Implement selecting specific organizations in FGAP permission by theohh0 · Pull Request #51717 · keycloak/keycloak

theohh0 · 2026-08-13T19:15:10Z

Implements selecting which organizations to apply fine-grained admin permissions to, similar to implementation group resource selection for FGAP.

Mostly reuses organizations/OrganizationModal.tsx currently used to add users to organizations.

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot

Pull request overview

Adds organization selection to fine-grained admin permissions.

Changes:

Introduces an organization resource selector.
Extends the organization modal with selection mode.
Adds related English translations.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`Organizations.tsx`	Adopts modal modes.
`ResourceType.tsx`	Registers organization selection.
`OrganizationSelect.tsx`	Implements the selector.
`OrganizationModal.tsx`	Adds selection mode behavior.
`messages_en.properties`	Adds selector labels.

Suppressed comments (2)

js/apps/admin-ui/src/permissions-configuration/resource-types/OrganizationSelect.tsx:83

variant="typeahead" is used for single-resource evaluation/search, but this modal always renders checkboxes with Select All enabled. Users can choose several organizations and this branch stores every ID, so pass a radio/single-selection mode through to OrganizationModal as the other resource pickers do.

              <OrganizationModal
                mode="add"
                existingOrgs={organizations}

js/apps/admin-ui/src/permissions-configuration/resource-types/OrganizationSelect.tsx:77

This required rule is not accompanied by any rendered form error, unlike GroupSelect.tsx:156. Submitting “Specific Organizations” without a selection is blocked with no explanation; render a FormErrorText for this field and add the corresponding message.

        rules={{
          validate: (value?: string[]) =>
            !isRequired || (value && value.length > 0),
        }}

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (3)

js/apps/admin-ui/src/permissions-configuration/resource-types/OrganizationSelect.tsx:83

In permission evaluation this component is used with variant="typeahead", but the modal still renders checkboxes and “select all”; choosing multiple organizations stores all IDs while evaluation silently uses only the first. Pass the single-selection intent through to OrganizationModal and set its table to radio selection (as GroupSelect does for selectOne).

              <OrganizationModal
                mode="add"
                existingOrgs={organizations}

js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties:4185

Permission evaluation requests the key selectOrganizations (PermissionsEvaluationTab.tsx:203), but only the singular key is defined, so the help text displays the raw key. Add the plural key while retaining this singular key for the modal title.

selectOrganization=Select Organization

js/apps/admin-ui/src/permissions-configuration/resource-types/OrganizationSelect.tsx:77

This required validator blocks submission when no organization is selected, but unlike GroupSelect and RoleSelect, this component never renders the form error. Selecting “Specific Organizations” and saving with an empty selection therefore fails without explaining why; render a FormErrorText for this field and add its message key.

This issue also appears on line 81 of the same file.

        rules={{
          validate: (value?: string[]) =>
            !isRequired || (value && value.length > 0),
        }}

pedroigor

Great stuff, @theohh0. Can you please check the following:

For specific organizations permissions, there is no validation message when clicking save without selection a organization
There is no message when the modal has no organizations in the list. IIRC, other similar components render a specific message when there are no results.

Other than, LGTM.

Wrong action

theohh0 · 2026-08-14T21:04:05Z

Great stuff, @theohh0. Can you please check the following:

For specific organizations permissions, there is no validation message when clicking save without selection a organization

There is no message when the modal has no organizations in the list. IIRC, other similar components render a specific message when there are no results.

Other than, LGTM.

In testing this I've noticed that the error message for the group select seems to be missing a translation key (it just says "requiredGroups"). Could fix this relatively easily but I assume would be more appropriate for a separate pull request.

ssilvert

Nice work — the component follows GroupSelect closely and the round-trip of organization IDs matches what AdminPermissionsSchema expects on the server, so the core approach looks right.

+1 to @pedroigor's two points (missing validation message, missing empty state in the modal); the emptyOrganizations message key already exists, so the empty state should be a one-liner — and it fixes the user Organizations tab modal at the same time.

The main thing I'd like addressed before merge is a new crash path: the Organizations resource type is offered even in realms where organizations aren't enabled, and the new picker turns that from "nothing renders" into a full-page error boundary. Details inline, along with a couple of robustness/consistency items.

