feat: third party authentication provider change

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/InitialDataController.kt

@@ -6,8 +6,11 @@ import io.tolgee.api.EeSubscriptionProvider
 import io.tolgee.component.PreferredOrganizationFacade
 import io.tolgee.hateoas.InitialDataModel
 import io.tolgee.hateoas.ee.IEeSubscriptionModelAssembler
+import io.tolgee.hateoas.sso.PublicSsoTenantModelAssembler
+import io.tolgee.hateoas.userAccount.PrivateUserAccountModelAssembler
 import io.tolgee.openApiDocs.OpenApiHideFromPublicDocs
 import io.tolgee.security.authentication.AuthenticationFacade
+import io.tolgee.service.TenantService
 import io.tolgee.service.security.UserPreferencesService
 import org.springframework.web.bind.annotation.CrossOrigin
 import org.springframework.web.bind.annotation.GetMapping
@@ -26,14 +29,16 @@ import org.springframework.web.bind.annotation.RestController
 class InitialDataController(
   private val configurationController: ConfigurationController,
   private val authenticationFacade: AuthenticationFacade,
-  private val userController: V2UserController,
   private val userPreferencesService: UserPreferencesService,
   private val preferredOrganizationFacade: PreferredOrganizationFacade,
   @Suppress("SpringJavaInjectionPointsAutowiringInspection")
   private val eeSubscriptionModelAssembler: IEeSubscriptionModelAssembler?,
   @Suppress("SpringJavaInjectionPointsAutowiringInspection")
   private val eeSubscriptionProvider: EeSubscriptionProvider?,
   private val announcementController: AnnouncementController,
+  private val tenantService: TenantService,
+  private val privateUserAccountModelAssembler: PrivateUserAccountModelAssembler,
+  private val publicSsoTenantModelAssembler: PublicSsoTenantModelAssembler,
 ) : IController {
   @GetMapping(value = [""])
   @Operation(summary = "Get initial data", description = "Returns initial data required by the UI to load")
@@ -51,7 +56,10 @@ class InitialDataController(
 
     val userAccount = authenticationFacade.authenticatedUserOrNull
     if (userAccount != null) {
-      data.userInfo = userController.getInfo()
+      val userAccountView = authenticationFacade.authenticatedUserView
+      val tenant = tenantService.getEnabledConfigByDomainOrNull(userAccount.domain)
+      data.userInfo = privateUserAccountModelAssembler.toModel(userAccountView)
+      data.ssoInfo = tenant?.let { publicSsoTenantModelAssembler.toModel(it) }
       data.preferredOrganization = preferredOrganizationFacade.getPreferred()
       data.languageTag = userPreferencesService.find(userAccount.id)?.language
       data.announcement = announcementController.getLatest()

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/PatController.kt

@@ -18,6 +18,8 @@ import io.tolgee.model.Pat
 import io.tolgee.security.authentication.AllowApiAccess
 import io.tolgee.security.authentication.AuthTokenType
 import io.tolgee.security.authentication.AuthenticationFacade
+import io.tolgee.security.authentication.BypassEmailVerification
+import io.tolgee.security.authentication.BypassForcedSsoAuthentication
 import io.tolgee.security.authentication.RequiresSuperAuthentication
 import io.tolgee.service.security.PatService
 import jakarta.validation.Valid
@@ -50,6 +52,8 @@ class PatController(
 ) : IController {
   @GetMapping(value = [""])
   @Operation(summary = "Get PAKs")
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
   fun getAll(
     @ParameterObject pageable: Pageable,
   ): PagedModel<PatModel> {
@@ -61,6 +65,8 @@ class PatController(
 
   @GetMapping(value = ["/{id:[0-9]+}"])
   @Operation(summary = "Get one PAK")
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
   fun get(
     @PathVariable id: Long,
   ): PatModel {
@@ -111,6 +117,8 @@ class PatController(
   @DeleteMapping(value = ["/{id:[0-9]+}"])
   @Operation(summary = "Delete PAK", description = "Deletes Personal Access Token")
   @RequiresSuperAuthentication
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
   fun delete(
     @PathVariable id: Long,
   ) {

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/QuickStartController.kt

@@ -7,6 +7,8 @@ import io.tolgee.component.reporting.OnBusinessEventToCaptureEvent
 import io.tolgee.hateoas.quickStart.QuickStartModel
 import io.tolgee.hateoas.quickStart.QuickStartModelAssembler
 import io.tolgee.security.authentication.AuthenticationFacade
+import io.tolgee.security.authentication.BypassEmailVerification
+import io.tolgee.security.authentication.BypassForcedSsoAuthentication
 import io.tolgee.service.QuickStartService
 import org.springframework.data.crossstore.ChangeSetPersister.NotFoundException
 import org.springframework.web.bind.annotation.PathVariable
@@ -25,6 +27,8 @@ class QuickStartController(
 ) {
   @PutMapping("/steps/{step}/complete")
   @Operation(summary = "Complete guide step", description = "Marks guide step as completed")
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
   fun completeGuideStep(
     @PathVariable("step") step: String,
   ): QuickStartModel {
@@ -42,6 +46,8 @@ class QuickStartController(
 
