base

plane-src/apps/api/plane/authentication/__init__.py

@@ -0,0 +1,4 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+

plane-src/apps/api/plane/authentication/adapter/__init__.py

@@ -0,0 +1,4 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+

plane-src/apps/api/plane/authentication/adapter/base.py

@@ -0,0 +1,357 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import logging
+import os
+import uuid
+from io import BytesIO
+
+import requests
+from django.conf import settings
+from django.core.exceptions import ValidationError
+from django.core.validators import validate_email
+
+# Django imports
+from django.utils import timezone
+
+from plane.bgtasks.user_activation_email_task import user_activation_email
+
+# Module imports
+from plane.authentication.utils.password_validation import is_password_policy_valid
+from plane.db.models import FileAsset, Profile, User, WorkspaceMemberInvite
+from plane.license.utils.instance_value import get_configuration_value
+from plane.settings.storage import S3Storage
+from plane.utils.exception_logger import log_exception
+from plane.utils.host import base_host
+from plane.utils.ip_address import get_client_ip
+
+from .error import AUTHENTICATION_ERROR_CODES, AuthenticationException
+
+
+class Adapter:
+    """Common interface for all auth providers"""
+
+    def __init__(self, request, provider, callback=None):
+        self.request = request
+        self.provider = provider
+        self.callback = callback
+        self.token_data = None
+        self.user_data = None
+        self.logger = logging.getLogger("plane.authentication")
+
+    def get_user_token(self, data, headers=None):
+        raise NotImplementedError
+
+    def get_user_response(self):
+        raise NotImplementedError
+
+    def set_token_data(self, data):
+        self.token_data = data
+
+    def set_user_data(self, data):
+        self.user_data = data
+
+    def create_update_account(self, user):
+        raise NotImplementedError
+
+    def authenticate(self):
+        raise NotImplementedError
+
+    def sanitize_email(self, email):
+        # Check if email is present
+        if not email:
+            self.logger.error("Email is not present")
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
+                error_message="INVALID_EMAIL",
+                payload={"email": email},
+            )
+
+        # Sanitize email
+        email = str(email).lower().strip()
+
+        # validate email
+        try:
+            validate_email(email)
+        except ValidationError:
+            self.logger.warning(f"Email is not valid: {email}")
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
+                error_message="INVALID_EMAIL",
+                payload={"email": email},
+            )
+        # Return email
+        return email
+
+    def validate_password(self, email):
+        """Validate password strength"""
+        if not is_password_policy_valid(self.code):
+            self.logger.warning("Password is not strong enough")
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["PASSWORD_TOO_WEAK"],
+                error_message="PASSWORD_TOO_WEAK",
+                payload={"email": email},
+            )
+        return
+
+    def __check_signup(self, email):
+        """Check if sign up is enabled or not and raise exception if not enabled"""
+
+        # Get configuration value
+        (ENABLE_SIGNUP,) = get_configuration_value([
+            {"key": "ENABLE_SIGNUP", "default": os.environ.get("ENABLE_SIGNUP", "1")}
+        ])
+
+        # Check if sign up is disabled and invite is present or not
+        if ENABLE_SIGNUP == "0" and not WorkspaceMemberInvite.objects.filter(email=email).exists():
+            self.logger.warning("Sign up is disabled and invite is not present")
+            # Raise exception
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["SIGNUP_DISABLED"],
+                error_message="SIGNUP_DISABLED",
+                payload={"email": email},
+            )
+
+        return True
+
+    def get_avatar_download_headers(self):
+        return {}
+
+    def check_sync_enabled(self):
+        """Check if sync is enabled for the provider"""
+        provider_config_map = {
+            "google": "ENABLE_GOOGLE_SYNC",
+            "github": "ENABLE_GITHUB_SYNC",
+            "gitlab": "ENABLE_GITLAB_SYNC",
+            "gitea": "ENABLE_GITEA_SYNC",
+        }
+        config_key = provider_config_map.get(self.provider)
+        if config_key:
+            (enabled,) = get_configuration_value([{"key": config_key, "default": os.environ.get(config_key, "0")}])
+            return enabled == "1"
+        return False
+
+    def download_and_upload_avatar(self, avatar_url, user):
+        """
+        Downloads avatar from OAuth provider and uploads to our storage.
+        Returns the uploaded file path or None if failed.
+        """
+        if not avatar_url:
+            return None
+
+        try:
+            headers = self.get_avatar_download_headers()
+            # Download the avatar image
+            response = requests.get(avatar_url, timeout=10, headers=headers)
+            response.raise_for_status()
+
+            # Check content length before downloading
+            content_length = response.headers.get("Content-Length")
+            max_size = settings.DATA_UPLOAD_MAX_MEMORY_SIZE
+            if content_length and int(content_length) > max_size:
+                return None
+
+            # Get content type and determine file extension
+            content_type = response.headers.get("Content-Type", "image/jpeg")
+            extension_map = {
+                "image/jpeg": "jpg",
+                "image/jpg": "jpg",
+                "image/png": "png",
+                "image/gif": "gif",
+                "image/webp": "webp",
+            }
+            extension = extension_map.get(content_type)
+
+            if not extension:
+                return None
+
+            # Download with size limit
+            chunks = []
+            total_size = 0
+            for chunk in response.iter_content(chunk_size=8192):
+                total_size += len(chunk)
+                if total_size > max_size:
+                    return None
+                chunks.append(chunk)
+            content = b"".join(chunks)
+            file_size = len(content)
+
+            # Generate unique filename
+            filename = f"{uuid.uuid4().hex}-user-avatar.{extension}"
+
+            storage = S3Storage(request=self.request)
+
+            # Create file-like object
+            file_obj = BytesIO(response.content)
+            file_obj.seek(0)
+
+            # Upload using boto3 directly
+            upload_success = storage.upload_file(file_obj=file_obj, object_name=filename, content_type=content_type)
+            if not upload_success:
+                return None
+
+            # Get storage metadata
+            storage_metadata = storage.get_object_metadata(object_name=filename)
+
+            # Create FileAsset record
+            file_asset = FileAsset.objects.create(
+                attributes={"name": f"{self.provider}-avatar.{extension}", "type": content_type, "size": file_size},
+                asset=filename,
+                size=file_size,
+                user=user,
+                created_by=user,
+                entity_type=FileAsset.EntityTypeContext.USER_AVATAR,
+                is_uploaded=True,
+                storage_metadata=storage_metadata,
+            )
+
+            return file_asset
+
+        except Exception as e:
+            log_exception(e)
+            # Return None if upload fails, so original URL can be used as fallback
+            return None
+
+    def save_user_data(self, user):
+        # Update user details
+        user.last_login_medium = self.provider
+        user.last_active = timezone.now()
+        user.last_login_time = timezone.now()
+        user.last_login_ip = get_client_ip(request=self.request)
+        user.last_login_uagent = self.request.META.get("HTTP_USER_AGENT")
+        user.token_updated_at = timezone.now()
+        # If user is not active, send the activation email and set the user as active
+        if not user.is_active:
+            user_activation_email.delay(base_host(request=self.request), user.id)
+        # Set user as active
+        user.is_active = True
+        user.save()
+        return user
+
+    def delete_old_avatar(self, user):
+        """Delete the old avatar if it exists"""
+        try:
+            if user.avatar_asset:
+                asset = FileAsset.objects.get(pk=user.avatar_asset_id)
+                storage = S3Storage(request=self.request)
+                storage.delete_files(object_names=[asset.asset.name])
+
+                # Delete the user avatar
+                asset.delete()
+                user.avatar_asset = None
+                user.avatar = ""
+                user.save()
+            return
+        except FileAsset.DoesNotExist:
+            pass
+        except Exception as e:
+            log_exception(e)
+            return
+
+    def sync_user_data(self, user):
+        # Update user details
+        first_name = self.user_data.get("user", {}).get("first_name", "")
+        last_name = self.user_data.get("user", {}).get("last_name", "")
+        user.first_name = first_name if first_name else ""
+        user.last_name = last_name if last_name else ""
+
+        # Get email
+        email = self.user_data.get("email")
+
+        # Get display name
+        display_name = self.user_data.get("user", {}).get("display_name")
+        # If display name is not provided, generate a random display name
+        if not display_name:
+            display_name = User.get_display_name(email)
+
+        # Set display name
+        user.display_name = display_name
+
+        # Download and upload avatar only if the avatar is different from the one in the storage
+        avatar = self.user_data.get("user", {}).get("avatar", "")
+        # Delete the old avatar if it exists
+        self.delete_old_avatar(user=user)
+        avatar_asset = self.download_and_upload_avatar(avatar_url=avatar, user=user)
+        if avatar_asset:
+            user.avatar_asset = avatar_asset
+        # If avatar upload fails, set the avatar to the original URL
+        else:
+            user.avatar = avatar
+
+        user.save()
+        return user
+
+    def complete_login_or_signup(self):
+        # Get email
+        email = self.user_data.get("email")
+
+        # Sanitize email
+        email = self.sanitize_email(email)
+
+        # Check if the user is present
+        user = User.objects.filter(email=email).first()
+        # Check if sign up case or login
+        is_signup = bool(user)
+        # If user is not present, create a new user
+        if not user:
+            # New user
+            self.__check_signup(email)
+
+            # Initialize user
+            user = User(email=email, username=uuid.uuid4().hex)
+
+            # Check if password is autoset
+            if self.user_data.get("user").get("is_password_autoset"):
+                user.set_password(uuid.uuid4().hex)
+                user.is_password_autoset = True
+                user.is_email_verified = True
+
+            # Validate password
+            else:
+                # Validate password
+                self.validate_password(email)
+                # Set password
+                user.set_password(self.code)
+                user.is_password_autoset = False
+
+            # Set user details
+            first_name = self.user_data.get("user", {}).get("first_name", "")
+            last_name = self.user_data.get("user", {}).get("last_name", "")
+            user.first_name = first_name if first_name else ""
+            user.last_name = last_name if last_name else ""
+
+            user.save()
+
+            # Download and upload avatar
+            avatar = self.user_data.get("user", {}).get("avatar", "")
+            if avatar:
+                avatar_asset = self.download_and_upload_avatar(avatar_url=avatar, user=user)
+                if avatar_asset:
+                    user.avatar_asset = avatar_asset
+                    user.avatar = avatar
+                # If avatar upload fails, set the avatar to the original URL
+                else:
+                    user.avatar = avatar
+
+            # Create profile
+            Profile.objects.create(user=user)
+
+        # Check if IDP sync is enabled and user is not signing up
+        if self.check_sync_enabled() and not is_signup:
+            user = self.sync_user_data(user=user)
+
+        # Save user data
+        user = self.save_user_data(user=user)
+
+        # Call callback if present
+        if self.callback:
+            self.callback(user, is_signup, self.request)
+
+        # Create or update account if token data is present
+        if self.token_data:
+            self.create_update_account(user=user)
+
+        # Return user
+        return user

plane-src/apps/api/plane/authentication/adapter/credential.py

@@ -0,0 +1,18 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from plane.authentication.adapter.base import Adapter
+
+
+class CredentialAdapter(Adapter):
+    """Common interface for all credential providers"""
+
+    def __init__(self, request, provider, callback=None):
+        super().__init__(request=request, provider=provider, callback=callback)
+        self.request = request
+        self.provider = provider
+
+    def authenticate(self):
+        self.set_user_data()
+        return self.complete_login_or_signup()