One more thing worth adding: test/permissions/main.ts already has pickGroup/removeGroup helpers and main.spec.ts covers the specificResources path for groups — an organizations equivalent should drop in with little effort and would cover the select/remove round-trip.

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Suppressed comments (4)

js/apps/admin-ui/src/permissions-configuration/resource-types/OrganizationSelect.tsx:45

The fetch depends on values (and adminClient), but the dependency array is [], so it will only run once and won’t refresh the displayed organizations when the form value changes (e.g., after adding/removing). Consider using watch(name) from react-hook-form (instead of getValues) and include the watched value in the useFetch deps, or otherwise include a stable representation of values in the deps so the list stays in sync.

  const values: string[] = getValues(name!) || [];

js/apps/admin-ui/src/permissions-configuration/resource-types/OrganizationSelect.tsx:66

The fetch depends on values (and adminClient), but the dependency array is [], so it will only run once and won’t refresh the displayed organizations when the form value changes (e.g., after adding/removing). Consider using watch(name) from react-hook-form (instead of getValues) and include the watched value in the useFetch deps, or otherwise include a stable representation of values in the deps so the list stays in sync.

  useFetch(
    () => {
      if (values.length > 0) {
        return Promise.all(
          (values as string[]).map((id) =>
            adminClient.organizations.findOne({ id }),
          ),
        );
      }
      return Promise.resolve([]);
    },
    (organizations) => {
      setOrganizations(organizations as OrganizationRepresentation[]);
    },
    [],
  );

js/apps/admin-ui/src/permissions-configuration/resource-types/OrganizationSelect.tsx:154

This is an icon-only button without an accessible name. Add an aria-label (and optionally title) such as “Remove organization” so screen readers can announce the action.

                  <Button
                    variant="link"
                    className="keycloak__client-authorization__policy-row-remove"
                    icon={<MinusCircleIcon />}
                     => {
                      setValue(name!, [
                        ...convertOrganizations(
                          organizations.filter(
                            ({ id }) => id !== organization.id,
                          ),
                        ),
                      ]);
                      setOrganizations([
                        ...organizations.filter(
                          ({ id }) => id !== organization.id,
                        ),
                      ]);
                    }}
                  />

js/apps/admin-ui/src/organizations/OrganizationModal.tsx:64

For mode === "send", data-testid is still set to "join", which makes tests and intent ambiguous and can cause incorrect test targeting. Consider mapping each mode to its own stable test id (e.g., "send" for send mode) or using data-testid={mode} if that matches your test strategy.

          data-testid={mode === "add" ? "add" : "join"}

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot

Copilot review overview

🔵 Needs a closer look

Select-all can submit duplicate organizations, and the remove control lacks an accessible name.

Review effort: Balanced
Findings: None

Resolved since last review (2)

selectableRows currently excludes rows that don’t have a disableSelection property. In a shared…
Changing findOne to return OrganizationRepresentation | undefined is an API-breaking change for…

Previously missed (1)

In code that hasn't changed since last review

Prevent duplicate rows when selecting all

js/libs/ui-shared/src/controls/table/KeycloakDataTable.tsx:186

When select-all is clicked from an indeterminate state, this appends rows that are already selected, so onSelect receives duplicate entries. In this modal that can submit the same organization twice; append only selectable rows not already present.

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot

Copilot review overview

🟡 Changes recommended

The nullable API contract breaks strict TypeScript callers, and the radio picker misaligns table headers.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

Handle missing organizations without breaking existing callers · New
Keep selection column alignment in radio mode · New

ssilvert · 2026-09-25T18:19:21Z

@theohh0 The build is failing now. Sorry this keeps dragging on but I swear we are getting close. See below:

The selectableRows fix looks right — keeping "disableSelection" in row inside the guard preserves the union narrowing, and UI Shared and Account UI are green again.

