "@server/routers/private/loginPage";
+import IdpLoginButtons from "@app/components/private/IdpLoginButtons";
+import {
+    Card,
+    CardContent,
+    CardDescription,
+    CardHeader,
+    CardTitle
+} from "@app/components/ui/card";
+import { Button } from "@app/components/ui/button";
+import Link from "next/link";
+import { getTranslations } from "next-intl/server";
+import { GetSessionTransferTokenRenponse } from "@server/routers/auth/privateGetSessionTransferToken";
+import { TransferSessionResponse } from "@server/routers/auth/privateTransferSession";
+import ValidateSessionTransferToken from "@app/components/private/ValidateSessionTransferToken";
+import { GetOrgTierResponse } from "@server/routers/private/billing";
+import { TierId } from "@server/lib/private/billing/tiers";
+
+export const dynamic = "force-dynamic";
+
+export default async function OrgAuthPage(props: {
+    params: Promise<{}>;
+    searchParams: Promise<{ token?: string }>;
+}) {
+    const params = await props.params;
+    const searchParams = await props.searchParams;
+
+    const env = pullEnv();
+
+    const authHeader = await authCookieHeader();
+
+    if (searchParams.token) {
+        return <ValidateSessionTransferToken token={searchParams.token} />;
+    }
+
+    const getUser = cache(verifySession);
+    const user = await getUser({ skipCheckVerifyEmail: true });
+
+    const allHeaders = await headers();
+    const host = allHeaders.get("host");
+
+    const t = await getTranslations();
+
+    const expectedHost = env.app.dashboardUrl.split("//")[1];
+    let loginPage: LoadLoginPageResponse | undefined;
+    if (host !== expectedHost) {
+        try {
+            const res = await priv.get<AxiosResponse<LoadLoginPageResponse>>(
+                `/login-page?fullDomain=${host}`
+            );
+
+            if (res && res.status === 200) {
+                loginPage = res.data.data;
+            }
+        } catch (e) {}
+
+        if (!loginPage) {
+            redirect(env.app.dashboardUrl);
+        }
+
+        let subscriptionStatus: GetOrgTierResponse | null = null;
+        try {
+            const getSubscription = cache(() =>
+                priv.get<AxiosResponse<GetOrgTierResponse>>(
+                    `/org/${loginPage!.orgId}/billing/tier`
+                )
+            );
+            const subRes = await getSubscription();
+            subscriptionStatus = subRes.data.data;
+        } catch {}
+        const subscribed = subscriptionStatus?.tier === TierId.STANDARD;
+
+        if (build === "saas" && !subscribed) {
+            redirect(env.app.dashboardUrl);
+        }
+
+        if (user) {
+            let redirectToken: string | undefined;
+            try {
+                const res = await priv.post<
+                    AxiosResponse<GetSessionTransferTokenRenponse>
+                >(`/get-session-transfer-token`, {}, authHeader);
+
+                if (res && res.status === 200) {
+                    const newToken = res.data.data.token;
+
+                    redirectToken = newToken;
+                }
+            } catch (e) {
+                console.error(
+                    formatAxiosError(e, "Failed to get transfer token")
+                );
+            }
+
+            if (redirectToken) {
+                redirect(
+                    `${env.app.dashboardUrl}/auth/org?token=${redirectToken}`
+                );
+            }
+        }
+    } else {
+        redirect(env.app.dashboardUrl);
+    }
+
+    let loginIdps: LoginFormIDP[] = [];
+    if (build === "saas") {
+        const idpsRes = await cache(
+            async () =>
+                await priv.get<AxiosResponse<ListOrgIdpsResponse>>(
+                    `/org/${loginPage!.orgId}/idp`
+                )
+        )();
+        loginIdps = idpsRes.data.data.idps.map((idp) => ({
+            idpId: idp.idpId,
+            name: idp.name,
+            variant: idp.variant
+        })) as LoginFormIDP[];
+    }
+
+    return (
+        <div>
+            <div className="text-center mb-2">
+                <span className="text-sm text-muted-foreground">
+                    {t("poweredBy")}{" "}
+                    <Link
+                        href="https://digpangolin.com/"
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        className="underline"
+                    >
+                        {env.branding.appName || "Pangolin"}
+                    </Link>
+                </span>
+            </div>
+            <Card className="shadow-md w-full max-w-md">
+                <CardHeader>
+                    <CardTitle>{t("orgAuthSignInTitle")}</CardTitle>
+                    <CardDescription>
+                        {loginIdps.length > 0
+                            ? t("orgAuthChooseIdpDescription")
+                            : ""}
+                    </CardDescription>
+                </CardHeader>
+                <CardContent>
+                    {loginIdps.length > 0 ? (
+                        <IdpLoginButtons
+                            idps={loginIdps}
+                            orgId={loginPage?.orgId}
+                        />
+                    ) : (
+                        <div className="space-y-4">
+                            <p className="text-sm text-muted-foreground">
+                                {t("orgAuthNoIdpConfigured")}
+                            </p>
+                            <Link href={`${env.app.dashboardUrl}/auth/login`}>
+                                <Button className="w-full">
+                                    {t("orgAuthSignInWithPangolin")}
+                                </Button>
+                            </Link>
+                        </div>
+                    )}
+                </CardContent>
+            </Card>
+        </div>
+    );
+}

