feat(auth): implement sub-organization login selection by IgorHorta · Pull Request #5522 · Infisical/infisical

IgorHorta · 2026-02-19T23:16:49Z

Context

Adds support for sub-organizations in the login flow. Previously, users could only select a root organization at login. This PR introduces a new select-organization page that displays the org hierarchy and allows users to log directly into a sub-organization or its root org.

Closes ENG-4584

Key changes:

New backend endpoint GET /api/v1/organization/accessible-with-sub-orgs returns orgs with their accessible sub-orgs
New useGetOrganizationsWithSubOrgs hook to consume the endpoint
Redesigned org selection page using Infisical's auth page design identity
Drill-down UX: clicking › on a root org shows its sub-orgs with a breadcrumb to navigate back
Sub-orgs automatically expand inline when the search term matches
Sub-orgs inherit the root org's SSO enforcement (SAML/OIDC/Google) at login
Auto-login is skipped when a user has one org with sub-orgs (they must pick which to enter)

Screenshots

Screenshare.-.2026-02-20.12_21_09.PM.mp4

Steps to verify the change

Log in as a user with access to multiple orgs (or one org with sub-orgs)
Confirm the org selection page appears instead of auto-login
Click › on an org with sub-orgs — verify breadcrumb appears and sub-orgs are listed
Log into a root org and a sub-org — verify each lands in the correct workspace
For an org with SSO enforced, verify sub-org login correctly triggers the SSO redirect
Search for a sub-org by name — verify the parent org expands automatically

Type

Checklist

Title follows the conventional commit format: type(scope): short description
Tested locally
Updated docs (if needed)
Read the contributing guide

linear · 2026-02-19T23:16:52Z

ENG-4584 Implement authentication into specific sub-organizations

frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx

maidul98 · 2026-02-19T23:22:09Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-02-20T15:18:52Z

Greptile Summary

This PR adds sub-organization support to the login flow, allowing users to select and log into sub-organizations or their root organizations. The implementation includes a new backend endpoint that returns organization hierarchies with proper authorization checks, and a redesigned frontend UI with drill-down navigation and search functionality.

Key changes:

New GET /api/v1/organization/accessible-with-sub-orgs endpoint returns root orgs with accessible sub-orgs
Backend properly validates user membership via direct assignment or group membership using grouped OR queries
Frontend inherits SSO enforcement settings from root org when logging into sub-orgs
Auto-login is skipped when a user has one org with accessible sub-orgs
Search functionality automatically expands parent orgs when sub-org names match

Security: Authorization is properly enforced - users can only see sub-orgs they have explicit membership in (direct or via groups). The existing selectOrganization flow validates membership before issuing tokens.

Confidence Score: 4/5

This PR is safe to merge with only minor spelling corrections needed
The implementation is well-structured with proper authorization checks and follows security best practices. OR queries are correctly grouped to prevent filter bypass. Only minor typos in function names need correction.
No files require special attention beyond fixing the spelling typos in backend/src/services/org/org-service.ts and backend/src/server/routes/v1/organization-router.ts

Important Files Changed

Filename	Overview
backend/src/server/routes/v1/organization-router.ts	Added new GET endpoint `/accessible-with-sub-orgs` to return organizations with sub-org hierarchy
backend/src/services/org/org-dal.ts	Implemented `listOrganizationsWithSubOrgs` with proper authorization checks and grouped OR queries
frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx	Redesigned org selection UI with drill-down navigation, search filtering, and sub-org support; inherits SSO from root org

_{Last reviewed commit: bd524e6}

greptile-apps

_{7 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

backend/src/services/org/org-service.ts

backend/src/server/routes/v1/organization-router.ts

Adds sub-organization navigation and enhances the organization selection interface. Improves the visual hierarchy and provides a smoother user experience.

Calculates and stores total organization count in a variable which is used to determine whether the search input should be displayed or not.

backend/src/services/org/org-schema.ts

backend/src/services/org/org-dal.ts

frontend/src/hooks/api/organization/queries.tsx

frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx

varonix0

I think we need the "Member since" here, looks very empty

varonix0

This arrow is pretty invisible, maybe we should make it more clear? @scott-ray-wilson might be good to loop in on this

varonix0

Sent a video to you privately showing a UI discrepancy with selecting root organizations

…specific-sub-organizations

This adds tracking of when a user joined an organization by retrieving the createdAt timestamp from the Membership table. The schema now includes userJoinedAt to expose this information in API responses. This enables the frontend to display "Member since" information on the organization selection screen. The actor type check in listOrganizationsWithSubOrgs has been removed to support future use cases beyond just user actors.

Updates the organization selection screen to display "Member since" information for both root and sub-organizations. The frontend type has been updated to include the userJoinedAt field, and the UI now renders the formatted join date for each organization using date-fns. This provides users with context about when they joined each organization, enhancing transparency in multi-organization environments.

Consolidate the two separate queries (root orgs and sub-orgs) into a single efficient query with proper left joins to resolve userJoinedAt for both direct membership and group-based access. Remove the unused actorType parameter from the function signature.

Extend the sub-organization schema to include the userJoinedAt field, which tracks when a user joined a specific sub-organization through direct membership or group membership.

Update the org service to pass only actorId when calling listOrganizationsWithSubOrgs, matching the simplified function signature in the DAL.

Extend the sub-organization schema to include the userJoinedAt field, which tracks when a user joined a specific sub-organization through direct membership or group membership.

Update the org service to pass only actorId when calling listOrganizationsWithSubOrgs, matching the simplified function signature in the DAL.

Extend the frontend type definition to include userJoinedAt on sub-organization objects, enabling the UI to display when users joined sub-organizations.

Refactor the organization selection UI to: - Make root org login section a semantic button element instead of div - Display user join dates in both root org and sub-org sections - Show join dates in the format 'Member since MMM d yyyy' - Improve accessibility with proper button semantics and ARIA labels - Update styling to work with the new button structure

…b-org label

IgorHorta added 4 commits February 19, 2026 17:59

Adds endpoint to list accessible orgs.

d4f9de4

new org selector

4822df2

Improves organization selection flow.

5118343

Refactors organization selection logic.

038d97b

IgorHorta commented Feb 19, 2026

View reviewed changes

frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx Show resolved Hide resolved

Improves organization selection UI/UX

bd524e6

IgorHorta changed the title ~~Igor/eng 4584 implement authentication into specific sub organizations~~ feat(auth): implement sub-organization login selection Feb 20, 2026

IgorHorta marked this pull request as ready for review February 20, 2026 15:14

greptile-apps bot reviewed Feb 20, 2026

View reviewed changes

backend/src/services/org/org-service.ts Outdated Show resolved Hide resolved

backend/src/server/routes/v1/organization-router.ts Outdated Show resolved Hide resolved

IgorHorta added 5 commits February 20, 2026 12:23

fix: correct typo in findAllAccessibleOrganizationsWithSubOrgs

71e979f

fix(auth): resolve lint errors in SelectOrgSection

92d9c93

Improves organization selection UX.

7b9be3d

Adds sub-organization navigation and enhances the organization selection interface. Improves the visual hierarchy and provides a smoother user experience.

Displays total organization count.

b85b183

Calculates and stores total organization count in a variable which is used to determine whether the search input should be displayed or not.

feat(auth): improve org selection UI with pill badge and alignment fixes

19ab427

IgorHorta requested a review from scott-ray-wilson February 20, 2026 17:11

varonix0 requested changes Mar 2, 2026

View reviewed changes

varonix0 reviewed Mar 2, 2026

View reviewed changes

IgorCorrea and others added 8 commits March 2, 2026 15:58

Merge branch 'main' into igor/eng-4584-implement-authentication-into-…

d94fa5a

…specific-sub-organizations

fix: removing unecessary imports

3c8477a

feat(org): update TOrgWithSubOrgs import to org-types

d21b0e7

feat(org): Add userJoinedAt field to sub-organization schema

8cbac3c

Extend the sub-organization schema to include the userJoinedAt field, which tracks when a user joined a specific sub-organization through direct membership or group membership.

refactor(org): Remove unused actorType parameter from service call

79a5627

Update the org service to pass only actorId when calling listOrganizationsWithSubOrgs, matching the simplified function signature in the DAL.

IgorHorta added 5 commits March 2, 2026 20:48

feat(org): Add userJoinedAt field to sub-organization schema

8cbac3c

Extend the sub-organization schema to include the userJoinedAt field, which tracks when a user joined a specific sub-organization through direct membership or group membership.

refactor(org): Remove unused actorType parameter from service call

79a5627

Update the org service to pass only actorId when calling listOrganizationsWithSubOrgs, matching the simplified function signature in the DAL.

feat(org): Update TOrgWithSubOrgs type to include sub-org userJoinedAt

6a834e2

Extend the frontend type definition to include userJoinedAt on sub-organization objects, enabling the UI to display when users joined sub-organizations.

chore: Update backend package-lock.json

102b185

IgorHorta force-pushed the igor/eng-4584-implement-authentication-into-specific-sub-organizations branch from 2df1b4b to 102b185 Compare March 2, 2026 23:53

IgorHorta requested a review from varonix0 March 2, 2026 23:54

IgorHorta and others added 10 commits March 2, 2026 21:03

style(ui): fix prettier formatting in SelectOrgSection

e149594

feat(ui): replace arrow icon with login icon in org selector

572825c

feat(ui): improve sub-org search row styling

c3d653a

feat(ui): increase contrast of parent org label in sub-org search rows

7d58705

feat(ui): add cursor-pointer to sub-organizations badge

99760ee

feat(ui): migrate to Lucide icons, thicken sub-org border, clarify su…

86e6a8e

…b-org label

fix(org): resolve lint errors in org DAL, schema, service and types

0d069de

fix: import order

eef5048

style: improve styling of sub-org selection ui

0b30ac9

fix: lint order

c0453de

varonix0 approved these changes Mar 3, 2026

View reviewed changes

IgorHorta merged commit 3c48e12 into main Mar 3, 2026
12 checks passed

Conversation

IgorHorta commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Screenshots

Steps to verify the change

Type

Checklist

Uh oh!

linear bot commented Feb 19, 2026

Uh oh!

Uh oh!

maidul98 commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

greptile-apps bot commented Feb 20, 2026

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

varonix0 left a comment

Choose a reason for hiding this comment

Uh oh!

varonix0 left a comment

Choose a reason for hiding this comment

Uh oh!

varonix0 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

IgorHorta commented Feb 19, 2026 •

edited

Loading

maidul98 commented Feb 19, 2026 •

edited

Loading