The build is still red, but it's now a different thing, and it's fallout from the merge with main rather than anything you changed:

src/identity-providers/add/IdpDomainsTab.tsx(38,19)  TS18048: 'org' is possibly 'undefined'
src/identity-providers/add/IdpDomainsTab.tsx(42,22)
src/identity-providers/add/IdpDomainsTab.tsx(43,24)
src/organizations/DomainsTab.tsx(66,23)
src/organizations/DomainsTab.tsx(181,12)
src/organizations/DomainsTab.tsx(192,26)

These are the multi-IdP-for-organizations files that landed on main while this PR was open. They call organizations.findOne and dereference the result straight away, which was fine against the old non-nullable signature:

const org = await adminClient.organizations.findOne({ id: link.organizationId! });
return (org.domains ?? [])
  .map((d) => ({ ...d, orgId: org.id!, orgName: org.name! }));

This is the breaking change we accepted showing up in practice — and behaving the way we expected it to: a compile error naming every affected line, rather than something silent. It's this PR's to fix, since the PR is what changes the signature.

Both are small. IdpDomainsTab.tsx is already inside a try/catch that returns [], so one early return covers all three errors:

const org = await adminClient.organizations.findOne({
  id: link.organizationId!,
});
if (!org) return [];

DomainsTab.tsx is the same org.domains ?? [] shape in all three places (lines 65, 180, 191), so optional chaining is enough:

const domains = org?.domains ?? [];

The other call sites are already fine and need nothing — IdpOrganizationsTab.tsx:53 handles the undefined case, DetailOrganization.tsx:67 already casts to | undefined and guards, and your OrganizationSelect.tsx:58 filters.

Worth flagging separately: this is good evidence for the release-note entry on the admin-client change. If code written in this repo last week needs updating, downstream consoles building on @keycloak/keycloak-admin-client will too.

theohh0 · 2026-09-29T18:25:49Z

The other call sites are already fine and need nothing — IdpOrganizationsTab.tsx:53 handles the undefined case, DetailOrganization.tsx:67 already casts to | undefined and guards, and your OrganizationSelect.tsx:58 filters.

@ssilvert I don't think IdpOrganizationsTab.tsx:53 in its current state does handle the undefined case correctly - it doesn't throw any errors as it doesnt try to access any properties of the undefined organization, but it will return {...org, ...link} which in practice is just {...link}, and this wont get filtered out on line 65 as thats still truthy, 10BC8 despite not being a correct OrgWithLink. I'll get this file updated as well as the others you suggested. (I think you're correct that DetailOrganization.tsx doesn't need a change tho).

* Handle undefined organization in findOne callers organizations.findOne now returns OrganizationRepresentation | undefined (catchNotFound), but the callers added on main in the multi-IdP work still assumed it always returns an organization, which fails the type check. Each caller now handles a missing organization the same way it did when the 404 was thrown, so behaviour doesn't change. Signed-off-by: Danny <117714228+UCNDanny@users.noreply.github.com> * Undo change to DetailOrganization.tsx Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Use optional chaining for organization domains rather than throwing for undefined orgs Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> --------- Signed-off-by: Danny <117714228+UCNDanny@users.noreply.github.com> Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> Co-authored-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot

Copilot review overview

🔵 Needs a closer look

The new icon-only removal control lacks an accessible name.

Review effort: Balanced
Findings: 1

Open (1)

Keep selection column alignment in radio mode

Resolved since last review (1)

Handle missing organizations without breaking existing callers

…n't incorrectly get shifted over by 1. Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot

Copilot review overview

🔵 Needs a closer look

Resource visibility incorrectly depends on organization query access, and the new remove control lacks an accessible name.

Review effort: Balanced
Findings: None

Resolved since last review (1)

Keep selection column alignment in radio mode

Previously missed (2)

In code that hasn't changed since last review

Organizations resource type incorrectly hidden for delegated admins

js/apps/admin-ui/src/utils/useSortedResourceTypes.ts:23

useIsFeatureEnabled(Feature.Organizations) also requires manage-realm or query-organizations (useIsFeatureEnabled.ts:40-43). A delegated admin with manage-authorization can access this screen without either role, so this removes the entire Organizations resource type—including the all-organizations option—while Groups and other resource types remain available; use a feature-only check here and handle picker access separately.

Add test for findOne after organization deletion

js/libs/keycloak-admin-client/src/resources/organizations.ts:77

Add an admin-client test asserting that findOne returns the not-found sentinel after an organization is deleted. This newly changes the public request behavior, while organizations.spec.ts currently exercises deletion only through find() and would not catch a regression in catchNotFound.

ssilvert

This one has been out here too long. It's good as it is. I'll create some follow-up issues to tie up loose ends after merging.

