Restore SAML reauth banner on Todos dashboard

Eduardo Sanz Garcíarequested to merge
eduardosanz/todo-saml-banner into master

What does this MR do and why?

The Todos dashboard no longer shows the "Group SAML single sign-on session expired" re-authentication banner, while the Issues and merge requests dashboards still show it. When a user's enforced group SAML session expires, some todo targets are hidden and the todo counter can exceed the number of visible items, with nothing telling the user to re-authenticate.

The banner (partial shared/dashboard/saml_reauth_notice) used to be rendered by the old server-rendered Todos view. When the Todos dashboard was migrated to a Vue app (removal of the todos_vue_application feature flag, commit 693fdd971c10), the old view was deleted and the banner render line was dropped, never carried into the new view. It looks like the banner was assumed to be unnecessary during the migration, but it is still needed: the per-item "Hidden" masking (which still works) does not tell the user at the page level that they must re-authenticate, and this is exactly what Issues and merge requests still do.

This MR renders shared/dashboard/saml_reauth_notice above the Vue app root, using the user_groups_requiring_reauth helper, matching the Issues and merge requests dashboards. It is gated on current_user.todos.any? so it only appears when the user has todos. This gate is safe: current_user.todos is a plain ActiveRecord association with no SAML filtering (the SAML hiding happens only at the GraphQL target-authorization layer, which nils out targetEntity), so the todo rows, and thus the banner, remain present even when all of a user's todos are in a group with an expired session.

Files changed:

  • app/views/dashboard/todos/index.html.haml: the fix.
  • ee/spec/features/dashboards/todos_spec.rb: reuses the existing dashboard SAML reauthentication banner shared example, plus a no-todos case.

No new translatable strings are introduced; the existing GroupSAML|... msgids are reused.

References

Related to #565992 (closed)

Related to #565992 (closed)

Screenshots or screen recordings

An EE user with an enforced group SAML session that has expired, viewing /dashboard/todos. Before, no banner appears; after, the "Group SAML single sign-on session expired" banner appears with a per-group re-authenticate button.

Light mode

State Before After
EE, expired group SAML session before, light after, light

Dark mode

State Before After
EE, expired group SAML session before, dark after, dark

How to set up and validate locally

  1. On an EE instance with a group that has SAML SSO enabled and enforced (enforced_sso), ensure your user has a linked SAML identity and at least one todo (for example, get mentioned in an issue or epic in that group).
  2. Let the group SAML session expire (or clear the active SSO session).
  3. Visit /dashboard/todos. The "Group SAML single sign-on session expired" warning banner appears with a "Re-authenticate <group>" button, matching /dashboard/issues.
  4. Re-authenticate via the button; the banner disappears and all todos become visible.
  5. Compare with /dashboard/issues and /dashboard/merge_requests for parity.

Merge request reports