iatoolkit 2.54.1__tar.gz → 2.56.0__tar.gz

{iatoolkit-2.54.1/src/iatoolkit.egg-info → iatoolkit-2.56.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.54.1
+Version: 2.56.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.54.1"
+__version__ = "2.56.0"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/common/interfaces/signup_policy_resolver.py

@@ -31,3 +31,20 @@ class SignupPolicyResolver(ABC):
         invite_token: str | None = None,
     ) -> SignupPolicyDecision:
         """Evaluates whether the email can sign up for the target company."""
+
+    def requires_invitation(self, company_short_name: str) -> bool:
+        return False
+
+    def invitation_email(self, company_short_name: str, invite_token: str | None) -> str | None:
+        return None
+
+    def claim_signup(
+        self,
+        company_short_name: str,
+        email: str,
+        invite_token: str | None = None,
+        *,
+        verified_email: bool = False,
+    ) -> bool:
+        """Claim an invitation in the same transaction that creates membership."""
+        return True

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/common/routes.py

@@ -33,6 +33,8 @@ def register_views(app):
         LoginView,
         GoogleLoginStartView,
         GoogleLoginCallbackView,
+        GlobalLoginView,
+        GlobalGoogleLoginStartView,
         FinalizeContextView,
     )
     from iatoolkit.views.configuration_api_view import ConfigurationApiView, ValidateConfigurationApiView
@@ -74,6 +76,13 @@ def register_views(app):
         view_func=GoogleLoginCallbackView.as_view('login_google_callback')
     )
 
+    # company-less login: identifies the person, the caller picks the company
+    app.add_url_rule('/auth/login', view_func=GlobalLoginView.as_view('global_login'))
+    app.add_url_rule(
+        '/auth/login/google',
+        view_func=GlobalGoogleLoginStartView.as_view('global_login_google_start')
+    )
+
     # Chat Route (Direct Access)
     app.add_url_rule('/<company_short_name>/chat',
                      view_func=ChatView.as_view('chat'))

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/config/system_tools_pack.yaml

@@ -129,8 +129,11 @@ tools:
   - function_name: iat_send_email
     description: iatoolkit mail system. envia mails cuando un usuario lo solicita.
     # Sends a real email: simulated, never sent, when an evaluation replays an agent.
+    # Not destructive (it changes nothing that existed) and not open-world for MCP
+    # annotations: it goes through the tenant's own mail service.
     execution_config:
       side_effects: true
+      destructive: false
     routing_profile:
       tags:
         - email
@@ -559,6 +562,9 @@ tools:
         - metadata_filter
   - function_name: iat_web_search
     description: Realiza una búsqueda web externa para obtener información pública actualizada.
+    # Reaches the public internet: openWorldHint in MCP annotations.
+    execution_config:
+      open_world: true
     routing_profile:
       tags:
         - web

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/locales/en.yaml

@@ -274,6 +274,10 @@ ui:
       pending_review: "Pending review"
       revoked: "Revoked"
 
+  global_login:
+    title: "Sign in to IAToolkit"
+    intro: "Sign in with the account you use in IAToolkit. You will choose the company next."
+
   login_widget:
     title: "Sign In"
     welcome_message: "Enter your credentials or register to access this platform."
@@ -287,6 +291,7 @@ ui:
     forgot_password_link: "Forgot your password?"
     no_account_prompt: "Don't have an account?"
     signup_link: "Sign Up"
+    invitation_prompt: "Need access? Ask your administrator for an invitation."
 
