[imrja8]

What is this PR about?

The SSO settings page has a "Self-hosted Restrictions" section with Enforce SSO and Remote Servers Only. Many self-hosted enterprise customers use Dokploy for whitelabeling but don't use SSO, passkeys or the default help links, and those buttons and links still show up on their instance.

This PR adds 5 visibility toggles to that section:

1. Hide SSO Button: Hides "Sign in with SSO" on the login page. It can't be turned on while an SSO provider exists or Enforce SSO is on, and registering an SSO provider turns it back off.

2. Hide Documentation Link & Hide Support Link: Hide the default links in the sidebar's "Extra" section, which disappears when both are hidden. Neither can be turned on while a custom URL for that link is set in Whitelabeling, and a custom URL always shows.

3. Hide Social Icons: Hides the GitHub, X and Discord icons on the login, registration, invitation and password reset pages. Uses the invisible class instead of removing them, so the layout doesn't jump.

4. Hide Passkey Button: Hides "Sign in with Passkey" on the login page and passkey setup in profile settings. It can't be turned on while any user has a passkey, and users who already have passkeys keep passkey management.

How it works:

• Only unused features can be hidden, so nobody loses a sign-in method or custom link they rely on. The server enforces this, since it's the source of truth, and its error tells the admin why a change was rejected.
• The toggles sit next to Enforce SSO and Remote Servers Only rather than in Whitelabeling, because they control which features are available, not branding. Like those two, they're enterprise-only and self-hosted-only.
• The flags are 5 boolean columns on webServerSettings, matching enforceSSO and remoteServersOnly, all defaulting to false. Login and other auth pages read them from the public whitelabeling config, since they're unauthenticated.
• All 7 toggles in the section share one component, and the 5 new flags share one mutation, since the toggles differed only in key and text. Remote Servers Only and Enforce SSO keep their existing endpoints, so no existing API changes.

Checklist

Before submitting this PR, please make sure that:

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Issues related

Addresses Point 1 (persistent SSO button), Point 3 (hardcoded social icons) and Point 4 (sidebar links) in #5395. Also adds a passkey visibility control.

Screenshots

Confidence Score: 5/5

No new blocking issue was established.

Summary

Adds five self-hosted enterprise visibility controls and combines all seven restriction toggles into one component.

• Self-hosted admins can hide unused sign-in options and social icons.
• Admins can hide default Documentation and Support links from the sidebar.

The previous commit failed the ancestry and shared-merge-base checks, so this review used the full PR diff. The supplied previous threads have no Comment numbers and therefore have no numbered entries above.

_{Reviews (4) · Last reviewed commit: "fix(enterprise): list every page Hide So..." · Reviewed by Greptile}

[imrja8]

Comments Outside Diff

These findings could not be posted inline.

•  Hide SSO does nothing apps/dokploy/pages/index.tsx:329 ▶
  On a licensed self-hosted instance with no SSO providers, enabling Hide SSO Button still leaves “Sign in with SSO” visible. This condition now ignores hideSSOButton, but showSignInWithSSO checks the owner's license, not whether providers exist.
  Keep the hide flag effective when no providers are configured, while showing SSO when providers exist.

Fixed. Restored hide flag check while keeping backend auto-clear. Hide now works for unused SSO, and the backend prevents the flag staying on when providers are added.

[narcisonunez]

@imrja8 Resolve the conflicts please

[imrja8]

@imrja8 Resolve the conflicts please

DONE

[imrja8]

Hi @narcisonunez I've pushed a refactor and rebased on canary. Same behaviour as before, much less code. The 5 new toggles and the existing Enforce SSO / Remote Servers Only toggles now render from one component, and the 5 new flags share one mutation. The PR went from about 700 to about 140 net added lines, not counting the generated migration snapshot.

On scope: this only works with self-hosted enterprise instances, gated the same way as Enforce SSO and Remote Servers Only.

• The section only shows on self-hosted, behind the enterprise license gate, and members are redirected away from the page.
• The mutation requires an owner/admin and a valid enterprise license.
• Every flag defaults to off, so nothing changes for anyone until an admin turns one on.

Why: on a whitelabeled instance, unused Dokploy UI (SSO and passkey buttons, social icons, default help links) still shows to the org's users. These toggles let an admin hide what they don't use, and only while it's unused.

To be upfront: this came from my own whitelabeled setup (#5395), and I can't point to other customers asking for it yet. I sent the PR so you can see what it would look like. Happy to drop any toggle you'd rather not have.