:sparkles: Hide password settings when AUTH_TYPE indicates SSO by jawad-khan · Pull Request #29 · Pressingly/penpot

jawad-khan · 2026-05-20T10:45:12Z

Summary

Plumb AUTH_TYPE from the frontend container environment into config.js as penpotAuthType (via the existing nginx entrypoint substitution pattern alongside flags / mPass sign-out).
Add cf/auth-type-sso?, treating the value case-insensitively as sso.
Hide the Account → Password sidebar entry when SSO is indicated.
Visiting #/settings/password redirects to #/settings/profile instead of rendering the password form.

Test plan

Frontend image / compose: set AUTH_TYPE=SSO (or uncomment the compose example). Reload app: Password is absent from settings sidebar.
Navigate directly to #/settings/password: URL flows to #/settings/profile; password form never stays visible.
With AUTH_TYPE unset (or not sso): Password still appears and the change-password UI works as before.
Confirm config.js served by the frontend includes var penpotAuthType = "sso" (or your value) after container start.

Deploy notes

Requires rebuilding/restarting the frontend image so nginx-entrypoint.sh runs against config.js.

Checklist

Choose the correct target branch; use develop by default.
Provide a brief summary of the changes introduced.
Add a detailed explanation of how to reproduce the issue and/or verify the fix, if applicable.
Include screenshots or videos, if applicable.
Add or modify existing integration tests in case of bugs or new features, if applicable.
Refactor any modified SCSS files following the refactor guide.
Check CI passes successfully.
Update the CHANGES.md file, referencing the related GitHub issue, if applicable.

Copilot

Pull request overview

This PR threads a deploy-time AUTH_TYPE environment variable into the frontend runtime config (config.js → app.config) and uses it to hide the Account → Password UI when SSO is enabled, including redirecting direct visits to #/settings/password back to profile.

Changes:

Add penpotAuthType injection via the frontend nginx entrypoint and expose it through cf/auth-type-sso?.
Hide the Password entry in the settings sidebar when AUTH_TYPE indicates SSO.
Redirect /settings/password to /settings/profile and prevent the password form from rendering under SSO.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
frontend/src/app/main/ui/settings/sidebar.cljs	Conditionally hides the Password settings nav entry when `auth-type-sso?` is true.
frontend/src/app/main/ui/settings.cljs	Adds redirect logic and blocks password page rendering under SSO.
frontend/src/app/config.cljs	Introduces `auth-type-sso?` helper reading `globalThis.penpotAuthType`.
docker/images/files/nginx-entrypoint.sh	Injects `AUTH_TYPE` into `config.js` at container start.
docker/images/files/config.js	Adds commented `penpotAuthType` placeholder for entrypoint substitution.
docker/images/docker-compose.yaml	Documents `AUTH_TYPE` usage for the frontend service (commented example).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+# AUTH_TYPE (e.g. SSO): consumed by frontend to hide native password UX.
+update_auth_type() {
+  if [ -n "$AUTH_TYPE" ]; then
+    echo "$(sed \
+      -e "s|^//var penpotAuthType = .*;|var penpotAuthType = \"$AUTH_TYPE\";|g" \


+    (mf/with-effect [section]
+      (when (and (= section :settings-password)
+                 (cf/auth-type-sso?))
+        (st/emit! (rt/nav :settings-profile))))


Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

+# Escape `\`, `"`, and `&` so the generated JS literal and sed replacement stay valid.
+update_auth_type() {
+  if [ -n "${AUTH_TYPE:-}" ]; then
+    local auth_esc
+    auth_esc=$(printf '%s' "$AUTH_TYPE" | sed -e 's/\\/\\\\/g' -e 's/&/\\\&/g' -e 's/"/\\"/g')


+update_auth_type() {
+  if [ -n "${AUTH_TYPE:-}" ]; then
+    local auth_esc
+    auth_esc=$(printf '%s' "$AUTH_TYPE" | sed -e 's/\\/\\\\/g' -e 's/&/\\\&/g' -e 's/"/\\"/g')
+    echo "$(sed \
+      -e "s#^//var penpotAuthType = .*;#var penpotAuthType = \"${auth_esc}\";#g" \
+      "$1")" > "$1"
+  fi


Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

jawad-khan · 2026-05-20T13:26:34Z

-        (st/emit! (rt/assign-exception {:type :authentication}))))
+        (st/emit! (rt/assign-exception {:type :authentication})))
+      (when (and (= section :settings-password)
+                 (cf/auth-type-sso?))