plane-src/apps/api/plane/authentication/adapter/error.py

@@ -0,0 +1,92 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+AUTHENTICATION_ERROR_CODES = {
+    # Global
+    "INSTANCE_NOT_CONFIGURED": 5000,
+    "INVALID_EMAIL": 5005,
+    "EMAIL_REQUIRED": 5010,
+    "SIGNUP_DISABLED": 5015,
+    "MAGIC_LINK_LOGIN_DISABLED": 5016,
+    "PASSWORD_LOGIN_DISABLED": 5018,
+    "USER_ACCOUNT_DEACTIVATED": 5019,
+    # Password strength
+    "INVALID_PASSWORD": 5020,
+    "PASSWORD_TOO_WEAK": 5021,
+    "SMTP_NOT_CONFIGURED": 5025,
+    # Sign Up
+    "USER_ALREADY_EXIST": 5030,
+    "AUTHENTICATION_FAILED_SIGN_UP": 5035,
+    "REQUIRED_EMAIL_PASSWORD_SIGN_UP": 5040,
+    "INVALID_EMAIL_SIGN_UP": 5045,
+    "INVALID_EMAIL_MAGIC_SIGN_UP": 5050,
+    "MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED": 5055,
+    "EMAIL_PASSWORD_AUTHENTICATION_DISABLED": 5056,
+    # Sign In
+    "USER_DOES_NOT_EXIST": 5060,
+    "AUTHENTICATION_FAILED_SIGN_IN": 5065,
+    "REQUIRED_EMAIL_PASSWORD_SIGN_IN": 5070,
+    "INVALID_EMAIL_SIGN_IN": 5075,
+    "INVALID_EMAIL_MAGIC_SIGN_IN": 5080,
+    "MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED": 5085,
+    # Both Sign in and Sign up for magic
+    "INVALID_MAGIC_CODE_SIGN_IN": 5090,
+    "INVALID_MAGIC_CODE_SIGN_UP": 5092,
+    "EXPIRED_MAGIC_CODE_SIGN_IN": 5095,
+    "EXPIRED_MAGIC_CODE_SIGN_UP": 5097,
+    "EMAIL_CODE_ATTEMPT_EXHAUSTED_SIGN_IN": 5100,
+    "EMAIL_CODE_ATTEMPT_EXHAUSTED_SIGN_UP": 5102,
+    # Oauth
+    "OAUTH_NOT_CONFIGURED": 5104,
+    "GOOGLE_NOT_CONFIGURED": 5105,
+    "GITHUB_NOT_CONFIGURED": 5110,
+    "GITHUB_USER_NOT_IN_ORG": 5122,
+    "GITLAB_NOT_CONFIGURED": 5111,
+    "GITEA_NOT_CONFIGURED": 5112,
+    "GOOGLE_OAUTH_PROVIDER_ERROR": 5115,
+    "GITHUB_OAUTH_PROVIDER_ERROR": 5120,
+    "GITLAB_OAUTH_PROVIDER_ERROR": 5121,
+    "GITEA_OAUTH_PROVIDER_ERROR": 5123,
+    # Reset Password
+    "INVALID_PASSWORD_TOKEN": 5125,
+    "EXPIRED_PASSWORD_TOKEN": 5130,
+    # Change password
+    "INCORRECT_OLD_PASSWORD": 5135,
+    "MISSING_PASSWORD": 5138,
+    "INVALID_NEW_PASSWORD": 5140,
+    # set password
+    "PASSWORD_ALREADY_SET": 5145,
+    # Admin
+    "ADMIN_ALREADY_EXIST": 5150,
+    "REQUIRED_ADMIN_EMAIL_PASSWORD_FIRST_NAME": 5155,
+    "INVALID_ADMIN_EMAIL": 5160,
+    "INVALID_ADMIN_PASSWORD": 5165,
+    "REQUIRED_ADMIN_EMAIL_PASSWORD": 5170,
+    "ADMIN_AUTHENTICATION_FAILED": 5175,
+    "ADMIN_USER_ALREADY_EXIST": 5180,
+    "ADMIN_USER_DOES_NOT_EXIST": 5185,
+    "ADMIN_USER_DEACTIVATED": 5190,
+    # Rate limit
+    "RATE_LIMIT_EXCEEDED": 5900,
+    # Unknown
+    "AUTHENTICATION_FAILED": 5999,
+}
+
+
+class AuthenticationException(Exception):
+    error_code = None
+    error_message = None
+    payload = {}
+
+    def __init__(self, error_code, error_message, payload={}):
+        self.error_code = error_code
+        self.error_message = error_message
+        self.payload = payload
+
+    def get_error_dict(self):
+        error = {"error_code": self.error_code, "error_message": self.error_message}
+        for key in self.payload:
+            error[key] = self.payload[key]
+
+        return error

plane-src/apps/api/plane/authentication/adapter/exception.py

@@ -0,0 +1,34 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third party imports
+from rest_framework.views import exception_handler
+from rest_framework.exceptions import NotAuthenticated
+from rest_framework.exceptions import Throttled
+
+# Module imports
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+
+
+def auth_exception_handler(exc, context):
+    # Call the default exception handler first, to get the standard error response.
+    response = exception_handler(exc, context)
+    # Check if an AuthenticationFailed exception is raised.
+    if isinstance(exc, NotAuthenticated):
+        response.status_code = 401
+
+    # Check if an Throttled exception is raised.
+    if isinstance(exc, Throttled):
+        exc = AuthenticationException(
+            error_code=AUTHENTICATION_ERROR_CODES["RATE_LIMIT_EXCEEDED"],
+            error_message="RATE_LIMIT_EXCEEDED",
+        )
+        response.data = exc.get_error_dict()
+        response.status_code = 429
+
+    # Return the response that is generated by the default exception handler.
+    return response

plane-src/apps/api/plane/authentication/adapter/oauth.py

@@ -0,0 +1,136 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import requests
+from django.db import DatabaseError, IntegrityError
+
+# Django imports
+from django.utils import timezone
+
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+
+# Module imports
+from plane.db.models import Account
+from plane.utils.exception_logger import log_exception
+
+from .base import Adapter
+
+
+class OauthAdapter(Adapter):
+    def __init__(
+        self,
+        request,
+        provider,
+        client_id,
+        scope,
+        redirect_uri,
+        auth_url,
+        token_url,
+        userinfo_url,
+        client_secret=None,
+        code=None,
+        callback=None,
+    ):
+        super().__init__(request=request, provider=provider, callback=callback)
+        self.client_id = client_id
+        self.scope = scope
+        self.redirect_uri = redirect_uri
+        self.auth_url = auth_url
+        self.token_url = token_url
+        self.userinfo_url = userinfo_url
+        self.client_secret = client_secret
+        self.code = code
+
+    def authentication_error_code(self):
+        if self.provider == "google":
+            return "GOOGLE_OAUTH_PROVIDER_ERROR"
+        elif self.provider == "github":
+            return "GITHUB_OAUTH_PROVIDER_ERROR"
+        elif self.provider == "gitlab":
+            return "GITLAB_OAUTH_PROVIDER_ERROR"
+        elif self.provider == "gitea":
+            return "GITEA_OAUTH_PROVIDER_ERROR"
+        else:
+            return "OAUTH_NOT_CONFIGURED"
+
+    def get_auth_url(self):
+        return self.auth_url
+
+    def get_token_url(self):
+        return self.token_url
+
+    def get_user_info_url(self):
+        return self.userinfo_url
+
+    def authenticate(self):
+        self.set_token_data()
+        self.set_user_data()
+        return self.complete_login_or_signup()
+
+    def get_user_token(self, data, headers=None):
+        try:
+            headers = headers or {}
+            response = requests.post(self.get_token_url(), data=data, headers=headers)
+            response.raise_for_status()
+            return response.json()
+        except requests.RequestException:
+            self.logger.warning("Error getting user token")
+            code = self.authentication_error_code()
+            raise AuthenticationException(error_code=AUTHENTICATION_ERROR_CODES[code], error_message=str(code))
+
+    def get_user_response(self):
+        try:
+            headers = {"Authorization": f"Bearer {self.token_data.get('access_token')}"}
+            response = requests.get(self.get_user_info_url(), headers=headers)
+            response.raise_for_status()
+            return response.json()
+        except requests.RequestException:
+            self.logger.warning(
+                "Error getting user response",
+                extra={
+                    "headers": headers,
+                },
+            )
+            code = self.authentication_error_code()
+            raise AuthenticationException(error_code=AUTHENTICATION_ERROR_CODES[code], error_message=str(code))
+
+    def set_user_data(self, data):
+        self.user_data = data
+
+    def create_update_account(self, user):
+        try:
+            # Check if the account already exists
+            account = Account.objects.filter(
+                user=user,
+                provider=self.provider,
+                provider_account_id=self.user_data.get("user").get("provider_id"),
+            ).first()
+            # Update the account if it exists
+            if account:
+                account.access_token = self.token_data.get("access_token")
+                account.refresh_token = self.token_data.get("refresh_token", None)
+                account.access_token_expired_at = self.token_data.get("access_token_expired_at")
+                account.refresh_token_expired_at = self.token_data.get("refresh_token_expired_at")
+                account.last_connected_at = timezone.now()
+                account.id_token = self.token_data.get("id_token", "")
+                account.save()
+            # Create a new account if it does not exist
+            else:
+                Account.objects.create(
+                    user=user,
+                    provider=self.provider,
+                    provider_account_id=self.user_data.get("user", {}).get("provider_id"),
+                    access_token=self.token_data.get("access_token"),
+                    refresh_token=self.token_data.get("refresh_token", None),
+                    access_token_expired_at=self.token_data.get("access_token_expired_at"),
+                    refresh_token_expired_at=self.token_data.get("refresh_token_expired_at"),
+                    last_connected_at=timezone.now(),
+                    id_token=self.token_data.get("id_token", ""),
+                )
+        except (DatabaseError, IntegrityError) as e:
+            log_exception(e)

plane-src/apps/api/plane/authentication/apps.py

@@ -0,0 +1,9 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from django.apps import AppConfig
+
+
+class AuthConfig(AppConfig):
+    name = "plane.authentication"

plane-src/apps/api/plane/authentication/middleware/__init__.py

@@ -0,0 +1,4 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+

plane-src/apps/api/plane/authentication/middleware/session.py

@@ -0,0 +1,92 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+import time
+from importlib import import_module
+
+from django.conf import settings
+from django.contrib.sessions.backends.base import UpdateError
+from django.contrib.sessions.exceptions import SessionInterrupted
+from django.utils.cache import patch_vary_headers
+from django.utils.deprecation import MiddlewareMixin
+from django.utils.http import http_date
+
+
+class SessionMiddleware(MiddlewareMixin):
+    def __init__(self, get_response):
+        super().__init__(get_response)
+        engine = import_module(settings.SESSION_ENGINE)
+        self.SessionStore = engine.SessionStore
+
+    def process_request(self, request):
+        if "instances" in request.path:
+            session_key = request.COOKIES.get(settings.ADMIN_SESSION_COOKIE_NAME)
+        else:
+            session_key = request.COOKIES.get(settings.SESSION_COOKIE_NAME)
+        request.session = self.SessionStore(session_key)
+
+    def process_response(self, request, response):
+        """
+        If request.session was modified, or if the configuration is to save the
+        session every time, save the changes and set a session cookie or delete
+        the session cookie if the session has been emptied.
+        """
+        try:
+            accessed = request.session.accessed
+            modified = request.session.modified
+            empty = request.session.is_empty()
+        except AttributeError:
+            return response
+        # First check if we need to delete this cookie.
+        # The session should be deleted only if the session is entirely empty.
+        is_admin_path = "instances" in request.path
+        cookie_name = settings.ADMIN_SESSION_COOKIE_NAME if is_admin_path else settings.SESSION_COOKIE_NAME
+
+        if cookie_name in request.COOKIES and empty:
+            response.delete_cookie(
+                cookie_name,
+                path=settings.SESSION_COOKIE_PATH,
+                domain=settings.SESSION_COOKIE_DOMAIN,
+                samesite=settings.SESSION_COOKIE_SAMESITE,
+            )
+            patch_vary_headers(response, ("Cookie",))
+        else:
+            if accessed:
+                patch_vary_headers(response, ("Cookie",))
+            if (modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty:
+                if request.session.get_expire_at_browser_close():
+                    max_age = None
+                    expires = None
+                else:
+                    # Use different max_age based on whether it's an admin cookie
+                    if is_admin_path:
+                        max_age = settings.ADMIN_SESSION_COOKIE_AGE
+                    else:
+                        max_age = request.session.get_expiry_age()
+
+                    expires_time = time.time() + max_age
+                    expires = http_date(expires_time)
+
+                # Save the session data and refresh the client cookie.
+                if response.status_code < 500:
+                    try:
+                        request.session.save()
+                    except UpdateError:
+                        raise SessionInterrupted(
+                            "The request's session was deleted before the "
+                            "request completed. The user may have logged "
+                            "out in a concurrent request, for example."
+                        )
+                    response.set_cookie(
+                        cookie_name,
+                        request.session.session_key,
+                        max_age=max_age,
+                        expires=expires,
+                        domain=settings.SESSION_COOKIE_DOMAIN,
+                        path=settings.SESSION_COOKIE_PATH,
+                        secure=settings.SESSION_COOKIE_SECURE or None,
+                        httponly=settings.SESSION_COOKIE_HTTPONLY or None,
+                        samesite=settings.SESSION_COOKIE_SAMESITE,
+                    )
+        return response

plane-src/apps/api/plane/authentication/provider/__init__.py

@@ -0,0 +1,4 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+

plane-src/apps/api/plane/authentication/provider/credentials/__init__.py

@@ -0,0 +1,4 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+

plane-src/apps/api/plane/authentication/provider/credentials/email.py

@@ -0,0 +1,96 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import os
+
+# Module imports
+from plane.authentication.adapter.credential import CredentialAdapter
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.db.models import User
+from plane.license.utils.instance_value import get_configuration_value
+
+
+class EmailProvider(CredentialAdapter):
+    provider = "email"
+
+    def __init__(self, request, key=None, code=None, is_signup=False, callback=None):
+        super().__init__(request=request, provider=self.provider, callback=callback)
+        self.key = key
+        self.code = code
+        self.is_signup = is_signup
+
+        (ENABLE_EMAIL_PASSWORD,) = get_configuration_value([
+            {
+                "key": "ENABLE_EMAIL_PASSWORD",
+                "default": os.environ.get("ENABLE_EMAIL_PASSWORD"),
+            }
+        ])
+
+        if ENABLE_EMAIL_PASSWORD == "0":
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["EMAIL_PASSWORD_AUTHENTICATION_DISABLED"],
+                error_message="EMAIL_PASSWORD_AUTHENTICATION_DISABLED",
+            )
+
+    def set_user_data(self):
+        if self.is_signup:
+            # Check if the user already exists
+            if User.objects.filter(email=self.key).exists():
+                self.logger.warning("User already exists")
+                raise AuthenticationException(
+                    error_message="USER_ALREADY_EXIST",
+                    error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
+                )
+
+            super().set_user_data({
+                "email": self.key,
+                "user": {
+                    "avatar": "",
+                    "first_name": "",
+                    "last_name": "",
+                    "provider_id": "",
+                    "is_password_autoset": False,
+                },
+            })
+            return
+        else:
+            user = User.objects.filter(email=self.key).first()
+
+            # User does not exists
+            if not user:
+                self.logger.warning("User does not exist")
+                raise AuthenticationException(
+                    error_message="USER_DOES_NOT_EXIST",
+                    error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+                    payload={"email": self.key},
+                )
+
+            # Check user password
+            if not user.check_password(self.code):
+                self.logger.warning("Authentication failed - invalid credentials")
+                raise AuthenticationException(
+                    error_message=(
+                        "AUTHENTICATION_FAILED_SIGN_UP" if self.is_signup else "AUTHENTICATION_FAILED_SIGN_IN"
+                    ),
+                    error_code=AUTHENTICATION_ERROR_CODES[
+                        ("AUTHENTICATION_FAILED_SIGN_UP" if self.is_signup else "AUTHENTICATION_FAILED_SIGN_IN")
+                    ],
+                    payload={"email": self.key},
+                )
+
+            super().set_user_data({
+                "email": self.key,
+                "user": {
+                    "avatar": "",
+                    "first_name": "",
+                    "last_name": "",
+                    "provider_id": "",
+                    "is_password_autoset": False,
+                },
+            })
+            return