   @PutMapping("/set-finished/{finished}")
   @Operation(summary = "Set finished state", description = "Sets finished state of the quick start guide")
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
   fun setFinishedState(
     @PathVariable finished: Boolean,
   ): QuickStartModel {
@@ -57,6 +63,8 @@ class QuickStartController(
 
   @PutMapping("/set-open/{open}")
   @Operation(summary = "Set open state", description = "Sets open state of the quick start guide")
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
   fun setOpenState(
     @PathVariable open: Boolean,
   ): QuickStartModel {

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/UserMfaController.kt

@@ -6,6 +6,7 @@ import io.tolgee.dtos.request.UserMfaRecoveryRequestDto
 import io.tolgee.dtos.request.UserTotpDisableRequestDto
 import io.tolgee.dtos.request.UserTotpEnableRequestDto
 import io.tolgee.security.authentication.AuthenticationFacade
+import io.tolgee.security.authentication.BypassEmailVerification
 import io.tolgee.security.authentication.JwtService
 import io.tolgee.security.payload.JwtAuthenticationResponse
 import io.tolgee.service.security.MfaService
@@ -29,6 +30,7 @@ class UserMfaController(
     summary = "Enable TOTP",
     description = "Enables TOTP-based two-factor authentication. Invalidates all previous sessions upon success.",
   )
+  @BypassEmailVerification
   fun enableMfa(
     @RequestBody @Valid
     dto: UserTotpEnableRequestDto,
@@ -44,6 +46,7 @@ class UserMfaController(
     summary = "Disable TOTP",
     description = "Disables TOTP-based two-factor authentication. Invalidates all previous sessions upon success.",
   )
+  @BypassEmailVerification
   fun disableMfa(
     @RequestBody @Valid
     dto: UserTotpDisableRequestDto,
@@ -56,6 +59,7 @@ class UserMfaController(
 
   @PutMapping("/recovery")
   @Operation(summary = "Regenerate Codes", description = "Regenerates multi-factor authentication recovery codes")
+  @BypassEmailVerification
   fun regenerateRecoveryCodes(
     @RequestBody @Valid
     dto: UserMfaRecoveryRequestDto,

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/UserPreferencesController.kt

@@ -8,6 +8,8 @@ import io.swagger.v3.oas.annotations.Operation
 import io.swagger.v3.oas.annotations.tags.Tag
 import io.tolgee.hateoas.userPreferences.UserPreferencesModel
 import io.tolgee.security.authentication.AuthenticationFacade
+import io.tolgee.security.authentication.BypassEmailVerification
+import io.tolgee.security.authentication.BypassForcedSsoAuthentication
 import io.tolgee.service.organization.OrganizationRoleService
 import io.tolgee.service.organization.OrganizationService
 import io.tolgee.service.security.UserPreferencesService
@@ -30,6 +32,8 @@ class UserPreferencesController(
 ) {
   @GetMapping("")
   @Operation(summary = "Get user's preferences")
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
   fun get(): UserPreferencesModel {
     return userPreferencesService.findOrCreate(authenticationFacade.authenticatedUser.id).let {
       UserPreferencesModel(language = it.language, preferredOrganizationId = it.preferredOrganization?.id)
@@ -38,6 +42,8 @@ class UserPreferencesController(
 
   @PutMapping("/set-language/{languageTag}")
   @Operation(summary = "Set user's UI language")
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
   fun setLanguage(
     @PathVariable languageTag: String,
   ) {