   signup:
     title: "Create an Account"
@@ -607,6 +612,25 @@ ui:
     status_closed: "Closed"
   admin:
     workspace: "Workspace"
+    team_invitations: "Invitations"
+    team_invite_user: "Invite user"
+    team_invite_none: "No invitations yet."
+    team_invite_loading: "Loading invitations..."
+    team_invite_email: "Email"
+    team_invite_pending: "Pending"
+    team_invite_accepted: "Accepted"
+    team_invite_expired: "Expired"
+    team_invite_revoked_status: "Revoked"
+    team_invite_status: "Status"
+    team_invite_invited_by: "Invited by"
+    team_invite_expires: "Expires"
+    team_invite_revoke: "Revoke"
+    team_invite_revoked: "Invitation revoked."
+    team_invite_load_error: "Could not load invitations."
+    team_invite_revoke_error: "Could not revoke invitation."
+    team_policy_note: "Choose domain access or require an invitation for each new member."
+    team_policy_static_note: "Signup policies are enforced when the company runs in hosted mode."
+    team_policy_invite_only: "Invitation only"
     configuration: "Configuration"
     error: "Error"
     company_config: "Company Configuration (company.yaml)"
@@ -2582,6 +2606,7 @@ errors:
     user_already_registered: "The user with email '{email}' already exists in this company."
     password_mismatch: "The passwords do not match. Please try again."
     signup_not_allowed: "Signup is not allowed for this company. Please contact an administrator."
+    invitation_required: "A valid invitation is required to join this company. Ask your administrator for a new link."
   change_password:
     token_expired: "The password change link has expired. Please request a new one."
     password_mismatch: "The passwords do not match. Please try again."

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/locales/es.yaml

@@ -288,6 +288,10 @@ ui:
       revoked: "Revocado"
 
 
+  global_login:
+    title: "Iniciar sesión en IAToolkit"
+    intro: "Ingresa con la cuenta que usas en IAToolkit. Después podrás elegir la empresa."
+
   login_widget:
     title: "Iniciar Sesión"
     welcome_message: "Ingresa tus credenciales o registrate para acceder a la plataforma."
@@ -301,6 +305,7 @@ ui:
     forgot_password_link: "¿Olvidaste tu contraseña?"
     no_account_prompt: "¿No tienes una cuenta?"
     signup_link: "Regístrate"
+    invitation_prompt: "¿Necesitas acceso? Solicita una invitación al administrador."
 
   signup:
     title: "Crear una Cuenta"
@@ -621,6 +626,25 @@ ui:
     status_closed: "Cerrada"
   admin:
     workspace: "Recursos"
+    team_invitations: "Invitaciones"
+    team_invite_user: "Invitar usuario"
+    team_invite_none: "Todavía no hay invitaciones."
+    team_invite_loading: "Cargando invitaciones..."
+    team_invite_email: "Correo"
+    team_invite_pending: "Pendiente"
+    team_invite_accepted: "Aceptada"
+    team_invite_expired: "Vencida"
+    team_invite_revoked_status: "Revocada"
+    team_invite_status: "Estado"
+    team_invite_invited_by: "Invitado por"
+    team_invite_expires: "Vence"
+    team_invite_revoke: "Revocar"
+    team_invite_revoked: "Invitación revocada."
+    team_invite_load_error: "No se pudieron cargar las invitaciones."
+    team_invite_revoke_error: "No se pudo revocar la invitación."
+    team_policy_note: "Permite el acceso por dominio o exige una invitación para cada nuevo miembro."
+    team_policy_static_note: "Las políticas de registro se aplican cuando la empresa funciona en modo alojado."
+    team_policy_invite_only: "Solo con invitación"
     configuration: "Configuración"
     error: "Error"
     company_config: "Configuración Empresa (company.yaml)"
@@ -2601,6 +2625,7 @@ errors:
     user_already_registered: "El usuario con email '{email}' ya existe en esta empresa."
     password_mismatch: "Las contraseñas no coinciden. Por favor, inténtalo de nuevo."
     signup_not_allowed: "El registro no está habilitado para esta empresa. Contacta a un administrador."
+    invitation_required: "Necesitas una invitación vigente para unirte a esta empresa. Solicita un nuevo enlace al administrador."
   change_password:
     token_expired: "El enlace de cambio de contraseña ha expirado. Por favor, solicita uno nuevo."
     password_mismatch: "Las contraseñas no coinciden. Por favor, inténtalo nuevamente."

