shivaansh0610-LUFFY opened a new pull request, #643:
URL: https://github.com/apache/fineract-backoffice-ui/pull/643
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!-- Commits must be signed to merge — see CONTRIBUTING.md#commit-signing if
you haven't set this up. -->
## What and why
<!-- One or two sentences explaining what changed and why. -->
#370 describes a full OIDC single-sign-on flow: the login page offering an
identity-provider route, authorization-code+PKCE, token exchange and refresh,
and Basic auth replaced on outbound requests — plus an open question the issue
itself raises (does enabling OIDC on Fineract also disable Basic auth?) that
needs a live identity provider to answer, and a note that #369 (already
confirmed to break the app) should probably go first. None of that is in this
PR.
What this PR does is narrower and deliberately so: it stops the login page
from having "no idea" an OIDC config exists, without pretending the round trip
works. A new `oidcLoginEnabled` config flag (off by default, same pattern as
`rbacEnabled`) lets a deployment show a "Sign in with your identity provider"
button above the existing form. The button and the form both stay — this flag
can never become the only way in, the way #369's did. Clicking the button shows
a plain notice that sign-in through a provider isn't built yet, instead of
doing nothing silently or faking a redirect that goes nowhere.
The flag itself is provisional: the login page can't ask Fineract's `GET
/v1/tenants/{tenantId}/oidc-config` before a session exists, because that
endpoint requires Basic auth. A deployment sets the flag by hand for now;
wiring it to the real tenant config is part of the unresolved work below.
**Left out on purpose**, tracked against #370:
- The authorization-code + PKCE flow itself (redirect, callback, code
exchange)
- Token refresh and a sign-out that ends the provider session
- `auth.interceptor.ts` gaining a token-based second mode alongside Basic
auth
- The backend question above — whether OIDC disables Basic auth in Fineract
— is still open
- The mocked and real-provider e2e coverage the issue asks for
- The `DOCS/`, `security.md` and `DOCS/RBAC.md` updates the issue asks for
Towards #370
## Verification
<!-- List what you ran and what you checked. Note whether the UI was
exercised with mocks, a real Fineract backend, or both. -->
- Added unit tests: 2 for `ConfigService.oidcLoginEnabled` (off when absent
from `config.json`, on when set), and 3 for the login page (button absent by
default; button and form both present when the flag is on; clicking the button
shows the notice and does not navigate or attempt to log in). All 32 tests in
the two files pass.
- `eslint`, `prettier --check`, `tsc --noEmit -p tsconfig.app.json`, `npm
run i18n:check` and `npm run check:a11y-names` are all clean.
- UI exercised in Chrome at 1280x900, dark theme, against a mocked
`config.json` only (no real Fineract backend, no identity provider). Confirmed
the button is absent with the flag off, appears above the form with it on, and
that clicking it shows the notice while leaving username/password usable.
- Not run: the full unit suite, the production build, and any e2e spec — no
e2e coverage was added, since the flow it would exercise isn't built yet.
## Screenshots
<!-- Add screenshots or a short recording for UI changes. Write "Not
applicable" for non-UI changes. -->
### Before
<img width="1280" height="900" alt="before-login-full"
src="https://github.com/user-attachments/assets/c1ed06d9-e6f6-427e-ba12-22ea5312f1ca";
/>
https://github.com/user-attachments/assets/495cd8c5-0c3f-46eb-aba9-2685ef41c62b
### After
<img width="1280" height="900" alt="after-login-full"
src="https://github.com/user-attachments/assets/bc018993-1289-4852-9bde-b817819991cc";
/>
<img width="1280" height="900" alt="after-login-sso-click"
src="https://github.com/user-attachments/assets/a55d1264-388b-469c-aeba-9a6ca6d8918e";
/>
https://github.com/user-attachments/assets/722971b7-cb53-4172-8f4c-dfb1ec614f7b
## AI assistance (optional)
<!-- If generative AI materially assisted this contribution, optionally
state the tool or model and
the harness or workflow used. The contributor remains responsible for the
submitted change. -->
- Tool / model:
- Harness / workflow:
## Checklist
<!-- Check each item, or explain why it does not apply. -->
- [x] I did not hand-edit generated files under `src/app/api/`.
- [x] New component or service code uses the adapter boundary in
`src/app/core/adapters/` instead of direct browser globals or imperative
third-party APIs.
- [x] User-facing strings use translation keys.
- [x] I added or updated tests appropriate to this change, or explained why
tests were not needed.
- [ ] UI workflow changes include suitable e2e coverage, including
real-backend testing where relevant. (Not added — see "Left out on purpose"
above; there is no flow yet to cover.)
- [ ] Commits are signed — see [Commit
Signing](CONTRIBUTING.md#commit-signing) in CONTRIBUTING.md.
- [ ] I followed the [AI-assisted contributions
guidance](CONTRIBUTING.md#ai-assisted-contributions).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
