Conversation
293b76b to
3f2ca50
Compare
| end | ||
|
|
||
| def login_method_allowed?(login_method) | ||
| active_organizations.pluck(:authentication_methods).flatten.uniq.include?(login_method) |
There was a problem hiding this comment.
if user belongs to two organizations;
org A allows password/google authentication methods,
org B allows okta only (or whatever authentication method that is not listed in orga A allowed ones).
should user be able to login and have access to both organizations (A and B) when authenticating with a method that is only allowed by one of them?
There was a problem hiding this comment.
@ancorcruz good question!
Right now it's already the case in backend on production: users can access both organizations even when only one of them allows password authentication. I am not looking into changing this behavior as part of this fix.
Long term we should consider limiting access by used sign in method in both backend and frontend.
The frontend already partially prevents this using accessibleByCurrentSession, but it does not cover every route and the backend does not enforce it.
2 participants
Context
Accepting an invitation does not handle existing users correctly.
Description
joinOrganizationmutation.acceptInvitekeepsemailas an optional ignored argument, so this backend fix can be deployed before the frontend fix.