base

plane-src/apps/api/plane/authentication/views/space/check.py

@@ -0,0 +1,101 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import os
+
+# Django imports
+from django.core.validators import validate_email
+from django.core.exceptions import ValidationError
+
+# Third party imports
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+## Module imports
+from plane.db.models import User
+from plane.license.models import Instance
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.authentication.rate_limit import AuthenticationThrottle
+from plane.license.utils.instance_value import get_configuration_value
+
+
+class EmailCheckSpaceEndpoint(APIView):
+    permission_classes = [AllowAny]
+
+    throttle_classes = [AuthenticationThrottle]
+
+    def post(self, request):
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        (EMAIL_HOST, ENABLE_MAGIC_LINK_LOGIN) = get_configuration_value(
+            [
+                {"key": "EMAIL_HOST", "default": os.environ.get("EMAIL_HOST", "")},
+                {
+                    "key": "ENABLE_MAGIC_LINK_LOGIN",
+                    "default": os.environ.get("ENABLE_MAGIC_LINK_LOGIN", "1"),
+                },
+            ]
+        )
+
+        smtp_configured = bool(EMAIL_HOST)
+        is_magic_login_enabled = ENABLE_MAGIC_LINK_LOGIN == "1"
+
+        email = request.data.get("email", False)
+
+        # Return error if email is not present
+        if not email:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["EMAIL_REQUIRED"],
+                error_message="EMAIL_REQUIRED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        email = str(email).lower().strip()
+        # Validate email
+        try:
+            validate_email(email)
+        except ValidationError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
+                error_message="INVALID_EMAIL",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+        # Check if a user already exists with the given email
+        existing_user = User.objects.filter(email=email).first()
+
+        # If existing user
+        if existing_user:
+            # Return response
+            return Response(
+                {
+                    "existing": True,
+                    "status": (
+                        "MAGIC_CODE"
+                        if existing_user.is_password_autoset and smtp_configured and is_magic_login_enabled
+                        else "CREDENTIAL"
+                    ),
+                },
+                status=status.HTTP_200_OK,
+            )
+        # Else return response
+        return Response(
+            {
+                "existing": False,
+                "status": ("MAGIC_CODE" if smtp_configured and is_magic_login_enabled else "CREDENTIAL"),
+            },
+            status=status.HTTP_200_OK,
+        )

plane-src/apps/api/plane/authentication/views/space/email.py

@@ -0,0 +1,191 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.core.exceptions import ValidationError
+from django.core.validators import validate_email
+from django.http import HttpResponseRedirect
+from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme
+
+# Module imports
+from plane.authentication.provider.credentials.email import EmailProvider
+from plane.authentication.utils.login import user_login
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.db.models import User
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+
+
+class SignInAuthSpaceEndpoint(View):
+    def post(self, request):
+        next_path = request.POST.get("next_path")
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        # set the referer as session to redirect after login
+        email = request.POST.get("email", False)
+        password = request.POST.get("password", False)
+
+        ## Raise exception if any of the above are missing
+        if not email or not password:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["REQUIRED_EMAIL_PASSWORD_SIGN_IN"],
+                error_message="REQUIRED_EMAIL_PASSWORD_SIGN_IN",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        # Validate email
+        email = email.strip().lower()
+        try:
+            validate_email(email)
+        except ValidationError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL_SIGN_IN"],
+                error_message="INVALID_EMAIL_SIGN_IN",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        # Existing User
+        existing_user = User.objects.filter(email=email).first()
+
+        if not existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+                error_message="USER_DOES_NOT_EXIST",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = EmailProvider(request=request, key=email, code=password, is_signup=False)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+
+class SignUpAuthSpaceEndpoint(View):
+    def post(self, request):
+        next_path = request.POST.get("next_path")
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        email = request.POST.get("email", False)
+        password = request.POST.get("password", False)
+        ## Raise exception if any of the above are missing
+        if not email or not password:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["REQUIRED_EMAIL_PASSWORD_SIGN_UP"],
+                error_message="REQUIRED_EMAIL_PASSWORD_SIGN_UP",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+        # Validate the email
+        email = email.strip().lower()
+        try:
+            validate_email(email)
+        except ValidationError:
+            # Redirection params
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL_SIGN_UP"],
+                error_message="INVALID_EMAIL_SIGN_UP",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        # Existing User
+        existing_user = User.objects.filter(email=email).first()
+
+        if existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
+                error_message="USER_ALREADY_EXIST",
+                payload={"email": str(email)},
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = EmailProvider(request=request, key=email, code=password, is_signup=True)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/gitea.py