plane-src/apps/api/plane/authentication/provider/credentials/magic_code.py

@@ -0,0 +1,147 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import json
+import os
+import secrets
+
+
+# Module imports
+from plane.authentication.adapter.credential import CredentialAdapter
+from plane.license.utils.instance_value import get_configuration_value
+from plane.settings.redis import redis_instance
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.db.models import User
+
+
+class MagicCodeProvider(CredentialAdapter):
+    provider = "magic-code"
+
+    def __init__(self, request, key, code=None, callback=None):
+        (EMAIL_HOST, ENABLE_MAGIC_LINK_LOGIN) = get_configuration_value(
+            [
+                {"key": "EMAIL_HOST", "default": os.environ.get("EMAIL_HOST")},
+                {
+                    "key": "ENABLE_MAGIC_LINK_LOGIN",
+                    "default": os.environ.get("ENABLE_MAGIC_LINK_LOGIN", "1"),
+                },
+            ]
+        )
+
+        if not (EMAIL_HOST):
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["SMTP_NOT_CONFIGURED"],
+                error_message="SMTP_NOT_CONFIGURED",
+                payload={"email": str(key)},
+            )
+
+        if ENABLE_MAGIC_LINK_LOGIN == "0":
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["MAGIC_LINK_LOGIN_DISABLED"],
+                error_message="MAGIC_LINK_LOGIN_DISABLED",
+                payload={"email": str(key)},
+            )
+
+        super().__init__(request=request, provider=self.provider, callback=callback)
+        self.key = key
+        self.code = code
+
+    def initiate(self):
+        ## Generate a random token
+        token = str(secrets.randbelow(900000) + 100000)
+
+        ri = redis_instance()
+
+        key = "magic_" + str(self.key)
+
+        # Check if the key already exists in python
+        if ri.exists(key):
+            data = json.loads(ri.get(key))
+
+            current_attempt = data["current_attempt"] + 1
+
+            if data["current_attempt"] > 2:
+                email = str(self.key).replace("magic_", "", 1)
+                if User.objects.filter(email=email).exists():
+                    raise AuthenticationException(
+                        error_code=AUTHENTICATION_ERROR_CODES["EMAIL_CODE_ATTEMPT_EXHAUSTED_SIGN_IN"],
+                        error_message="EMAIL_CODE_ATTEMPT_EXHAUSTED_SIGN_IN",
+                        payload={"email": str(email)},
+                    )
+                else:
+                    raise AuthenticationException(
+                        error_code=AUTHENTICATION_ERROR_CODES["EMAIL_CODE_ATTEMPT_EXHAUSTED_SIGN_UP"],
+                        error_message="EMAIL_CODE_ATTEMPT_EXHAUSTED_SIGN_UP",
+                        payload={"email": self.key},
+                    )
+
+            value = {
+                "current_attempt": current_attempt,
+                "email": str(self.key),
+                "token": token,
+            }
+            expiry = 600
+            ri.set(key, json.dumps(value), ex=expiry)
+        else:
+            value = {"current_attempt": 0, "email": self.key, "token": token}
+            expiry = 600
+
+            ri.set(key, json.dumps(value), ex=expiry)
+        return key, token
+
+    def set_user_data(self):
+        ri = redis_instance()
+        if ri.exists(self.key):
+            data = json.loads(ri.get(self.key))
+            token = data["token"]
+            email = data["email"]
+
+            if str(token) == str(self.code):
+                super().set_user_data(
+                    {
+                        "email": email,
+                        "user": {
+                            "avatar": "",
+                            "first_name": "",
+                            "last_name": "",
+                            "provider_id": "",
+                            "is_password_autoset": True,
+                        },
+                    }
+                )
+                # Delete the token from redis if the code match is successful
+                ri.delete(self.key)
+                return
+            else:
+                email = str(self.key).replace("magic_", "", 1)
+                if User.objects.filter(email=email).exists():
+                    raise AuthenticationException(
+                        error_code=AUTHENTICATION_ERROR_CODES["INVALID_MAGIC_CODE_SIGN_IN"],
+                        error_message="INVALID_MAGIC_CODE_SIGN_IN",
+                        payload={"email": str(email)},
+                    )
+                else:
+                    raise AuthenticationException(
+                        error_code=AUTHENTICATION_ERROR_CODES["INVALID_MAGIC_CODE_SIGN_UP"],
+                        error_message="INVALID_MAGIC_CODE_SIGN_UP",
+                        payload={"email": str(email)},
+                    )
+        else:
+            email = str(self.key).replace("magic_", "", 1)
+            if User.objects.filter(email=email).exists():
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["EXPIRED_MAGIC_CODE_SIGN_IN"],
+                    error_message="EXPIRED_MAGIC_CODE_SIGN_IN",
+                    payload={"email": str(email)},
+                )
+            else:
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["EXPIRED_MAGIC_CODE_SIGN_UP"],
+                    error_message="EXPIRED_MAGIC_CODE_SIGN_UP",
+                    payload={"email": str(email)},
+                )

plane-src/apps/api/plane/authentication/provider/oauth/__init__.py

@@ -0,0 +1,4 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+

plane-src/apps/api/plane/authentication/provider/oauth/gitea.py

@@ -0,0 +1,173 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+import os
+from datetime import datetime, timedelta
+from urllib.parse import urlencode, urlparse
+import pytz
+import requests
+
+# Module imports
+from plane.authentication.adapter.oauth import OauthAdapter
+from plane.license.utils.instance_value import get_configuration_value
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+
+
+class GiteaOAuthProvider(OauthAdapter):
+    provider = "gitea"
+    scope = "openid email profile"
+
+    def __init__(self, request, code=None, state=None, callback=None):
+        (GITEA_CLIENT_ID, GITEA_CLIENT_SECRET, GITEA_HOST) = get_configuration_value(
+            [
+                {
+                    "key": "GITEA_CLIENT_ID",
+                    "default": os.environ.get("GITEA_CLIENT_ID"),
+                },
+                {
+                    "key": "GITEA_CLIENT_SECRET",
+                    "default": os.environ.get("GITEA_CLIENT_SECRET"),
+                },
+                {
+                    "key": "GITEA_HOST",
+                    "default": os.environ.get("GITEA_HOST"),
+                },
+            ]
+        )
+
+        if not (GITEA_CLIENT_ID and GITEA_CLIENT_SECRET and GITEA_HOST):
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITEA_NOT_CONFIGURED"],
+                error_message="GITEA_NOT_CONFIGURED",
+            )
+
+        # Enforce scheme and normalize trailing slash(es)
+        parsed = urlparse(GITEA_HOST)
+        if not parsed.scheme or parsed.scheme not in ("https", "http"):
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITEA_NOT_CONFIGURED"],
+                error_message="GITEA_NOT_CONFIGURED",  # avoid leaking details to query params
+            )
+        GITEA_HOST = GITEA_HOST.rstrip("/")
+
+        # Set URLs based on the host
+        self.token_url = f"{GITEA_HOST}/login/oauth/access_token"
+        self.userinfo_url = f"{GITEA_HOST}/api/v1/user"
+
+        client_id = GITEA_CLIENT_ID
+        client_secret = GITEA_CLIENT_SECRET
+
+        redirect_uri = f"{'https' if request.is_secure() else 'http'}://{request.get_host()}/auth/gitea/callback/"
+        url_params = {
+            "client_id": client_id,
+            "scope": self.scope,
+            "redirect_uri": redirect_uri,
+            "response_type": "code",
+            "state": state,
+        }
+        auth_url = f"{GITEA_HOST}/login/oauth/authorize?{urlencode(url_params)}"
+
+        super().__init__(
+            request,
+            self.provider,
+            client_id,
+            self.scope,
+            redirect_uri,
+            auth_url,
+            self.token_url,
+            self.userinfo_url,
+            client_secret,
+            code,
+            callback=callback,
+        )
+
+    def set_token_data(self):
+        data = {
+            "code": self.code,
+            "client_id": self.client_id,
+            "client_secret": self.client_secret,
+            "redirect_uri": self.redirect_uri,
+            "grant_type": "authorization_code",
+        }
+        headers = {"Accept": "application/json"}
+        token_response = self.get_user_token(data=data, headers=headers)
+        super().set_token_data(
+            {
+                "access_token": token_response.get("access_token"),
+                "refresh_token": token_response.get("refresh_token", None),
+                "access_token_expired_at": (
+                    datetime.now(tz=pytz.utc) + timedelta(seconds=token_response.get("expires_in"))
+                    if token_response.get("expires_in")
+                    else None
+                ),
+                "refresh_token_expired_at": (
+                    datetime.fromtimestamp(token_response.get("refresh_token_expired_at"), tz=pytz.utc)
+                    if token_response.get("refresh_token_expired_at")
+                    else None
+                ),
+                "id_token": token_response.get("id_token", ""),
+            }
+        )
+
+    def __get_email(self, headers):
+        try:
+            # Gitea may not provide email in user response, so fetch it separately
+            emails_url = f"{self.userinfo_url}/emails"
+            response = requests.get(emails_url, headers=headers)
+            if not response.ok:
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["GITEA_OAUTH_PROVIDER_ERROR"],
+                    error_message="GITEA_OAUTH_PROVIDER_ERROR: Failed to fetch emails",
+                )
+            emails_response = response.json()
+
+            if not emails_response:
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["GITEA_OAUTH_PROVIDER_ERROR"],
+                    error_message="GITEA_OAUTH_PROVIDER_ERROR: No emails found",
+                )
+            # Prefer primary+verified, then any verified, then primary, else first
+            email = next((e.get("email") for e in emails_response if e.get("primary") and e.get("verified")), None)
+            if not email:
+                email = next((e.get("email") for e in emails_response if e.get("verified")), None)
+            if not email:
+                email = next((e.get("email") for e in emails_response if e.get("primary")), None)
+            if not email and emails_response:
+                # If no primary email, use the first one
+                email = emails_response[0].get("email")
+            return email
+        except requests.RequestException:
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITEA_OAUTH_PROVIDER_ERROR"],
+                error_message="GITEA_OAUTH_PROVIDER_ERROR: Exception occurred while fetching emails",
+            )
+
+    def set_user_data(self):
+        user_info_response = self.get_user_response()
+        headers = {
+            "Authorization": f"Bearer {self.token_data.get('access_token')}",
+            "Accept": "application/json",
+        }
+
+        # Get email if not provided in user info
+        email = user_info_response.get("email")
+        if not email:
+            email = self.__get_email(headers=headers)
+
+        super().set_user_data(
+            {
+                "email": email,
+                "user": {
+                    "provider_id": str(user_info_response.get("id")),
+                    "email": email,
+                    "avatar": user_info_response.get("avatar_url"),
+                    "first_name": user_info_response.get("full_name") or user_info_response.get("login"),
+                    "last_name": "",  # Gitea doesn't provide separate first/last name
+                    "is_password_autoset": True,
+                },
+            }
+        )