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/services/auth_service.py

@@ -22,6 +22,8 @@ class AuthService:
     Centralized service for handling authentication for all incoming requests.
     It determines the user's identity based on either a Flask session cookie or an API Key.
     """
+    # access-log scope for logins that are not tied to a company
+    GLOBAL_ACCESS_SCOPE = '*'
 
     @inject
     def __init__(self, profile_service: ProfileService,
@@ -186,6 +188,82 @@ class AuthService:
 
         return auth_response
 
+    def login_global_local_user(self, email: str, password: str) -> dict:
+        # company-less login: authenticates the person, the company is chosen later
+        auth_response = self.profile_service.authenticate_local_credentials(email=email, password=password)
+        if not auth_response.get('success'):
+            self.log_access(
+                company_short_name=self.GLOBAL_ACCESS_SCOPE,
+                user_identifier=email,
+                auth_type='local',
+                outcome='failure',
+                reason_code='INVALID_CREDENTIALS',
+            )
+            return auth_response
+
+        self.profile_service.set_global_identity(auth_response['user_identifier'], 'local')
+        self.log_access(
+            company_short_name=self.GLOBAL_ACCESS_SCOPE,
+            auth_type='local',
+            outcome='success',
+            user_identifier=auth_response['user_identifier'],
+        )
+        return auth_response
+
+    def login_global_google_user(self, code: str, state: str, nonce: str, redirect_uri: str) -> dict:
+        try:
+            google_identity = self.google_auth_client.exchange_code_for_identity(
+                code=code,
+                state=state,
+                nonce=nonce,
+                redirect_uri=redirect_uri,
+            )
+        except GoogleAuthError as exc:
+            self.log_access(
+                company_short_name=self.GLOBAL_ACCESS_SCOPE,
+                auth_type='google',
+                outcome='failure',
+                reason_code=exc.reason_code,
+            )
+            return {
+                'success': False,
+                'reason_code': exc.reason_code,
+                'message': self.i18n_service.t(exc.message_key),
+            }
+        except Exception:
+            logging.exception("Unexpected Google auth client failure in company-less login.")
+            self.log_access(
+                company_short_name=self.GLOBAL_ACCESS_SCOPE,
+                auth_type='google',
+                outcome='failure',
+                reason_code='GOOGLE_AUTH_UNEXPECTED_ERROR',
+            )
+            return {
+                'success': False,
+                'reason_code': 'GOOGLE_AUTH_UNEXPECTED_ERROR',
+                'message': self.i18n_service.t('errors.auth.google_login_failed'),
+            }
+
+        auth_response = self.profile_service.identify_google_user(google_identity)
+        if not auth_response.get('success'):
+            self.log_access(
+                company_short_name=self.GLOBAL_ACCESS_SCOPE,
+                auth_type='google',
+                outcome='failure',
+                reason_code=auth_response.get('reason_code', 'GOOGLE_LOGIN_FAILED'),
+                user_identifier=google_identity.email,
+            )
+            return auth_response
+
+        self.profile_service.set_global_identity(auth_response['user_identifier'], 'google')
+        self.log_access(
+            company_short_name=self.GLOBAL_ACCESS_SCOPE,
+            auth_type='google',
+            outcome='success',
+            user_identifier=auth_response['user_identifier'],
+        )
+        return auth_response
+
     def verify(self, anonymous: bool = False, company_short_name: str = None) -> dict:
         """
         Verifies the current request and identifies the user.

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/services/configuration_service.py

@@ -794,8 +794,14 @@ class ConfigurationService:
             if execution_config is not None:
                 if not isinstance(execution_config, dict):
                     add_error(f"tools[{i}].execution_config", "Must be a dictionary.")
-                elif "side_effects" in execution_config and not isinstance(execution_config["side_effects"], bool):
-                    add_error(f"tools[{i}].execution_config.side_effects", "Must be true or false.")
+                else:
+                    # side_effects drives evaluations; destructive / open_world / title
+                    # feed the MCP tool annotations.
+                    for flag in ("side_effects", "destructive", "open_world"):
+                        if flag in execution_config and not isinstance(execution_config[flag], bool):
+                            add_error(f"tools[{i}].execution_config.{flag}", "Must be true or false.")
+                    if "title" in execution_config and not isinstance(execution_config["title"], str):
+                        add_error(f"tools[{i}].execution_config.title", "Must be a string.")
 
