Migrates this fork to the binarybeachio platform-architecture pivot: oauth2-proxy at the edge enforces a Zitadel session, the auth-bridge mints a short-lived RS256 JWT, and a NEW additive endpoint at /auth/sign-in-trusted/ verifies the JWT, claims its jti against shared-redis (single-use replay protection, fail-closed), find-or-creates the User, and starts a Django session via user_login(). Net surface vs. upstream-clean: 1 new view file + 1 url path + 1 exports __init__ entry + 7 reserved error codes (6000-6099 range). github.py and the GitHub-button rebrand patch are reverted to upstream — sign-in entry-point UX is now driven by Traefik redirectregex on /sign-in* in infrastructure/plane/docker-compose.yml. Replay protection contract: jti claim minted by bridge, consumed via Redis SETNX with ttl = exp - now + 30s. Documented at binarybeachio/docs/architecture/bridge-jwt-replay-protection.md. Public-key transport: BB_BRIDGE_PUBLIC_KEY_URL env points at the in-cluster bridge's /.well-known/bb-bridge.pub.pem (avoids the env-PEM corruption issue Coolify has with backslash-escaped keys). Endpoint is implicitly disabled (404) when env unset — vanilla upstream behavior preserved. Storage patches (Patch 2) unchanged. Brand asset preserved (dormant). Pre-migration source state preserved on branch pre-migration-2026-05-04. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