plane-src/apps/api/plane/authentication/provider/oauth/github.py

@@ -0,0 +1,183 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import os
+from datetime import datetime
+from urllib.parse import urlencode
+
+import pytz
+import requests
+
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+
+# Module imports
+from plane.authentication.adapter.oauth import OauthAdapter
+from plane.license.utils.instance_value import get_configuration_value
+
+
+class GitHubOAuthProvider(OauthAdapter):
+    token_url = "https://github.com/login/oauth/access_token"
+    userinfo_url = "https://api.github.com/user"
+    org_membership_url = "https://api.github.com/orgs"
+
+    provider = "github"
+    scope = "read:user user:email"
+
+    organization_scope = "read:org"
+
+    def __init__(self, request, code=None, state=None, callback=None):
+        GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, GITHUB_ORGANIZATION_ID = get_configuration_value([
+            {
+                "key": "GITHUB_CLIENT_ID",
+                "default": os.environ.get("GITHUB_CLIENT_ID"),
+            },
+            {
+                "key": "GITHUB_CLIENT_SECRET",
+                "default": os.environ.get("GITHUB_CLIENT_SECRET"),
+            },
+            {
+                "key": "GITHUB_ORGANIZATION_ID",
+                "default": os.environ.get("GITHUB_ORGANIZATION_ID"),
+            },
+        ])
+
+        if not (GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET):
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITHUB_NOT_CONFIGURED"],
+                error_message="GITHUB_NOT_CONFIGURED",
+            )
+
+        client_id = GITHUB_CLIENT_ID
+        client_secret = GITHUB_CLIENT_SECRET
+        self.organization_id = GITHUB_ORGANIZATION_ID
+
+        if self.organization_id:
+            self.scope += f" {self.organization_scope}"
+
+        redirect_uri = f"""{"https" if request.is_secure() else "http"}://{request.get_host()}/auth/github/callback/"""
+        url_params = {
+            "client_id": client_id,
+            "redirect_uri": redirect_uri,
+            "scope": self.scope,
+            "state": state,
+        }
+        auth_url = f"https://github.com/login/oauth/authorize?{urlencode(url_params)}"
+        super().__init__(
+            request,
+            self.provider,
+            client_id,
+            self.scope,
+            redirect_uri,
+            auth_url,
+            self.token_url,
+            self.userinfo_url,
+            client_secret,
+            code,
+            callback=callback,
+        )
+
+    def set_token_data(self):
+        data = {
+            "client_id": self.client_id,
+            "client_secret": self.client_secret,
+            "code": self.code,
+            "redirect_uri": self.redirect_uri,
+        }
+        token_response = self.get_user_token(data=data, headers={"Accept": "application/json"})
+        super().set_token_data({
+            "access_token": token_response.get("access_token"),
+            "refresh_token": token_response.get("refresh_token", None),
+            "access_token_expired_at": (
+                datetime.fromtimestamp(token_response.get("expires_in"), tz=pytz.utc)
+                if token_response.get("expires_in")
+                else None
+            ),
+            "refresh_token_expired_at": (
+                datetime.fromtimestamp(token_response.get("refresh_token_expired_at"), tz=pytz.utc)
+                if token_response.get("refresh_token_expired_at")
+                else None
+            ),
+            "id_token": token_response.get("id_token", ""),
+        })
+
+    def __get_email(self, headers):
+        try:
+            # Github does not provide email in user response
+            emails_url = "https://api.github.com/user/emails"
+            emails_response = requests.get(emails_url, headers=headers).json()
+            # Ensure the response is a list before iterating
+            if not isinstance(emails_response, list):
+                self.logger.error("Unexpected response format from GitHub emails API")
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["GITHUB_OAUTH_PROVIDER_ERROR"],
+                    error_message="GITHUB_OAUTH_PROVIDER_ERROR",
+                )
+            email = next((email["email"] for email in emails_response if email["primary"]), None)
+            if not email:
+                self.logger.error("No primary email found for user")
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["GITHUB_OAUTH_PROVIDER_ERROR"],
+                    error_message="GITHUB_OAUTH_PROVIDER_ERROR",
+                )
+            return email
+        except requests.RequestException:
+            self.logger.warning(
+                "Error getting email from GitHub",
+            )
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITHUB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITHUB_OAUTH_PROVIDER_ERROR",
+            )
+
+    def is_user_in_organization(self, github_username):
+        headers = {"Authorization": f"Bearer {self.token_data.get('access_token')}"}
+        response = requests.get(
+            f"{self.org_membership_url}/{self.organization_id}/memberships/{github_username}",
+            headers=headers,
+        )
+        return response.status_code == 200  # 200 means the user is a member
+
+    def set_user_data(self):
+        user_info_response = self.get_user_response()
+        headers = {
+            "Authorization": f"Bearer {self.token_data.get('access_token')}",
+            "Accept": "application/json",
+        }
+
+        if self.organization_id:
+            if not self.is_user_in_organization(user_info_response.get("login")):
+                self.logger.warning(
+                    "User is not in organization",
+                    extra={
+                        "organization_id": self.organization_id,
+                        "user_login": user_info_response.get("login"),
+                    },
+                )
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["GITHUB_USER_NOT_IN_ORG"],
+                    error_message="GITHUB_USER_NOT_IN_ORG",
+                )
+
+        email = self.__get_email(headers=headers)
+        self.logger.debug(
+            "Email found",
+            extra={
+                "email": email,
+            },
+        )
+        super().set_user_data({
+            "email": email,
+            "user": {
+                "provider_id": user_info_response.get("id"),
+                "email": email,
+                "avatar": user_info_response.get("avatar_url"),
+                "first_name": user_info_response.get("name"),
+                "last_name": user_info_response.get("family_name"),
+                "is_password_autoset": True,
+            },
+        })

plane-src/apps/api/plane/authentication/provider/oauth/gitlab.py

@@ -0,0 +1,124 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import os
+from datetime import datetime
+from urllib.parse import urlencode
+
+import pytz
+
+# Module imports
+from plane.authentication.adapter.oauth import OauthAdapter
+from plane.license.utils.instance_value import get_configuration_value
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+
+
+class GitLabOAuthProvider(OauthAdapter):
+    provider = "gitlab"
+    scope = "read_user"
+
+    def __init__(self, request, code=None, state=None, callback=None):
+        GITLAB_CLIENT_ID, GITLAB_CLIENT_SECRET, GITLAB_HOST = get_configuration_value(
+            [
+                {
+                    "key": "GITLAB_CLIENT_ID",
+                    "default": os.environ.get("GITLAB_CLIENT_ID"),
+                },
+                {
+                    "key": "GITLAB_CLIENT_SECRET",
+                    "default": os.environ.get("GITLAB_CLIENT_SECRET"),
+                },
+                {
+                    "key": "GITLAB_HOST",
+                    "default": os.environ.get("GITLAB_HOST", "https://gitlab.com"),
+                },
+            ]
+        )
+
+        self.host = GITLAB_HOST
+        self.token_url = f"{self.host}/oauth/token"
+        self.userinfo_url = f"{self.host}/api/v4/user"
+
+        if not (GITLAB_CLIENT_ID and GITLAB_CLIENT_SECRET and GITLAB_HOST):
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITLAB_NOT_CONFIGURED"],
+                error_message="GITLAB_NOT_CONFIGURED",
+            )
+
+        client_id = GITLAB_CLIENT_ID
+        client_secret = GITLAB_CLIENT_SECRET
+
+        redirect_uri = f"""{"https" if request.is_secure() else "http"}://{request.get_host()}/auth/gitlab/callback/"""
+        url_params = {
+            "client_id": client_id,
+            "redirect_uri": redirect_uri,
+            "response_type": "code",
+            "scope": self.scope,
+            "state": state,
+        }
+        auth_url = f"{self.host}/oauth/authorize?{urlencode(url_params)}"
+        super().__init__(
+            request,
+            self.provider,
+            client_id,
+            self.scope,
+            redirect_uri,
+            auth_url,
+            self.token_url,
+            self.userinfo_url,
+            client_secret,
+            code,
+            callback=callback,
+        )
+
+    def set_token_data(self):
+        data = {
+            "client_id": self.client_id,
+            "client_secret": self.client_secret,
+            "code": self.code,
+            "redirect_uri": self.redirect_uri,
+            "grant_type": "authorization_code",
+        }
+        token_response = self.get_user_token(data=data, headers={"Accept": "application/json"})
+        super().set_token_data(
+            {
+                "access_token": token_response.get("access_token"),
+                "refresh_token": token_response.get("refresh_token", None),
+                "access_token_expired_at": (
+                    datetime.fromtimestamp(
+                        token_response.get("created_at") + token_response.get("expires_in"),
+                        tz=pytz.utc,
+                    )
+                    if token_response.get("expires_in")
+                    else None
+                ),
+                "refresh_token_expired_at": (
+                    datetime.fromtimestamp(token_response.get("refresh_token_expired_at"), tz=pytz.utc)
+                    if token_response.get("refresh_token_expired_at")
+                    else None
+                ),
+                "id_token": token_response.get("id_token", ""),
+            }
+        )
+
+    def set_user_data(self):
+        user_info_response = self.get_user_response()
+        email = user_info_response.get("email")
+        super().set_user_data(
+            {
+                "email": email,
+                "user": {
+                    "provider_id": user_info_response.get("id"),
+                    "email": email,
+                    "avatar": user_info_response.get("avatar_url"),
+                    "first_name": user_info_response.get("name"),
+                    "last_name": user_info_response.get("family_name"),
+                    "is_password_autoset": True,
+                },
+            }
+        )

plane-src/apps/api/plane/authentication/provider/oauth/google.py

@@ -0,0 +1,115 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import os
+from datetime import datetime
+from urllib.parse import urlencode
+
+import pytz
+
+# Module imports
+from plane.authentication.adapter.oauth import OauthAdapter
+from plane.license.utils.instance_value import get_configuration_value
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+
+
+class GoogleOAuthProvider(OauthAdapter):
+    token_url = "https://oauth2.googleapis.com/token"
+    userinfo_url = "https://www.googleapis.com/oauth2/v2/userinfo"
+    scope = "https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile"
+    provider = "google"
+
+    def __init__(self, request, code=None, state=None, callback=None):
+        (GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET) = get_configuration_value(
+            [
+                {
+                    "key": "GOOGLE_CLIENT_ID",
+                    "default": os.environ.get("GOOGLE_CLIENT_ID"),
+                },
+                {
+                    "key": "GOOGLE_CLIENT_SECRET",
+                    "default": os.environ.get("GOOGLE_CLIENT_SECRET"),
+                },
+            ]
+        )
+
+        if not (GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET):
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GOOGLE_NOT_CONFIGURED"],
+                error_message="GOOGLE_NOT_CONFIGURED",
+            )
+
+        client_id = GOOGLE_CLIENT_ID
+        client_secret = GOOGLE_CLIENT_SECRET
+
+        redirect_uri = f"""{"https" if request.is_secure() else "http"}://{request.get_host()}/auth/google/callback/"""
+        url_params = {
+            "client_id": client_id,
+            "scope": self.scope,
+            "redirect_uri": redirect_uri,
+            "response_type": "code",
+            "access_type": "offline",
+            "prompt": "consent",
+            "state": state,
+        }
+        auth_url = f"https://accounts.google.com/o/oauth2/v2/auth?{urlencode(url_params)}"
+
+        super().__init__(
+            request,
+            self.provider,
+            client_id,
+            self.scope,
+            redirect_uri,
+            auth_url,
+            self.token_url,
+            self.userinfo_url,
+            client_secret,
+            code,
+            callback=callback,
+        )
+
+    def set_token_data(self):
+        data = {
+            "code": self.code,
+            "client_id": self.client_id,
+            "client_secret": self.client_secret,
+            "redirect_uri": self.redirect_uri,
+            "grant_type": "authorization_code",
+        }
+        token_response = self.get_user_token(data=data)
+        super().set_token_data(
+            {
+                "access_token": token_response.get("access_token"),
+                "refresh_token": token_response.get("refresh_token", None),
+                "access_token_expired_at": (
+                    datetime.fromtimestamp(token_response.get("expires_in"), tz=pytz.utc)
+                    if token_response.get("expires_in")
+                    else None
+                ),
+                "refresh_token_expired_at": (
+                    datetime.fromtimestamp(token_response.get("refresh_token_expired_at"), tz=pytz.utc)
+                    if token_response.get("refresh_token_expired_at")
+                    else None
+                ),
+                "id_token": token_response.get("id_token", ""),
+            }
+        )
+
+    def set_user_data(self):
+        user_info_response = self.get_user_response()
+        user_data = {
+            "email": user_info_response.get("email"),
+            "user": {
+                "avatar": user_info_response.get("picture"),
+                "first_name": user_info_response.get("given_name"),
+                "last_name": user_info_response.get("family_name"),
+                "provider_id": user_info_response.get("id"),
+                "is_password_autoset": True,
+            },
+        }
+        super().set_user_data(user_data)

plane-src/apps/api/plane/authentication/rate_limit.py

@@ -0,0 +1,47 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third party imports
+from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
+from rest_framework import status
+from rest_framework.response import Response
+
+# Module imports
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+
+
+class AuthenticationThrottle(AnonRateThrottle):
+    rate = "30/minute"
+    scope = "authentication"
+
+    def throttle_failure_view(self, request, *args, **kwargs):
+        try:
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["RATE_LIMIT_EXCEEDED"],
+                error_message="RATE_LIMIT_EXCEEDED",
+            )
+        except AuthenticationException as e:
+            return Response(e.get_error_dict(), status=status.HTTP_429_TOO_MANY_REQUESTS)
+
+
+class EmailVerificationThrottle(UserRateThrottle):
+    """
+    Throttle for email verification code generation.
+    Limits to 3 requests per hour per user to prevent abuse.
+    """
+
+    rate = "3/hour"
+    scope = "email_verification"
+
+    def throttle_failure_view(self, request, *args, **kwargs):
+        try:
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["RATE_LIMIT_EXCEEDED"],
+                error_message="RATE_LIMIT_EXCEEDED",
+            )
+        except AuthenticationException as e:
+            return Response(e.get_error_dict(), status=status.HTTP_429_TOO_MANY_REQUESTS)

plane-src/apps/api/plane/authentication/session.py

@@ -0,0 +1,11 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from rest_framework.authentication import SessionAuthentication
+
+
+class BaseSessionAuthentication(SessionAuthentication):
+    # Disable csrf for the rest apis
+    def enforce_csrf(self, request):
+        return

