Add ability to renew sso certificate (#42899)

GitOrigin-RevId: 7821b3d12de8a8380247aad1eebcaf6f25dc7c9b

Author: atrakh

crates/workos_client/src/lib.rs

@@ -116,7 +116,7 @@ pub struct WorkOSAPIKeyResponse {
 
 #[derive(Debug, Deserialize)]
 pub struct WorkOSErrorResponse {
-    pub code: String,
+    pub code: Option<String>,
     pub message: String,
 }
 
@@ -182,6 +182,7 @@ pub struct WorkOSPortalLinkResponse {
 pub enum WorkOSPortalIntent {
     Sso,
     DomainVerification,
+    CertificateRenewal,
 }
 
 #[async_trait]
@@ -500,6 +501,7 @@ impl WorkOSClient for MockWorkOSClient {
         let intent_str = match intent {
             WorkOSPortalIntent::Sso => "sso",
             WorkOSPortalIntent::DomainVerification => "domain_verification",
+            WorkOSPortalIntent::CertificateRenewal => "certificate_renewal",
         };
         Ok(WorkOSPortalLinkResponse {
             link: format!(
@@ -857,7 +859,7 @@ where
         let response_body = response.into_body();
 
         if let Ok(error_response) = serde_json::from_slice::<WorkOSErrorResponse>(&response_body)
-            && error_response.code == "user_already_exists"
+            && error_response.code == Some("user_already_exists".to_string())
         {
             // This will be special-cased in scripts.
             anyhow::bail!(ErrorMetadata::bad_request(
@@ -1372,6 +1374,21 @@ where
     if !response.status().is_success() {
         let status = response.status();
         let response_body = response.into_body();
+
+        // Handle 400 Bad Request specially to forward the error message
+        if status == http::StatusCode::BAD_REQUEST {
+            println!("Hello! Bad request");
+            if let Ok(error_response) =
+                serde_json::from_slice::<WorkOSErrorResponse>(&response_body)
+            {
+                println!("Error message: {}", error_response.message);
+                return Err(anyhow::anyhow!(ErrorMetadata::bad_request(
+                    "WorkOSPortalLinkError",
+                    error_response.message
+                )));
+            }
+        }
+
         anyhow::bail!(format_workos_error(
             "generate portal link",
             status,

npm-packages/dashboard/dashboard-management-openapi.json

@@ -5237,7 +5237,8 @@
         "type": "string",
         "enum": [
           "sso",
-          "domainVerification"
+          "domainVerification",
+          "certificateRenewal"
         ]
       },
       "SerializedAccessToken": {

