feat(orgs): company access modes (internal/external), data model + admin UI

franz commented

2026-07-07 07:26:51 +00:00

Owner

What this is

Phases 1-2 of "company access modes": each organization gains an explicit internal / external access mode, so an admin can distinguish an internal workforce org (invite-only) from an external, public-facing org, and the setup intent is a first-class, visible choice rather than an implicit one.

This lands the data model and the admin UI only. It does NOT yet route public sign-ups into an external org (that is deferred, see below), so today choosing "external" sets the mode, enables the branded public landing page, and locks the member directory to administrators. The actual self-serve join wiring comes in a later change.

Included

New access_mode column on organizations (postgres + sqlite), defaulting to internal, so the migration is behavior-preserving and every existing org (including the seeded Default) stays internal.
A fail-closed AccessMode enum: only the exact literal external is external; anything unknown degrades to internal, so an unrecognised value never opens a public surface.
Admin UI: a mode picker on org creation, the mode surfaced on the overview page, and a confirmed mode-change route. Mode changes are audited (org.access_mode.changed).
Enforced guardrails for external orgs: the member directory is hard-enforced to administrators-only (loosening it is rejected server-side). Public login stays togglable so an owner can pause sign-ups.
Full i18n across all nine locales.

Design decisions

External mode is a licensed feature (requires Feature::Orgs), and the Default org can never be set external: it is the operator's own internal org. OSS installs keep exactly today's behavior (one internal Default org).
The access_mode enum is intentionally open (a future customer variant fits without a schema change), keeping the door open for a later B2B-SaaS tenancy model.

Deferred (not in this PR)

The self-serve sign-up routing (a registration bound to an external org actually creating membership in that org, with email-verification gating and abuse controls) is deferred. It depends on live Kratos/Hydra behavior that has to be verified against a running stack before the mechanism is committed, and an OIDC review flagged one of those spikes as potentially forcing a mechanism change. It is tracked separately.

Because of that, the external-mode UI copy is forward-looking: it describes self-serve sign-up that becomes fully live with the deferred change.

Verification

cargo clippy --all-targets -- -D warnings: clean.
Full unit suite: 552 passed, 0 failed.
Integration tests and the new licensed Playwright spec (g-org-access-mode.spec.ts) require the live Ory playground stack and were not run here.

Known follow-ups

The onsubmit="confirm('...')" pattern used across the org settings templates breaks if the interpolated string contains an apostrophe. A pre-existing instance exists in the French team-delete confirm; the new French mode-switch strings were rewritten to avoid it, but the underlying pattern is worth hardening separately.
docs/commercial/organizations.md does not yet describe access modes.

## What this is Phases 1-2 of "company access modes": each organization gains an explicit `internal` / `external` access mode, so an admin can distinguish an internal workforce org (invite-only) from an external, public-facing org, and the setup intent is a first-class, visible choice rather than an implicit one. This lands the data model and the admin UI only. It does NOT yet route public sign-ups into an external org (that is deferred, see below), so today choosing "external" sets the mode, enables the branded public landing page, and locks the member directory to administrators. The actual self-serve join wiring comes in a later change. ## Included - New `access_mode` column on `organizations` (postgres + sqlite), defaulting to `internal`, so the migration is behavior-preserving and every existing org (including the seeded Default) stays internal. - A fail-closed `AccessMode` enum: only the exact literal `external` is external; anything unknown degrades to internal, so an unrecognised value never opens a public surface. - Admin UI: a mode picker on org creation, the mode surfaced on the overview page, and a confirmed mode-change route. Mode changes are audited (`org.access_mode.changed`). - Enforced guardrails for external orgs: the member directory is hard-enforced to administrators-only (loosening it is rejected server-side). Public login stays togglable so an owner can pause sign-ups. - Full i18n across all nine locales. ## Design decisions - External mode is a licensed feature (requires `Feature::Orgs`), and the Default org can never be set external: it is the operator's own internal org. OSS installs keep exactly today's behavior (one internal Default org). - The `access_mode` enum is intentionally open (a future `customer` variant fits without a schema change), keeping the door open for a later B2B-SaaS tenancy model. ## Deferred (not in this PR) The self-serve sign-up routing (a registration bound to an external org actually creating membership in that org, with email-verification gating and abuse controls) is deferred. It depends on live Kratos/Hydra behavior that has to be verified against a running stack before the mechanism is committed, and an OIDC review flagged one of those spikes as potentially forcing a mechanism change. It is tracked separately. Because of that, the external-mode UI copy is forward-looking: it describes self-serve sign-up that becomes fully live with the deferred change. ## Verification - `cargo clippy --all-targets -- -D warnings`: clean. - Full unit suite: 552 passed, 0 failed. - Integration tests and the new licensed Playwright spec (`g-org-access-mode.spec.ts`) require the live Ory playground stack and were not run here. ## Known follow-ups - The `onsubmit="confirm('...')"` pattern used across the org settings templates breaks if the interpolated string contains an apostrophe. A pre-existing instance exists in the French team-delete confirm; the new French mode-switch strings were rewritten to avoid it, but the underlying pattern is worth hardening separately. - `docs/commercial/organizations.md` does not yet describe access modes.

franz added 12 commits

2026-07-07 07:26:51 +00:00

fix: sign CSRF tokens, scope admin identity search, and harden SSRF, rate-limiter, and readiness paths b6a2e552ab

feat: watermark admin pages with the licensee identity d5aa5f77fb

feat: expose license-gated, token-authed Prometheus /metrics endpoint 8fe643efcb

feat(orgs): add access_mode column to organizations 6c17ddeb91

feat(orgs): add fail-closed AccessMode enum 74d8418e4f

feat(orgs): project access_mode onto Org and PublicBranding bd50947c9c

feat(orgs): license-gated access_mode writer, Default stays internal 5597c0a2e6

feat(orgs): mode picker on org creation with enforced external defaults f1c1875d53

feat(orgs): surface access mode on overview with a confirmed mode-change route baff7fd044

test(orgs): verify access-mode transitions enforce and preserve guardrails 1a3c1e70c9

fix(orgs): avoid apostrophes in French mode-switch confirms for inline JS 23a83b4887

feat(orgs): enforce admins-only directory on external orgs b29880e57b

franz referenced this pull request

2026-07-07 08:21:24 +00:00

feat(orgs): external self-serve join (Phase 3) #7

franz closed this pull request

2026-07-07 10:54:23 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Rows
Columns

feat(orgs): company access modes (internal/external), data model + admin UI #6