PR keycloak#51717 changed organizations.findOne to resolve to undefined for a missing organization instead of rejecting with a 404, but merged without an upgrading-guide entry. Opens the 26.9.0 changes file for it. Fixes keycloak#53371 Signed-off-by: Stan Silvert <ssilvert@redhat.com> Assisted-by: Claude Opus 5.5

…ak#51717) * Safely Adapted organization modal for use with fgap Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Create OrganizationSelect component Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Add organizations to resource types Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Added en translation keys Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * added orgs to permission eval Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Show error when no orgs selected Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * disable add/join button if no orgs selected Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * display error message when no organizations exist Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * filter out organization resource type if disabled Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Catch not found organizations Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * pass isRadio through to organization modal Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Clean up organization modal titles code Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * casing and placement Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Don't show empty orgs error when orgs loading. Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Disable existing orgs selected rather than removing them from modal Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Select all shouldnt select disabled rows in `KeycloakDataTable` Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * fix adminclient org typing and catch nulls Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * use translation keys for OrganizationModal.tsx titles Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Missing message keys Signed-off-by: theohh0 <theo.hinton-h 10BC8 allows@ibm.com> * Calculate orgsEnabled outside of memo Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Don't include subrows in select all Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * remove unnecessary properties from SubRow Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * disable select all if nothing selectable Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * don't need to pass existingOrgs length into loader params now that they aren't removed Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * added select/delete org permission test Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * enable organizations in test realm Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * reusable selectedRows var Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * hopefully more concrete org row selector Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * create policy with different name Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * just check for presence of data property - not truthiness Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * clean up perm tests once complete Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Safely Adapted organization modal for use with fgap Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Create OrganizationSelect component Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Add organizations to resource types Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Added en translation keys Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * added orgs to permission eval Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Show error when no orgs selected Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * disable add/join button if no orgs selected Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * display error message when no organizations exist Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * filter out organization resource type if disabled Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Catch not found organizations Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * pass isRadio through to organization modal Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Clean up organization modal titles code Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * casing and placement Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Don't show empty orgs error when orgs loading. Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Disable existing orgs selected rather than removing them from modal Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Select all shouldnt select disabled rows in `KeycloakDataTable` Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * fix adminclient org typing and catch nulls Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * use translation keys for OrganizationModal.tsx titles Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Missing message keys Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Calculate orgsEnabled outside of memo Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Don't include subrows in select all Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * remove unnecessary properties from SubRow Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * disable select all if nothing selectable Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * don't need to pass existingOrgs length into loader params now that they aren't removed Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * added select/delete org permission test Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * enable organizations in test realm Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * reusable selectedRows var Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * hopefully more concrete org row selector Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * create policy with different name Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * just check for presence of data property - not truthiness Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * clean up perm tests once complete Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Make sure delete completes Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * disable row selection only when var exists and true in KeycloakDataTable Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: theohh0 <theo.hintonhallows123@gmail.com> * corrected copilots edit Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Handle undefined organization in findOne callers * Handle undefined organization in findOne callers organizations.findOne now returns OrganizationRepresentation | undefined (catchNotFound), but the callers added on main in the multi-IdP work still assumed it always returns an organization, which fails the type check. Each caller now handles a missing organization the same way it did when the 404 was thrown, so behaviour doesn't change. Signed-off-by: Danny <117714228+UCNDanny@users.noreply.github.com> * Undo change to DetailOrganization.tsx Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> * Use optional chaining for organization domains rather than throwing for undefined orgs Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> --------- Signed-off-by: Danny <117714228+UCNDanny@users.noreply.github.com> Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> Co-authored-by: theohh0 <theo.hinton-hallows@ibm.com> * use isRadio to manage evaluation 'canSelectAll' so column headings don't incorrectly get shifted over by 1. Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> --------- Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com> Signed-off-by: theohh0 <theo.hintonhallows123@gmail.com> Signed-off-by: Danny <117714228+UCNDanny@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Danny <117714228+UCNDanny@users.noreply.github.com>

PR keycloak#51717 changed organizations.findOne to resolve to undefined for a missing organization instead of rejecting with a 404, but merged without an upgrading-guide entry. Opens the 27.0.0 changes file for it. Fixes keycloak#53371 Signed-off-by: Stan Silvert <ssilvert@redhat.com> Assisted-by: Claude Opus 5.5

PR #51717 changed organizations.findOne to resolve to undefined for a missing organization instead of rejecting with a 404, but merged without an upgrading-guide entry. Opens the 27.0.0 changes file for it. Fixes #53371 Assisted-by: Claude Opus 5.5 Signed-off-by: Stan Silvert <ssilvert@redhat.com>

