Merge branch 'auth-fixes' of github.com:makeplane/plane into auth-fixes

* chore: change password api updated and missing password error code added

* chore: auth helper updated

* chore: disable send code input suggestion

* chore: change password function updated

* fix: application error on sign in page

* chore: change password validation added and enhancement

admin/package.json

@@ -14,6 +14,7 @@
     "@headlessui/react": "^1.7.19",
     "@plane/types": "*",
     "@plane/ui": "*",
+    "@plane/constants": "*",
     "@tailwindcss/typography": "^0.5.9",
     "@types/lodash": "^4.17.0",
     "autoprefixer": "10.4.14",

apiserver/plane/app/views/workspace/base.py

@@ -96,6 +96,7 @@ class WorkSpaceViewSet(BaseViewSet):
 
     @invalidate_cache(path="/api/workspaces/", user=False)
     @invalidate_cache(path="/api/users/me/workspaces/")
+    @invalidate_cache(path="/api/instances/", user=False)
     def create(self, request):
         try:
             serializer = WorkSpaceSerializer(data=request.data)
@@ -151,8 +152,12 @@ class WorkSpaceViewSet(BaseViewSet):
         return super().partial_update(request, *args, **kwargs)
 
     @invalidate_cache(path="/api/workspaces/", user=False)
-    @invalidate_cache(path="/api/users/me/workspaces/", multiple=True, user=False)
-    @invalidate_cache(path="/api/users/me/settings/", multiple=True, user=False)
+    @invalidate_cache(
+        path="/api/users/me/workspaces/", multiple=True, user=False
+    )
+    @invalidate_cache(
+        path="/api/users/me/settings/", multiple=True, user=False
+    )
     def destroy(self, request, *args, **kwargs):
         return super().destroy(request, *args, **kwargs)
 

apiserver/plane/authentication/adapter/base.py

@@ -100,6 +100,12 @@ class Adapter:
             user.save()
             Profile.objects.create(user=user)
 
+        if not user.is_active:
+            raise AuthenticationException(
+                AUTHENTICATION_ERROR_CODES["USER_ACCOUNT_DEACTIVATED"],
+                error_message="USER_ACCOUNT_DEACTIVATED",
+            )
+
         # Update user details
         user.last_login_medium = self.provider
         user.last_active = timezone.now()

apiserver/plane/authentication/adapter/error.py

@@ -4,6 +4,9 @@ AUTHENTICATION_ERROR_CODES = {
     "INVALID_EMAIL": 5005,
     "EMAIL_REQUIRED": 5010,
     "SIGNUP_DISABLED": 5015,
+    "MAGIC_LINK_LOGIN_DISABLED": 5016,
+    "PASSWORD_LOGIN_DISABLED": 5018,
+    "USER_ACCOUNT_DEACTIVATED": 5019,
     # Password strength
     "INVALID_PASSWORD": 5020,
     "SMTP_NOT_CONFIGURED": 5025,
@@ -35,6 +38,7 @@ AUTHENTICATION_ERROR_CODES = {
     "EXPIRED_PASSWORD_TOKEN": 5130,
     # Change password
     "INCORRECT_OLD_PASSWORD": 5135,
+    "MISSING_PASSWORD": 5138,
     "INVALID_NEW_PASSWORD": 5140,
     # set passowrd
     "PASSWORD_ALREADY_SET": 5145,
@@ -47,6 +51,7 @@ AUTHENTICATION_ERROR_CODES = {
     "ADMIN_AUTHENTICATION_FAILED": 5175,
     "ADMIN_USER_ALREADY_EXIST": 5180,
     "ADMIN_USER_DOES_NOT_EXIST": 5185,
+    "ADMIN_USER_DEACTIVATED": 5190,
 }
 
 

apiserver/plane/authentication/provider/credentials/email.py

@@ -1,3 +1,6 @@
+# Python imports
+import os
+
 # Module imports
 from plane.authentication.adapter.credential import CredentialAdapter
 from plane.db.models import User
@@ -5,6 +8,7 @@ from plane.authentication.adapter.error import (
     AUTHENTICATION_ERROR_CODES,
     AuthenticationException,
 )
+from plane.license.utils.instance_value import get_configuration_value
 
 
 class EmailProvider(CredentialAdapter):
@@ -23,6 +27,21 @@ class EmailProvider(CredentialAdapter):
         self.code = code
         self.is_signup = is_signup
 