         # 6. Prompts
         prompt_list, categories_config = self._get_prompt_config(config)

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/services/profile_service.py

@@ -21,6 +21,7 @@ import random
 import re
 import string
 import logging
+import time
 from html import escape
 from datetime import datetime
 from typing import List, Dict
@@ -30,6 +31,8 @@ from iatoolkit.services.signup_policy_resolver import AllowAllSignupPolicyResolv
 
 
 class ProfileService:
+    GLOBAL_IDENTITY_SESSION_KEY = 'global_identity'
+
     @inject
     def __init__(self,
                  i18n_service: I18nService,
@@ -65,6 +68,16 @@ class ProfileService:
         except Exception as rollback_error:
             logging.warning(f"ProfileService rollback failed: {rollback_error}")
 
+    def signup_invitation_context(
+        self, company_short_name: str, invite_token: str | None,
+    ) -> tuple[bool, str | None]:
+        required = self.signup_policy_resolver.requires_invitation(company_short_name)
+        email = (
+            self.signup_policy_resolver.invitation_email(company_short_name, invite_token)
+            if invite_token else None
+        )
+        return required, email
+
     @staticmethod
     def _normalize_name_value(value: str | None, fallback: str) -> str:
         text = str(value or "").strip()
@@ -159,22 +172,110 @@ class ProfileService:
         if not str(user.last_name or "").strip():
             user.last_name = last_name
 
-    def login(self, company_short_name: str, email: str, password: str) -> dict:
+    def _check_local_credentials(self, email: str, password: str) -> tuple[User | None, dict | None]:
+        # check if user exists
+        user = self.profile_repo.get_user_by_email(email)
+        if not user:
+            return None, {'success': False, 'message': self.i18n_service.t('errors.auth.user_not_found')}
+
+        if self._is_google_auth_user(user):
+            return None, {
+                'success': False,
+                'message': self.i18n_service.t('errors.auth.google_account_requires_google_login')
+            }
+
+        # check the encrypted password
+        if not user.password or not check_password_hash(user.password, password):
+            return None, {'success': False, 'message': self.i18n_service.t('errors.auth.invalid_password')}
+
+        return user, None
+
+    def authenticate_local_credentials(self, email: str, password: str) -> dict:
+        """
+        Checks email and password without tying the user to a company and
+        without opening a company session. Used by the company-less login,
+        where the company is chosen afterwards among the user's memberships.
+        """
         try:
-            # check if user exists
+            user, error = self._check_local_credentials(email, password)
+            if error:
+                return error
+
+            if not user.verified:
+                return {'success': False,
+                        "message": self.i18n_service.t('errors.services.account_not_verified')}
+
+            return {'success': True, 'user_identifier': user.email}
+        except Exception as e:
+            self._safe_rollback()
+            logging.error(f"Error in authenticate_local_credentials: {e}")
+            return {'success': False, "message": str(e)}
+
+    def identify_google_user(self, google_identity: GoogleIdentity) -> dict:
+        """
+        Resolves an existing user from a Google identity without creating the
+        user, linking the Google account or adding a company membership: the
+        company-less login only lets in people who already belong somewhere.
+        """
+        email = str(google_identity.email or "").strip().lower()
+        if not email or not google_identity.email_verified:
+            return {
+                "success": False,
+                "message": self.i18n_service.t('errors.auth.google_email_not_verified'),
+                "reason_code": "GOOGLE_EMAIL_NOT_VERIFIED",
+            }
+
+        user = self.profile_repo.get_user_by_google_sub(google_identity.subject)
+        if user:
+            if str(user.email or "").strip().lower() != email:
+                return {
+                    "success": False,
+                    "message": self.i18n_service.t('errors.auth.google_account_email_changed'),
+                    "reason_code": "GOOGLE_EMAIL_CHANGED",
+                }
+        else:
             user = self.profile_repo.get_user_by_email(email)
             if not user:
-                return {'success': False, 'message': self.i18n_service.t('errors.auth.user_not_found')}
-
-            if self._is_google_auth_user(user):
                 return {
-                    'success': False,
-                    'message': self.i18n_service.t('errors.auth.google_account_requires_google_login')
+                    "success": False,
+                    "message": self.i18n_service.t('errors.auth.user_not_found'),
+                    "reason_code": "USER_NOT_FOUND",
+                }
+            if self._is_google_auth_user(user) and user.google_sub and user.google_sub != google_identity.subject:
+                return {
+                    "success": False,
+                    "message": self.i18n_service.t('errors.auth.google_account_conflict'),
+                    "reason_code": "GOOGLE_ACCOUNT_CONFLICT",
                 }
 
