@stigmer/react 0.0.89 → 0.0.90

package/src/identity-provider/IdentityProviderWizard.tsx

@@ -8,6 +8,7 @@ import {
 import { cn } from "@stigmer/theme";
 import { getUserMessage } from "@stigmer/sdk";
 import type { IdentityProvider } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { ProviderPicker } from "./ProviderPicker";
 import { useCreateIdentityProvider } from "./useCreateIdentityProvider";
 import { useOidcDiscovery } from "./useOidcDiscovery";
@@ -81,6 +82,12 @@ export function IdentityProviderWizard({
   const [oidcClientId, setOidcClientId] = useState("");
   const [discoveryFailed, setDiscoveryFailed] = useState(false);
 
+  // JIT provisioning
+  const [autoProvision, setAutoProvision] = useState(false);
+  const [autoGrant, setAutoGrant] = useState(false);
+  const [autoGrantRole, setAutoGrantRole] = useState<IamRole>(IamRole.iam_role_unspecified);
+  const [tenantOrgClaim, setTenantOrgClaim] = useState("");
+
   // -- Step transitions ------------------------------------------------
 
   const handlePickProvider = useCallback((selected: ProviderPreset) => {
@@ -130,6 +137,24 @@ export function IdentityProviderWizard({
 
   // -- Submit ----------------------------------------------------------
 
+  const handleAutoProvisionChange = useCallback((v: boolean) => {
+    setAutoProvision(v);
+    if (!v) {
+      setAutoGrant(false);
+      setAutoGrantRole(IamRole.iam_role_unspecified);
+      setTenantOrgClaim("");
+    }
+  }, []);
+
+  const handleAutoGrantChange = useCallback((v: boolean) => {
+    setAutoGrant(v);
+    if (v) setAutoProvision(true);
+    if (!v) {
+      setAutoGrantRole(IamRole.iam_role_unspecified);
+      setTenantOrgClaim("");
+    }
+  }, []);
+
   const handleSubmit = useCallback(
     async (e: FormEvent) => {
       e.preventDefault();
@@ -150,6 +175,16 @@ export function IdentityProviderWizard({
             isSsoProvider: true,
             oidcClientId: oidcClientId.trim(),
           }),
+          ...(!isSso && {
+            autoProvisionAccounts: autoProvision,
+            autoGrantOnOrg: autoGrant,
+            ...(autoGrant && autoGrantRole !== IamRole.iam_role_unspecified && {
+              autoGrantRole,
+            }),
+            ...(autoGrant && tenantOrgClaim.trim() && {
+              tenantOrgClaim: tenantOrgClaim.trim(),
+            }),
+          }),
         });
         onCreated?.(idp);
       } catch {
@@ -158,7 +193,8 @@ export function IdentityProviderWizard({
     },
     [
       name, org, jwksUri, issuers, audience, userinfoEndpoint,
-      isSso, oidcClientId, create, clearError, onCreated,
+      isSso, oidcClientId, autoProvision, autoGrant, autoGrantRole,
+      tenantOrgClaim, create, clearError, onCreated,
     ],
   );
 
@@ -216,6 +252,14 @@ export function IdentityProviderWizard({
           onIsSsoChange={setIsSso}
           oidcClientId={oidcClientId}
           onOidcClientIdChange={setOidcClientId}
+          autoProvision={autoProvision}
+          onAutoProvisionChange={handleAutoProvisionChange}
+          autoGrant={autoGrant}
+          onAutoGrantChange={handleAutoGrantChange}
+          autoGrantRole={autoGrantRole}
+          onAutoGrantRoleChange={setAutoGrantRole}
+          tenantOrgClaim={tenantOrgClaim}
+          onTenantOrgClaimChange={setTenantOrgClaim}
           isCreating={isCreating}
           createError={createError}
           onBack={handleBackToConfigure}
@@ -407,6 +451,14 @@ function ReviewStep({
   onIsSsoChange,
   oidcClientId,
   onOidcClientIdChange,
+  autoProvision,
+  onAutoProvisionChange,
+  autoGrant,
+  onAutoGrantChange,
+  autoGrantRole,
+  onAutoGrantRoleChange,
+  tenantOrgClaim,
+  onTenantOrgClaimChange,
   isCreating,
   createError,
   onBack,
@@ -424,6 +476,14 @@ function ReviewStep({
   onIsSsoChange: (v: boolean) => void;
   oidcClientId: string;
   onOidcClientIdChange: (v: string) => void;
+  autoProvision: boolean;
+  onAutoProvisionChange: (v: boolean) => void;
+  autoGrant: boolean;
+  onAutoGrantChange: (v: boolean) => void;
+  autoGrantRole: IamRole;
+  onAutoGrantRoleChange: (v: IamRole) => void;
+  tenantOrgClaim: string;
+  onTenantOrgClaimChange: (v: string) => void;
   isCreating: boolean;
   createError: Error | null;
   onBack: () => void;
@@ -484,30 +544,12 @@ function ReviewStep({
       />
 