npm-packages/dashboard/src/components/teamSettings/TeamSSO.tsx

@@ -38,6 +38,10 @@ export function TeamSSO({ team }: { team: Team }) {
   const [isSubmitting, setIsSubmitting] = useState(false);
   const [isGeneratingDomainsLink, setIsGeneratingDomainsLink] = useState(false);
   const [isGeneratingSSOLink, setIsGeneratingSSOLink] = useState(false);
+  const [
+    isGeneratingCertificateRenewalLink,
+    setIsGeneratingCertificateRenewalLink,
+  ] = useState(false);
   const [showDisableConfirmation, setShowDisableConfirmation] = useState(false);
   const [disableError, setDisableError] = useState<string>();
   const [requireSsoLoginValue, setRequireSsoLoginValue] = useState(false);
@@ -277,8 +281,34 @@ export function TeamSSO({ team }: { team: Team }) {
                       </div>
                     )}
                     <div className="flex gap-2">
+                      <ManageSSOConfigurationButton
+                        loading={isGeneratingSSOLink}
+                        onClick={async () => {
+                          setIsGeneratingSSOLink(true);
+                          try {
+                            const result = await generateSSOConfigurationLink({
+                              intent: "sso",
+                            });
+                            if (result?.link) {
+                              window.open(result.link, "_blank");
+                            }
+                          } finally {
+                            setIsGeneratingSSOLink(false);
+                          }
+                        }}
+                        disabled={
+                          isSubmitting ||
+                          !hasAdminPermissions ||
+                          !hasVerifiedDomain ||
+                          isGeneratingAnyLink
+                        }
+                        tooltip={
+                          !hasVerifiedDomain
+                            ? "You must verify at least one domain before managing the SSO configuration."
+                            : undefined
+                        }
+                      />
                       <ManageDomainsButton
-                        variant="neutral"
                         loading={isGeneratingDomainsLink}
                         onClick={async () => {
                           setIsGeneratingDomainsLink(true);
@@ -299,20 +329,19 @@ export function TeamSSO({ team }: { team: Team }) {
                           isGeneratingAnyLink
                         }
                       />
-                      <ManageSSOConfigurationButton
-                        variant="primary"
-                        loading={isGeneratingSSOLink}
+                      <CertificateRenewalButton
+                        loading={isGeneratingCertificateRenewalLink}
                         onClick={async () => {
-                          setIsGeneratingSSOLink(true);
                           try {
+                            setIsGeneratingCertificateRenewalLink(true);
                             const result = await generateSSOConfigurationLink({
-                              intent: "sso",
+                              intent: "certificateRenewal",
                             });
-                            if (result?.link) {
+                            if (result) {
                               window.open(result.link, "_blank");
                             }
                           } finally {
-                            setIsGeneratingSSOLink(false);
+                            setIsGeneratingCertificateRenewalLink(false);
                           }
                         }}
                         disabled={
@@ -328,35 +357,40 @@ export function TeamSSO({ team }: { team: Team }) {
                         }
                       />
                     </div>
-                  </div>
-                  <hr />
-                  <h4 className="text-sm font-semibold text-content-primary">
-                    Additional Options
-                  </h4>
-                  <div className="space-y-2">
-                    <label className="ml-1 flex items-center gap-3 text-sm text-content-primary">
-                      <Checkbox
-                        checked={requireSsoLoginValue}
-                        disabled={requireSsoLoginDisabled}
-                        onChange={() => {
-                          if (requireSsoLoginDisabled) {
-                            return;
-                          }
-                          setRequireSsoLoginValue(!requireSsoLoginValue);
-                        }}
-                      />
-                      <span className="flex items-center gap-2">
-                        Require SSO to access team
-                        <Tooltip
-                          tip="Require that team members log in with SSO to access the team."
-                          side="right"
-                        >
-                          <QuestionMarkCircledIcon className="h-4 w-4 text-content-secondary" />
-                        </Tooltip>
-                      </span>
-                    </label>
+                    <hr />
+                    <h4 className="text-sm font-semibold text-content-primary">
+                      Additional Options
+                    </h4>
+                    <Tooltip
+                      tip={
+                        !hasAdminPermissions
+                          ? "You do not have permission to change SSO settings."
+                          : !ssoEnabled
+                            ? "SSO is not available on your plan."
+                            : undefined
+                      }
+                    >
+                      <label className="ml-px flex items-center gap-2">
+                        <Checkbox
+                          checked={requireSsoLoginValue}
+                          disabled={requireSsoLoginDisabled}
+                          onChange={() => {
+                            setRequireSsoLoginValue(!requireSsoLoginValue);
+                          }}
+                        />
+                        <span className="ml-px flex items-center gap-2">
+                          Require SSO to access team
+                          <Tooltip
+                            tip="Require that team members log in with SSO to access the team."
+                            side="right"
+                          >
+                            <QuestionMarkCircledIcon className="h-4 w-4 text-content-secondary" />
+                          </Tooltip>
+                        </span>
+                      </label>
+                    </Tooltip>
 
-                    <div className="mt-4 flex">
+                    <div className="flex">
                       <Button
                         type="button"
                         variant="primary"
@@ -468,16 +502,14 @@ function ManageDomainsButton({
   onClick,
   disabled,
   loading,
-  variant,
 }: {
   onClick: () => Promise<void>;
   disabled: boolean;
   loading: boolean;
-  variant: "primary" | "neutral";
 }) {
   return (
     <Button
-      variant={variant}
+      variant="neutral"
       className="w-fit"
       size="sm"
       loading={loading}
@@ -493,31 +525,50 @@ function ManageSSOConfigurationButton({
   onClick,
   disabled,
   loading,
-  variant,
   tooltip,
 }: {
   onClick: () => Promise<void>;
   disabled: boolean;
   loading: boolean;
-  variant: "primary" | "neutral";
   tooltip?: string;
 }) {
-  const button = (
+  return (
     <Button
-      variant={variant}
+      variant="primary"
       className="w-fit"
       size="sm"
       loading={loading}
       onClick={onClick}
       disabled={disabled}
+      tip={tooltip}
     >
       Manage SSO configuration
     </Button>
   );
+}
 
-  if (tooltip) {
-    return <Tooltip tip={tooltip}>{button}</Tooltip>;
-  }
-
-  return button;
+function CertificateRenewalButton({
+  onClick,
+  disabled,
+  loading,
+  tooltip,
+}: {
+  onClick: () => Promise<void>;
+  disabled: boolean;
+  loading: boolean;
+  tooltip?: string;
+}) {
+  return (
+    <Button
+      variant="neutral"
+      className="w-fit"
+      size="sm"
+      loading={loading}
+      onClick={onClick}
+      disabled={disabled}
+      tip={tooltip}
+    >
+      Renew Certificate
+    </Button>
+  );
 }

npm-packages/dashboard/src/generatedApi.ts

@@ -2271,7 +2271,7 @@ export interface components {
             requireSsoLogin: boolean;
         };
         /** @enum {string} */
-        SSOPortalIntent: "sso" | "domainVerification";
+        SSOPortalIntent: "sso" | "domainVerification" | "certificateRenewal";
         /** @description ConvexAccessToken is our own internal notion of authorization.
          *     It is versioned.
          *