-            # check the encrypted password
-            if not user.password or not check_password_hash(user.password, password):
-                return {'success': False, 'message': self.i18n_service.t('errors.auth.invalid_password')}
+        return {"success": True, "user_identifier": user.email}
+
+    def set_global_identity(self, user_identifier: str, auth_method: str):
+        """
+        Records who authenticated through the company-less login. It is not a
+        company session: no profile is built and no company page trusts it.
+        """
+        SessionManager.set_permanent(True)
+        SessionManager.set(self.GLOBAL_IDENTITY_SESSION_KEY, {
+            'user_identifier': user_identifier,
+            'auth_method': auth_method,
+            'authenticated_at': int(time.time()),
+        })
+
+    def get_global_identity(self) -> dict | None:
+        identity = SessionManager.get(self.GLOBAL_IDENTITY_SESSION_KEY)
+        if not isinstance(identity, dict) or not identity.get('user_identifier'):
+            return None
+        return identity
+
+    def clear_global_identity(self):
+        SessionManager.remove(self.GLOBAL_IDENTITY_SESSION_KEY)
+
+    def login(self, company_short_name: str, email: str, password: str) -> dict:
+        try:
+            user, error = self._check_local_credentials(email, password)
+            if error:
+                return error
 
             company = self.profile_repo.get_company_by_short_name(company_short_name)
             if not company:
@@ -488,6 +589,7 @@ class ProfileService:
                 )
                 policy_metadata = dict(policy_decision.metadata or {})
                 if not policy_decision.allowed:
+                    self._safe_rollback()
                     logging.info(
                         "Google login blocked by signup policy. company=%s email=%s policy=%s metadata=%s",
                         company_short_name,
@@ -506,6 +608,15 @@ class ProfileService:
                         "message": message,
                         "reason_code": "SIGNUP_NOT_ALLOWED",
                     }
+                if not self.signup_policy_resolver.claim_signup(
+                    company_short_name, email, verified_email=True,
+                ):
+                    self._safe_rollback()
+                    return {
+                        "success": False,
+                        "message": self.i18n_service.t('errors.signup.signup_not_allowed'),
+                        "reason_code": "SIGNUP_NOT_ALLOWED",
+                    }
                 user.companies.append(company)
                 provisioning_outcome = "company_associated" if user.id is not None else provisioning_outcome
                 persisted = True
@@ -664,6 +775,11 @@ class ProfileService:
                     return {"error": self.i18n_service.t('errors.signup.user_already_registered', email=email)}
                 else:
                     # add new company to existing user
+                    if not self.signup_policy_resolver.claim_signup(
+                        company_short_name, email, invite_token,
+                    ):
+                        self._safe_rollback()
+                        return {"error": self.i18n_service.t('errors.signup.signup_not_allowed')}
                     existing_user.companies.append(company)
                     self.profile_repo.save_user(existing_user)
                     self._promote_bootstrap_owner_if_needed(company, existing_user)
@@ -699,6 +815,11 @@ class ProfileService:
                             )
 
             # associate new company to user
+            if not self.signup_policy_resolver.claim_signup(
+                company_short_name, email, invite_token,
+            ):
+                self._safe_rollback()
+                return {"error": self.i18n_service.t('errors.signup.signup_not_allowed')}
             new_user.companies.append(company)
 