@copilot is this resolved now or not?

Yes, this was resolved. The redirect is now guarded with (some? profile) (line 50), so it only fires after the profile is loaded. While profile is nil and SSO is active, the :settings-password case renders a loading spinner instead (lines 76-79), preventing any race between the auth exception and the redirect.

+# AUTH_TYPE (e.g. SSO): consumed by frontend to hide native password UX.
+#
+# `#` separates pattern/replacement because values may contain "/" or "|".
+# Escape `\`, `#`, `"`, and `&` so the generated JS literal and sed replacement stay valid.
+update_auth_type() {
+  if [ -n "${AUTH_TYPE:-}" ]; then
+    local auth_esc
+    auth_esc=$(printf '%s' "$AUTH_TYPE" | sed \
+      -e 's/\\/\\\\/g' \
+      -e 's/#/\\#/g' \
+      -e 's/&/\\\&/g' \
+      -e 's/"/\\"/g')
+    echo "$(sed \
+      -e "s#^//var penpotAuthType = .*;#var penpotAuthType = \"${auth_esc}\";#g" \
+      "$1")" > "$1"


          :settings-password
-          [:& password-page]
+          (if (cf/auth-type-sso?)
+            ;; Prefer profile UX over a loader until `rt/nav` updates the fragment.
+            [:& profile-page]
+            [:& password-page])


jawad-khan · 2026-05-20T12:55:41Z

@copilot

Agent-Logs-Url: https://github.com/Pressingly/penpot/sessions/4698e215-0f97-44d4-8097-664912d66b92 Co-authored-by: jawad-khan <5320368+jawad-khan@users.noreply.github.com>

Copilot · 2026-05-20T12:58:47Z

@copilot

Addressed the two remaining review issues in commit 5656a23:

nginx-entrypoint.sh — AUTH_TYPE is now normalized before injection: control characters are stripped (tr -d '[:cntrl:]'), whitespace is trimmed, and the value is lowercased (tr '[:upper:]' '[:lower:]'). This means AUTH_TYPE=SSO now produces var penpotAuthType = "sso" in config.js, consistent with the test plan.
settings.cljs — The SSO redirect now uses {::rt/replace true} (rt/nav :settings-profile {} {::rt/replace true}), matching the pattern used in the subscription page. This replaces the history entry instead of pushing a new one, eliminating the back-button redirect loop.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

+      | tr '[:upper:]' '[:lower:]')
+    auth_esc=$(printf '%s' "$auth_norm" | sed \
+      -e 's/\\/\\\\/g' \
+      -e 's/#/\\#/g' \
+      -e 's/&/\\\&/g' \
+      -e 's/"/\\"/g')
+    tmp="$(mktemp)" || return 1
+    if ! sed \
+      -e "s#^//var penpotAuthType = .*;#var penpotAuthType = \"${auth_esc}\";#g" \


+# Substitution uses '#' as the sed delimiter (values may include "/" or "|").
+# Normalises AUTH_TYPE: strip control characters, trim whitespace, lowercase.
+# Then escapes \, #, ", & before embedding into a JS double-quoted string.
+# Writes via a temp file + mv so a failed/interrupted sed cannot truncate config.js.
+update_auth_type() {
+  if [ -n "${AUTH_TYPE:-}" ]; then
+    local auth_norm auth_esc tmp
+    # Strip control chars, trim leading/trailing whitespace, convert to lowercase.
+    auth_norm=$(printf '%s' "$AUTH_TYPE" \
+      | tr -d '[:cntrl:]' \
+      | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' \
+      | tr '[:upper:]' '[:lower:]')
+    auth_esc=$(printf '%s' "$auth_norm" | sed \
+      -e 's/\\/\\\\/g' \
+      -e 's/#/\\#/g' \


…n SSO redirect

jawad-khan · 2026-05-20T13:09:41Z

@copilot

Agent-Logs-Url: https://github.com/Pressingly/penpot/sessions/c4ba84fe-6203-434b-bd9b-6a3453203439 Co-authored-by: jawad-khan <5320368+jawad-khan@users.noreply.github.com>

