feat(connector,console,core): add SSO paywall for core management APIs (#5024)

packages/connectors/connector-logto-email/package.json

@@ -49,6 +49,6 @@
     "access": "public"
   },
   "devDependencies": {
-    "@logto/cloud": "0.2.5-9257c0d"
+    "@logto/cloud": "0.2.5-5a698db"
   }
 }

packages/console/package.json

@@ -26,7 +26,7 @@
     "@fontsource/roboto-mono": "^5.0.0",
     "@jest/types": "^29.5.0",
     "@logto/app-insights": "workspace:^1.3.1",
-    "@logto/cloud": "0.2.5-9257c0d",
+    "@logto/cloud": "0.2.5-5a698db",
     "@logto/connector-kit": "workspace:^2.0.0",
     "@logto/core-kit": "workspace:^2.1.2",
     "@logto/language-kit": "workspace:^1.0.0",

packages/core/package.json

@@ -91,7 +91,7 @@
     "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@logto/cloud": "0.2.5-9257c0d",
+    "@logto/cloud": "0.2.5-5a698db",
     "@silverhand/eslint-config": "4.0.1",
     "@silverhand/ts-config": "4.0.0",
     "@types/debug": "^4.1.7",

packages/core/src/libraries/quota.ts

@@ -71,6 +71,7 @@ export const createQuotaLibrary = (
     customDomainEnabled: notNumber,
     mfaEnabled: notNumber,
     organizationsEnabled: notNumber,
+    ssoEnabled: notNumber,
     omniSignInEnabled: notNumber, // No limit for now
     builtInEmailConnectorEnabled: notNumber, // No limit for now
   };

packages/core/src/routes/sso-connector/index.ts

@@ -12,6 +12,7 @@ import { EnvSet } from '#src/env-set/index.js';
 import RequestError from '#src/errors/RequestError/index.js';
 import koaGuard from '#src/middleware/koa-guard.js';
 import koaPagination from '#src/middleware/koa-pagination.js';
+import koaQuotaGuard from '#src/middleware/koa-quota-guard.js';
 import { ssoConnectorCreateGuard, ssoConnectorPatchGuard } from '#src/routes/sso-connector/type.js';
 import { ssoConnectorFactories, standardSsoConnectorProviders } from '#src/sso/index.js';
 import { isSupportedSsoProvider, isSupportedSsoConnector } from '#src/sso/utils.js';
@@ -40,11 +41,14 @@ export default function singleSignOnRoutes<T extends AuthedRouter>(...args: Rout
       id: tenantId,
       queries: { ssoConnectors },
       libraries: {
+        quota,
         ssoConnectors: { getSsoConnectorById, getSsoConnectors },
       },
     },
   ] = args;
 
+  router.use(koaQuotaGuard({ key: 'ssoEnabled', quota, methods: ['POST', 'PUT'] }));
+
   const pathname = `/${tableToPathname(SsoConnectors.table)}`;
 
   /*

pnpm-lock.yaml

@@ -1322,8 +1322,8 @@ importers:
         specifier: ^29.5.0
         version: 29.5.0
       '@logto/cloud':
-        specifier: 0.2.5-9257c0d
+        specifier: 0.2.5-5a698db
-        version: 0.2.5-9257c0d(zod@3.22.4)
+        version: 0.2.5-5a698db(zod@3.22.4)
       '@rollup/plugin-commonjs':
         specifier: ^25.0.0
         version: 25.0.7(rollup@4.1.4)
@@ -2840,8 +2840,8 @@ importers:
         specifier: workspace:^1.3.1
         version: link:../app-insights
       '@logto/cloud':
-        specifier: 0.2.5-9257c0d
+        specifier: 0.2.5-5a698db
-        version: 0.2.5-9257c0d(zod@3.22.4)
+        version: 0.2.5-5a698db(zod@3.22.4)
       '@logto/connector-kit':
         specifier: workspace:^2.0.0
         version: link:../toolkit/connector-kit
@@ -3318,8 +3318,8 @@ importers:
         version: 3.22.4
     devDependencies:
       '@logto/cloud':
-        specifier: 0.2.5-9257c0d
+        specifier: 0.2.5-5a698db
-        version: 0.2.5-9257c0d(zod@3.22.4)
+        version: 0.2.5-5a698db(zod@3.22.4)
       '@silverhand/eslint-config':
         specifier: 4.0.1
         version: 4.0.1(eslint@8.44.0)(prettier@3.0.0)(typescript@5.0.2)
@@ -7519,8 +7519,8 @@ packages:
       jose: 4.14.4
     dev: true
 
-  /@logto/cloud@0.2.5-9257c0d(zod@3.22.4):
+  /@logto/cloud@0.2.5-5a698db(zod@3.22.4):
-    resolution: {integrity: sha512-tACUnAH8eRVS/InlIFIP50IcQzjlqCCPPa2Oqs4NNe1EkVMW7uplNZDPa1cTqT3fk223OvU9/9f0ydK9gwNZPQ==}
+    resolution: {integrity: sha512-khGNmCJgUBQCpIxsewsoeaPHDtR5FgX03SSAYfaPJATxvMS8j+B0BeGP6J2OTsH5iB86K6dJ4BJwKlB2cweY4g==}
     engines: {node: ^18.12.0}
     dependencies:
       '@silverhand/essentials': 2.8.5