@@ -0,0 +1,104 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import uuid
+from urllib.parse import urlencode
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+
+# Module imports
+from plane.authentication.provider.oauth.gitea import GiteaOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.utils.path_validator import validate_next_path
+
+
+class GiteaOauthInitiateSpaceEndpoint(View):
+    def get(self, request):
+        # Get host and next path
+        request.session["host"] = base_host(request=request, is_space=True)
+        next_path = request.GET.get("next_path")
+        if next_path:
+            request.session["next_path"] = str(validate_next_path(next_path))
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            return HttpResponseRedirect(url)
+
+        try:
+            state = uuid.uuid4().hex
+            provider = GiteaOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            if next_path:
+                params["next_path"] = str(next_path)
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            return HttpResponseRedirect(url)
+
+
+class GiteaCallbackSpaceEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITEA_OAUTH_PROVIDER_ERROR"],
+                error_message="GITEA_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            return HttpResponseRedirect(url)
+
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITEA_OAUTH_PROVIDER_ERROR"],
+                error_message="GITEA_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = GiteaOAuthProvider(request=request, code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # Process workspace and project invitations
+            # redirect to referer path
+            url = (
+                f"{base_host(request=request, is_space=True)}{str(validate_next_path(next_path)) if next_path else ''}"
+            )
+            return HttpResponseRedirect(url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/github.py

@@ -0,0 +1,105 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import uuid
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme
+
+# Module imports
+from plane.authentication.provider.oauth.github import GitHubOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+
+
+class GitHubOauthInitiateSpaceEndpoint(View):
+    def get(self, request):
+        # Get host and next path
+        request.session["host"] = base_host(request=request, is_space=True)
+        next_path = request.GET.get("next_path")
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            state = uuid.uuid4().hex
+            provider = GitHubOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+
+class GitHubCallbackSpaceEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        base_host = request.session.get("host")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITHUB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITHUB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITHUB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITHUB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = GitHubOAuthProvider(request=request, code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # Process workspace and project invitations
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/gitlab.py

@@ -0,0 +1,106 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import uuid
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme
+
+# Module imports
+from plane.authentication.provider.oauth.gitlab import GitLabOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AUTHENTICATION_ERROR_CODES,
+    AuthenticationException,
+)
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+
+
+class GitLabOauthInitiateSpaceEndpoint(View):
+    def get(self, request):
+        # Get host and next path
+        request.session["host"] = base_host(request=request, is_space=True)
+        next_path = request.GET.get("next_path")
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            state = uuid.uuid4().hex
+            provider = GitLabOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+
+class GitLabCallbackSpaceEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        base_host = request.session.get("host")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITLAB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITLAB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GITLAB_OAUTH_PROVIDER_ERROR"],
+                error_message="GITLAB_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = GitLabOAuthProvider(request=request, code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # Process workspace and project invitations
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/google.py

@@ -0,0 +1,102 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import uuid
+
+# Django import
+from django.http import HttpResponseRedirect
+from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme
+
+# Module imports
+from plane.authentication.provider.oauth.google import GoogleOAuthProvider
+from plane.authentication.utils.login import user_login
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+
+
+class GoogleOauthInitiateSpaceEndpoint(View):
+    def get(self, request):
+        request.session["host"] = base_host(request=request, is_space=True)
+        next_path = request.GET.get("next_path")
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            state = uuid.uuid4().hex
+            provider = GoogleOAuthProvider(request=request, state=state)
+            request.session["state"] = state
+            auth_url = provider.get_auth_url()
+            return HttpResponseRedirect(auth_url)
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+
+
+class GoogleCallbackSpaceEndpoint(View):
+    def get(self, request):
+        code = request.GET.get("code")
+        state = request.GET.get("state")
+        base_host = request.session.get("host")
+        next_path = request.session.get("next_path")
+
+        if state != request.session.get("state", ""):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GOOGLE_OAUTH_PROVIDER_ERROR"],
+                error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+        if not code:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["GOOGLE_OAUTH_PROVIDER_ERROR"],
+                error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)
+        try:
+            provider = GoogleOAuthProvider(request=request, code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True), next_path=next_path, params=params
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/magic.py