+        (ENABLE_EMAIL_PASSWORD,) = get_configuration_value(
+            [
+                {
+                    "key": "ENABLE_EMAIL_PASSWORD",
+                    "default": os.environ.get("ENABLE_EMAIL_PASSWORD"),
+                },
+            ]
+        )
+
+        if ENABLE_EMAIL_PASSWORD == "0":
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["ENABLE_EMAIL_PASSWORD"],
+                error_message="ENABLE_EMAIL_PASSWORD",
+            )
+
     def set_user_data(self):
         if self.is_signup:
             # Check if the user already exists

apiserver/plane/authentication/provider/credentials/magic_code.py

@@ -26,23 +26,20 @@ class MagicCodeProvider(CredentialAdapter):
         code=None,
     ):
 
-        (EMAIL_HOST, EMAIL_HOST_USER, EMAIL_HOST_PASSWORD) = (
-            get_configuration_value(
-                [
-                    {
-                        "key": "EMAIL_HOST",
-                        "default": os.environ.get("EMAIL_HOST"),
-                    },
-                    {
-                        "key": "EMAIL_HOST_USER",
-                        "default": os.environ.get("EMAIL_HOST_USER"),
-                    },
-                    {
-                        "key": "EMAIL_HOST_PASSWORD",
-                        "default": os.environ.get("EMAIL_HOST_PASSWORD"),
-                    },
-                ]
-            )
+        (
+            EMAIL_HOST,
+            ENABLE_MAGIC_LINK_LOGIN,
+        ) = get_configuration_value(
+            [
+                {
+                    "key": "EMAIL_HOST",
+                    "default": os.environ.get("EMAIL_HOST"),
+                },
+                {
+                    "key": "ENABLE_MAGIC_LINK_LOGIN",
+                    "default": os.environ.get("ENABLE_MAGIC_LINK_LOGIN", "1"),
+                },
+            ]
         )
 
         if not (EMAIL_HOST):
@@ -52,6 +49,15 @@ class MagicCodeProvider(CredentialAdapter):
                 payload={"email": str(self.key)},
             )
 
+        if ENABLE_MAGIC_LINK_LOGIN == "0":
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES[
+                    "MAGIC_LINK_LOGIN_DISABLED"
+                ],
+                error_message="MAGIC_LINK_LOGIN_DISABLED",
+                payload={"email": str(self.key)},
+            )
+
         super().__init__(request, self.provider)
         self.key = key
         self.code = code

apiserver/plane/authentication/views/app/check.py

@@ -24,62 +24,59 @@ class EmailCheckSignUpEndpoint(APIView):
     ]
 
     def post(self, request):
-        # Check instance configuration
-        instance = Instance.objects.first()
-        if instance is None or not instance.is_setup_done:
-            exc = AuthenticationException(
-                error_code=AUTHENTICATION_ERROR_CODES[
-                    "INSTANCE_NOT_CONFIGURED"
-                ],
-                error_message="INSTANCE_NOT_CONFIGURED",
-            )
-            return Response(
-                exc.get_error_dict(),
-                status=status.HTTP_400_BAD_REQUEST,
-            )
-
-        email = request.data.get("email", False)
-
-        # Return error if email is not present
-        if not email:
-            exc = AuthenticationException(
-                error_code=AUTHENTICATION_ERROR_CODES["EMAIL_REQUIRED"],
-                error_message="EMAIL_REQUIRED",
-            )
-            return Response(
-                exc.get_error_dict(),
-                status=status.HTTP_400_BAD_REQUEST,
-            )
-
-        # Validate email
         try:
+            # Check instance configuration
+            instance = Instance.objects.first()
+            if instance is None or not instance.is_setup_done:
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES[
+                        "INSTANCE_NOT_CONFIGURED"
+                    ],
+                    error_message="INSTANCE_NOT_CONFIGURED",
+                )
+            email = request.data.get("email", False)
+
+            # Return error if email is not present
+            if not email:
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["EMAIL_REQUIRED"],
+                    error_message="EMAIL_REQUIRED",
+                )
+
+            # Validate email
             validate_email(email)
+
+            existing_user = User.objects.filter(email=email).first()
+
+            if existing_user:
+                # check if the account is the deactivated
+                if not existing_user.is_active:
+                    raise AuthenticationException(
+                        error_code=AUTHENTICATION_ERROR_CODES[
+                            "USER_ACCOUNT_DEACTIVATED"
+                        ],
+                        error_message="USER_ACCOUNT_DEACTIVATED",
+                    )
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES[
+                        "USER_ALREADY_EXIST"
+                    ],
+                    error_message="USER_ALREADY_EXIST",
+                )
+            return Response(
+                {"status": True},
+                status=status.HTTP_200_OK,
+            )
         except ValidationError:
-            exc = AuthenticationException(
+            raise AuthenticationException(
                 error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
                 error_message="INVALID_EMAIL",
             )
+        except AuthenticationException as e:
             return Response(
-                exc.get_error_dict(),
-                status=status.HTTP_400_BAD_REQUEST,
+                e.get_error_dict(), status=status.HTTP_400_BAD_REQUEST
             )
 