PR keycloak#51717 changed organizations.findOne to resolve to undefined for a missing organization instead of rejecting with a 404, but merged without an upgrading-guide entry. Opens the 27.0.0 changes file for it. Fixes keycloak#53371 Assisted-by: Claude Opus 5.5 Signed-off-by: Stan Silvert <ssilvert@redhat.com>

theohh0 added 4 commits August 13, 2026 15:06

Safely Adapted organization modal for use with fgap

0407296

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Create OrganizationSelect component

66a947f

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Add organizations to resource types

85f1d26

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Added en translation keys

182f654

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

theohh0 requested a review from a team as a code owner August 13, 2026 19:15

Copilot AI balanced review requested due to automatic review settings August 13, 2026 19:15

theohh0 requested a review from a team as a code owner August 13, 2026 19:15

theohh0 mentioned this pull request Aug 13, 2026

Select org fgap #51715

Closed

Copilot started reviewing on behalf of theohh0 August 13, 2026 19:20

View session

Copilot AI reviewed Aug 13, 2026

View reviewed changes

Comment thread js/apps/admin-ui/src/permissions-configuration/resource-types/OrganizationSelect.tsx Resolved

Comment thread js/apps/admin-ui/src/permissions-configuration/resource-types/ResourceType.tsx Resolved

added orgs to permission eval

de3b91e

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot AI review requested due to automatic review settings August 13, 2026 20:11

Copilot started reviewing on behalf of theohh0 August 13, 2026 20:12

View session

Copilot AI reviewed Aug 13, 2026

View reviewed changes

stianst added the team/core-iam label Aug 14, 2026

pedroigor previously approved these changes Aug 14, 2026

View reviewed changes

Comment thread js/apps/admin-ui/src/organizations/OrganizationModal.tsx Resolved

pedroigor requested a review from ssilvert August 14, 2026 19:06

ssilvert requested changes Aug 17, 2026

View reviewed changes

theohh0 added 3 commits August 17, 2026 11:33

Show error when no orgs selected

99af335

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

disable add/join button if no orgs selected

fe82415

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

display error message when no organizations exist

b074544

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot AI review requested due to automatic review settings August 17, 2026 19:07

Copilot AI reviewed Aug 17, 2026

View reviewed changes

Comment thread js/apps/admin-ui/src/organizations/OrganizationModal.tsx Resolved

Comment thread js/apps/admin-ui/src/organizations/OrganizationModal.tsx Resolved

theohh0 added 5 commits August 18, 2026 11:54

filter out organization resource type if disabled

0ef99c1

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Catch not found organizations

ce91a27

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

pass isRadio through to organization modal

63fb8da

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Clean up organization modal titles code

0292c3a

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

casing and placement

95b9c78

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot AI reviewed Sep 24, 2026

View reviewed changes

Merge branch 'main' into select-org-fgap2

97fd06f

Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot AI review requested due to automatic review settings September 24, 2026 19:56

Copilot started reviewing on behalf of theohh0 September 24, 2026 19:56

View session

Copilot AI reviewed Sep 24, 2026

View reviewed changes

Comment thread js/libs/keycloak-admin-client/src/resources/organizations.ts Resolved

Comment thread js/apps/admin-ui/src/organizations/OrganizationModal.tsx Resolved

UCNDanny mentioned this pull request Sep 25, 2026

Add organization picker to FGAP permissions in Admin UI #53203

Open

UCNDanny mentioned this pull request Sep 27, 2026

Handle undefined organization in findOne callers theohh0/keycloak#1

Merged

Copilot AI balanced review requested due to automatic review settings September 29, 2026 19:00

Copilot started reviewing on behalf of theohh0 September 29, 2026 19:01

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

use isRadio to manage evaluation 'canSelectAll' so column headings do…

474e96e

…n't incorrectly get shifted over by 1. Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>

Copilot AI balanced review requested due to automatic review settings September 29, 2026 20:01

Copilot started reviewing on behalf of theohh0 September 29, 2026 20:02

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

ssilvert approved these changes Sep 30, 2026

View reviewed changes

ssilvert merged commit feedec8 into keycloak:main Sep 30, 2026
93 checks passed

Conversation

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants