Conversation
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
n8n-assistant
Bot
added
core
Contributor
Performance ComparisonComparing current → latest master → 14-day baseline Memory consumption baseline with starter plan resources
docker-stats
Idle baseline with Instance AI module loaded
How to read this table
|
Bundle ReportChanges will increase total bundle size by 3.27kB (0.01%) ⬆️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: editor-ui-esmAssets Changed:
Files in
|
…after-switching-to
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
No issues found across 17 files
Architecture diagram
sequenceDiagram
participant Admin as Browser (SSO Settings)
participant UI as Frontend (Vue/Pinia)
participant API as Backend API
participant PS as ProvisioningService
participant RMRS as RoleMappingRuleService
participant DB as Database (Transaction)
participant EB as Event Bus / PubSub
Note over Admin,EB: Strategy Switch: Project Roles -> Instance Roles Only
Admin->>UI: Click Save Settings
UI->>UI: CHANGED: Check if dropping project scope
opt isDroppingProjectRules
UI->>Admin: NEW: Show confirmation dialog with deletion warning
Admin->>UI: Confirm & Click Save
end
UI->>API: PATCH /sso/provisioning/config
Note right of UI: NEW: payload includes { deleteProjectRules: true }
API->>PS: patchConfig(dto)
PS->>DB: CHANGED: Start Transaction (EntityManager)
PS->>DB: Update 'provisioning_preferences' record
opt shouldDeleteProjectRules
PS->>RMRS: NEW: deleteAllOfType('project', tx)
RMRS->>DB: DELETE FROM role_mapping_rule WHERE type = 'project'
DB-->>RMRS: count affected rows
end
PS->>DB: Commit Transaction
alt Transaction Success
opt shouldDeleteProjectRules
PS->>EB: NEW: Emit 'role-mapping-rules-bulk-deleted' (Audit)
end
opt Multi-Main Setup
PS->>EB: Publish 'reload-sso-provisioning-configuration'
end
PS-->>API: Return updated config
API-->>UI: 200 OK
UI-->>Admin: Show Success Notification
else Transaction Failure
DB-->>PS: Rollback
PS-->>API: Error
API-->>UI: 500 Error
end
cstuncsik
requested review from
a team,
BGZStephen,
afitzek,
guillaumejacquart and
phyllis-noester
and removed request for
a team
…ping-rules-stay-active-after-switching-to # Conflicts: # packages/frontend/editor-ui/src/features/settings/sso/provisioning/composables/useRoleMappingRules.test.ts
cstuncsik
deleted the
iam-561-project-mapping-rules-stay-active-after-switching-to
branch
Merged
Contributor
|
Got released with |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When an admin switches away from a strategy that manages project roles (e.g. from Instance and project roles back to Instance roles only, or from expression-based mapping back to IdP claims), existing
role_mapping_rulerows oftype='project'are now cleaned up transactionally together with the config update. A danger callout in the confirmation dialog explicitly warns the user before saving, and the project-roles CSV backup download is already gated.How to manually verify in the browser
Pre-requisite: SSO licence enabled (SAML or OIDC),
N8N_ENV_FEAT_ROLE_MAPPING_STRATEGY=trueto see expression-based mapping.Scenario A — IdP mapping, drop project scope
GET /role-mapping-rulereturns notype: "project"rowsScenario B — Expression-based, drop project rules
GET /role-mapping-rulereturns only instance rulesScenario C — Disable SSO entirely
Negative check — no false positives
Related Linear tickets, Github issues, and Community forum posts
https://linear.app/n8n/issue/IAM-561/project-mapping-rules-stay-active-after-switching-to-instance-only
Review / Merge checklist
🤖 PR Summary generated by AI