-        existing_user = User.objects.filter(email=email).first()
-
-        if existing_user:
-            exc = AuthenticationException(
-                error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
-                error_message="USER_ALREADY_EXIST",
-            )
-            return Response(
-                exc.get_error_dict(),
-                status=status.HTTP_400_BAD_REQUEST,
-            )
-        return Response(
-            {"status": True},
-            status=status.HTTP_200_OK,
-        )
-
 
 class EmailCheckSignInEndpoint(APIView):
 
@@ -88,61 +85,59 @@ class EmailCheckSignInEndpoint(APIView):
     ]
 
     def post(self, request):
-        # Check instance configuration
-        instance = Instance.objects.first()
-        if instance is None or not instance.is_setup_done:
-            exc = AuthenticationException(
-                error_code=AUTHENTICATION_ERROR_CODES[
-                    "INSTANCE_NOT_CONFIGURED"
-                ],
-                error_message="INSTANCE_NOT_CONFIGURED",
-            )
-            return Response(
-                exc.get_error_dict(),
-                status=status.HTTP_400_BAD_REQUEST,
-            )
-
-        email = request.data.get("email", False)
-
-        # Return error if email is not present
-        if not email:
-            exc = AuthenticationException(
-                error_code=AUTHENTICATION_ERROR_CODES["EMAIL_REQUIRED"],
-                error_message="EMAIL_REQUIRED",
-            )
-            return Response(
-                exc.get_error_dict(),
-                status=status.HTTP_400_BAD_REQUEST,
-            )
-
-        # Validate email
         try:
+            # Check instance configuration
+            instance = Instance.objects.first()
+            if instance is None or not instance.is_setup_done:
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES[
+                        "INSTANCE_NOT_CONFIGURED"
+                    ],
+                    error_message="INSTANCE_NOT_CONFIGURED",
+                )
+
+            email = request.data.get("email", False)
+
+            # Return error if email is not present
+            if not email:
+                raise AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES["EMAIL_REQUIRED"],
+                    error_message="EMAIL_REQUIRED",
+                )
+
+            # Validate email
             validate_email(email)
+
+            existing_user = User.objects.filter(email=email).first()
+
+            # If existing user
+            if existing_user:
+                # Raise different exception when user is not active
+                if not existing_user.is_active:
+                    raise AuthenticationException(
+                        error_code=AUTHENTICATION_ERROR_CODES[
+                            "USER_ACCOUNT_DEACTIVATED"
+                        ],
+                        error_message="USER_ACCOUNT_DEACTIVATED",
+                    )
+
+                return Response(
+                    {
+                        "status": True,
+                        "is_password_autoset": existing_user.is_password_autoset,
+                    },
+                    status=status.HTTP_200_OK,
+                )
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+                error_message="USER_DOES_NOT_EXIST",
+            )
         except ValidationError:
-            exc = AuthenticationException(
+            raise AuthenticationException(
                 error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
                 error_message="INVALID_EMAIL",
             )
+        except AuthenticationException as e:
             return Response(
-                exc.get_error_dict(),
-                status=status.HTTP_400_BAD_REQUEST,
+                e.get_error_dict(), status=status.HTTP_400_BAD_REQUEST
             )
-
-        existing_user = User.objects.filter(email=email).first()
-
-        if existing_user:
-            return Response(
-                {
-                    "status": True,
-                    "is_password_autoset": existing_user.is_password_autoset,
-                },
-                status=status.HTTP_200_OK,
-            )
-        exc = AuthenticationException(
-            error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
-            error_message="USER_DOES_NOT_EXIST",
-        )
-        return Response(
-            exc.get_error_dict(),
-            status=status.HTTP_400_BAD_REQUEST,
-        )

apiserver/plane/authentication/views/app/email.py

@@ -90,7 +90,9 @@ class SignInAuthEndpoint(View):
             )
             return HttpResponseRedirect(url)
 
