Organization onboarding into origin with signed URL #525

Merged

tobru merged 3 commits from switch-onboarding into main

2026-06-23 06:39:01 +00:00

tobru commented

2026-05-22 11:37:54 +00:00

Owner

This is used for Switch Cloud Portal to Servala Portal onboarding.

Switch generates a signed URL pointing to the Servala Portal. When a customer clicks it, the portal:

Verifies the URL came from Switch (HMAC signature with a shared secret).
Pre-configures the organization with the Switch origin (which controls billing, allowed cloud providers, and the assigned limit profile, so new Switch customers skip the default trial limits).
Pre-fills the organization name; the field is locked.
If an organization with that name already exists under the Switch origin, the customer is offered a way to request access from its existing owners instead of creating a duplicate.

This is used for Switch Cloud Portal to Servala Portal onboarding. Switch generates a signed URL pointing to the Servala Portal. When a customer clicks it, the portal: 1. Verifies the URL came from Switch (HMAC signature with a shared secret). 2. Pre-configures the organization with the Switch origin (which controls billing, allowed cloud providers, and the assigned limit profile, so new Switch customers skip the default trial limits). 3. Pre-fills the organization name; the field is locked. 4. If an organization with that name already exists under the Switch origin, the customer is offered a way to request access from its existing owners instead of creating a duplicate.

tobru added the

enhancement

label

2026-05-22 11:37:54 +00:00

tobru commented

2026-06-22 12:38:46 +00:00

Author

Owner

Also store swissEduPersonUniqueID in Servala Portal DB and be aware of the fact that a person can have multiple email addresses. Allow to choose primary email address, maybe per organization?

https://vshnticket.atlassian.net/browse/VCI-990

Also store `swissEduPersonUniqueID` in Servala Portal DB and be aware of the fact that a person can have multiple email addresses. Allow to choose primary email address, maybe per organization? https://vshnticket.atlassian.net/browse/VCI-990

tobru force-pushed switch-onboarding from 2cefe61f5e

Tests / test (push) Successful in 51s

Details

to aacc3de485

Tests / test (push) Successful in 56s

Details

2026-06-22 13:43:37 +00:00

Compare

tobru added 1 commit

2026-06-22 15:41:19 +00:00

feat: signed onboarding for organization origins

Tests / test (push) Successful in 1m0s

Details

94aff7bc24

Add a generic signed-onboarding flow so a cloud provider (Switch first)
can send an HMAC-signed URL that pre-configures a new organization or
routes the visitor to request access from an existing org's owners.

- OrganizationOrigin gains slug, signing_secret (encrypted), and
  onboarding_limit_profile; verify_signed_query() validates the HMAC
  against the raw query string and enforces expiry. Registered with
  auditlog excluding signing_secret.
- OnboardingLandingView verifies the link, redirects members to their
  dashboard, and otherwise stashes a short-lived session and shows a
  create-org CTA or an access-request panel.
- send_org_access_request notifies all owners (reply-to the requester);
  OrganizationAccessRequestView is session-gated via
  OnboardingSessionAccessMixin.
- OrganizationCreateView pins the name (tamper-proof), origin, and limit
  profile from the onboarding session, falling back to a normal create
  when the session is absent or stale.
- Admin exposes the new fields; migration 0056 adds them and backfills
  slugs, 0055 merges the pre-existing migration fork on this branch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tobru changed title from ~~WIP: Organization onboarding into origin with signed URL~~ to Organization onboarding into origin with signed URL

2026-06-23 06:22:20 +00:00

tobru merged commit e95b7a1527 into main

2026-06-23 06:39:01 +00:00

tobru deleted branch switch-onboarding

2026-06-23 06:39:01 +00:00

tobru referenced this pull request from a commit

2026-06-23 06:39:02 +00:00

Merge pull request 'Organization onboarding into origin with signed URL' (#525) from switch-onboarding into main