plane-src/apps/api/plane/authentication/urls.py

@@ -0,0 +1,153 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from django.urls import path
+
+from .views import (
+    CSRFTokenEndpoint,
+    ForgotPasswordEndpoint,
+    SetUserPasswordEndpoint,
+    ResetPasswordEndpoint,
+    ChangePasswordEndpoint,
+    # App
+    EmailCheckEndpoint,
+    GitLabCallbackEndpoint,
+    GitLabOauthInitiateEndpoint,
+    GitHubCallbackEndpoint,
+    GitHubOauthInitiateEndpoint,
+    GoogleCallbackEndpoint,
+    GoogleOauthInitiateEndpoint,
+    MagicGenerateEndpoint,
+    MagicSignInEndpoint,
+    MagicSignUpEndpoint,
+    SignInAuthEndpoint,
+    SignOutAuthEndpoint,
+    SignUpAuthEndpoint,
+    ForgotPasswordSpaceEndpoint,
+    ResetPasswordSpaceEndpoint,
+    # Space
+    EmailCheckSpaceEndpoint,
+    GitLabCallbackSpaceEndpoint,
+    GitLabOauthInitiateSpaceEndpoint,
+    GitHubCallbackSpaceEndpoint,
+    GitHubOauthInitiateSpaceEndpoint,
+    GoogleCallbackSpaceEndpoint,
+    GoogleOauthInitiateSpaceEndpoint,
+    MagicGenerateSpaceEndpoint,
+    MagicSignInSpaceEndpoint,
+    MagicSignUpSpaceEndpoint,
+    SignInAuthSpaceEndpoint,
+    SignUpAuthSpaceEndpoint,
+    SignOutAuthSpaceEndpoint,
+    GiteaCallbackEndpoint,
+    GiteaOauthInitiateEndpoint,
+    GiteaCallbackSpaceEndpoint,
+    GiteaOauthInitiateSpaceEndpoint,
+)
+
+urlpatterns = [
+    # credentials
+    path("sign-in/", SignInAuthEndpoint.as_view(), name="sign-in"),
+    path("sign-up/", SignUpAuthEndpoint.as_view(), name="sign-up"),
+    path("spaces/sign-in/", SignInAuthSpaceEndpoint.as_view(), name="space-sign-in"),
+    path("spaces/sign-up/", SignUpAuthSpaceEndpoint.as_view(), name="space-sign-up"),
+    # signout
+    path("sign-out/", SignOutAuthEndpoint.as_view(), name="sign-out"),
+    path("spaces/sign-out/", SignOutAuthSpaceEndpoint.as_view(), name="space-sign-out"),
+    # csrf token
+    path("get-csrf-token/", CSRFTokenEndpoint.as_view(), name="get_csrf_token"),
+    # Magic sign in
+    path("magic-generate/", MagicGenerateEndpoint.as_view(), name="magic-generate"),
+    path("magic-sign-in/", MagicSignInEndpoint.as_view(), name="magic-sign-in"),
+    path("magic-sign-up/", MagicSignUpEndpoint.as_view(), name="magic-sign-up"),
+    path(
+        "spaces/magic-generate/",
+        MagicGenerateSpaceEndpoint.as_view(),
+        name="space-magic-generate",
+    ),
+    path(
+        "spaces/magic-sign-in/",
+        MagicSignInSpaceEndpoint.as_view(),
+        name="space-magic-sign-in",
+    ),
+    path(
+        "spaces/magic-sign-up/",
+        MagicSignUpSpaceEndpoint.as_view(),
+        name="space-magic-sign-up",
+    ),
+    ## Google Oauth
+    path("google/", GoogleOauthInitiateEndpoint.as_view(), name="google-initiate"),
+    path("google/callback/", GoogleCallbackEndpoint.as_view(), name="google-callback"),
+    path(
+        "spaces/google/",
+        GoogleOauthInitiateSpaceEndpoint.as_view(),
+        name="space-google-initiate",
+    ),
+    path(
+        "spaces/google/callback/",
+        GoogleCallbackSpaceEndpoint.as_view(),
+        name="space-google-callback",
+    ),
+    ## Github Oauth
+    path("github/", GitHubOauthInitiateEndpoint.as_view(), name="github-initiate"),
+    path("github/callback/", GitHubCallbackEndpoint.as_view(), name="github-callback"),
+    path(
+        "spaces/github/",
+        GitHubOauthInitiateSpaceEndpoint.as_view(),
+        name="space-github-initiate",
+    ),
+    path(
+        "spaces/github/callback/",
+        GitHubCallbackSpaceEndpoint.as_view(),
+        name="space-github-callback",
+    ),
+    ## Gitlab Oauth
+    path("gitlab/", GitLabOauthInitiateEndpoint.as_view(), name="gitlab-initiate"),
+    path("gitlab/callback/", GitLabCallbackEndpoint.as_view(), name="gitlab-callback"),
+    path(
+        "spaces/gitlab/",
+        GitLabOauthInitiateSpaceEndpoint.as_view(),
+        name="space-gitlab-initiate",
+    ),
+    path(
+        "spaces/gitlab/callback/",
+        GitLabCallbackSpaceEndpoint.as_view(),
+        name="space-gitlab-callback",
+    ),
+    # Email Check
+    path("email-check/", EmailCheckEndpoint.as_view(), name="email-check"),
+    path("spaces/email-check/", EmailCheckSpaceEndpoint.as_view(), name="email-check"),
+    # Password
+    path("forgot-password/", ForgotPasswordEndpoint.as_view(), name="forgot-password"),
+    path(
+        "reset-password/<uidb64>/<token>/",
+        ResetPasswordEndpoint.as_view(),
+        name="forgot-password",
+    ),
+    path(
+        "spaces/forgot-password/",
+        ForgotPasswordSpaceEndpoint.as_view(),
+        name="space-forgot-password",
+    ),
+    path(
+        "spaces/reset-password/<uidb64>/<token>/",
+        ResetPasswordSpaceEndpoint.as_view(),
+        name="space-forgot-password",
+    ),
+    path("change-password/", ChangePasswordEndpoint.as_view(), name="forgot-password"),
+    path("set-password/", SetUserPasswordEndpoint.as_view(), name="set-password"),
+    ## Gitea Oauth
+    path("gitea/", GiteaOauthInitiateEndpoint.as_view(), name="gitea-initiate"),
+    path("gitea/callback/", GiteaCallbackEndpoint.as_view(), name="gitea-callback"),
+    path(
+        "spaces/gitea/",
+        GiteaOauthInitiateSpaceEndpoint.as_view(),
+        name="space-gitea-initiate",
+    ),
+    path(
+        "spaces/gitea/callback/",
+        GiteaCallbackSpaceEndpoint.as_view(),
+        name="space-gitea-callback",
+    ),
+]

plane-src/apps/api/plane/authentication/utils/host.py

@@ -0,0 +1,67 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.conf import settings
+from django.http import HttpRequest
+
+# Third party imports
+from rest_framework.request import Request
+
+# Module imports
+from plane.utils.ip_address import get_client_ip
+
+
+def base_host(
+    request: Request | HttpRequest,
+    is_admin: bool = False,
+    is_space: bool = False,
+    is_app: bool = False,
+) -> str:
+    """Utility function to return host / origin from the request"""
+    # Calculate the base origin from request
+    base_origin = settings.WEB_URL or settings.APP_BASE_URL
+
+    # Admin redirection
+    if is_admin:
+        admin_base_path = getattr(settings, "ADMIN_BASE_PATH", None)
+        if not isinstance(admin_base_path, str):
+            admin_base_path = "/god-mode/"
+        if not admin_base_path.startswith("/"):
+            admin_base_path = "/" + admin_base_path
+        if not admin_base_path.endswith("/"):
+            admin_base_path += "/"
+
+        if settings.ADMIN_BASE_URL:
+            return settings.ADMIN_BASE_URL + admin_base_path
+        else:
+            return base_origin + admin_base_path
+
+    # Space redirection
+    if is_space:
+        space_base_path = getattr(settings, "SPACE_BASE_PATH", None)
+        if not isinstance(space_base_path, str):
+            space_base_path = "/spaces/"
+        if not space_base_path.startswith("/"):
+            space_base_path = "/" + space_base_path
+        if not space_base_path.endswith("/"):
+            space_base_path += "/"
+
+        if settings.SPACE_BASE_URL:
+            return settings.SPACE_BASE_URL + space_base_path
+        else:
+            return base_origin + space_base_path
+
+    # App Redirection
+    if is_app:
+        if settings.APP_BASE_URL:
+            return settings.APP_BASE_URL
+        else:
+            return base_origin
+
+    return base_origin
+
+
+def user_ip(request: Request | HttpRequest) -> str:
+    return get_client_ip(request=request)

plane-src/apps/api/plane/authentication/utils/login.py

@@ -0,0 +1,28 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.contrib.auth import login
+from django.conf import settings
+
+# Module imports
+from plane.utils.host import base_host
+from plane.utils.ip_address import get_client_ip
+
+
+def user_login(request, user, is_app=False, is_admin=False, is_space=False):
+    login(request=request, user=user)
+
+    # If is admin cookie set the custom age
+    if is_admin:
+        request.session.set_expiry(settings.ADMIN_SESSION_COOKIE_AGE)
+
+    device_info = {
+        "user_agent": request.META.get("HTTP_USER_AGENT", ""),
+        "ip_address": get_client_ip(request=request),
+        "domain": base_host(request=request, is_app=is_app, is_admin=is_admin, is_space=is_space),
+    }
+    request.session["device_info"] = device_info
+    request.session.save()
+    return

plane-src/apps/api/plane/authentication/utils/password_validation.py

@@ -0,0 +1,35 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+import re
+
+from zxcvbn import zxcvbn
+
+PASSWORD_MIN_LENGTH = 8
+PASSWORD_UPPERCASE_REGEX = re.compile(r"[A-Z]")
+PASSWORD_LOWERCASE_REGEX = re.compile(r"[a-z]")
+PASSWORD_DIGIT_REGEX = re.compile(r"[0-9]")
+PASSWORD_SPECIAL_CHAR_REGEX = re.compile(r"""[!@#$%^&*()\-_+=\[\]{}|;:'",.<>?/]""")
+
+
+def has_required_password_complexity(password: str) -> bool:
+    if len(password) < PASSWORD_MIN_LENGTH:
+        return False
+
+    return all(
+        (
+            PASSWORD_UPPERCASE_REGEX.search(password),
+            PASSWORD_LOWERCASE_REGEX.search(password),
+            PASSWORD_DIGIT_REGEX.search(password),
+            PASSWORD_SPECIAL_CHAR_REGEX.search(password),
+        )
+    )
+
+
+def is_password_policy_valid(password: str) -> bool:
+    if not has_required_password_complexity(password):
+        return False
+
+    results = zxcvbn(password)
+    return results["score"] >= 3

plane-src/apps/api/plane/authentication/utils/redirection_path.py

@@ -0,0 +1,46 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from plane.db.models import Profile, Workspace, WorkspaceMemberInvite
+
+
+def get_redirection_path(user):
+    # Handle redirections
+    profile, _ = Profile.objects.get_or_create(user=user)
+
+    # Redirect to onboarding if the user is not onboarded yet
+    if not profile.is_onboarded:
+        return "onboarding"
+
+    # Redirect to the last workspace if the user has last workspace
+    if (
+        profile.last_workspace_id
+        and Workspace.objects.filter(
+            pk=profile.last_workspace_id,
+            workspace_member__member_id=user.id,
+            workspace_member__is_active=True,
+        ).exists()
+    ):
+        workspace = Workspace.objects.filter(
+            pk=profile.last_workspace_id,
+            workspace_member__member_id=user.id,
+            workspace_member__is_active=True,
+        ).first()
+        return f"{workspace.slug}"
+
+    fallback_workspace = (
+        Workspace.objects.filter(workspace_member__member_id=user.id, workspace_member__is_active=True)
+        .order_by("created_at")
+        .first()
+    )
+    # Redirect to fallback workspace
+    if fallback_workspace:
+        return f"{fallback_workspace.slug}"
+
+    # Redirect to invitations if the user has unaccepted invitations
+    if WorkspaceMemberInvite.objects.filter(email=user.email).count():
+        return "invitations"
+
+    # Redirect the user to create workspace
+    return "create-workspace"

plane-src/apps/api/plane/authentication/utils/user_auth_workflow.py

@@ -0,0 +1,9 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from .workspace_project_join import process_workspace_project_invitations
+
+
+def post_user_auth_workflow(user, is_signup, request):
+    process_workspace_project_invitations(user=user)

plane-src/apps/api/plane/authentication/utils/workspace_project_join.py

@@ -0,0 +1,91 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.utils import timezone
+
+# Module imports
+from plane.db.models import (
+    ProjectMember,
+    ProjectMemberInvite,
+    WorkspaceMember,
+    WorkspaceMemberInvite,
+)
+from plane.utils.cache import invalidate_cache_directly
+from plane.bgtasks.event_tracking_task import track_event
+from plane.utils.analytics_events import USER_JOINED_WORKSPACE
+
+
+def process_workspace_project_invitations(user):
+    """This function takes in User and adds him to all workspace and projects that the user has accepted invited of"""
+
+    # Check if user has any accepted invites for workspace and add them to workspace
+    workspace_member_invites = WorkspaceMemberInvite.objects.filter(email=user.email, accepted=True)
+
+    WorkspaceMember.objects.bulk_create(
+        [
+            WorkspaceMember(
+                workspace_id=workspace_member_invite.workspace_id,
+                member=user,
+                role=workspace_member_invite.role,
+            )
+            for workspace_member_invite in workspace_member_invites
+        ],
+        ignore_conflicts=True,
+    )
+
+    for workspace_member_invite in workspace_member_invites:
+        invalidate_cache_directly(
+            path=f"/api/workspaces/{str(workspace_member_invite.workspace.slug)}/members/",
+            url_params=False,
+            user=False,
+            multiple=True,
+        )
+        track_event.delay(
+            user_id=user.id,
+            event_name=USER_JOINED_WORKSPACE,
+            slug=workspace_member_invite.workspace.slug,
+            event_properties={
+                "user_id": user.id,
+                "workspace_id": workspace_member_invite.workspace.id,
+                "workspace_slug": workspace_member_invite.workspace.slug,
+                "role": workspace_member_invite.role,
+                "joined_at": str(timezone.now().isoformat()),
+            },
+        )
+
+    # Check if user has any project invites
+    project_member_invites = ProjectMemberInvite.objects.filter(email=user.email, accepted=True)
+
+    # Add user to workspace
+    WorkspaceMember.objects.bulk_create(
+        [
+            WorkspaceMember(
+                workspace_id=project_member_invite.workspace_id,
+                role=(project_member_invite.role if project_member_invite.role in [5, 15] else 15),
+                member=user,
+                created_by_id=project_member_invite.created_by_id,
+            )
+            for project_member_invite in project_member_invites
+        ],
+        ignore_conflicts=True,
+    )
+
+    # Now add the users to project
+    ProjectMember.objects.bulk_create(
+        [
+            ProjectMember(
+                workspace_id=project_member_invite.workspace_id,
+                role=(project_member_invite.role if project_member_invite.role in [5, 15] else 15),
+                member=user,
+                created_by_id=project_member_invite.created_by_id,
+            )
+            for project_member_invite in project_member_invites
+        ],
+        ignore_conflicts=True,
+    )
+
+    # Delete all the invites
+    workspace_member_invites.delete()
+    project_member_invites.delete()