-        if not User.objects.filter(email=email).exists():
+        existing_user = User.objects.filter(email=email).first()
+
+        if not existing_user:
             exc = AuthenticationException(
                 error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
                 error_message="USER_DOES_NOT_EXIST",
@@ -105,6 +107,22 @@ class SignInAuthEndpoint(View):
             )
             return HttpResponseRedirect(url)
 
+        if not existing_user.is_active:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES[
+                    "USER_ACCOUNT_DEACTIVATED"
+                ],
+                error_message="USER_ACCOUNT_DEACTIVATED",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(next_path)
+            url = urljoin(
+                base_host(request=request, is_app=True),
+                "sign-in?" + urlencode(params),
+            )
+            return HttpResponseRedirect(url)
+
         try:
             provider = EmailProvider(
                 request=request, key=email, code=password, is_signup=False
@@ -197,7 +215,26 @@ class SignUpAuthEndpoint(View):
             )
             return HttpResponseRedirect(url)
 
-        if User.objects.filter(email=email).exists():
+        existing_user = User.objects.filter(email=email).first()
+
+        if existing_user:
+            # Existing User
+            if not existing_user.is_active:
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES[
+                        "USER_ACCOUNT_DEACTIVATED"
+                    ],
+                    error_message="USER_ACCOUNT_DEACTIVATED",
+                )
+                params = exc.get_error_dict()
+                if next_path:
+                    params["next_path"] = str(next_path)
+                url = urljoin(
+                    base_host(request=request, is_app=True),
+                    "?" + urlencode(params),
+                )
+                return HttpResponseRedirect(url)
+
             exc = AuthenticationException(
                 error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
                 error_message="USER_ALREADY_EXIST",

apiserver/plane/authentication/views/app/magic.py

@@ -95,7 +95,26 @@ class MagicSignInEndpoint(View):
             )
             return HttpResponseRedirect(url)
 
-        if not User.objects.filter(email=email).exists():
+        # Existing User
+        existing_user = User.objects.filter(email=email).first()
+
+        if not existing_user:
+            if not existing_user.is_active:
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES[
+                        "USER_ACCOUNT_DEACTIVATED"
+                    ],
+                    error_message="USER_ACCOUNT_DEACTIVATED",
+                )
+                params = exc.get_error_dict()
+                if next_path:
+                    params["next_path"] = str(next_path)
+                url = urljoin(
+                    base_host(request=request, is_app=True),
+                    "sign-in?" + urlencode(params),
+                )
+                return HttpResponseRedirect(url)
+
             exc = AuthenticationException(
                 error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
                 error_message="USER_DOES_NOT_EXIST",
@@ -167,8 +186,25 @@ class MagicSignUpEndpoint(View):
                 "?" + urlencode(params),
             )
             return HttpResponseRedirect(url)
+        # Existing user
+        existing_user = User.objects.filter(email=email).first()
+        if not existing_user:
+            if not existing_user.is_active:
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES[
+                        "USER_ACCOUNT_DEACTIVATED"
+                    ],
+                    error_message="USER_ACCOUNT_DEACTIVATED",
+                )
+                params = exc.get_error_dict()
+                if next_path:
+                    params["next_path"] = str(next_path)
+                url = urljoin(
+                    base_host(request=request, is_app=True),
+                    "?" + urlencode(params),
+                )
+                return HttpResponseRedirect(url)
 
