mirror of
https://github.com/hanzoai/id.git
synced 2026-10-16 18:38:15 +00:00
zooqueen
aba085af6b
LoginForm no longer pins organization=<brand> on POST /v1/iam/login. It passes the new (normally-unset) TenantConfig.loginOrg, and client.login() OMITS the organization field when empty so IAM runs cross-org resolution and the session encodes the user's REAL owner-org (GetOrganizationByUser), never the hint. Fixes: global admins (z@/[email protected], [email protected] — owner=admin) were truncated to a 1-org 'hanzo' session via the UI because the pinned org made GetUserByFields hit the colliding hanzo/<name> row first, so the cross-org fallback to admin/<name> never ran. IAM IsGlobalAdmin()==(Owner=='admin') and get-organizations returns all orgs only for a global admin. Verified live on hanzo.id: [email protected] -> owner=admin, 45 orgs; brand-only user -> 1 org. Boundaries preserved: signup still sends a concrete org; per-app SSO (client_id+redirect_uri, type=code) still mints a code bound to the resolved user; a brand can force single-org login via loginOrg in the catalog ConfigMap. Contract locked in pkgs/auth/src/client.test.ts. Bump 0.1.22 -> 0.1.23.
16 lines
382 B
JSON
16 lines
382 B
JSON
{
|
|
"name": "@hanzo/id",
|
|
"private": true,
|
|
"version": "0.1.23",
|
|
"description": "Hanzo ID — white-label login + identity verification portal (Vite + @hanzo/gui)",
|
|
"scripts": {
|
|
"build": "pnpm -r build",
|
|
"dev": "pnpm --filter @hanzo/id-web dev",
|
|
"tc": "pnpm -r tc",
|
|
"clean": "bash scripts/clean.sh"
|
|
},
|
|
"devDependencies": {
|
|
"typescript": "^5.9.3"
|
|
}
|
|
}
|