plane-src/apps/api/plane/authentication/views/__init__.py

@@ -0,0 +1,43 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from .common import ChangePasswordEndpoint, CSRFTokenEndpoint, SetUserPasswordEndpoint
+
+from .app.check import EmailCheckEndpoint
+
+from .app.email import SignInAuthEndpoint, SignUpAuthEndpoint
+from .app.github import GitHubCallbackEndpoint, GitHubOauthInitiateEndpoint
+from .app.gitlab import GitLabCallbackEndpoint, GitLabOauthInitiateEndpoint
+from .app.gitea import GiteaCallbackEndpoint, GiteaOauthInitiateEndpoint
+from .app.google import GoogleCallbackEndpoint, GoogleOauthInitiateEndpoint
+from .app.magic import MagicGenerateEndpoint, MagicSignInEndpoint, MagicSignUpEndpoint
+
+from .app.signout import SignOutAuthEndpoint
+
+
+from .space.email import SignInAuthSpaceEndpoint, SignUpAuthSpaceEndpoint
+
+from .space.github import GitHubCallbackSpaceEndpoint, GitHubOauthInitiateSpaceEndpoint
+
+from .space.gitlab import GitLabCallbackSpaceEndpoint, GitLabOauthInitiateSpaceEndpoint
+
+from .space.gitea import GiteaCallbackSpaceEndpoint, GiteaOauthInitiateSpaceEndpoint
+
+from .space.google import GoogleCallbackSpaceEndpoint, GoogleOauthInitiateSpaceEndpoint
+
+from .space.magic import (
+    MagicGenerateSpaceEndpoint,
+    MagicSignInSpaceEndpoint,
+    MagicSignUpSpaceEndpoint,
+)
+
+from .space.signout import SignOutAuthSpaceEndpoint
+
+from .space.check import EmailCheckSpaceEndpoint
+
+from .space.password_management import (
+    ForgotPasswordSpaceEndpoint,
+    ResetPasswordSpaceEndpoint,
+)
+from .app.password_management import ForgotPasswordEndpoint, ResetPasswordEndpoint

plane-src/apps/api/plane/authentication/views/app/check.py

@@ -0,0 +1,103 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import os
+
+# Django imports
+from django.core.validators import validate_email
+from django.core.exceptions import ValidationError
+
+# Third party imports
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+## Module imports
+from plane.db.models import User
+from plane.license.models import Instance
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.authentication.rate_limit import AuthenticationThrottle
+from plane.license.utils.instance_value import get_configuration_value
+
+
+class EmailCheckEndpoint(APIView):
+    permission_classes = [AllowAny]
+
+    throttle_classes = [AuthenticationThrottle]
+
+    def post(self, request):
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        (EMAIL_HOST, ENABLE_MAGIC_LINK_LOGIN) = get_configuration_value(
+            [
+                {"key": "EMAIL_HOST", "default": os.environ.get("EMAIL_HOST", "")},
+                {
+                    "key": "ENABLE_MAGIC_LINK_LOGIN",
+                    "default": os.environ.get("ENABLE_MAGIC_LINK_LOGIN", "1"),
+                },
+            ]
+        )
+
+        smtp_configured = bool(EMAIL_HOST)
+        is_magic_login_enabled = ENABLE_MAGIC_LINK_LOGIN == "1"
+
+        email = request.data.get("email", False)
+
+        # Return error if email is not present
+        if not email:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["EMAIL_REQUIRED"],
+                error_message="EMAIL_REQUIRED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        # Lower the email
+        email = str(email).lower().strip()
+
+        # Validate email
+        try:
+            validate_email(email)
+        except ValidationError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
+                error_message="INVALID_EMAIL",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+        # Check if a user already exists with the given email
+        existing_user = User.objects.filter(email=email).first()
+
+        # If existing user
+        if existing_user:
+            # Return response
+            return Response(
+                {
+                    "existing": True,
+                    "status": (
+                        "MAGIC_CODE"
+                        if existing_user.is_password_autoset and smtp_configured and is_magic_login_enabled
+                        else "CREDENTIAL"
+                    ),
+                },
+                status=status.HTTP_200_OK,
+            )
+        # Else return response
+        return Response(
+            {
+                "existing": False,
+                "status": ("MAGIC_CODE" if smtp_configured and is_magic_login_enabled else "CREDENTIAL"),
+            },
+            status=status.HTTP_200_OK,
+        )

plane-src/apps/api/plane/authentication/views/app/email.py

@@ -0,0 +1,239 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.core.exceptions import ValidationError
+from django.core.validators import validate_email
+from django.http import HttpResponseRedirect
+from django.views import View
+
+# Module imports
+from plane.authentication.provider.credentials.email import EmailProvider
+from plane.authentication.utils.login import user_login
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.utils.redirection_path import get_redirection_path
+from plane.authentication.utils.user_auth_workflow import post_user_auth_workflow
+from plane.db.models import User
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.utils.path_validator import get_safe_redirect_url
+
+
+class SignInAuthEndpoint(View):
+    def post(self, request):
+        next_path = request.POST.get("next_path")
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            # Base URL join
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        # set the referer as session to redirect after login
+        email = request.POST.get("email", False)
+        password = request.POST.get("password", False)
+
+        ## Raise exception if any of the above are missing
+        if not email or not password:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["REQUIRED_EMAIL_PASSWORD_SIGN_IN"],
+                error_message="REQUIRED_EMAIL_PASSWORD_SIGN_IN",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            # Next path
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        # Validate email
+        email = email.strip().lower()
+        try:
+            validate_email(email)
+        except ValidationError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL_SIGN_IN"],
+                error_message="INVALID_EMAIL_SIGN_IN",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        existing_user = User.objects.filter(email=email).first()
+
+        if not existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+                error_message="USER_DOES_NOT_EXIST",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = EmailProvider(
+                request=request,
+                key=email,
+                code=password,
+                is_signup=False,
+                callback=post_user_auth_workflow,
+            )
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_app=True)
+            # Get the redirection path
+            if next_path:
+                path = next_path
+            else:
+                path = get_redirection_path(user=user)
+
+            # Get the safe redirect URL
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=path,
+                params={},
+            )
+            return HttpResponseRedirect(url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+
+class SignUpAuthEndpoint(View):
+    def post(self, request):
+        next_path = request.POST.get("next_path")
+        signup_base_url = f"{base_host(request=request, is_app=True).rstrip('/')}/sign-up"
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=signup_base_url,
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        email = request.POST.get("email", False)
+        password = request.POST.get("password", False)
+        ## Raise exception if any of the above are missing
+        if not email or not password:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["REQUIRED_EMAIL_PASSWORD_SIGN_UP"],
+                error_message="REQUIRED_EMAIL_PASSWORD_SIGN_UP",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=signup_base_url,
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+        # Validate the email
+        email = email.strip().lower()
+        try:
+            validate_email(email)
+        except ValidationError:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL_SIGN_UP"],
+                error_message="INVALID_EMAIL_SIGN_UP",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=signup_base_url,
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        # Existing user
+        existing_user = User.objects.filter(email=email).first()
+
+        if existing_user:
+            # Existing User
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
+                error_message="USER_ALREADY_EXIST",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=signup_base_url,
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = EmailProvider(
+                request=request,
+                key=email,
+                code=password,
+                is_signup=True,
+                callback=post_user_auth_workflow,
+            )
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_app=True)
+            # Get the redirection path
+            if next_path:
+                path = next_path
+            else:
+                path = get_redirection_path(user=user)
+
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=path,
+                params={},
+            )
+            return HttpResponseRedirect(url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=signup_base_url,
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/app/gitea.py

@@ -0,0 +1,107 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+import uuid
+from urllib.parse import urlencode, urljoin
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+
+# Module imports
+from plane.authentication.provider.oauth.gitea import GiteaOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.authentication.utils.redirection_path import get_redirection_path
+from plane.authentication.utils.user_auth_workflow import post_user_auth_workflow
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.utils.path_validator import validate_next_path
+
+
+class GiteaOauthInitiateEndpoint(View):
+    def get(self, request):
+        # Get host and next path
+        request.session["host"] = base_host(request=request, is_app=True)
+        next_path = request.GET.get("next_path")
+        if next_path:
+            request.session["next_path"] = str(validate_next_path(next_path))
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host(request=request, is_app=True), "?" + urlencode(params))
+            return HttpResponseRedirect(url)
+        try:
+            state = uuid.uuid4().hex
+            provider = GiteaOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host(request=request, is_app=True), "?" + urlencode(params))
+            return HttpResponseRedirect(url)
+
+
+class GiteaCallbackEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        base_host = request.session.get("host")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITEA_OAUTH_PROVIDER_ERROR"],
+                error_message="GITEA_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(next_path)
+            url = urljoin(base_host, "?" + urlencode(params))
+            return HttpResponseRedirect(url)
+
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITEA_OAUTH_PROVIDER_ERROR"],
+                error_message="GITEA_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host, "?" + urlencode(params))
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = GiteaOAuthProvider(request=request, code=code, callback=post_user_auth_workflow)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_app=True)
+            # Get the redirection path
+            if next_path:
+                path = str(validate_next_path(next_path))
+            else:
+                path = get_redirection_path(user=user)
+            # redirect to referer path
+            url = urljoin(base_host, path)
+            return HttpResponseRedirect(url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host, "?" + urlencode(params))
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/app/github.py

@@ -0,0 +1,106 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import uuid
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+
+# Module imports
+from plane.authentication.provider.oauth.github import GitHubOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.authentication.utils.redirection_path import get_redirection_path
+from plane.authentication.utils.user_auth_workflow import post_user_auth_workflow
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.utils.path_validator import get_safe_redirect_url
+
+
+class GitHubOauthInitiateEndpoint(View):
+    def get(self, request):
+        # Get host and next path
+        request.session["host"] = base_host(request=request, is_app=True)
+        next_path = request.GET.get("next_path")
+        if next_path:
+            request.session["next_path"] = str(next_path)
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+        try:
+            state = uuid.uuid4().hex
+            provider = GitHubOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+
+class GitHubCallbackEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITHUB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITHUB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITHUB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITHUB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = GitHubOAuthProvider(request=request, code=code, callback=post_user_auth_workflow)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_app=True)
+            if next_path:
+                path = next_path
+            else:
+                path = get_redirection_path(user=user)
+
+            # Get the safe redirect URL
+            url = get_safe_redirect_url(base_url=base_host(request=request, is_app=True), next_path=path, params={})
+            return HttpResponseRedirect(url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/app/gitlab.py

@@ -0,0 +1,107 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import uuid
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+
+# Module imports
+from plane.authentication.provider.oauth.gitlab import GitLabOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.authentication.utils.redirection_path import get_redirection_path
+from plane.authentication.utils.user_auth_workflow import post_user_auth_workflow
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.utils.path_validator import get_safe_redirect_url
+
+
+class GitLabOauthInitiateEndpoint(View):
+    def get(self, request):
+        # Get host and next path
+        request.session["host"] = base_host(request=request, is_app=True)
+        next_path = request.GET.get("next_path")
+        if next_path:
+            request.session["next_path"] = str(next_path)
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+        try:
+            state = uuid.uuid4().hex
+            provider = GitLabOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+
+class GitLabCallbackEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITLAB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITLAB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITLAB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITLAB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = GitLabOAuthProvider(request=request, code=code, callback=post_user_auth_workflow)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_app=True)
+            # Get the redirection path
+
+            if next_path:
+                path = next_path
+            else:
+                path = get_redirection_path(user=user)
+            # redirect to referer path
+            url = get_safe_redirect_url(base_url=base_host(request=request, is_app=True), next_path=path, params={})
+            return HttpResponseRedirect(url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/app/google.py

@@ -0,0 +1,104 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import uuid
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+
+
+# Module imports
+from plane.authentication.provider.oauth.google import GoogleOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.authentication.utils.redirection_path import get_redirection_path
+from plane.authentication.utils.user_auth_workflow import post_user_auth_workflow
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.utils.path_validator import get_safe_redirect_url
+
+
+class GoogleOauthInitiateEndpoint(View):
+    def get(self, request):
+        request.session["host"] = base_host(request=request, is_app=True)
+        next_path = request.GET.get("next_path")
+        if next_path:
+            request.session["next_path"] = str(next_path)
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            state = uuid.uuid4().hex
+            provider = GoogleOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+
+class GoogleCallbackEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GOOGLE_OAUTH_PROVIDER_ERROR"],
+                error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GOOGLE_OAUTH_PROVIDER_ERROR"],
+                error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+        try:
+            provider = GoogleOAuthProvider(request=request, code=code, callback=post_user_auth_workflow)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_app=True)
+            # Get the redirection path
+            if next_path:
+                path = next_path
+            else:
+                path = get_redirection_path(user=user)
+            url = get_safe_redirect_url(base_url=base_host(request=request, is_app=True), next_path=path, params={})
+            return HttpResponseRedirect(url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/app/magic.py