-        if User.objects.filter(email=email).exists():
             exc = AuthenticationException(
                 error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
                 error_message="USER_ALREADY_EXIST",

apiserver/plane/authentication/views/app/password_management.py

@@ -63,23 +63,13 @@ class ForgotPasswordEndpoint(APIView):
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
-        (EMAIL_HOST, EMAIL_HOST_USER, EMAIL_HOST_PASSWORD) = (
-            get_configuration_value(
-                [
-                    {
-                        "key": "EMAIL_HOST",
-                        "default": os.environ.get("EMAIL_HOST"),
-                    },
-                    {
-                        "key": "EMAIL_HOST_USER",
-                        "default": os.environ.get("EMAIL_HOST_USER"),
-                    },
-                    {
-                        "key": "EMAIL_HOST_PASSWORD",
-                        "default": os.environ.get("EMAIL_HOST_PASSWORD"),
-                    },
-                ]
-            )
+        (EMAIL_HOST,) = get_configuration_value(
+            [
+                {
+                    "key": "EMAIL_HOST",
+                    "default": os.environ.get("EMAIL_HOST"),
+                },
+            ]
         )
 
         if not (EMAIL_HOST):

apiserver/plane/authentication/views/common.py

@@ -36,55 +36,60 @@ class CSRFTokenEndpoint(APIView):
 
 class ChangePasswordEndpoint(APIView):
     def post(self, request):
-        serializer = ChangePasswordSerializer(data=request.data)
         user = User.objects.get(pk=request.user.id)
-        if serializer.is_valid():
-            if not user.check_password(serializer.data.get("old_password")):
-                exc = AuthenticationException(
-                    error_code=AUTHENTICATION_ERROR_CODES[
-                        "INCORRECT_OLD_PASSWORD"
-                    ],
-                    error_message="INCORRECT_OLD_PASSWORD",
-                    payload={"error": "Old password is not correct"},
-                )
-                return Response(
-                    exc.get_error_dict(),
-                    status=status.HTTP_400_BAD_REQUEST,
-                )
 
-            # check the password score
-            results = zxcvbn(serializer.data.get("new_password"))
-            if results["score"] < 3:
-                exc = AuthenticationException(
-                    error_code=AUTHENTICATION_ERROR_CODES[
-                        "INVALID_NEW_PASSWORD"
-                    ],
-                    error_message="INVALID_NEW_PASSWORD",
-                )
-                return Response(
-                    exc.get_error_dict(),
-                    status=status.HTTP_400_BAD_REQUEST,
-                )
+        old_password = request.data.get("old_password", False)
+        new_password = request.data.get("new_password", False)
 
-            # set_password also hashes the password that the user will get
-            user.set_password(serializer.data.get("new_password"))
-            user.is_password_autoset = False
-            user.save()
-            user_login(user=user, request=request, is_app=True)
-            return Response(
-                {"message": "Password updated successfully"},
-                status=status.HTTP_200_OK,
+        if not old_password or not new_password:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["MISSING_PASSWORD"],
+                error_message="MISSING_PASSWORD",
+                payload={"error": "Old or new password is missing"},
+            )
+            return Response(
+                exc.get_error_dict(),
+                status=status.HTTP_400_BAD_REQUEST,
             )
-        exc = AuthenticationException(
-            error_code=AUTHENTICATION_ERROR_CODES["INVALID_PASSWORD"],
-            error_message="INVALID_PASSWORD",
-        )
-        return Response(
-            exc.get_error_dict(),
-            status=status.HTTP_400_BAD_REQUEST,
-        )
 
 
+        if not user.check_password(old_password):
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES[
+                    "INCORRECT_OLD_PASSWORD"
+                ],
+                error_message="INCORRECT_OLD_PASSWORD",
+                payload={"error": "Old password is not correct"},
+            )
+            return Response(
+                exc.get_error_dict(),
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        # check the password score
+        results = zxcvbn(new_password)
+        if results["score"] < 3:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES[
+                    "INVALID_NEW_PASSWORD"
+                ],
+                error_message="INVALID_NEW_PASSWORD",
+            )
+            return Response(
+                exc.get_error_dict(),
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        # set_password also hashes the password that the user will get
+        user.set_password(new_password)
+        user.is_password_autoset = False
+        user.save()
+        user_login(user=user, request=request, is_app=True)
+        return Response(
+            {"message": "Password updated successfully"},
+            status=status.HTTP_200_OK,
+        )
+
 class SetUserPasswordEndpoint(APIView):
     def post(self, request):
         user = User.objects.get(pk=request.user.id)

apiserver/plane/authentication/views/space/check.py

@@ -68,6 +68,17 @@ class EmailCheckEndpoint(APIView):
 
