From bbea9b28ecd6aa18972f6f279b718b03fbf7d110 Mon Sep 17 00:00:00 2001 From: JOY <5027251+JOY@users.noreply.github.com> Date: Thu, 3 Sep 2026 12:30:12 +0700 Subject: [PATCH 1/2] feat(auth): integrate DOS.Me JIT teams claims and scope support in OAuth provider --- .../src/services/auth/providers.interface.ts | 4 +- .../services/auth/providers/oauth.provider.ts | 8 +++- docs/sso-architecture.md | 48 +++++++++++++++++++ 3 files changed, 57 insertions(+), 3 deletions(-) diff --git a/apps/backend/src/services/auth/providers.interface.ts b/apps/backend/src/services/auth/providers.interface.ts index f0fb2b61be..5001cd0f27 100644 --- a/apps/backend/src/services/auth/providers.interface.ts +++ b/apps/backend/src/services/auth/providers.interface.ts @@ -10,7 +10,9 @@ export abstract class AuthProviderAbstract { id: string; name?: string; picture?: string; - organizations?: Array<{ id: string; name: string; role?: 'OWNER' | 'ADMIN' | 'MEMBER' }>; + active_org_id?: string; + organizations?: Array<{ id: string; name: string; slug?: string; role?: 'OWNER' | 'ADMIN' | 'MEMBER' | 'SUPERADMIN' }>; + teams?: Array<{ id: string; org_id: string; name: string; slug: string; role?: 'LEAD' | 'MEMBER' | string }>; }> | false; async postRegistration( providerToken: string, diff --git a/apps/backend/src/services/auth/providers/oauth.provider.ts b/apps/backend/src/services/auth/providers/oauth.provider.ts index 2c9d04ce9e..450353f679 100644 --- a/apps/backend/src/services/auth/providers/oauth.provider.ts +++ b/apps/backend/src/services/auth/providers/oauth.provider.ts @@ -40,7 +40,7 @@ export class OauthProvider extends AuthProviderAbstract { const { authUrl, clientId, frontendUrl } = this.getConfig(); const params = new URLSearchParams({ client_id: clientId, - scope: process.env.POSTIZ_OAUTH_SCOPE || 'openid profile email organizations offline_access', + scope: process.env.POSTIZ_OAUTH_SCOPE || 'openid profile email organizations teams offline_access', response_type: 'code', state: query?.state || 'login', redirect_uri: `${frontendUrl}/auth`, @@ -80,7 +80,9 @@ export class OauthProvider extends AuthProviderAbstract { id: string; name?: string; picture?: string; - organizations?: Array<{ id: string; name: string; role?: 'OWNER' | 'ADMIN' | 'MEMBER' }>; + active_org_id?: string; + organizations?: Array<{ id: string; name: string; slug?: string; role?: 'OWNER' | 'ADMIN' | 'MEMBER' | 'SUPERADMIN' }>; + teams?: Array<{ id: string; org_id: string; name: string; slug: string; role?: 'LEAD' | 'MEMBER' | string }>; }> { const { userInfoUrl } = this.getConfig(); const response = await fetch(`${userInfoUrl}`, { @@ -101,7 +103,9 @@ export class OauthProvider extends AuthProviderAbstract { id: payload.sub || payload.id, name: payload.name || payload.full_name || payload.user_metadata?.name || payload.user_metadata?.full_name, picture: payload.picture || payload.avatar_url || payload.user_metadata?.picture || payload.user_metadata?.avatar_url, + active_org_id: payload.active_org_id || payload.user_metadata?.active_org_id, organizations: payload.organizations || payload.user_metadata?.organizations || [], + teams: payload.teams || payload.user_metadata?.teams || [], }; } } diff --git a/docs/sso-architecture.md b/docs/sso-architecture.md index c244296b25..51142d378c 100644 --- a/docs/sso-architecture.md +++ b/docs/sso-architecture.md @@ -118,3 +118,51 @@ For all ecosystem applications (Crove Post, Crove CRM, Crove Desk, Crove Sign) c | **Recommended Env Vars** | `CROVE_OAUTH_CLIENT_ID`
`CROVE_OAUTH_CLIENT_SECRET` | Standardized environment variable naming convention across the Crove ecosystem | | **Postiz Specific Mapping** | `POSTIZ_OAUTH_CLIENT_ID=crove-postiz`