@@ -0,0 +1,196 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.core.validators import validate_email
+from django.http import HttpResponseRedirect
+from django.views import View
+
+# Third party imports
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+# Module imports
+from plane.authentication.provider.credentials.magic_code import MagicCodeProvider
+from plane.authentication.utils.login import user_login
+from plane.authentication.utils.redirection_path import get_redirection_path
+from plane.authentication.utils.user_auth_workflow import post_user_auth_workflow
+from plane.bgtasks.magic_link_code_task import magic_link
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.db.models import User, Profile
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.authentication.rate_limit import AuthenticationThrottle
+from plane.utils.path_validator import get_safe_redirect_url
+
+
+class MagicGenerateEndpoint(APIView):
+    permission_classes = [AllowAny]
+
+    throttle_classes = [AuthenticationThrottle]
+
+    def post(self, request):
+        # Check if instance is configured
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        email = request.data.get("email", "").strip().lower()
+        try:
+            validate_email(email)
+            adapter = MagicCodeProvider(request=request, key=email)
+            key, token = adapter.initiate()
+            # If the smtp is configured send through here
+            magic_link.delay(email, key, token)
+            return Response({"key": str(key)}, status=status.HTTP_200_OK)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            return Response(params, status=status.HTTP_400_BAD_REQUEST)
+
+
+class MagicSignInEndpoint(View):
+    def post(self, request):
+        # set the referer as session to redirect after login
+        code = request.POST.get("code", "").strip()
+        email = request.POST.get("email", "").strip().lower()
+        next_path = request.POST.get("next_path")
+
+        if code == "" or email == "":
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED"],
+                error_message="MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        # Existing User
+        existing_user = User.objects.filter(email=email).first()
+
+        if not existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+                error_message="USER_DOES_NOT_EXIST",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = MagicCodeProvider(
+                request=request,
+                key=f"magic_{email}",
+                code=code,
+                callback=post_user_auth_workflow,
+            )
+            user = provider.authenticate()
+            profile, _ = Profile.objects.get_or_create(user=user)
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_app=True)
+            if user.is_password_autoset and profile.is_onboarded:
+                # Redirect to the home page
+                path = "/"
+            else:
+                # Get the redirection path
+                path = str(next_path) if next_path else str(get_redirection_path(user=user))
+            # redirect to referer path
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=path,
+                params={},
+            )
+            return HttpResponseRedirect(url)
+
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+
+class MagicSignUpEndpoint(View):
+    def post(self, request):
+        # set the referer as session to redirect after login
+        code = request.POST.get("code", "").strip()
+        email = request.POST.get("email", "").strip().lower()
+        next_path = request.POST.get("next_path")
+
+        if code == "" or email == "":
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED"],
+                error_message="MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+        # Existing user
+        existing_user = User.objects.filter(email=email).first()
+        if existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
+                error_message="USER_ALREADY_EXIST",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = MagicCodeProvider(
+                request=request,
+                key=f"magic_{email}",
+                code=code,
+                callback=post_user_auth_workflow,
+            )
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_app=True)
+            # Get the redirection path
+            if next_path:
+                path = next_path
+            else:
+                path = get_redirection_path(user=user)
+            # redirect to referer path
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=path,
+                params={},
+            )
+            return HttpResponseRedirect(url)
+
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/app/password_management.py

@@ -0,0 +1,174 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import os
+from urllib.parse import urlencode, urljoin
+
+# Third party imports
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+# Django imports
+from django.contrib.auth.tokens import PasswordResetTokenGenerator
+from django.core.exceptions import ValidationError
+from django.core.validators import validate_email
+from django.http import HttpResponseRedirect
+from django.utils.encoding import DjangoUnicodeDecodeError, smart_bytes, smart_str
+from django.utils.http import urlsafe_base64_decode, urlsafe_base64_encode
+from django.views import View
+
+# Module imports
+from plane.bgtasks.forgot_password_task import forgot_password
+from plane.license.models import Instance
+from plane.db.models import User
+from plane.license.utils.instance_value import get_configuration_value
+from plane.authentication.utils.host import base_host
+from plane.authentication.utils.password_validation import is_password_policy_valid
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.authentication.rate_limit import AuthenticationThrottle
+
+
+def generate_password_token(user):
+    uidb64 = urlsafe_base64_encode(smart_bytes(user.id))
+    token = PasswordResetTokenGenerator().make_token(user)
+
+    return uidb64, token
+
+
+class ForgotPasswordEndpoint(APIView):
+    permission_classes = [AllowAny]
+
+    throttle_classes = [AuthenticationThrottle]
+
+    def post(self, request):
+        email = request.data.get("email")
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        (EMAIL_HOST,) = get_configuration_value([{"key": "EMAIL_HOST", "default": os.environ.get("EMAIL_HOST")}])
+
+        if not (EMAIL_HOST):
+            exc = AuthenticationException(
+                error_message="SMTP_NOT_CONFIGURED",
+                error_code=AUTHENTICATION_ERROR_CODES["SMTP_NOT_CONFIGURED"],
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        try:
+            validate_email(email)
+        except ValidationError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
+                error_message="INVALID_EMAIL",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        # Get the user
+        user = User.objects.filter(email=email).first()
+        if user:
+            # Get the reset token for user
+            uidb64, token = generate_password_token(user=user)
+            current_site = base_host(request=request, is_app=True)
+            # send the forgot password email
+            forgot_password.delay(user.first_name, user.email, uidb64, token, current_site)
+            return Response(
+                {"message": "Check your email to reset your password"},
+                status=status.HTTP_200_OK,
+            )
+        exc = AuthenticationException(
+            error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+            error_message="USER_DOES_NOT_EXIST",
+        )
+        return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+
+class ResetPasswordEndpoint(View):
+    def post(self, request, uidb64, token):
+        try:
+            # Decode the id from the uidb64
+            try:
+                id = smart_str(urlsafe_base64_decode(uidb64))
+                user = User.objects.get(id=id)
+            except (ValueError, User.DoesNotExist):
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["INVALID_PASSWORD_TOKEN"],
+                    error_message="INVALID_PASSWORD_TOKEN",
+                )
+                params = exc.get_error_dict()
+                url = urljoin(
+                    base_host(request=request, is_app=True),
+                    "accounts/reset-password?" + urlencode(params),
+                )
+                return HttpResponseRedirect(url)
+
+            # check if the token is valid for the user
+            if not PasswordResetTokenGenerator().check_token(user, token):
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["INVALID_PASSWORD_TOKEN"],
+                    error_message="INVALID_PASSWORD_TOKEN",
+                )
+                params = exc.get_error_dict()
+                url = urljoin(
+                    base_host(request=request, is_app=True),
+                    "accounts/reset-password?" + urlencode(params),
+                )
+                return HttpResponseRedirect(url)
+
+            password = request.POST.get("password", False)
+
+            if not password:
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["INVALID_PASSWORD"],
+                    error_message="INVALID_PASSWORD",
+                )
+                url = urljoin(
+                    base_host(request=request, is_app=True),
+                    "accounts/reset-password?" + urlencode(exc.get_error_dict()),
+                )
+                return HttpResponseRedirect(url)
+
+            if not is_password_policy_valid(password):
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["PASSWORD_TOO_WEAK"],
+                    error_message="PASSWORD_TOO_WEAK",
+                )
+                url = urljoin(
+                    base_host(request=request, is_app=True),
+                    "accounts/reset-password?" + urlencode(exc.get_error_dict()),
+                )
+                return HttpResponseRedirect(url)
+
+            # set_password also hashes the password that the user will get
+            user.set_password(password)
+            user.is_password_autoset = False
+            user.save()
+
+            url = urljoin(
+                base_host(request=request, is_app=True),
+                "sign-in?" + urlencode({"success": True}),
+            )
+            return HttpResponseRedirect(url)
+        except DjangoUnicodeDecodeError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["EXPIRED_PASSWORD_TOKEN"],
+                error_message="EXPIRED_PASSWORD_TOKEN",
+            )
+            url = urljoin(
+                base_host(request=request, is_app=True),
+                "accounts/reset-password?" + urlencode(exc.get_error_dict()),
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/app/signout.py

@@ -0,0 +1,28 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.views import View
+from django.contrib.auth import logout
+from django.http import HttpResponseRedirect
+from django.utils import timezone
+
+# Module imports
+from plane.authentication.utils.host import user_ip, base_host
+from plane.db.models import User
+
+
+class SignOutAuthEndpoint(View):
+    def post(self, request):
+        # Get user
+        try:
+            user = User.objects.get(pk=request.user.id)
+            user.last_logout_ip = user_ip(request=request)
+            user.last_logout_time = timezone.now()
+            user.save()
+            # Log the user out
+            logout(request)
+            return HttpResponseRedirect(base_host(request=request, is_app=True))
+        except Exception:
+            return HttpResponseRedirect(base_host(request=request, is_app=True))

plane-src/apps/api/plane/authentication/views/common.py

@@ -0,0 +1,135 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.shortcuts import render
+
+# Third party imports
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+## Module imports
+from plane.authentication.utils.password_validation import is_password_policy_valid
+from plane.app.serializers import UserSerializer
+from plane.authentication.utils.login import user_login
+from plane.db.models import User
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from django.middleware.csrf import get_token
+from plane.utils.cache import invalidate_cache
+from plane.authentication.utils.host import base_host
+
+
+class CSRFTokenEndpoint(APIView):
+    permission_classes = [AllowAny]
+
+    def get(self, request):
+        # Generate a CSRF token
+        csrf_token = get_token(request)
+        # Return the CSRF token in a JSON response
+        return Response({"csrf_token": str(csrf_token)}, status=status.HTTP_200_OK)
+
+
+def csrf_failure(request, reason=""):
+    """Custom CSRF failure view"""
+    return render(
+        request,
+        "csrf_failure.html",
+        {"reason": reason, "root_url": base_host(request=request)},
+    )
+
+
+class ChangePasswordEndpoint(APIView):
+    def post(self, request):
+        user = User.objects.get(pk=request.user.id)
+
+        # If the user password is not autoset then we need to check the old passwords
+        if not user.is_password_autoset:
+            old_password = request.data.get("old_password", False)
+            if not old_password:
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["MISSING_PASSWORD"],
+                    error_message="MISSING_PASSWORD",
+                    payload={"error": "Old password is missing"},
+                )
+                return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        # Get the new password
+        new_password = request.data.get("new_password", False)
+
+        if not new_password:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["MISSING_PASSWORD"],
+                error_message="MISSING_PASSWORD",
+                payload={"error": "Old or new password is missing"},
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        # If the user password is not autoset then we need to check the old passwords
+        if not user.is_password_autoset and not user.check_password(old_password):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INCORRECT_OLD_PASSWORD"],
+                error_message="INCORRECT_OLD_PASSWORD",
+                payload={"error": "Old password is not correct"},
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        if not is_password_policy_valid(new_password):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["PASSWORD_TOO_WEAK"],
+                error_message="PASSWORD_TOO_WEAK",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        # set_password also hashes the password that the user will get
+        user.set_password(new_password)
+        user.is_password_autoset = False
+        user.save()
+        user_login(user=user, request=request, is_app=True)
+        return Response({"message": "Password updated successfully"}, status=status.HTTP_200_OK)
+
+
+class SetUserPasswordEndpoint(APIView):
+    @invalidate_cache("/api/users/me/")
+    def post(self, request):
+        user = User.objects.get(pk=request.user.id)
+        password = request.data.get("password", False)
+
+        # If the user password is not autoset then return error
+        if not user.is_password_autoset:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["PASSWORD_ALREADY_SET"],
+                error_message="PASSWORD_ALREADY_SET",
+                payload={"error": "Your password is already set please change your password from profile"},
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        # Check password validation
+        if not password:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_PASSWORD"],
+                error_message="INVALID_PASSWORD",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        if not is_password_policy_valid(password):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_PASSWORD"],
+                error_message="INVALID_PASSWORD",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        # Set the user password
+        user.set_password(password)
+        user.is_password_autoset = False
+        user.save()
+        # Login the user as the session is invalidated
+        user_login(user=user, request=request, is_app=True)
+        # Return the user
+        serializer = UserSerializer(user)
+        return Response(serializer.data, status=status.HTTP_200_OK)

plane-src/apps/api/plane/authentication/views/space/check.py

@@ -0,0 +1,101 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import os
+
+# Django imports
+from django.core.validators import validate_email
+from django.core.exceptions import ValidationError
+
+# Third party imports
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+## Module imports
+from plane.db.models import User
+from plane.license.models import Instance
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.authentication.rate_limit import AuthenticationThrottle
+from plane.license.utils.instance_value import get_configuration_value
+
+
+class EmailCheckSpaceEndpoint(APIView):
+    permission_classes = [AllowAny]
+
+    throttle_classes = [AuthenticationThrottle]
+
+    def post(self, request):
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        (EMAIL_HOST, ENABLE_MAGIC_LINK_LOGIN) = get_configuration_value(
+            [
+                {"key": "EMAIL_HOST", "default": os.environ.get("EMAIL_HOST", "")},
+                {
+                    "key": "ENABLE_MAGIC_LINK_LOGIN",
+                    "default": os.environ.get("ENABLE_MAGIC_LINK_LOGIN", "1"),
+                },
+            ]
+        )
+
+        smtp_configured = bool(EMAIL_HOST)
+        is_magic_login_enabled = ENABLE_MAGIC_LINK_LOGIN == "1"
+
+        email = request.data.get("email", False)
+
+        # Return error if email is not present
+        if not email:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["EMAIL_REQUIRED"],
+                error_message="EMAIL_REQUIRED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        email = str(email).lower().strip()
+        # Validate email
+        try:
+            validate_email(email)
+        except ValidationError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
+                error_message="INVALID_EMAIL",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+        # Check if a user already exists with the given email
+        existing_user = User.objects.filter(email=email).first()
+
+        # If existing user
+        if existing_user:
+            # Return response
+            return Response(
+                {
+                    "existing": True,
+                    "status": (
+                        "MAGIC_CODE"
+                        if existing_user.is_password_autoset and smtp_configured and is_magic_login_enabled
+                        else "CREDENTIAL"
+                    ),
+                },
+                status=status.HTTP_200_OK,
+            )
+        # Else return response
+        return Response(
+            {
+                "existing": False,
+                "status": ("MAGIC_CODE" if smtp_configured and is_magic_login_enabled else "CREDENTIAL"),
+            },
+            status=status.HTTP_200_OK,
+        )