         # If existing user
         if existing_user:
+            if not existing_user.is_active:
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES[
+                        "USER_ACCOUNT_DEACTIVATED"
+                    ],
+                    error_message="USER_ACCOUNT_DEACTIVATED",
+                )
+                return Response(
+                    exc.get_error_dict(), status=status.HTTP_400_BAD_REQUEST
+                )
+
             return Response(
                 {
                     "existing": True,

apiserver/plane/authentication/views/space/email.py

@@ -83,7 +83,10 @@ class SignInAuthSpaceEndpoint(View):
             )
             return HttpResponseRedirect(url)
 
-        if not User.objects.filter(email=email).exists():
+        # Existing User
+        existing_user = User.objects.filter(email=email).first()
+
+        if not existing_user:
             exc = AuthenticationException(
                 error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
                 error_message="USER_DOES_NOT_EXIST",
@@ -98,6 +101,22 @@ class SignInAuthSpaceEndpoint(View):
             )
             return HttpResponseRedirect(url)
 
+        if not existing_user.is_active:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES[
+                    "USER_ACCOUNT_DEACTIVATED"
+                ],
+                error_message="USER_ACCOUNT_DEACTIVATED",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(next_path)
+            url = urljoin(
+                base_host(request=request, is_space=True),
+                "?" + urlencode(params),
+            )
+            return HttpResponseRedirect(url)
+
         try:
             provider = EmailProvider(
                 request=request, key=email, code=password, is_signup=False
@@ -185,7 +204,26 @@ class SignUpAuthSpaceEndpoint(View):
             )
             return HttpResponseRedirect(url)
 
-        if User.objects.filter(email=email).exists():
+        # Existing User
+        existing_user = User.objects.filter(email=email).first()
+
+        if existing_user:
+            if not existing_user.is_active:
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES[
+                        "USER_ACCOUNT_DEACTIVATED"
+                    ],
+                    error_message="USER_ACCOUNT_DEACTIVATED",
+                )
+                params = exc.get_error_dict()
+                if next_path:
+                    params["next_path"] = str(next_path)
+                url = urljoin(
+                    base_host(request=request, is_space=True),
+                    "?" + urlencode(params),
+                )
+                return HttpResponseRedirect(url)
+
             exc = AuthenticationException(
                 error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
                 error_message="USER_ALREADY_EXIST",

apiserver/plane/authentication/views/space/magic.py

@@ -90,11 +90,14 @@ class MagicSignInSpaceEndpoint(View):
             )
             return HttpResponseRedirect(url)
 
-        if not User.objects.filter(email=email).exists():
-            params = {
-                "error_code": "USER_DOES_NOT_EXIST",
-                "error_message": "User could not be found with the given email.",
-            }
+        existing_user = User.objects.filter(email=email).first()
+
+        if not existing_user:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["USER_DOES_NOT_EXIST"],
+                error_message="USER_DOES_NOT_EXIST",
+            )
+            params = exc.get_error_dict()
             if next_path:
                 params["next_path"] = str(next_path)
             url = urljoin(
@@ -103,6 +106,22 @@ class MagicSignInSpaceEndpoint(View):
             )
             return HttpResponseRedirect(url)
 
+        # Active User
+        if not existing_user.is_active:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES[
+                    "USER_ACCOUNT_DEACTIVATED"
+                ],
+                error_message="USER_ACCOUNT_DEACTIVATED",
+            )
+            params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(next_path)
+            url = urljoin(
+                base_host(request=request, is_space=True),
+                "?" + urlencode(params),
+            )
+            return HttpResponseRedirect(url)
         try:
             provider = MagicCodeProvider(
                 request=request, key=f"magic_{email}", code=code
@@ -155,8 +174,25 @@ class MagicSignUpSpaceEndpoint(View):
                 "?" + urlencode(params),
             )
             return HttpResponseRedirect(url)
+        # Existing User
+        existing_user = User.objects.filter(email=email).first()
+        if existing_user:
+            if not existing_user.is_active:
+                exc = AuthenticationException(
+                    error_code=AUTHENTICATION_ERROR_CODES[
+                        "USER_ACCOUNT_DEACTIVATED"
+                    ],
+                    error_message="USER_ACCOUNT_DEACTIVATED",
+                )
+                params = exc.get_error_dict()
+                if next_path:
+                    params["next_path"] = str(next_path)
+                url = urljoin(
+                    base_host(request=request, is_space=True),
+                    "?" + urlencode(params),
+                )
+                return HttpResponseRedirect(url)
 