`POSTIZ_OAUTH_CLIENT_SECRET=` | Internal bridge client credentials connecting to `api.dos.me/sso/*` | +--- + +## 6. Organization -> Teams Hierarchy & JIT Token Claims Standard + +As standardized by DOS.Me Core, all SSO identity tokens and `/sso/userinfo` endpoints now embed unified `organizations` and `teams` claims for Zero-Latency JIT Provisioning. + +### Unified JWT Claims Payload: +```json +{ + "sub": "7a3562bb-f529-45e0-bdfa-b73ca55ce8c8", + "email": "agent@acme.com", + "name": "Jane Doe", + "picture": "https://avatar.dos.me/jane.png", + "active_org_id": "org_987654321", + "organizations": [ + { + "id": "org_987654321", + "name": "Acme Corporation", + "slug": "acme", + "role": "ADMIN" + } + ], + "teams": [ + { + "id": "team_11223344", + "org_id": "org_987654321", + "name": "Customer Support", + "slug": "customer-support", + "role": "LEAD" + }, + { + "id": "team_55667788", + "org_id": "org_987654321", + "name": "Social Media Marketing", + "slug": "social-media", + "role": "MEMBER" + } + ] +} +``` + +### Integration across Crove Products: +- **Crove Post (`post.crove.com`)**: Parses `organizations` for active workspace and `teams` for channel access & campaign group assignment. +- **Crove Desk (`desk.crove.com`)**: Maps `teams` to Inboxes (Support, Billing, VIP) with role `LEAD` for supervisor privileges. +- **Crove CRM (`crm.crove.com`)**: Scopes Leads, Deals, and Pipelines to the user's active `teams`. +- **Crove Sign (`sign.crove.com`)**: Authorizes document signature workflows based on team roles (`LEAD` / `ADMIN`). + + From 2643e244422c5e3aefece515244309855cd02c98 Mon Sep 17 00:00:00 2001 From: JOY <5027251+JOY@users.noreply.github.com> Date: Thu, 3 Sep 2026 12:35:30 +0700 Subject: [PATCH 2/2] docs(changelog): document v2.24.0 release highlights --- CHANGELOG.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9ff01ecb41..4f464803c2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [v2.24.0] - 2026-09-03 + +### Added +- **DOS.Me Organization -> Teams Hierarchy & JIT Token Claims**: + - Integrated `teams` scope (`openid profile email organizations teams offline_access`) into OAuth authorization links. + - Added parsing for `active_org_id`, `organizations: [{ id, name, slug, role }]`, and `teams: [{ id, org_id, name, slug, role }]` claims in `OauthProvider.getUser()`. + - Added documentation for Zero-Latency JIT Token Claims and Organization/Teams hierarchy in `docs/sso-architecture.md`. +- **OpenAI-Compatible API Gateway Support**: + - Added dynamic configuration support for `OPENAI_BASE_URL`, `OPENAI_MODEL_NAME`, and `OPENAI_IMAGE_MODEL` across `OpenaiService`, `CopilotController`, `AgentGraphService`, and `AutopostService`. +- **Cross-Platform Chrome Extension Build System**: + - Added Node.js cross-platform build script (`apps/extension/build.mjs`) supporting Windows PowerShell and Linux/macOS `zip`. + - Updated Chrome Extension Manifest V3 with expanded host permissions and externally connectable domains (`*.crove.com`, `*.crove.io`, `*.dos.me`). +- **Multi-Provider Subscription Architecture**: + - Added `provider` column (`@default("stripe")`) to `Subscription` model to support multi-provider billing engines (e.g. RevenueCat). + +### Fixed +- **JIT Organization Synchronization in `AuthService.checkExists()`**: + - Fixed returning users missing claim/org updates by centralizing `syncUserOrganizations()` in `checkExists()` before issuing JWT. + - Enabled canonical `orgId` inheritance during initial user/org creation in `createOrgAndUser()`. +- **Database Catalog & Schema Stability**: + - Cleaned up orphaned dynamic Mastra catalog entries from PostgreSQL. + - Optimized database connection pool strings with `connection_limit`, `pool_timeout`, and `connect_timeout`. +- **Upstream Sync**: + - Merged upstream Postiz changes including Post Workflow v1.1.1, RevenueCat subscriptions, and Seedance video provider. + +### Previous Releases + +## [v2.23.0] - 2026-08-27 + ### Added - **Centralized DOS.Me SSO & PKCE Bridge Integration**: - Configured Generic OAuth 2.0 client authentication pointing to `https://api.dos.me/oauth/*` (Production) and `https://beta-api.dos.me/oauth/*` (Beta).