@@ -0,0 +1,170 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.core.validators import validate_email
+from django.http import HttpResponseRedirect
+from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme
+
+# Third party imports
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+# Module imports
+from plane.authentication.provider.credentials.magic_code import MagicCodeProvider
+from plane.authentication.utils.login import user_login
+from plane.bgtasks.magic_link_code_task import magic_link
+from plane.license.models import Instance
+from plane.authentication.utils.host import base_host
+from plane.db.models import User
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+
+
+class MagicGenerateSpaceEndpoint(APIView):
+    permission_classes = [AllowAny]
+
+    def post(self, request):
+        # Check if instance is configured
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        email = request.data.get("email", "").strip().lower()
+        try:
+            validate_email(email)
+            adapter = MagicCodeProvider(request=request, key=email)
+            key, token = adapter.initiate()
+            # If the smtp is configured send through here
+            magic_link.delay(email, key, token)
+            return Response({"key": str(key)}, status=status.HTTP_200_OK)
+        except AuthenticationException as e:
+            return Response(e.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+
+class MagicSignInSpaceEndpoint(View):
+    def post(self, request):
+        # set the referer as session to redirect after login
+        code = request.POST.get("code", "").strip()
+        email = request.POST.get("email", "").strip().lower()
+        next_path = request.POST.get("next_path")
+
+        if code == "" or email == "":
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED"],
+                error_message="MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        existing_user = User.objects.filter(email=email).first()
+
+        if not existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+                error_message="USER_DOES_NOT_EXIST",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        # Active User
+        try:
+            provider = MagicCodeProvider(request=request, key=f"magic_{email}", code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+
+class MagicSignUpSpaceEndpoint(View):
+    def post(self, request):
+        # set the referer as session to redirect after login
+        code = request.POST.get("code", "").strip()
+        email = request.POST.get("email", "").strip().lower()
+        next_path = request.POST.get("next_path")
+
+        if code == "" or email == "":
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED"],
+                error_message="MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+        # Existing User
+        existing_user = User.objects.filter(email=email).first()
+        # Already existing
+        if existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
+                error_message="USER_ALREADY_EXIST",
+            )
+            params = exc.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)
+
+        try:
+            provider = MagicCodeProvider(request=request, key=f"magic_{email}", code=code)
+            user = provider.authenticate()
+            # Login the user and record his device info
+            user_login(request=request, user=user, is_space=True)
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
+
+        except AuthenticationException as e:
+            params = e.get_error_dict()
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/password_management.py