158 lines
5.5 KiB
Python
158 lines
5.5 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
from django.urls import path
|
|
|
|
from .views import (
|
|
CSRFTokenEndpoint,
|
|
ForgotPasswordEndpoint,
|
|
SetUserPasswordEndpoint,
|
|
ResetPasswordEndpoint,
|
|
ChangePasswordEndpoint,
|
|
# App
|
|
EmailCheckEndpoint,
|
|
GitLabCallbackEndpoint,
|
|
GitLabOauthInitiateEndpoint,
|
|
GitHubCallbackEndpoint,
|
|
GitHubOauthInitiateEndpoint,
|
|
GoogleCallbackEndpoint,
|
|
GoogleOauthInitiateEndpoint,
|
|
MagicGenerateEndpoint,
|
|
MagicSignInEndpoint,
|
|
MagicSignUpEndpoint,
|
|
SignInAuthEndpoint,
|
|
SignOutAuthEndpoint,
|
|
SignUpAuthEndpoint,
|
|
ForgotPasswordSpaceEndpoint,
|
|
ResetPasswordSpaceEndpoint,
|
|
# Space
|
|
EmailCheckSpaceEndpoint,
|
|
GitLabCallbackSpaceEndpoint,
|
|
GitLabOauthInitiateSpaceEndpoint,
|
|
GitHubCallbackSpaceEndpoint,
|
|
GitHubOauthInitiateSpaceEndpoint,
|
|
GoogleCallbackSpaceEndpoint,
|
|
GoogleOauthInitiateSpaceEndpoint,
|
|
MagicGenerateSpaceEndpoint,
|
|
MagicSignInSpaceEndpoint,
|
|
MagicSignUpSpaceEndpoint,
|
|
SignInAuthSpaceEndpoint,
|
|
SignUpAuthSpaceEndpoint,
|
|
SignOutAuthSpaceEndpoint,
|
|
GiteaCallbackEndpoint,
|
|
GiteaOauthInitiateEndpoint,
|
|
GiteaCallbackSpaceEndpoint,
|
|
GiteaOauthInitiateSpaceEndpoint,
|
|
# binarybeachio fork addition — see views/app/trusted.py.
|
|
TrustedSignInEndpoint,
|
|
)
|
|
|
|
urlpatterns = [
|
|
# credentials
|
|
path("sign-in/", SignInAuthEndpoint.as_view(), name="sign-in"),
|
|
path("sign-up/", SignUpAuthEndpoint.as_view(), name="sign-up"),
|
|
path("spaces/sign-in/", SignInAuthSpaceEndpoint.as_view(), name="space-sign-in"),
|
|
path("spaces/sign-up/", SignUpAuthSpaceEndpoint.as_view(), name="space-sign-up"),
|
|
# signout
|
|
path("sign-out/", SignOutAuthEndpoint.as_view(), name="sign-out"),
|
|
path("spaces/sign-out/", SignOutAuthSpaceEndpoint.as_view(), name="space-sign-out"),
|
|
# csrf token
|
|
path("get-csrf-token/", CSRFTokenEndpoint.as_view(), name="get_csrf_token"),
|
|
# Magic sign in
|
|
path("magic-generate/", MagicGenerateEndpoint.as_view(), name="magic-generate"),
|
|
path("magic-sign-in/", MagicSignInEndpoint.as_view(), name="magic-sign-in"),
|
|
path("magic-sign-up/", MagicSignUpEndpoint.as_view(), name="magic-sign-up"),
|
|
path(
|
|
"spaces/magic-generate/",
|
|
MagicGenerateSpaceEndpoint.as_view(),
|
|
name="space-magic-generate",
|
|
),
|
|
path(
|
|
"spaces/magic-sign-in/",
|
|
MagicSignInSpaceEndpoint.as_view(),
|
|
name="space-magic-sign-in",
|
|
),
|
|
path(
|
|
"spaces/magic-sign-up/",
|
|
MagicSignUpSpaceEndpoint.as_view(),
|
|
name="space-magic-sign-up",
|
|
),
|
|
## Google Oauth
|
|
path("google/", GoogleOauthInitiateEndpoint.as_view(), name="google-initiate"),
|
|
path("google/callback/", GoogleCallbackEndpoint.as_view(), name="google-callback"),
|
|
path(
|
|
"spaces/google/",
|
|
GoogleOauthInitiateSpaceEndpoint.as_view(),
|
|
name="space-google-initiate",
|
|
),
|
|
path(
|
|
"spaces/google/callback/",
|
|
GoogleCallbackSpaceEndpoint.as_view(),
|
|
name="space-google-callback",
|
|
),
|
|
## Github Oauth
|
|
path("github/", GitHubOauthInitiateEndpoint.as_view(), name="github-initiate"),
|
|
path("github/callback/", GitHubCallbackEndpoint.as_view(), name="github-callback"),
|
|
path(
|
|
"spaces/github/",
|
|
GitHubOauthInitiateSpaceEndpoint.as_view(),
|
|
name="space-github-initiate",
|
|
),
|
|
path(
|
|
"spaces/github/callback/",
|
|
GitHubCallbackSpaceEndpoint.as_view(),
|
|
name="space-github-callback",
|
|
),
|
|
## Gitlab Oauth
|
|
path("gitlab/", GitLabOauthInitiateEndpoint.as_view(), name="gitlab-initiate"),
|
|
path("gitlab/callback/", GitLabCallbackEndpoint.as_view(), name="gitlab-callback"),
|
|
path(
|
|
"spaces/gitlab/",
|
|
GitLabOauthInitiateSpaceEndpoint.as_view(),
|
|
name="space-gitlab-initiate",
|
|
),
|
|
path(
|
|
"spaces/gitlab/callback/",
|
|
GitLabCallbackSpaceEndpoint.as_view(),
|
|
name="space-gitlab-callback",
|
|
),
|
|
# Email Check
|
|
path("email-check/", EmailCheckEndpoint.as_view(), name="email-check"),
|
|
path("spaces/email-check/", EmailCheckSpaceEndpoint.as_view(), name="email-check"),
|
|
# Password
|
|
path("forgot-password/", ForgotPasswordEndpoint.as_view(), name="forgot-password"),
|
|
path(
|
|
"reset-password/<uidb64>/<token>/",
|
|
ResetPasswordEndpoint.as_view(),
|
|
name="forgot-password",
|
|
),
|
|
path(
|
|
"spaces/forgot-password/",
|
|
ForgotPasswordSpaceEndpoint.as_view(),
|
|
name="space-forgot-password",
|
|
),
|
|
path(
|
|
"spaces/reset-password/<uidb64>/<token>/",
|
|
ResetPasswordSpaceEndpoint.as_view(),
|
|
name="space-forgot-password",
|
|
),
|
|
path("change-password/", ChangePasswordEndpoint.as_view(), name="forgot-password"),
|
|
path("set-password/", SetUserPasswordEndpoint.as_view(), name="set-password"),
|
|
## Gitea Oauth
|
|
path("gitea/", GiteaOauthInitiateEndpoint.as_view(), name="gitea-initiate"),
|
|
path("gitea/callback/", GiteaCallbackEndpoint.as_view(), name="gitea-callback"),
|
|
path(
|
|
"spaces/gitea/",
|
|
GiteaOauthInitiateSpaceEndpoint.as_view(),
|
|
name="space-gitea-initiate",
|
|
),
|
|
path(
|
|
"spaces/gitea/callback/",
|
|
GiteaCallbackSpaceEndpoint.as_view(),
|
|
name="space-gitea-callback",
|
|
),
|
|
# binarybeachio fork addition — Bucket-4 trusted-JWT entry-point.
|
|
# See views/app/trusted.py and BINARYBEACHIO.md.
|
|
path("sign-in-trusted/", TrustedSignInEndpoint.as_view(), name="sign-in-trusted"),
|
|
]
|