             # and create in the database

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/services/system_tools.py

@@ -60,8 +60,11 @@ def _validate_system_tool_entry(entry: dict, index: int) -> dict:
     if execution_config is not None:
         if not isinstance(execution_config, dict):
             raise ValueError(f"tools[{index}].execution_config must be an object")
-        if "side_effects" in execution_config and not isinstance(execution_config["side_effects"], bool):
-            raise ValueError(f"tools[{index}].execution_config.side_effects must be a boolean")
+        for flag in ("side_effects", "destructive", "open_world"):
+            if flag in execution_config and not isinstance(execution_config[flag], bool):
+                raise ValueError(f"tools[{index}].execution_config.{flag} must be a boolean")
+        if "title" in execution_config and not isinstance(execution_config["title"], str):
+            raise ValueError(f"tools[{index}].execution_config.title must be a string")
 
     normalized = {
         "function_name": function_name,

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/templates/_login_widget.html

@@ -54,10 +54,14 @@
 
     <!-- 3. Nueva Sección de Registro más Atractiva -->
     <div class="mt-4 pt-3 text-center" style="border-top: 1px solid #e0e0e0;">
+        {% if signup_invitation_required|default(false) %}
+        <span class="text-muted small">{{ t('ui.login_widget.invitation_prompt') }}</span>
+        {% else %}
         <span class="text-muted small">{{ t('ui.login_widget.no_account_prompt') }}</span>
         <a href="{{ url_for('signup', company_short_name=company_short_name, lang=current_lang) }}" id="signup-link"
            class="fw-bold ms-1 text-decoration-none" style="color: var(--brand-primary-color);">
             {{ t('ui.login_widget.signup_link') }}</a>
+        {% endif %}
     </div>
 
     <!-- 4. Enlace de Recuperación de Contraseña (más sutil) -->

iatoolkit-2.56.0/src/iatoolkit/templates/login_global.html

@@ -0,0 +1,76 @@
+{% extends "base.html" %}
+
+{% block title %}{{ t('ui.global_login.title') }}{% endblock %}
+
+{% block styles %}
+<style>
+    /* No company yet, so no company branding: the page wears IAToolkit's own. */
+    :root {
+        --brand-primary-color: #4A55A2;
+        --brand-secondary-color: #3A448A;
+        --brand-text-on-primary: #ffffff;
+    }
+    body { background: linear-gradient(180deg, #ffffff 0%, #f1f3fb 100%); min-height: 100vh; }
+    .iat-brand { display: inline-flex; align-items: center; gap: 10px; font-weight: 700; font-size: 1.35rem; color: #1d2541; text-decoration: none; }
+    .iat-brand-mark { display: inline-grid; place-items: center; width: 32px; height: 32px; border-radius: 8px; background: #4A55A2; color: #fff; }
+    /* Self-contained: this page does not load the company-home stylesheet. */
+    .global-login .branded-form-container { background: #fff; border-radius: 12px; padding: 32px; border-top: 4px solid #4A55A2; box-shadow: 0 8px 28px rgba(29, 37, 65, .10); }
+    .global-login .btn-branded-primary { background: #4A55A2; border: 1px solid #4A55A2; color: #fff; }
+    .global-login .btn-branded-primary:hover { background: #3A448A; border-color: #3A448A; color: #fff; }
+    .global-login .form-control:focus { border-color: #4A55A2; box-shadow: 0 0 0 .2rem rgba(74, 85, 162, .18); }
+</style>
+{% endblock %}
+
+{% block content %}
+<div class="container my-5 global-login">
+    <div class="text-center mb-4">
+        <span class="iat-brand">
+            <span class="iat-brand-mark" aria-hidden="true"><svg width="16" height="16" viewBox="0 0 16 16" fill="currentColor"><path d="M6 1l1.2 3.6L11 6 7.2 7.4 6 11 4.8 7.4 1 6l3.8-1.4z"/><path d="M12 9l.7 1.8 1.8.7-1.8.7L12 14l-.7-1.8-1.8-.7 1.8-.7z"/></svg></span>
+            <span>IAToolkit</span>
+        </span>
+    </div>
+    <div class="row justify-content-center">
+        <div class="col-md-6 col-lg-5">
+            <div class="branded-form-container">
+                <div class="text-center mb-4">
+                    <h1 class="h4 fw-bold">{{ t('ui.global_login.title') }}</h1>
+                    <p class="text-muted widget-intro-text">{{ t('ui.global_login.intro') }}</p>
+                </div>
+
+                {% if google_login_enabled|default(false) %}
+                <a href="{{ url_for('global_login_google_start', lang=lang, next=login_next) }}"
+                   class="btn btn-outline-secondary w-100 fw-semibold py-2 d-flex align-items-center justify-content-center gap-2">
+                    <i class="bi bi-google"></i>
+                    {{ t('ui.login_widget.google_button') }}
+                </a>
+
+                <div class="d-flex align-items-center gap-3 my-4">
+                    <div class="flex-grow-1" style="height: 1px; background: #e0e0e0;"></div>
+                    <span class="text-muted text-uppercase" style="font-size: 0.75rem; letter-spacing: 0.08em;">
+                        {{ t('ui.login_widget.or_continue_with') }}
+                    </span>
+                    <div class="flex-grow-1" style="height: 1px; background: #e0e0e0;"></div>
+                </div>
+                {% endif %}
+
+                <form id="global-login-form" action="{{ url_for('global_login', lang=lang) }}" method="post">
+                    {% if login_next %}<input type="hidden" name="next" value="{{ login_next }}">{% endif %}
+                    <input type="hidden" name="lang" value="{{ lang }}">
+                    <div class="mb-3">
+                        <label for="email" class="form-label d-block">{{ t('ui.signup.email_label') }}</label>
+                        <input type="email" id="email" name="email" class="form-control"
+                               required value="{{ form_data.email if form_data is defined else '' }}">
+                    </div>
+                    <div class="mb-3">
+                        <label for="password" class="form-label d-block">{{ t('ui.signup.password_label') }}</label>
+                        <input type="password" id="password" name="password" class="form-control" required>
+                    </div>
+                    <button type="submit" class="btn btn-branded-primary w-100 fw-bold py-2">
+                        {{ t('ui.login_widget.login_button') }}
+                    </button>
+                </form>
+            </div>
+        </div>
+    </div>
+</div>
+{% endblock %}

