Merge pull request #30988 from overleaf/jel-check-domain-matches-matcher-web

[web] Check if email domain from SAML callback matches domain matcher

GitOrigin-RevId: e29a7dc6a1b5f6db46ab4146626c9f1d6659b7ea

services/web/app/src/Features/Errors/Errors.js

@@ -227,6 +227,12 @@ class SAMLSessionProviderDataMissing extends SAMLAuthenticationError {
   }
 }
 
+class SAMLDomainCaptureEmailDomainMismatchError extends SAMLDomainCaptureError {
+  get i18nKey() {
+    return 'invalid_organization_email'
+  }
+}
+
 class SAMLSessionDataMissing extends BackwardCompatibleError {
   constructor(arg) {
     super(arg)
@@ -388,6 +394,7 @@ module.exports = {
   SAMLAuthenticationRequiredError,
   SAMLCommonsUnavailable,
   SAMLDomainCaptureEmailExistsError,
+  SAMLDomainCaptureEmailDomainMismatchError,
   SAMLDomainCaptureError,
   SAMLDomainCaptureJoiningError,
   SAMLDomainCaptureMissingSessionDataError,

services/web/app/src/Features/Institutions/InstitutionsAPI.mjs

@@ -316,6 +316,15 @@ function sendUsersWithReconfirmationsLapsedProcessed(users, callback) {
   )
 }
 
+async function verifyDomainMatchesDomainMatcher(domain, institutionId) {
+  return await _affiliationRequestFetchJson({
+    method: 'POST',
+    path: `/api/v2/institutions/domain_matches_matcher`,
+    body: { domain, id: institutionId },
+    defaultErrorMessage: "Couldn't verify if domain matches matcher",
+  })
+}
+
 const InstitutionsAPI = {
   getInstitutionAffiliations,
 
@@ -431,6 +440,7 @@ InstitutionsAPI.promises = {
   sendUsersWithReconfirmationsLapsedProcessed: promisify(
     InstitutionsAPI.sendUsersWithReconfirmationsLapsedProcessed
   ),
+  verifyDomainMatchesDomainMatcher,
 }
 
 export default InstitutionsAPI

services/web/frontend/extracted-translations.json

@@ -927,6 +927,7 @@
   "invalid_email": "",
   "invalid_file_name": "",
   "invalid_filename": "",
+  "invalid_organization_email": "",
   "invalid_password_contains_email": "",
   "invalid_password_too_similar": "",
   "invalid_regular_expression": "",

services/web/locales/en.json

@@ -1165,7 +1165,8 @@
   "invalid_email": "An email address is invalid",
   "invalid_file_name": "Invalid File Name",
   "invalid_filename": "Upload failed: check that the file name doesn’t contain special characters, trailing/leading whitespace or more than __nameLimit__ characters",
-  "invalid_institutional_email": "Your institution’s SSO service returned your email address as __email__, which is at an unexpected domain that we do not recognise as belonging to it. You may be able to change your primary email address via your user profile at your institution to one at your institution’s domain. Please contact your IT department if you have any questions.",
+  "invalid_institutional_email": "Your institution’s SSO service returned your email address as __email__, which is an unexpected domain that we do not recognise as belonging to it. You may be able to change your primary email address via your user profile at your institution to one at your institution’s domain. Please contact your IT department if you have any questions.",
+  "invalid_organization_email": "Your organization’s SSO service returned your email address as <0>__institutionEmail__</0>, which is an unexpected domain that we do not recognise as belonging to it. Please <1>contact us</1> if you think this is in error.",
   "invalid_password": "Invalid Password.",
   "invalid_password_contains_email": "Password cannot contain parts of email address.",
   "invalid_password_invalid_character": "Password contains an invalid character.",