improvement(people): increase 2FA source selection pool on identity-provider integrations (#3350) - #3350
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
…ions Scope the People-tab 2FA column's sources to identity-provider integrations — the systems that authenticate the whole workforce and key each person by email (Google Workspace, Microsoft Entra ID, JumpCloud, Okta, …). Their per-user 2FA results align with the People roster; integrations that merely expose a 2FA check but aren't a workforce identity provider don't map cleanly onto members. - Expose the integration `category` on CheckResultsService's source list as descriptive metadata; the service stays feature-agnostic and the filtering decision lives in the 2FA feature layer. - Offer and accept only sources whose category is an identity-provider category (currently "Identity & Access") as 2FA sources. Tests: 2FA controller + check-results service (23 passing). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
tofikwest
force-pushed
the
tofik/2fa-source-identity-providers
branch
from
July 5, 2026 22:45
eed3d82 to
a1756b5
Compare
tofikwest
changed the title
tofikwest
changed the title
Contributor
|
🎉 This PR is included in version 3.97.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Scopes the People-tab 2FA column's source selector to identity-provider integrations — the systems that authenticate the whole workforce and identify each person by email (Google Workspace, Microsoft Entra ID, JumpCloud, Okta, …).
Why
The 2FA column matches a source's per-user results to org members by email. Identity providers cover every employee and key users by email, so their results line up with the People roster. The selector now gates on the integration's category (
Identity & Access) rather than a hand-maintained list of slugs — so any future IdP in that category qualifies automatically, while integrations that merely expose a 2FA check but aren't a workforce identity provider (developer tools, comms apps, etc.) don't.Changes
CheckResultsService: expose the integrationcategoryon the bound-source list as descriptive manifest metadata. The service stays feature-agnostic; the filtering decision lives in the feature layer.TwoFactorSourceController: offer and accept only identity-provider sources — bothavailable-2fa-sourcesand thesetvalidation — via aTWO_FA_SOURCE_CATEGORIESset.Tests
two-factor-source.controller.spec— the selector offers only identity-provider sources; a connected, bound, non-identity provider is rejected on set.check-results.service.spec—categoryflows through the source list.23 tests passing. The API typecheck shows no new errors from these files (the repo's existing spec-file typecheck warnings are unrelated and pre-existing on
main).🤖 Generated with Claude Code