Copilot · 2026-05-20T13:12:59Z

@copilot

Addressed both issues in commit de9566c:

Cross-filesystem mktemp — changed to mktemp -p "$(dirname "$1")" so the temp file is always on the same filesystem as config.js, making the final mv a guaranteed atomic rename.
Escaping complexity / injection risk — replaced the entire multi-step escape pipeline with a strict whitelist: after lowercasing, auth_norm is validated against ^[a-z0-9_-]+$. Any value containing spaces, #, &, \, ", newlines, or other special characters is rejected and a warning is printed to stderr. Since auth_norm is guaranteed to contain only safe characters, it can be embedded directly into the sed replacement and JS string with zero escaping needed.

jawad-khan requested a review from Copilot May 20, 2026 10:45

Copilot started reviewing on behalf of jawad-khan May 20, 2026 10:46 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

jawad-khan requested a review from Copilot May 20, 2026 11:19

Copilot started reviewing on behalf of jawad-khan May 20, 2026 11:20 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

jawad-khan requested a review from Copilot May 20, 2026 11:34

Copilot started reviewing on behalf of jawad-khan May 20, 2026 11:35 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

jawad-khan added 4 commits May 20, 2026 17:51

✨ Hide password settings when AUTH_TYPE indicates SSO

4a74228

🐛 Address Copilot review on AUTH_TYPE SSO settings

f0867ec

🐛 Escape # in AUTH_TYPE injection; show profile for SSO password route

877b5ed

🐛 Harden AUTH_TYPE sed write and SSO settings redirect sequencing

4c11066

jawad-khan force-pushed the jawad/hide-password-tab branch from 7e2540e to 4c11066 Compare May 20, 2026 12:53

jawad-khan requested a review from Copilot May 20, 2026 12:53

Copilot started work on behalf of jawad-khan May 20, 2026 12:55 View session

🐛 Normalize AUTH_TYPE to lowercase and use replace nav for SSO redirect

5656a23

Agent-Logs-Url: https://github.com/Pressingly/penpot/sessions/4698e215-0f97-44d4-8097-664912d66b92 Co-authored-by: jawad-khan <5320368+jawad-khan@users.noreply.github.com>

Copilot finished work on behalf of jawad-khan May 20, 2026 12:59

Copilot AI reviewed May 20, 2026

View reviewed changes

🐛 Fix Copilot review: normalize AUTH_TYPE in entrypoint; replace-toke…

452b170

…n SSO redirect

Copilot started work on behalf of jawad-khan May 20, 2026 13:09 View session

🐛 Whitelist AUTH_TYPE and fix mktemp cross-filesystem issue

de9566c

Agent-Logs-Url: https://github.com/Pressingly/penpot/sessions/c4ba84fe-6203-434b-bd9b-6a3453203439 Co-authored-by: jawad-khan <5320368+jawad-khan@users.noreply.github.com>

Copilot finished work on behalf of jawad-khan May 20, 2026 13:13

Copilot started work on behalf of jawad-khan May 20, 2026 13:26 View session

Copilot finished work on behalf of jawad-khan May 20, 2026 13:28

jawad-khan changed the base branch from foss-main to foss-sandbox May 21, 2026 12:10

UsamaSadiq approved these changes May 22, 2026

View reviewed changes

UsamaSadiq merged commit 05673be into foss-sandbox May 22, 2026
5 of 13 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Hide password settings when AUTH_TYPE indicates SSO#29

✨ Hide password settings when AUTH_TYPE indicates SSO#29
UsamaSadiq merged 7 commits into
foss-sandboxfrom
jawad/hide-password-tab

jawad-khan commented May 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

jawad-khan May 20, 2026

Uh oh!

Copilot AI May 20, 2026

Uh oh!

jawad-khan commented May 20, 2026

Uh oh!

Copilot AI commented May 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

jawad-khan commented May 20, 2026

Uh oh!

Copilot AI commented May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

jawad-khan commented May 20, 2026

Summary

Test plan

Deploy notes

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

jawad-khan May 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 20, 2026

Choose a reason for hiding this comment

Uh oh!

jawad-khan commented May 20, 2026

Uh oh!

Copilot AI commented May 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

jawad-khan commented May 20, 2026

Uh oh!

Copilot AI commented May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants