feat: Remove OIDC and SSO support

Existing SSO accounts have no local password, so the migration
deactivates them before dropping is_sso_user and the
identity_provider_user table.

server/api/controllers/users/create.js

@@ -200,10 +200,6 @@ module.exports = {
   async fn(inputs) {
     const { currentUser } = this.req;
 
-    if (sails.config.custom.oidcEnforced) {
-      throw Errors.NOT_ENOUGH_RIGHTS;
-    }
-
     const values = _.pick(inputs, [
       'email',
       'password',

server/api/controllers/users/update-email.js

@@ -134,11 +134,7 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
-    if (
-      user.email === sails.config.custom.defaultAdminEmail ||
-      user.isSsoUser ||
-      sails.config.custom.demoMode
-    ) {
+    if (user.email === sails.config.custom.defaultAdminEmail || sails.config.custom.demoMode) {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 

server/api/controllers/users/update-password.js

@@ -136,11 +136,7 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
-    if (
-      user.email === sails.config.custom.defaultAdminEmail ||
-      user.isSsoUser ||
-      sails.config.custom.demoMode
-    ) {
+    if (user.email === sails.config.custom.defaultAdminEmail || sails.config.custom.demoMode) {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 

server/api/controllers/users/update-username.js

@@ -8,7 +8,7 @@
  * /users/{id}/username:
  *   patch:
  *     summary: Update user username
- *     description: Updates a user's username. Users must provide a current password when updating their own username (unless they are SSO users with `oidcIgnoreUsername` enabled). Admins can update any user's username without the current password.
+ *     description: Updates a user's username. Users must provide a current password when updating their own username. Admins can update any user's username without the current password.
  *     tags:
  *       - Users
  *     operationId: updateUserUsername
@@ -136,11 +136,7 @@ module.exports = {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 
-    if (user.isSsoUser) {
-      if (!sails.config.custom.oidcIgnoreUsername) {
-        throw Errors.NOT_ENOUGH_RIGHTS;
-      }
-    } else if (inputs.id === currentUser.id) {
+    if (inputs.id === currentUser.id) {
       if (!inputs.currentPassword) {
         throw Errors.INVALID_CURRENT_PASSWORD;
       }

server/api/controllers/users/update.js

@@ -95,10 +95,6 @@
  *                 enum: [byDefault, alphabetically, byCreationTime]
  *                 description: Default sort order for projects display
  *                 example: byDefault
- *               isSsoUser:
- *                 type: boolean
- *                 description: Whether the user is SSO user (only false value to unlink SSO, for admins)
- *                 example: false
  *               isDeactivated:
  *                 type: boolean
  *                 description: Whether the user account is deactivated and cannot log in (for admins)
@@ -127,7 +123,6 @@
  *         $ref: '#/components/responses/Conflict'
  */
 
-const { is } = require('../../../utils/validators');
 const { idInput } = require('../../../utils/inputs');
 
 const Errors = {
@@ -205,10 +200,6 @@ module.exports = {
       type: 'string',
       isIn: Object.values(User.ProjectOrders),
     },
-    isSsoUser: {
-      type: 'boolean',
-      custom: is(false),
-    },
     isDeactivated: {
       type: 'boolean',
     },
@@ -233,7 +224,7 @@ module.exports = {
     if (inputs.id === currentUser.id) {
       availableInputKeys.push(...User.PERSONAL_FIELD_NAMES);
     } else if (currentUser.role === User.Roles.ADMIN) {
-      availableInputKeys.push('role', 'isSsoUser', 'isDeactivated');
+      availableInputKeys.push('role', 'isDeactivated');
     } else {
       throw Errors.USER_NOT_FOUND; // Forbidden
     }
@@ -257,14 +248,6 @@ module.exports = {
       if (inputs.role || inputs.name) {
         throw Errors.NOT_ENOUGH_RIGHTS;
       }
-    } else if (user.isSsoUser) {
-      if (!sails.config.custom.oidcIgnoreRoles && inputs.role) {
-        throw Errors.NOT_ENOUGH_RIGHTS;
-      }
-
-      if (inputs.name) {
-        throw Errors.NOT_ENOUGH_RIGHTS;
-      }
     }
 
     const values = {
@@ -283,7 +266,6 @@ module.exports = {
         'defaultEditorMode',
         'defaultHomeView',
         'defaultProjectsOrder',
-        'isSsoUser',
         'isDeactivated',
       ]),
     };