src/app/auth/idp/[idpId]/oidc/callback/page.tsx

@@ -1,10 +1,13 @@
-import { cookies } from "next/headers";
+import { cookies, headers } from "next/headers";
 import ValidateOidcToken from "@app/components/ValidateOidcToken";
 import { cache } from "react";
-import { priv } from "@app/lib/api";
+import { formatAxiosError, priv } from "@app/lib/api";
 import { AxiosResponse } from "axios";
 import { GetIdpResponse } from "@server/routers/idp";
 import { getTranslations } from "next-intl/server";
+import { pullEnv } from "@app/lib/pullEnv";
+import { LoadLoginPageResponse } from "@server/routers/private/loginPage";
+import { redirect } from "next/navigation";
 
 export const dynamic = "force-dynamic";
 
@@ -33,10 +36,34 @@ export default async function Page(props: {
         return <div>{t('idpErrorNotFound')}</div>;
     }
 
+    const allHeaders = await headers();
+    const host = allHeaders.get("host");
+    const env = pullEnv();
+    const expectedHost = env.app.dashboardUrl.split("//")[1];
+    let loginPage: LoadLoginPageResponse | undefined;
+    if (host !== expectedHost) {
+        try {
+            const res = await priv.get<AxiosResponse<LoadLoginPageResponse>>(
+                `/login-page?idpId=${foundIdp.idpId}&fullDomain=${host}`
+            );
+
+            if (res && res.status === 200) {
+                loginPage = res.data.data;
+            }
+        } catch (e) {
+            console.error(formatAxiosError(e));
+        }
+
+        if (!loginPage) {
+            redirect(env.app.dashboardUrl);
+        }
+    }
+
     return (
         <>
             <ValidateOidcToken
                 orgId={params.orgId}
+                loginPageId={loginPage?.loginPageId}
                 idpId={params.idpId}
                 code={searchParams.code}
                 expectedState={searchParams.state}

src/app/auth/layout.tsx

@@ -12,7 +12,7 @@ import { cache } from "react";
 import { getTranslations } from "next-intl/server";
 
 export const metadata: Metadata = {
-    title: `Auth - Pangolin`,
+    title: `Auth - ${process.env.BRANDING_APP_NAME || "Pangolin"}`,
     description: ""
 };
 

src/app/auth/login/page.tsx

@@ -12,6 +12,7 @@ import { priv } from "@app/lib/api";
 import { AxiosResponse } from "axios";
 import { ListIdpsResponse } from "@server/routers/idp";
 import { getTranslations } from "next-intl/server";
+import { build } from "@server/build";
 
 export const dynamic = "force-dynamic";
 
@@ -37,14 +38,17 @@ export default async function Page(props: {
         redirectUrl = cleanRedirect(searchParams.redirect as string);
     }
 
-    const idpsRes = await cache(
-        async () => await priv.get<AxiosResponse<ListIdpsResponse>>("/idp")
-    )();
-    const loginIdps = idpsRes.data.data.idps.map((idp) => ({
-        idpId: idp.idpId,
-        name: idp.name,
-        variant: idp.variant
-    })) as LoginFormIDP[];
+    let loginIdps: LoginFormIDP[] = [];
+    if (build !== "saas") {
+        const idpsRes = await cache(
+            async () => await priv.get<AxiosResponse<ListIdpsResponse>>("/idp")
+        )();
+        loginIdps = idpsRes.data.data.idps.map((idp) => ({
+            idpId: idp.idpId,
+            name: idp.name,
+            variant: idp.type
+        })) as LoginFormIDP[];
+    }
 
     const t = await getTranslations();
 

