binarybeach
712612865d
Migrates this fork to the binarybeachio platform-architecture pivot: oauth2-proxy at the edge enforces a Zitadel session, the auth-bridge mints a short-lived RS256 JWT, and a NEW additive endpoint at /auth/sign-in-trusted/ verifies the JWT, claims its jti against shared-redis (single-use replay protection, fail-closed), find-or-creates the User, and starts a Django session via user_login(). Net surface vs. upstream-clean: 1 new view file + 1 url path + 1 exports __init__ entry + 7 reserved error codes (6000-6099 range). github.py and the GitHub-button rebrand patch are reverted to upstream — sign-in entry-point UX is now driven by Traefik redirectregex on /sign-in* in infrastructure/plane/docker-compose.yml. Replay protection contract: jti claim minted by bridge, consumed via Redis SETNX with ttl = exp - now + 30s. Documented at binarybeachio/docs/architecture/bridge-jwt-replay-protection.md. Public-key transport: BB_BRIDGE_PUBLIC_KEY_URL env points at the in-cluster bridge's /.well-known/bb-bridge.pub.pem (avoids the env-PEM corruption issue Coolify has with backslash-escaped keys). Endpoint is implicitly disabled (404) when env unset — vanilla upstream behavior preserved. Storage patches (Patch 2) unchanged. Brand asset preserved (dormant). Pre-migration source state preserved on branch pre-migration-2026-05-04. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
47 lines
1.7 KiB
Python
47 lines
1.7 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
from .common import ChangePasswordEndpoint, CSRFTokenEndpoint, SetUserPasswordEndpoint
|
|
|
|
from .app.check import EmailCheckEndpoint
|
|
|
|
from .app.email import SignInAuthEndpoint, SignUpAuthEndpoint
|
|
from .app.github import GitHubCallbackEndpoint, GitHubOauthInitiateEndpoint
|
|
from .app.gitlab import GitLabCallbackEndpoint, GitLabOauthInitiateEndpoint
|
|
from .app.gitea import GiteaCallbackEndpoint, GiteaOauthInitiateEndpoint
|
|
from .app.google import GoogleCallbackEndpoint, GoogleOauthInitiateEndpoint
|
|
from .app.magic import MagicGenerateEndpoint, MagicSignInEndpoint, MagicSignUpEndpoint
|
|
|
|
from .app.signout import SignOutAuthEndpoint
|
|
|
|
|
|
from .space.email import SignInAuthSpaceEndpoint, SignUpAuthSpaceEndpoint
|
|
|
|
from .space.github import GitHubCallbackSpaceEndpoint, GitHubOauthInitiateSpaceEndpoint
|
|
|
|
from .space.gitlab import GitLabCallbackSpaceEndpoint, GitLabOauthInitiateSpaceEndpoint
|
|
|
|
from .space.gitea import GiteaCallbackSpaceEndpoint, GiteaOauthInitiateSpaceEndpoint
|
|
|
|
from .space.google import GoogleCallbackSpaceEndpoint, GoogleOauthInitiateSpaceEndpoint
|
|
|
|
from .space.magic import (
|
|
MagicGenerateSpaceEndpoint,
|
|
MagicSignInSpaceEndpoint,
|
|
MagicSignUpSpaceEndpoint,
|
|
)
|
|
|
|
from .space.signout import SignOutAuthSpaceEndpoint
|
|
|
|
from .space.check import EmailCheckSpaceEndpoint
|
|
|
|
from .space.password_management import (
|
|
ForgotPasswordSpaceEndpoint,
|
|
ResetPasswordSpaceEndpoint,
|
|
)
|
|
from .app.password_management import ForgotPasswordEndpoint, ResetPasswordEndpoint
|
|
|
|
# binarybeachio fork addition (Bucket-4 trusted-JWT entry-point) — see
|
|
# views/app/trusted.py and BINARYBEACHIO.md.
|
|
from .app.trusted import TrustedSignInEndpoint
|