-        if User.objects.filter(email=email).exists():
             exc = AuthenticationException(
                 error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
                 error_message="USER_ALREADY_EXIST",

apiserver/plane/authentication/views/space/signout.py

@@ -1,6 +1,3 @@
-# Python imports
-from urllib.parse import urlencode, urljoin
-
 # Django imports
 from django.views import View
 from django.contrib.auth import logout

apiserver/plane/db/management/commands/test_email.py

@@ -1,6 +1,9 @@
 from django.core.mail import EmailMultiAlternatives, get_connection
 from django.core.management import BaseCommand, CommandError
+from django.template.loader import render_to_string
+from django.utils.html import strip_tags
 
+# Module imports
 from plane.license.utils.instance_value import get_email_configuration
 
 
@@ -37,10 +40,10 @@ class Command(BaseCommand):
             timeout=30,
         )
         # Prepare email details
-        subject = "Email Notification from Plane"
-        message = (
-            "This is a sample email notification sent from Plane application."
-        )
+        subject = "Test email from Plane"
+
+        html_content = render_to_string("emails/test_email.html")
+        text_content = strip_tags(html_content)
 
         self.stdout.write(self.style.SUCCESS("Trying to send test email..."))
 
@@ -48,11 +51,14 @@ class Command(BaseCommand):
         try:
             msg = EmailMultiAlternatives(
                 subject=subject,
-                body=message,
+                body=text_content,
                 from_email=EMAIL_FROM,
-                to=[receiver_email],
+                to=[
+                    receiver_email,
+                ],
                 connection=connection,
             )
+            msg.attach_alternative(html_content, "text/html")
             msg.send()
             self.stdout.write(self.style.SUCCESS("Email successfully sent"))
         except Exception as e:

apiserver/plane/license/api/views/admin.py

@@ -316,6 +316,20 @@ class InstanceAdminSignInEndpoint(View):
         # Fetch the user
         user = User.objects.filter(email=email).first()
 
+        # is_active
+        if not user.is_active:
+            exc = AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES[
+                    "ADMIN_USER_DEACTIVATED"
+                ],
+                error_message="ADMIN_USER_DEACTIVATED",
+            )
+            url = urljoin(
+                base_host(request=request, is_admin=True),
+                "?" + urlencode(exc.get_error_dict()),
+            )
+            return HttpResponseRedirect(url)
+
         # Error out if the user is not present
         if not user:
             exc = AuthenticationException(

apiserver/templates/emails/test_email.html

@@ -0,0 +1,6 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 
+<html>
+    <p>This is a test email sent to verify if email configuration is working as expected in your Plane instance.</p>
+
+<p>Regards,</br> Team Plane </p>
+</html>

nginx/nginx.conf.dev

@@ -28,7 +28,7 @@ http {
         }
 
         location /god-mode/ {
-            proxy_pass http://admin:3000/god-mode/;
+            proxy_pass http://admin:3001/god-mode/;
         }
 
         location /api/ {
@@ -45,7 +45,7 @@ http {
 
         location /spaces/ {
             rewrite ^/spaces/?$ /spaces/login break;
-            proxy_pass http://space:4000/spaces/;
+            proxy_pass http://space:3002/spaces/;
         }
 
         location /${BUCKET_NAME}/ {

package.json

@@ -12,7 +12,8 @@
     "packages/tailwind-config-custom",
     "packages/tsconfig",
     "packages/ui",
-    "packages/types"
+    "packages/types",
+    "packages/constants"
   ],
   "scripts": {
     "build": "turbo run build",
@@ -25,7 +26,7 @@
   "devDependencies": {
     "autoprefixer": "^10.4.15",
     "eslint-config-custom": "*",
-    "postcss": "^8.4.38",
+    "postcss": "^8.4.29",
     "prettier": "latest",
     "prettier-plugin-tailwindcss": "^0.5.4",
     "tailwindcss": "^3.3.3",

packages/constants/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@plane/constants",
+  "version": "0.0.1",
+  "private": true,
+  "main": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts",
+    "./*": "./src/*"
+  }
+}