src/app/auth/resource/[resourceGuid]/page.tsx

@@ -3,7 +3,7 @@ import {
     GetExchangeTokenResponse
 } from "@server/routers/resource";
 import ResourceAuthPortal from "@app/components/ResourceAuthPortal";
-import { internal, priv } from "@app/lib/api";
+import { formatAxiosError, internal, priv } from "@app/lib/api";
 import { AxiosResponse } from "axios";
 import { authCookieHeader } from "@app/lib/api/cookies";
 import { cache } from "react";
@@ -15,7 +15,13 @@ import AccessToken from "@app/components/AccessToken";
 import { pullEnv } from "@app/lib/pullEnv";
 import { LoginFormIDP } from "@app/components/LoginForm";
 import { ListIdpsResponse } from "@server/routers/idp";
+import { ListOrgIdpsResponse } from "@server/routers/private/orgIdp";
 import AutoLoginHandler from "@app/components/AutoLoginHandler";
+import { build } from "@server/build";
+import { headers } from "next/headers";
+import { GetLoginPageResponse } from "@server/routers/private/loginPage";
+import { GetOrgTierResponse } from "@server/routers/private/billing";
+import { TierId } from "@server/lib/private/billing/tiers";
 
 export const dynamic = "force-dynamic";
 
@@ -55,6 +61,45 @@ export default async function ResourceAuthPage(props: {
         );
     }
 
+    let subscriptionStatus: GetOrgTierResponse | null = null;
+    if (build == "saas") {
+        try {
+            const getSubscription = cache(() =>
+                priv.get<AxiosResponse<GetOrgTierResponse>>(
+                    `/org/${authInfo.orgId}/billing/tier`
+                )
+            );
+            const subRes = await getSubscription();
+            subscriptionStatus = subRes.data.data;
+        } catch {}
+    }
+    const subscribed = subscriptionStatus?.tier === TierId.STANDARD;
+
+    const allHeaders = await headers();
+    const host = allHeaders.get("host");
+
+    const expectedHost = env.app.dashboardUrl.split("//")[1];
+    if (host !== expectedHost) {
+        if (build === "saas" && !subscribed) {
+            redirect(env.app.dashboardUrl);
+        }
+
+        let loginPage: GetLoginPageResponse | undefined;
+        try {
+            const res = await priv.get<AxiosResponse<GetLoginPageResponse>>(
+                `/login-page?resourceId=${authInfo.resourceId}&fullDomain=${host}`
+            );
+
+            if (res && res.status === 200) {
+                loginPage = res.data.data;
+            }
+        } catch (e) {}
+
+        if (!loginPage) {
+            redirect(env.app.dashboardUrl);
+        }
+    }
+
     let redirectUrl = authInfo.url;
     if (searchParams.redirect) {
         try {
@@ -136,13 +181,31 @@ export default async function ResourceAuthPage(props: {
         );
     }
 
-    const idpsRes = await cache(
-        async () => await priv.get<AxiosResponse<ListIdpsResponse>>("/idp")
-    )();
-    const loginIdps = idpsRes.data.data.idps.map((idp) => ({
-        idpId: idp.idpId,
-        name: idp.name
-    })) as LoginFormIDP[];
+    let loginIdps: LoginFormIDP[] = [];
+    if (build === "saas") {
+        if (subscribed) {
+            const idpsRes = await cache(
+                async () =>
+                    await priv.get<AxiosResponse<ListOrgIdpsResponse>>(
+                        `/org/${authInfo!.orgId}/idp`
+                    )
+            )();
+            loginIdps = idpsRes.data.data.idps.map((idp) => ({
+                idpId: idp.idpId,
+                name: idp.name,
+                variant: idp.variant
+            })) as LoginFormIDP[];
+        }
+    } else {
+        const idpsRes = await cache(
+            async () => await priv.get<AxiosResponse<ListIdpsResponse>>("/idp")
+        )();
+        loginIdps = idpsRes.data.data.idps.map((idp) => ({
+            idpId: idp.idpId,
+            name: idp.name,
+            variant: idp.type
+        })) as LoginFormIDP[];
+    }
 
     if (authInfo.skipToIdpId && authInfo.skipToIdpId !== null) {
         const idp = loginIdps.find((idp) => idp.idpId === authInfo.skipToIdpId);
@@ -152,6 +215,7 @@ export default async function ResourceAuthPage(props: {
                     resourceId={authInfo.resourceId}
                     skipToIdpId={authInfo.skipToIdpId}
                     redirectUrl={redirectUrl}
+                    orgId={build == "saas" ? authInfo.orgId : undefined}
                 />
             );
         }
@@ -178,6 +242,7 @@ export default async function ResourceAuthPage(props: {
                         }}
                         redirect={redirectUrl}
                         idps={loginIdps}
+                        orgId={build === "saas" ? authInfo.orgId : undefined}
                     />
                 </div>
             )}