fix: support global OIDC defaults with organization overrides

Mono-RevId: 506a4ac59ea98e5da2db5e9d4834c3abe1b69a2c

Author: carderne

apps/webapp/app/services/oidc/externalOidc.server.ts

@@ -10,7 +10,9 @@ import { env } from "~/env.server";
 import { isCloud } from "~/services/platform.v3.server";
 import { createRedisRateLimitClient } from "~/services/rateLimiterCore.server";
 import { singleton } from "~/utils/singleton";
+import { globalFlagsRegistry } from "~/v3/globalFlagsRegistry.server";
 import { runStore } from "~/v3/runStore.server";
+import { resolveExternalOidcFlags } from "./externalOidcFeatureFlags";
 import { loadExternalOidcPlugin } from "./externalOidcPlugin.server";
 import { ExternalOidcRateLimits } from "./externalOidcRateLimit.server";
 import { externalOidcSigningService } from "./instance.server";
@@ -37,7 +39,11 @@ export function getExternalOidcController(): Promise<ExternalOidcController | nu
 export async function isExternalOidcEnabled(orgFeatureFlags: unknown): Promise<boolean> {
   if (!runTokenInjectionEnabled(orgFeatureFlags)) return false;
   const controller = await getExternalOidcController();
-  return controller?.isEnabled(orgFeatureFlags) ?? false;
+  return (
+    controller?.isEnabled(
+      resolveExternalOidcFlags(globalFlagsRegistry.current() ?? {}, orgFeatureFlags)
+    ) ?? false
+  );
 }
 
 async function findEnvironment(
@@ -70,7 +76,10 @@ async function findEnvironment(
     organizationId: environment.organizationId,
     projectId: environment.projectId,
     projectRef: environment.project.externalRef,
-    orgFeatureFlags: environment.organization.featureFlags,
+    orgFeatureFlags: resolveExternalOidcFlags(
+      globalFlagsRegistry.current() ?? {},
+      environment.organization.featureFlags
+    ),
   };
 }
 

apps/webapp/app/services/oidc/externalOidcFeatureFlags.ts

@@ -0,0 +1,13 @@
+import { FeatureFlagCatalog, isPlainFlagObject } from "~/v3/featureFlags";
+
+export function resolveExternalOidcFlags(
+  globalFlags: Partial<FeatureFlagCatalog>,
+  orgFeatureFlags: unknown
+): { externalOidc: boolean } {
+  const override = FeatureFlagCatalog.externalOidc.safeParse(
+    isPlainFlagObject(orgFeatureFlags) ? orgFeatureFlags.externalOidc : undefined
+  );
+  return {
+    externalOidc: override.success ? override.data : (globalFlags.externalOidc ?? false),
+  };
+}

apps/webapp/app/v3/featureFlags.ts

@@ -236,6 +236,7 @@ export const FeatureFlagCatalog = {
   // Injects a signed per-attempt TRIGGER_RUN_TOKEN into deployed runs. Org override wins over
   // the global value. Requires RUN_TOKEN_ISSUER_URL and an active internal run signing key.
   [FEATURE_FLAG.runTokenInjection]: z.boolean(),
+  // Org override wins over the global value; off by default.
   [FEATURE_FLAG.externalOidc]: z.boolean(),
   // Shows the session page's Trace tab and serves its routes. Org override wins over the global
   // value; off by default. Admins always have it.
@@ -254,7 +255,6 @@ export const GLOBAL_LOCKED_FLAGS: FeatureFlagKey[] = [
   FEATURE_FLAG.runOpsMintShard,
   FEATURE_FLAG.runOpsMintShardEnvPins,
   FEATURE_FLAG.apiRateLimitMetricsEnabled,
-  FEATURE_FLAG.externalOidc,
   FEATURE_FLAG.workerQueueCompatibility,
   FEATURE_FLAG.workerQueueChannel,
   FEATURE_FLAG.workerQueueEnvironmentOverrides,

apps/webapp/test/externalOidcFeatureFlags.test.ts

@@ -0,0 +1,28 @@
+import { expect, it } from "vitest";
+import { resolveExternalOidcFlags } from "~/services/oidc/externalOidcFeatureFlags";
+
+// Catches: an invalid sibling flag discarding an explicit OIDC authorization override.
+it.each([
+  { global: true, override: false },
+  { global: false, override: true },
+  { global: undefined, override: true },
+])(
+  "preserves org OIDC $override over global $global despite an invalid sibling",
+  ({ global, override }) => {
+    expect(
+      resolveExternalOidcFlags(
+        { externalOidc: global },
+        { externalOidc: override, realtimeBackend: "not-a-backend" }
+      )
+    ).toEqual({ externalOidc: override });
+  }
+);
+
+it.each([
+  { global: true, expected: true },
+  { global: undefined, expected: false },
+])("falls back to global $global for an invalid org OIDC value", ({ global, expected }) => {
+  expect(
+    resolveExternalOidcFlags({ externalOidc: global }, { externalOidc: "not-a-boolean" })
+  ).toEqual({ externalOidc: expected });
+});

apps/webapp/test/globalFlagWriteRouting.test.ts

@@ -96,6 +96,11 @@ describe("lockedFlagsInPayload — what the global page refuses", () => {
     ]);
   });
 
+  // Catches: rejecting the external OIDC global toggle as an org-only flag.
+  it("allows external OIDC to be configured globally", () => {
+    expect(lockedFlagsInPayload([FEATURE_FLAG.externalOidc], true)).toEqual([]);
+  });
+
   it("allows the shard list, because that is the page's ramp lever", () => {
     expect(lockedFlagsInPayload([FEATURE_FLAG.runOpsMintShardSet], true)).toEqual([]);
   });