       {/* SSO toggle */}
-      <div className="flex items-center gap-2">
-        <button
-          type="button"
-          role="switch"
-          aria-checked={isSso}
-          onClick={() => onIsSsoChange(!isSso)}
-          disabled={isCreating}
-          className={cn(
-            "relative inline-flex h-5 w-9 shrink-0 cursor-pointer rounded-full border-2 border-transparent transition-colors",
-            isSso ? "bg-primary" : "bg-muted",
-            "disabled:pointer-events-none disabled:opacity-50",
-          )}
-        >
-          <span
-            className={cn(
-              "pointer-events-none inline-block h-4 w-4 rounded-full bg-background shadow-sm ring-0 transition-transform",
-              isSso ? "translate-x-4" : "translate-x-0",
-            )}
-          />
-        </button>
-        <span className="text-xs font-medium text-foreground">
-          SSO provider
-        </span>
-      </div>
+      <ToggleSwitch
+        checked={isSso}
+        onChange={onIsSsoChange}
+        label="SSO provider"
+        disabled={isCreating}
+      />
 
       {isSso && (
         <FieldInput
@@ -522,6 +564,20 @@ function ReviewStep({
         />
       )}
 
+      {/* JIT provisioning */}
+      <JitProvisioningSection
+        isSso={isSso}
+        autoProvision={autoProvision}
+        onAutoProvisionChange={onAutoProvisionChange}
+        autoGrant={autoGrant}
+        onAutoGrantChange={onAutoGrantChange}
+        autoGrantRole={autoGrantRole}
+        onAutoGrantRoleChange={onAutoGrantRoleChange}
+        tenantOrgClaim={tenantOrgClaim}
+        onTenantOrgClaimChange={onTenantOrgClaimChange}
+        disabled={isCreating}
+      />
+
       {createError && (
         <p className="text-destructive text-[0.65rem]" role="alert">
           {getUserMessage(createError)}
@@ -626,6 +682,156 @@ function FieldInput({
   );
 }
 
