binarybeach
712612865d
Migrates this fork to the binarybeachio platform-architecture pivot: oauth2-proxy at the edge enforces a Zitadel session, the auth-bridge mints a short-lived RS256 JWT, and a NEW additive endpoint at /auth/sign-in-trusted/ verifies the JWT, claims its jti against shared-redis (single-use replay protection, fail-closed), find-or-creates the User, and starts a Django session via user_login(). Net surface vs. upstream-clean: 1 new view file + 1 url path + 1 exports __init__ entry + 7 reserved error codes (6000-6099 range). github.py and the GitHub-button rebrand patch are reverted to upstream — sign-in entry-point UX is now driven by Traefik redirectregex on /sign-in* in infrastructure/plane/docker-compose.yml. Replay protection contract: jti claim minted by bridge, consumed via Redis SETNX with ttl = exp - now + 30s. Documented at binarybeachio/docs/architecture/bridge-jwt-replay-protection.md. Public-key transport: BB_BRIDGE_PUBLIC_KEY_URL env points at the in-cluster bridge's /.well-known/bb-bridge.pub.pem (avoids the env-PEM corruption issue Coolify has with backslash-escaped keys). Endpoint is implicitly disabled (404) when env unset — vanilla upstream behavior preserved. Storage patches (Patch 2) unchanged. Brand asset preserved (dormant). Pre-migration source state preserved on branch pre-migration-2026-05-04. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
103 lines
3.5 KiB
Python
103 lines
3.5 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
AUTHENTICATION_ERROR_CODES = {
|
|
# Global
|
|
"INSTANCE_NOT_CONFIGURED": 5000,
|
|
"INVALID_EMAIL": 5005,
|
|
"EMAIL_REQUIRED": 5010,
|
|
"SIGNUP_DISABLED": 5015,
|
|
"MAGIC_LINK_LOGIN_DISABLED": 5016,
|
|
"PASSWORD_LOGIN_DISABLED": 5018,
|
|
"USER_ACCOUNT_DEACTIVATED": 5019,
|
|
# Password strength
|
|
"INVALID_PASSWORD": 5020,
|
|
"PASSWORD_TOO_WEAK": 5021,
|
|
"SMTP_NOT_CONFIGURED": 5025,
|
|
# Sign Up
|
|
"USER_ALREADY_EXIST": 5030,
|
|
"AUTHENTICATION_FAILED_SIGN_UP": 5035,
|
|
"REQUIRED_EMAIL_PASSWORD_SIGN_UP": 5040,
|
|
"INVALID_EMAIL_SIGN_UP": 5045,
|
|
"INVALID_EMAIL_MAGIC_SIGN_UP": 5050,
|
|
"MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED": 5055,
|
|
"EMAIL_PASSWORD_AUTHENTICATION_DISABLED": 5056,
|
|
# Sign In
|
|
"USER_DOES_NOT_EXIST": 5060,
|
|
"AUTHENTICATION_FAILED_SIGN_IN": 5065,
|
|
"REQUIRED_EMAIL_PASSWORD_SIGN_IN": 5070,
|
|
"INVALID_EMAIL_SIGN_IN": 5075,
|
|
"INVALID_EMAIL_MAGIC_SIGN_IN": 5080,
|
|
"MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED": 5085,
|
|
# Both Sign in and Sign up for magic
|
|
"INVALID_MAGIC_CODE_SIGN_IN": 5090,
|
|
"INVALID_MAGIC_CODE_SIGN_UP": 5092,
|
|
"EXPIRED_MAGIC_CODE_SIGN_IN": 5095,
|
|
"EXPIRED_MAGIC_CODE_SIGN_UP": 5097,
|
|
"EMAIL_CODE_ATTEMPT_EXHAUSTED_SIGN_IN": 5100,
|
|
"EMAIL_CODE_ATTEMPT_EXHAUSTED_SIGN_UP": 5102,
|
|
# Oauth
|
|
"OAUTH_NOT_CONFIGURED": 5104,
|
|
"GOOGLE_NOT_CONFIGURED": 5105,
|
|
"GITHUB_NOT_CONFIGURED": 5110,
|
|
"GITHUB_USER_NOT_IN_ORG": 5122,
|
|
"GITLAB_NOT_CONFIGURED": 5111,
|
|
"GITEA_NOT_CONFIGURED": 5112,
|
|
"GOOGLE_OAUTH_PROVIDER_ERROR": 5115,
|
|
"GITHUB_OAUTH_PROVIDER_ERROR": 5120,
|
|
"GITLAB_OAUTH_PROVIDER_ERROR": 5121,
|
|
"GITEA_OAUTH_PROVIDER_ERROR": 5123,
|
|
# Reset Password
|
|
"INVALID_PASSWORD_TOKEN": 5125,
|
|
"EXPIRED_PASSWORD_TOKEN": 5130,
|
|
# Change password
|
|
"INCORRECT_OLD_PASSWORD": 5135,
|
|
"MISSING_PASSWORD": 5138,
|
|
"INVALID_NEW_PASSWORD": 5140,
|
|
# set password
|
|
"PASSWORD_ALREADY_SET": 5145,
|
|
# Admin
|
|
"ADMIN_ALREADY_EXIST": 5150,
|
|
"REQUIRED_ADMIN_EMAIL_PASSWORD_FIRST_NAME": 5155,
|
|
"INVALID_ADMIN_EMAIL": 5160,
|
|
"INVALID_ADMIN_PASSWORD": 5165,
|
|
"REQUIRED_ADMIN_EMAIL_PASSWORD": 5170,
|
|
"ADMIN_AUTHENTICATION_FAILED": 5175,
|
|
"ADMIN_USER_ALREADY_EXIST": 5180,
|
|
"ADMIN_USER_DOES_NOT_EXIST": 5185,
|
|
"ADMIN_USER_DEACTIVATED": 5190,
|
|
# Rate limit
|
|
"RATE_LIMIT_EXCEEDED": 5900,
|
|
# Unknown
|
|
"AUTHENTICATION_FAILED": 5999,
|
|
# binarybeachio fork addition (Bucket-4 trusted-JWT entry-point) — see
|
|
# views/app/trusted.py and BINARYBEACHIO.md. Codes 6000-6099 are reserved
|
|
# for fork additions to keep them outside the upstream-allocated 5000-5999
|
|
# range and reduce upstream-merge collision risk.
|
|
"TRUSTED_JWT_ENDPOINT_DISABLED": 6000,
|
|
"TRUSTED_JWT_TOKEN_MISSING": 6001,
|
|
"TRUSTED_JWT_TOKEN_INVALID": 6002,
|
|
"TRUSTED_JWT_TOKEN_EXPIRED": 6003,
|
|
"TRUSTED_JWT_TOKEN_REPLAYED": 6004,
|
|
"TRUSTED_JWT_REPLAY_STORE_DOWN": 6005,
|
|
"TRUSTED_JWT_KEY_FETCH_FAILED": 6006,
|
|
}
|
|
|
|
|
|
class AuthenticationException(Exception):
|
|
error_code = None
|
|
error_message = None
|
|
payload = {}
|
|
|
|
def __init__(self, error_code, error_message, payload={}):
|
|
self.error_code = error_code
|
|
self.error_message = error_message
|
|
self.payload = payload
|
|
|
|
def get_error_dict(self):
|
|
error = {"error_code": self.error_code, "error_message": self.error_message}
|
|
for key in self.payload:
|
|
error[key] = self.payload[key]
|
|
|
|
return error
|