@@ -0,0 +1,158 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import os
+from urllib.parse import urlencode
+
+# Third party imports
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+# Django imports
+from django.contrib.auth.tokens import PasswordResetTokenGenerator
+from django.core.exceptions import ValidationError
+from django.core.validators import validate_email
+from django.http import HttpResponseRedirect
+from django.utils.encoding import DjangoUnicodeDecodeError, smart_bytes, smart_str
+from django.utils.http import urlsafe_base64_decode, urlsafe_base64_encode
+from django.views import View
+
+# Module imports
+from plane.bgtasks.forgot_password_task import forgot_password
+from plane.license.models import Instance
+from plane.db.models import User
+from plane.license.utils.instance_value import get_configuration_value
+from plane.authentication.utils.host import base_host
+from plane.authentication.utils.password_validation import is_password_policy_valid
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+from plane.authentication.rate_limit import AuthenticationThrottle
+
+
+def generate_password_token(user):
+    uidb64 = urlsafe_base64_encode(smart_bytes(user.id))
+    token = PasswordResetTokenGenerator().make_token(user)
+
+    return uidb64, token
+
+
+class ForgotPasswordSpaceEndpoint(APIView):
+    permission_classes = [AllowAny]
+
+    throttle_classes = [AuthenticationThrottle]
+
+    def post(self, request):
+        email = request.data.get("email")
+
+        # Check instance configuration
+        instance = Instance.objects.first()
+        if instance is None or not instance.is_setup_done:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INSTANCE_NOT_CONFIGURED"],
+                error_message="INSTANCE_NOT_CONFIGURED",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        (EMAIL_HOST, EMAIL_HOST_USER, EMAIL_HOST_PASSWORD) = get_configuration_value(
+            [
+                {"key": "EMAIL_HOST", "default": os.environ.get("EMAIL_HOST")},
+                {
+                    "key": "EMAIL_HOST_USER",
+                    "default": os.environ.get("EMAIL_HOST_USER"),
+                },
+                {
+                    "key": "EMAIL_HOST_PASSWORD",
+                    "default": os.environ.get("EMAIL_HOST_PASSWORD"),
+                },
+            ]
+        )
+
+        if not (EMAIL_HOST):
+            exc = AuthenticationException(
+                error_message="SMTP_NOT_CONFIGURED",
+                error_code=AUTHENTICATION_ERROR_CODES["SMTP_NOT_CONFIGURED"],
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        try:
+            validate_email(email)
+        except ValidationError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
+                error_message="INVALID_EMAIL",
+            )
+            return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+        # Get the user
+        user = User.objects.filter(email=email).first()
+        if user:
+            # Get the reset token for user
+            uidb64, token = generate_password_token(user=user)
+            current_site = base_host(request=request, is_space=True)
+            # send the forgot password email
+            forgot_password.delay(user.first_name, user.email, uidb64, token, current_site)
+            return Response(
+                {"message": "Check your email to reset your password"},
+                status=status.HTTP_200_OK,
+            )
+        exc = AuthenticationException(
+            error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+            error_message="USER_DOES_NOT_EXIST",
+        )
+        return Response(exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST)
+
+
+class ResetPasswordSpaceEndpoint(View):
+    def post(self, request, uidb64, token):
+        try:
+            # Decode the id from the uidb64
+            id = smart_str(urlsafe_base64_decode(uidb64))
+            user = User.objects.get(id=id)
+
+            # check if the token is valid for the user
+            if not PasswordResetTokenGenerator().check_token(user, token):
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["INVALID_PASSWORD_TOKEN"],
+                    error_message="INVALID_PASSWORD_TOKEN",
+                )
+                params = exc.get_error_dict()
+                url = f"{base_host(request=request, is_space=True)}/accounts/reset-password/?{urlencode(params)}"
+                return HttpResponseRedirect(url)
+
+            password = request.POST.get("password", False)
+
+            if not password:
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["INVALID_PASSWORD"],
+                    error_message="INVALID_PASSWORD",
+                )
+                url = f"{base_host(request=request, is_space=True)}/accounts/reset-password/?{urlencode(exc.get_error_dict())}"  # noqa: E501
+                return HttpResponseRedirect(url)
+
+            if not is_password_policy_valid(password):
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["PASSWORD_TOO_WEAK"],
+                    error_message="PASSWORD_TOO_WEAK",
+                )
+                url = f"{base_host(request=request, is_space=True)}/accounts/reset-password/?{urlencode(exc.get_error_dict())}"  # noqa: E501
+                return HttpResponseRedirect(url)
+
+            # set_password also hashes the password that the user will get
+            user.set_password(password)
+            user.is_password_autoset = False
+            user.save()
+
+            return HttpResponseRedirect(base_host(request=request, is_space=True))
+        except DjangoUnicodeDecodeError:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["EXPIRED_PASSWORD_TOKEN"],
+                error_message="EXPIRED_PASSWORD_TOKEN",
+            )
+            url = f"{base_host(request=request, is_space=True)}/accounts/reset-password/?{urlencode(exc.get_error_dict())}"  # noqa: E501
+            return HttpResponseRedirect(url)

plane-src/apps/api/plane/authentication/views/space/signout.py

@@ -0,0 +1,33 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.views import View
+from django.contrib.auth import logout
+from django.http import HttpResponseRedirect
+from django.utils import timezone
+
+# Module imports
+from plane.authentication.utils.host import base_host, user_ip
+from plane.db.models import User
+from plane.utils.path_validator import get_safe_redirect_url
+
+
+class SignOutAuthSpaceEndpoint(View):
+    def post(self, request):
+        next_path = request.POST.get("next_path")
+
+        # Get user
+        try:
+            user = User.objects.get(pk=request.user.id)
+            user.last_logout_ip = user_ip(request=request)
+            user.last_logout_time = timezone.now()
+            user.save()
+            # Log the user out
+            logout(request)
+            url = get_safe_redirect_url(base_url=base_host(request=request, is_space=True), next_path=next_path)
+            return HttpResponseRedirect(url)
+        except Exception:
+            url = get_safe_redirect_url(base_url=base_host(request=request, is_space=True), next_path=next_path)
+            return HttpResponseRedirect(url)