Add ssoLoginURL in activate account outputs

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/connect/v1/schema.graphql

@@ -788,6 +788,7 @@ type SignOutPayload {
 
 type ActivateAccountPayload {
   createPasswordToken: String
+  ssoLoginUrl: String
   profile: Profile
 }
 

pkg/server/api/connect/v1/schema/schema.go

@@ -65,6 +65,7 @@ type ComplexityRoot struct {
 	ActivateAccountPayload struct {
 		CreatePasswordToken func(childComplexity int) int
 		Profile             func(childComplexity int) int
+		SsoLoginURL         func(childComplexity int) int
 	}
 
 	AssumeOrganizationSessionPayload struct {
@@ -623,6 +624,12 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.ComplexityRoot.ActivateAccountPayload.Profile(childComplexity), true
+	case "ActivateAccountPayload.ssoLoginUrl":
+		if e.ComplexityRoot.ActivateAccountPayload.SsoLoginURL == nil {
+			break
+		}
+
+		return e.ComplexityRoot.ActivateAccountPayload.SsoLoginURL(childComplexity), true
 
 	case "AssumeOrganizationSessionPayload.result":
 		if e.ComplexityRoot.AssumeOrganizationSessionPayload.Result == nil {
@@ -3206,6 +3213,7 @@ type SignOutPayload {
 
 type ActivateAccountPayload {
   createPasswordToken: String
+  ssoLoginUrl: String
   profile: Profile
 }
 
@@ -4195,6 +4203,35 @@ func (ec *executionContext) fieldContext_ActivateAccountPayload_createPasswordTo
 	return fc, nil
 }
 
+func (ec *executionContext) _ActivateAccountPayload_ssoLoginUrl(ctx context.Context, field graphql.CollectedField, obj *types.ActivateAccountPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_ActivateAccountPayload_ssoLoginUrl,
+		func(ctx context.Context) (any, error) {
+			return obj.SsoLoginURL, nil
+		},
+		nil,
+		ec.marshalOString2ᚖstring,
+		true,
+		false,
+	)
+}
+
+func (ec *executionContext) fieldContext_ActivateAccountPayload_ssoLoginUrl(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "ActivateAccountPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _ActivateAccountPayload_profile(ctx context.Context, field graphql.CollectedField, obj *types.ActivateAccountPayload) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -6342,6 +6379,8 @@ func (ec *executionContext) fieldContext_Mutation_activateAccount(ctx context.Co
 			switch field.Name {
 			case "createPasswordToken":
 				return ec.fieldContext_ActivateAccountPayload_createPasswordToken(ctx, field)
+			case "ssoLoginUrl":
+				return ec.fieldContext_ActivateAccountPayload_ssoLoginUrl(ctx, field)
 			case "profile":
 				return ec.fieldContext_ActivateAccountPayload_profile(ctx, field)
 			}
@@ -16444,6 +16483,8 @@ func (ec *executionContext) _ActivateAccountPayload(ctx context.Context, sel ast
 			out.Values[i] = graphql.MarshalString("ActivateAccountPayload")
 		case "createPasswordToken":
 			out.Values[i] = ec._ActivateAccountPayload_createPasswordToken(ctx, field, obj)
+		case "ssoLoginUrl":
+			out.Values[i] = ec._ActivateAccountPayload_ssoLoginUrl(ctx, field, obj)
 		case "profile":
 			out.Values[i] = ec._ActivateAccountPayload_profile(ctx, field, obj)
 		default:

pkg/server/api/connect/v1/types/types.go

@@ -31,6 +31,7 @@ type ActivateAccountInput struct {
 
 type ActivateAccountPayload struct {
 	CreatePasswordToken *string  `json:"createPasswordToken,omitempty"`
+	SsoLoginURL         *string  `json:"ssoLoginUrl,omitempty"`
 	Profile             *Profile `json:"profile,omitempty"`
 }
 

pkg/server/api/connect/v1/v1_resolver.go

@@ -371,7 +371,7 @@ func (r *mutationResolver) ActivateAccount(ctx context.Context, input types.Acti
 		r.sessionCookie.Clear(w)
 	}
 
-	user, createPasswordToken, err := r.iam.AuthService.ActivateAccount(
+	identity, user, err := r.iam.AuthService.ActivateAccount(
 		ctx,
 		&iam.ActivateAccountRequest{
 			InvitationToken: input.Token,
@@ -400,8 +400,42 @@ func (r *mutationResolver) ActivateAccount(ctx context.Context, input types.Acti
 		return nil, gqlutils.Internal(ctx)
 	}
 
+	var ssoLoginURL *string
+	samlConfigs, err := r.iam.AccountService.ListSAMLConfigurationsForEmail(ctx, user.EmailAddress)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list saml configurations", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	for _, samlConfig := range samlConfigs {
+		if samlConfig.OrganizationID != user.OrganizationID {
+			continue
+		}
+
+		ssoLoginURL = new(r.SSOLoginURL(samlConfig.ID))
+	}
+
+	if ssoLoginURL != nil {
+		return &types.ActivateAccountPayload{
+			CreatePasswordToken: nil,
+			SsoLoginURL:         ssoLoginURL,
+			Profile:             types.NewProfile(user),
+		}, nil
+	}
+
+	var createPasswordToken *string
+	if identity.HashedPassword == nil {
+		token, err := r.iam.AuthService.GetResetPasswordToken(ctx, identity.EmailAddress)
+		if err != nil {
+			return nil, fmt.Errorf("cannot generate password create token: %w", err)
+		}
+
+		createPasswordToken = &token
+	}
+
 	return &types.ActivateAccountPayload{
 		CreatePasswordToken: createPasswordToken,
+		SsoLoginURL:         nil,
 		Profile:             types.NewProfile(user),
 	}, nil
 }