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/V2UserController.kt

@@ -1,26 +1,36 @@
 package io.tolgee.api.v2.controllers
 
 import io.swagger.v3.oas.annotations.Operation
+import io.swagger.v3.oas.annotations.responses.ApiResponse
 import io.swagger.v3.oas.annotations.tags.Tag
 import io.tolgee.activity.ActivityHolder
+import io.tolgee.component.enabledFeaturesProvider.EnabledFeaturesProvider
 import io.tolgee.constants.Message
 import io.tolgee.dtos.request.SuperTokenRequest
 import io.tolgee.dtos.request.UserUpdatePasswordRequestDto
 import io.tolgee.dtos.request.UserUpdateRequestDto
 import io.tolgee.exceptions.AuthenticationException
+import io.tolgee.hateoas.organization.PrivateOrganizationModel
+import io.tolgee.hateoas.organization.PrivateOrganizationModelAssembler
 import io.tolgee.hateoas.organization.SimpleOrganizationModel
 import io.tolgee.hateoas.organization.SimpleOrganizationModelAssembler
+import io.tolgee.hateoas.sso.PublicSsoTenantModel
+import io.tolgee.hateoas.sso.PublicSsoTenantModelAssembler
 import io.tolgee.hateoas.userAccount.PrivateUserAccountModel
 import io.tolgee.hateoas.userAccount.PrivateUserAccountModelAssembler
 import io.tolgee.openApiDocs.OpenApiHideFromPublicDocs
 import io.tolgee.openApiDocs.OpenApiOrderExtension
 import io.tolgee.security.authentication.AllowApiAccess
 import io.tolgee.security.authentication.AuthenticationFacade
+import io.tolgee.security.authentication.BypassEmailVerification
+import io.tolgee.security.authentication.BypassForcedSsoAuthentication
 import io.tolgee.security.authentication.JwtService
 import io.tolgee.security.authentication.RequiresSuperAuthentication
 import io.tolgee.security.payload.JwtAuthenticationResponse
 import io.tolgee.service.EmailVerificationService
 import io.tolgee.service.ImageUploadService
+import io.tolgee.service.TenantService
+import io.tolgee.service.organization.OrganizationRoleService
 import io.tolgee.service.organization.OrganizationService
 import io.tolgee.service.security.MfaService
 import io.tolgee.service.security.UserAccountService
@@ -42,12 +52,17 @@ class V2UserController(
   private val authenticationFacade: AuthenticationFacade,
   private val userAccountService: UserAccountService,
   private val privateUserAccountModelAssembler: PrivateUserAccountModelAssembler,
+  private val publicSsoTenantModelAssembler: PublicSsoTenantModelAssembler,
   private val imageUploadService: ImageUploadService,
   private val organizationService: OrganizationService,
+  private val organizationRoleService: OrganizationRoleService,
+  private val privateOrganizationModelAssembler: PrivateOrganizationModelAssembler,
+  private val tenantService: TenantService,
   private val simpleOrganizationModelAssembler: SimpleOrganizationModelAssembler,
   private val passwordEncoder: PasswordEncoder,
   private val jwtService: JwtService,
   private val mfaService: MfaService,
+  private val enabledFeaturesProvider: EnabledFeaturesProvider,
   private val emailVerificationService: EmailVerificationService,
   @Qualifier("requestActivityHolder") private val request: ActivityHolder,
 ) {
@@ -56,6 +71,7 @@ class V2UserController(
     description = "Resends email verification email to currently authenticated user.",
   )
   @PostMapping("/send-email-verification")
+  @BypassEmailVerification
   fun sendEmailVerification(request: HttpServletRequest) {
     val user = authenticationFacade.authenticatedUserEntity
     emailVerificationService.resendEmailVerification(user, request)
@@ -66,6 +82,8 @@ class V2UserController(
     description = "Returns information about currently authenticated user.",
   )
   @GetMapping("")
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
   @AllowApiAccess
   @OpenApiOrderExtension(1)
   fun getInfo(): PrivateUserAccountModel {
@@ -141,6 +159,51 @@ class V2UserController(
     userAccountService.delete(authenticationFacade.authenticatedUserEntity)
   }
 
+  @Operation(
+    summary = "Get information about SSO configuration",
+    description = "Returns information about sso configuration affecting the user.",
+  )
+  @GetMapping("/sso")
+  @ApiResponse(
+    responseCode = "204",
+    description = "No SSO configuration available for this user",
+  )
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
+  @AllowApiAccess
+  fun getSso(): ResponseEntity<PublicSsoTenantModel> {
+    val userAccount = authenticationFacade.authenticatedUser
+    val domain = userAccount.domain ?: return ResponseEntity.noContent().build()
+    val tenant = tenantService.getEnabledConfigByDomainOrNull(domain) ?: return ResponseEntity.noContent().build()
+    return ResponseEntity.ok(publicSsoTenantModelAssembler.toModel(tenant))
+  }
+
+  @GetMapping("/managed-by")
+  @Operation(
+    summary = "Get organization which manages user",
+    description = "Returns the organization that manages a given user or null",
+  )
+  @ApiResponse(
+    responseCode = "204",
+    description = "No SSO configuration available for this user",
+  )
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
+  @OpenApiHideFromPublicDocs
+  fun getManagedBy(): ResponseEntity<PrivateOrganizationModel> {
+    val userAccount = authenticationFacade.authenticatedUser
+    val org = organizationRoleService.getManagedBy(userId = userAccount.id) ?: return ResponseEntity.noContent().build()
+    val view =
+      organizationService.findPrivateView(org.id, authenticationFacade.authenticatedUser.id)
+        ?: return ResponseEntity.noContent().build()
+    return ResponseEntity.ok(
+      privateOrganizationModelAssembler.toModel(
+        view,
+        enabledFeaturesProvider.get(view.organization.id),
+      ),
+    )
+  }
+
   @PostMapping("")
   @Operation(summary = "Updates current user's data.", deprecated = true)
   @OpenApiHideFromPublicDocs
@@ -163,6 +226,8 @@ class V2UserController(
 
   @PostMapping("/generate-super-token")
   @Operation(summary = "Get super JWT", description = "Generates new JWT token permitted to sensitive operations")
+  @BypassEmailVerification
+  @BypassForcedSsoAuthentication
   fun getSuperToken(
     @RequestBody @Valid
     req: SuperTokenRequest,