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/templates/signup.html

@@ -39,11 +39,13 @@
                         {% endif %}
 
                         <form action="{{ url_for('signup', company_short_name=company_short_name) }}" method="post">
+                            {% if invite_token %}<input type="hidden" name="invite_token" value="{{ invite_token }}">{% endif %}
                             <div class="mb-3">
                                 <label for="email" class="form-label text-secondary">{{ t('ui.signup.email_label') }}</label>
                                 <input type="email" autocomplete="off" id="email" name="email"
                                        class="form-control" required
-                                       value="{{ form_data.email if form_data else '' }}">
+                                       value="{{ invited_email or (form_data.email if form_data else '') }}"
+                                       {% if invited_email %}readonly{% endif %}>
                             </div>
 
                             <div class="row">

{iatoolkit-2.54.1 → iatoolkit-2.56.0}/src/iatoolkit/views/home_view.py

@@ -36,6 +36,11 @@ class HomeView(MethodView):
             self._trigger_warmup(company_short_name, "home_pre_login")
 
             branding_data = self.branding_service.get_company_branding(company_short_name)
+            invitation_context = self.profile_service.signup_invitation_context(company_short_name, None)
+            login_context = (
+                {"signup_invitation_required": True}
+                if isinstance(invitation_context, tuple) and invitation_context[0] is True else {}
+            )
 
             template_name = self.util.get_template_by_language("home")
             home_template = self.util.get_company_template(company_short_name, template_name)
@@ -52,6 +57,7 @@ class HomeView(MethodView):
                         company_short_name=company_short_name,
                         company=company,
                         branding=branding_data,
+                        **login_context,
                     )
 
                 message = self.i18n_service.t(
@@ -70,6 +76,7 @@ class HomeView(MethodView):
                 home_template,
                 company_short_name=company_short_name,
                 branding=branding_data,
+                **login_context,
             )
         except Exception as e:
             message = self.i18n_service.t('errors.templates.processing_error', error=str(e))