[server, dashboard] Introduce multi-org (behind feature flag) #20431
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ace isSIngleOrgInstallation incl. further cleanup around getConfiguration and server config
… and replace is with getInstallationConfiguration.IsDedicatedInstallation
…w admin-user to create organizations
… in a "create workspace" URL (e.g. "/?orgSlug=org1#github.com/my/repo")
geropl
changed the title
filiptronicek
approved these changes
Dec 8, 2024
this bad boy.| } | ||
|
|
||
| async createOrganization(userId: string, name: string): Promise<Organization> { | ||
| // TODO(gpl): Should we use the authorization layer to make this decision? |
There was a problem hiding this comment.
If we wanted to, could we? Does spicedb allow these conditional decisions from the schema depending on the installation config?
There was a problem hiding this comment.
Because it's static, we could also make it a relation. But there's also a way to attach data to a request, and "dynamic" rules that can decide based on that data.
But anyway, this is more speculative, as I don't see it being worth the effort to pull off right now.
geropl
force-pushed
the
gpl/970-multi-org
branch
from
eac3aed to
2fa6e93
Compare
|
@filiptronicek I fixed the tests + special tests for the "can't create/join org" cases in this separate PR, too ease reviewing: #20436 I don't see the point in separating it from this PR completely, so we'll just wait for that merge. 👍 |
* fix tests for real * [server] Create OrgService.createOrgOwnedUser, and use that across tests to fix the "can't join org" permission issues * Update components/server/src/orgs/organization-service.ts Co-authored-by: Filip Troníček <[email protected]> --------- Co-authored-by: Filip Troníček <[email protected]>
|
/unhold |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This is a POC of "multi-orgs in Dedicated", which comes with two main changesets:
admin-user
The core idea is that we enable the
admin-userto perform all cross-organization operations ("create org", "configure SSO", etc.).This approach has a couple of benefits:
A limitation is that user who is configuring SSO
for a new organization needs to be able to login using that SSO - which is the same flow as we have today. This is fine, because it works for the current actual usecase.
Another issue not addressed here is "how does a user get hold of the admin link". This is solved out-of-band for the current usecase.
UI
There is one main change, which is the introduction of the
/?orgSlug=parameter, which is checked across the dashboard and selects one of your organizations. It's especially understood by/login: This solves the use case of "first time user onboards into correct organization".Related Issue(s)
Fixes CLC-970
How to test
UI
admin-userSetup
enable_multi_orgfor your branchexport GITPOD_WITH_DEDICATED_EMU=true; leeway run dev:previewDocumentation
Preview status
gitpod:summary
Build Options
Build
Run the build with werft instead of GHA
Run Leeway with
--dont-testPublish
Installer
Add desired feature flags to the end of the line above, space separated
Preview Environment / Integration Tests
If enabled this will build
install/previewIf enabled this will create the environment on GCE infra
Saves cost. Untick this only if you're really sure you need a non-preemtible machine.
Valid options are
all,workspace,webapp,ide,jetbrains,vscode,ssh. If enabled,with-previewandwith-large-vmwill be enabled./hold