+// ---------------------------------------------------------------------------
+// JIT provisioning section
+// ---------------------------------------------------------------------------
+
+const JIT_ROLE_OPTIONS: readonly { readonly value: string; readonly label: string }[] = [
+  { value: String(IamRole.iam_role_unspecified), label: "Default (viewer)" },
+  { value: String(IamRole.viewer), label: "Viewer" },
+  { value: String(IamRole.member), label: "Member" },
+  { value: String(IamRole.admin), label: "Admin" },
+];
+
+function JitProvisioningSection({
+  isSso,
+  autoProvision,
+  onAutoProvisionChange,
+  autoGrant,
+  onAutoGrantChange,
+  autoGrantRole,
+  onAutoGrantRoleChange,
+  tenantOrgClaim,
+  onTenantOrgClaimChange,
+  disabled,
+}: {
+  isSso: boolean;
+  autoProvision: boolean;
+  onAutoProvisionChange: (v: boolean) => void;
+  autoGrant: boolean;
+  onAutoGrantChange: (v: boolean) => void;
+  autoGrantRole: IamRole;
+  onAutoGrantRoleChange: (v: IamRole) => void;
+  tenantOrgClaim: string;
+  onTenantOrgClaimChange: (v: string) => void;
+  disabled?: boolean;
+}) {
+  if (isSso) {
+    return (
+      <div className="rounded-md border border-border/60 bg-muted/30 px-3 py-2">
+        <p className="text-[0.65rem] text-muted-foreground">
+          SSO providers automatically provision accounts and grant the{" "}
+          <span className="font-medium text-foreground">viewer</span> role on
+          the owning organization. JIT provisioning settings are not applicable.
+        </p>
+      </div>
+    );
+  }
+
+  return (
+    <fieldset className="space-y-2.5" disabled={disabled}>
+      <hr className="border-border/40" />
+      <legend className="text-xs font-medium text-foreground">
+        JIT provisioning
+      </legend>
+      <p className="text-[0.65rem] text-muted-foreground">
+        Configure automatic account creation and role assignment for users
+        authenticating with this provider.
+      </p>
+
+      <ToggleSwitch
+        checked={autoProvision}
+        onChange={onAutoProvisionChange}
+        label="Auto-provision accounts"
+        hint="Create a federated account automatically on first authentication"
+        disabled={disabled}
+      />
+
+      <ToggleSwitch
+        checked={autoGrant}
+        onChange={onAutoGrantChange}
+        label="Auto-grant on organization"
+        hint="Grant a role on the owning organization when an account is provisioned"
+        disabled={disabled || !autoProvision}
+      />
+
+      {autoGrant && (
+        <>
+          <FieldInput
+            id="stgm-idp-wiz-grant-role"
+            label="Auto-grant role"
+            value={String(autoGrantRole)}
+            onChange={(v) => onAutoGrantRoleChange(Number(v) as IamRole)}
+            placeholder=""
+            hint="Role granted automatically — org admins can upgrade later"
+            disabled={disabled}
+            type="select"
+            options={JIT_ROLE_OPTIONS}
+          />
+
+          <FieldInput
+            id="stgm-idp-wiz-tenant-claim"
+            label="Tenant org claim"
+            value={tenantOrgClaim}
+            onChange={onTenantOrgClaimChange}
+            placeholder="e.g., org_id"
+            hint="JWT claim name that maps to a platform-managed organization (max 256 chars)"
+            disabled={disabled}
+          />
+        </>
+      )}
+    </fieldset>
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Toggle switch
+// ---------------------------------------------------------------------------
+
+function ToggleSwitch({
+  checked,
+  onChange,
+  label,
+  hint,
+  disabled,
+}: {
+  checked: boolean;
+  onChange: (v: boolean) => void;
+  label: string;
+  hint?: string;
+  disabled?: boolean;
+}) {
+  return (
+    <div className="space-y-0.5">
+      <div className="flex items-center gap-2">
+        <button
+          type="button"
+          role="switch"
+          aria-checked={checked}
+          onClick={() => onChange(!checked)}
+          disabled={disabled}
+          className={cn(
+            "relative inline-flex h-5 w-9 shrink-0 cursor-pointer rounded-full border-2 border-transparent transition-colors",
+            checked ? "bg-primary" : "bg-muted",
+            "disabled:pointer-events-none disabled:opacity-50",
+          )}
+        >
+          <span
+            className={cn(
+              "pointer-events-none inline-block h-4 w-4 rounded-full bg-background shadow-sm ring-0 transition-transform",
+              checked ? "translate-x-4" : "translate-x-0",
+            )}
+          />
+        </button>
+        <span className="text-xs font-medium text-foreground">{label}</span>
+      </div>
+      {hint && (
+        <p className="pl-11 text-[0.65rem] text-muted-foreground">{hint}</p>
+      )}
+    </div>
+  );
+}
+
 function TextButton({
   onClick,
   disabled,

package/src/index.ts

@@ -454,6 +454,32 @@ export type {
   ApiKeyCreatedAlertProps,
 } from "./api-key";
 
+// Platform Client — data hooks, mutation hooks, and styled components for platform client lifecycle
+export {
+  usePlatformClientList,
+  usePlatformClient,
+  useCreatePlatformClient,
+  useUpdatePlatformClient,
+  useDeletePlatformClient,
+  useRotatePlatformClientSecret,
+  PlatformClientListPanel,
+  CreatePlatformClientForm,
+  PlatformClientDetailPanel,
+  PlatformClientSecretAlert,
+} from "./platform-client";
+export type {
+  UsePlatformClientListReturn,
+  UsePlatformClientReturn,
+  UseCreatePlatformClientReturn,
+  UseUpdatePlatformClientReturn,
+  UseDeletePlatformClientReturn,
+  UseRotatePlatformClientSecretReturn,
+  PlatformClientListPanelProps,
+  CreatePlatformClientFormProps,
+  PlatformClientDetailPanelProps,
+  PlatformClientSecretAlertProps,
+} from "./platform-client";
+
 // OAuth App — data hooks, mutation hooks, and styled components for OAuth app management
 export {
   useOAuthAppList,