plane-src/apps/api/plane/authentication/views/space/email.py

@@ -0,0 +1,191 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.core.exceptions import ValidationError
+from django.core.validators import validate_email
+from django.http import HttpResponseRedirect
+from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme
+
+# Module imports
+from plane.authentication.provider.credentials.email import EmailProvider
+from plane.authentication.utils.login import user_login
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.db.models import User
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+
+
+class SignInAuthSpaceEndpoint(View):
+    def post(self, request):
+        next_path = request.POST.get("next_path")
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        # set the referer as session to redirect after login
+        email = request.POST.get("email", False)
+        password = request.POST.get("password", False)
+
+        ## Raise exception if any of the above are missing
+        if not email or not password:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["REQUIRED_EMAIL_PASSWORD_SIGN_IN"],
+                error_message="REQUIRED_EMAIL_PASSWORD_SIGN_IN",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        # Validate email
+        email = email.strip().lower()
+        try:
+            validate_email(email)
+        except ValidationError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL_SIGN_IN"],
+                error_message="INVALID_EMAIL_SIGN_IN",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        # Existing User
+        existing_user = User.objects.filter(email=email).first()
+
+        if not existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+                error_message="USER_DOES_NOT_EXIST",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = EmailProvider(request=request, key=email, code=password, is_signup=False)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+
+class SignUpAuthSpaceEndpoint(View):
+    def post(self, request):
+        next_path = request.POST.get("next_path")
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        email = request.POST.get("email", False)
+        password = request.POST.get("password", False)
+        ## Raise exception if any of the above are missing
+        if not email or not password:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["REQUIRED_EMAIL_PASSWORD_SIGN_UP"],
+                error_message="REQUIRED_EMAIL_PASSWORD_SIGN_UP",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+        # Validate the email
+        email = email.strip().lower()
+        try:
+            validate_email(email)
+        except ValidationError:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL_SIGN_UP"],
+                error_message="INVALID_EMAIL_SIGN_UP",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        # Existing User
+        existing_user = User.objects.filter(email=email).first()
+
+        if existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
+                error_message="USER_ALREADY_EXIST",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = EmailProvider(request=request, key=email, code=password, is_signup=True)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/gitea.py

@@ -0,0 +1,104 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import uuid
+from urllib.parse import urlencode
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+
+# Module imports
+from plane.authentication.provider.oauth.gitea import GiteaOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.utils.path_validator import validate_next_path
+
+
+class GiteaOauthInitiateSpaceEndpoint(View):
+    def get(self, request):
+        # Get host and next path
+        request.session["host"] = base_host(request=request, is_space=True)
+        next_path = request.GET.get("next_path")
+        if next_path:
+            request.session["next_path"] = str(validate_next_path(next_path))
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            return HttpResponseRedirect(url)
+
+        try:
+            state = uuid.uuid4().hex
+            provider = GiteaOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            if next_path:
+                params["next_path"] = str(next_path)
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            return HttpResponseRedirect(url)
+
+
+class GiteaCallbackSpaceEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITEA_OAUTH_PROVIDER_ERROR"],
+                error_message="GITEA_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            return HttpResponseRedirect(url)
+
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITEA_OAUTH_PROVIDER_ERROR"],
+                error_message="GITEA_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = GiteaOAuthProvider(request=request, code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # Process workspace and project invitations
+            # redirect to referer path
+            url = (
+                f"{base_host(request=request, is_space=True)}{str(validate_next_path(next_path)) if next_path else ''}"
+            )
+            return HttpResponseRedirect(url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/github.py

@@ -0,0 +1,105 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import uuid
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme
+
+# Module imports
+from plane.authentication.provider.oauth.github import GitHubOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+
+
+class GitHubOauthInitiateSpaceEndpoint(View):
+    def get(self, request):
+        # Get host and next path
+        request.session["host"] = base_host(request=request, is_space=True)
+        next_path = request.GET.get("next_path")
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            state = uuid.uuid4().hex
+            provider = GitHubOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+
+class GitHubCallbackSpaceEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        base_host = request.session.get("host")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITHUB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITHUB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITHUB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITHUB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = GitHubOAuthProvider(request=request, code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # Process workspace and project invitations
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/gitlab.py

@@ -0,0 +1,106 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import uuid
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme
+
+# Module imports
+from plane.authentication.provider.oauth.gitlab import GitLabOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+
+
+class GitLabOauthInitiateSpaceEndpoint(View):
+    def get(self, request):
+        # Get host and next path
+        request.session["host"] = base_host(request=request, is_space=True)
+        next_path = request.GET.get("next_path")
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            state = uuid.uuid4().hex
+            provider = GitLabOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+
+class GitLabCallbackSpaceEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        base_host = request.session.get("host")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITLAB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITLAB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITLAB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITLAB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = GitLabOAuthProvider(request=request, code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # Process workspace and project invitations
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/google.py

@@ -0,0 +1,102 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import uuid
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme
+
+# Module imports
+from plane.authentication.provider.oauth.google import GoogleOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+
+
+class GoogleOauthInitiateSpaceEndpoint(View):
+    def get(self, request):
+        request.session["host"] = base_host(request=request, is_space=True)
+        next_path = request.GET.get("next_path")
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            state = uuid.uuid4().hex
+            provider = GoogleOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+
+class GoogleCallbackSpaceEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        base_host = request.session.get("host")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GOOGLE_OAUTH_PROVIDER_ERROR"],
+                error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GOOGLE_OAUTH_PROVIDER_ERROR"],
+                error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+        try:
+            provider = GoogleOAuthProvider(request=request, code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/magic.py

@@ -0,0 +1,170 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.core.validators import validate_email
+from django.http import HttpResponseRedirect
+from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme
+
+# Third party imports
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+# Module imports
+from plane.authentication.provider.credentials.magic_code import MagicCodeProvider
+from plane.authentication.utils.login import user_login
+from plane.bgtasks.magic_link_code_task import magic_link
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.db.models import User
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+
+
+class MagicGenerateSpaceEndpoint(APIView):
+    permission_classes = [AllowAny]
+
+    def post(self, request):
+        # Check if instance is configured
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        email = request.data.get("email", "").strip().lower()
+        try:
+            validate_email(email)
+            adapter = MagicCodeProvider(request=request, key=email)
+            key, token = adapter.initiate()
+            # If the smtp is configured send through here
+            magic_link.delay(email, key, token)
+            return Response({"key": str(key)}, status=status.HTTP_200_OK)
+        except AuthenticationException as e:
+            return Response(e.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+
+class MagicSignInSpaceEndpoint(View):
+    def post(self, request):
+        # set the referer as session to redirect after login
+        code = request.POST.get("code", "").strip()
+        email = request.POST.get("email", "").strip().lower()
+        next_path = request.POST.get("next_path")
+
+        if code == "" or email == "":
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED"],
+                error_message="MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        existing_user = User.objects.filter(email=email).first()
+
+        if not existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+                error_message="USER_DOES_NOT_EXIST",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        # Active User
+        try:
+            provider = MagicCodeProvider(request=request, key=f"magic_{email}", code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+
+class MagicSignUpSpaceEndpoint(View):
+    def post(self, request):
+        # set the referer as session to redirect after login
+        code = request.POST.get("code", "").strip()
+        email = request.POST.get("email", "").strip().lower()
+        next_path = request.POST.get("next_path")
+
+        if code == "" or email == "":
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED"],
+                error_message="MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+        # Existing User
+        existing_user = User.objects.filter(email=email).first()
+        # Already existing
+        if existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
+                error_message="USER_ALREADY_EXIST",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = MagicCodeProvider(request=request, key=f"magic_{email}", code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/password_management.py

@@ -0,0 +1,158 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import os
+from urllib.parse import urlencode
+
+# Third party imports
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+# Django imports
+from django.contrib.auth.tokens import PasswordResetTokenGenerator
+from django.core.exceptions import ValidationError
+from django.core.validators import validate_email
+from django.http import HttpResponseRedirect
+from django.utils.encoding import DjangoUnicodeDecodeError, smart_bytes, smart_str
+from django.utils.http import urlsafe_base64_decode, urlsafe_base64_encode
+from django.views import View
+
+# Module imports
+from plane.bgtasks.forgot_password_task import forgot_password
+from plane.license.models import Instance
+from plane.db.models import User
+from plane.license.utils.instance_value import get_configuration_value
+from plane.authentication.utils.host import base_host
+from plane.authentication.utils.password_validation import is_password_policy_valid
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.authentication.rate_limit import AuthenticationThrottle
+
+
+def generate_password_token(user):
+    uidb64 = urlsafe_base64_encode(smart_bytes(user.id))
+    token = PasswordResetTokenGenerator().make_token(user)
+
+    return uidb64, token
+
+
+class ForgotPasswordSpaceEndpoint(APIView):
+    permission_classes = [AllowAny]
+
+    throttle_classes = [AuthenticationThrottle]
+
+    def post(self, request):
+        email = request.data.get("email")
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        (EMAIL_HOST, EMAIL_HOST_USER, EMAIL_HOST_PASSWORD) = get_configuration_value(
+            [
+                {"key": "EMAIL_HOST", "default": os.environ.get("EMAIL_HOST")},
+                {
+                    "key": "EMAIL_HOST_USER",
+                    "default": os.environ.get("EMAIL_HOST_USER"),
+                },
+                {
+                    "key": "EMAIL_HOST_PASSWORD",
+                    "default": os.environ.get("EMAIL_HOST_PASSWORD"),
+                },
+            ]
+        )
+
+        if not (EMAIL_HOST):
+            exc = AuthenticationException(
+                error_message="SMTP_NOT_CONFIGURED",
+                error_code=AUTHENTICATION_ERROR_CODES["SMTP_NOT_CONFIGURED"],
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        try:
+            validate_email(email)
+        except ValidationError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
+                error_message="INVALID_EMAIL",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        # Get the user
+        user = User.objects.filter(email=email).first()
+        if user:
+            # Get the reset token for user
+            uidb64, token = generate_password_token(user=user)
+            current_site = base_host(request=request, is_space=True)
+            # send the forgot password email
+            forgot_password.delay(user.first_name, user.email, uidb64, token, current_site)
+            return Response(
+                {"message": "Check your email to reset your password"},
+                status=status.HTTP_200_OK,
+            )
+        exc = AuthenticationException(
+            error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+            error_message="USER_DOES_NOT_EXIST",
+        )
+        return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+
+class ResetPasswordSpaceEndpoint(View):
+    def post(self, request, uidb64, token):
+        try:
+            # Decode the id from the uidb64
+            id = smart_str(urlsafe_base64_decode(uidb64))
+            user = User.objects.get(id=id)
+
+            # check if the token is valid for the user
+            if not PasswordResetTokenGenerator().check_token(user, token):
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["INVALID_PASSWORD_TOKEN"],
+                    error_message="INVALID_PASSWORD_TOKEN",
+                )
+                params = exc.get_error_dict()
+                url = f"{base_host(request=request, is_space=True)}/accounts/reset-password/?{urlencode(params)}"
+                return HttpResponseRedirect(url)
+
+            password = request.POST.get("password", False)
+
+            if not password:
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["INVALID_PASSWORD"],
+                    error_message="INVALID_PASSWORD",
+                )
+                url = f"{base_host(request=request, is_space=True)}/accounts/reset-password/?{urlencode(exc.get_error_dict())}"  # noqa: E501
+                return HttpResponseRedirect(url)
+
+            if not is_password_policy_valid(password):
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["PASSWORD_TOO_WEAK"],
+                    error_message="PASSWORD_TOO_WEAK",
+                )
+                url = f"{base_host(request=request, is_space=True)}/accounts/reset-password/?{urlencode(exc.get_error_dict())}"  # noqa: E501
+                return HttpResponseRedirect(url)
+
+            # set_password also hashes the password that the user will get
+            user.set_password(password)
+            user.is_password_autoset = False
+            user.save()
+
+            return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except DjangoUnicodeDecodeError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["EXPIRED_PASSWORD_TOKEN"],
+                error_message="EXPIRED_PASSWORD_TOKEN",
+            )
+            url = f"{base_host(request=request, is_space=True)}/accounts/reset-password/?{urlencode(exc.get_error_dict())}"  # noqa: E501
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/signout.py

@@ -0,0 +1,33 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.views import View
+from django.contrib.auth import logout
+from django.http import HttpResponseRedirect
+from django.utils import timezone
+
+# Module imports
+from plane.authentication.utils.host import base_host, user_ip
+from plane.db.models import User
+from plane.utils.path_validator import get_safe_redirect_url
+
+
+class SignOutAuthSpaceEndpoint(View):
+    def post(self, request):
+        next_path = request.POST.get("next_path")
+
+        # Get user
+        try:
+            user = User.objects.get(pk=request.user.id)
+            user.last_logout_ip = user_ip(request=request)
+            user.last_logout_time = timezone.now()
+            user.save()
+            # Log the user out
+            logout(request)
+            url = get_safe_redirect_url(base_url=base_host(request=request, is_space=True), next_path=next_path)
+            return HttpResponseRedirect(url)
+        except Exception:
+            url = get_safe_redirect_url(base_url=base_host(request=request, is_space=True), next_path=next_path)
+            return HttpResponseRedirect(url)