packages/constants/src/auth.ts

@@ -0,0 +1,371 @@
+import { ReactNode } from "react";
+import Link from "next/link";
+
+export enum EPageTypes {
+  PUBLIC = "PUBLIC",
+  NON_AUTHENTICATED = "NON_AUTHENTICATED",
+  SET_PASSWORD = "SET_PASSWORD",
+  ONBOARDING = "ONBOARDING",
+  AUTHENTICATED = "AUTHENTICATED",
+}
+
+export enum EAuthModes {
+  SIGN_IN = "SIGN_IN",
+  SIGN_UP = "SIGN_UP",
+}
+
+export enum EAuthSteps {
+  EMAIL = "EMAIL",
+  PASSWORD = "PASSWORD",
+  UNIQUE_CODE = "UNIQUE_CODE",
+}
+
+// TODO: remove this
+export enum EErrorAlertType {
+  BANNER_ALERT = "BANNER_ALERT",
+  INLINE_FIRST_NAME = "INLINE_FIRST_NAME",
+  INLINE_EMAIL = "INLINE_EMAIL",
+  INLINE_PASSWORD = "INLINE_PASSWORD",
+  INLINE_EMAIL_CODE = "INLINE_EMAIL_CODE",
+}
+
+export enum EAuthErrorCodes {
+  // Global
+  INSTANCE_NOT_CONFIGURED = "5000",
+  INVALID_EMAIL = "5005",
+  EMAIL_REQUIRED = "5010",
+  SIGNUP_DISABLED = "5015",
+  MAGIC_LINK_LOGIN_DISABLED = "5017",
+  PASSWORD_LOGIN_DISABLED = "5019",
+  SMTP_NOT_CONFIGURED = "5025",
+  // Password strength
+  INVALID_PASSWORD = "5020",
+  // Sign Up
+  USER_ACCOUNT_DEACTIVATED = "5019",
+  USER_ALREADY_EXIST = "5030",
+  AUTHENTICATION_FAILED_SIGN_UP = "5035",
+  REQUIRED_EMAIL_PASSWORD_SIGN_UP = "5040",
+  INVALID_EMAIL_SIGN_UP = "5045",
+  INVALID_EMAIL_MAGIC_SIGN_UP = "5050",
+  MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED = "5055",
+  // Sign In
+  USER_DOES_NOT_EXIST = "5060",
+  AUTHENTICATION_FAILED_SIGN_IN = "5065",
+  REQUIRED_EMAIL_PASSWORD_SIGN_IN = "5070",
+  INVALID_EMAIL_SIGN_IN = "5075",
+  INVALID_EMAIL_MAGIC_SIGN_IN = "5080",
+  MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED = "5085",
+  // Both Sign in and Sign up for magic
+  INVALID_MAGIC_CODE = "5090",
+  EXPIRED_MAGIC_CODE = "5095",
+  EMAIL_CODE_ATTEMPT_EXHAUSTED = "5100",
+  // Oauth
+  GOOGLE_NOT_CONFIGURED = "5105",
+  GITHUB_NOT_CONFIGURED = "5110",
+  GOOGLE_OAUTH_PROVIDER_ERROR = "5115",
+  GITHUB_OAUTH_PROVIDER_ERROR = "5120",
+  // Reset Password
+  INVALID_PASSWORD_TOKEN = "5125",
+  EXPIRED_PASSWORD_TOKEN = "5130",
+  // Change password
+  INCORRECT_OLD_PASSWORD = "5135",
+  MISSING_PASSWORD= "5138",
+  INVALID_NEW_PASSWORD = "5140",
+  // set passowrd
+  PASSWORD_ALREADY_SET = "5145",
+  // Admin
+  ADMIN_ALREADY_EXIST = "5150",
+  REQUIRED_ADMIN_EMAIL_PASSWORD_FIRST_NAME = "5155",
+  INVALID_ADMIN_EMAIL = "5160",
+  INVALID_ADMIN_PASSWORD = "5165",
+  REQUIRED_ADMIN_EMAIL_PASSWORD = "5170",
+  ADMIN_AUTHENTICATION_FAILED = "5175",
+  ADMIN_USER_ALREADY_EXIST = "5180",
+  ADMIN_USER_DOES_NOT_EXIST = "5185",
+}
+
+export type TAuthErrorInfo = {
+  type: EErrorAlertType;
+  code: EAuthErrorCodes;
+  title: string;
+  message: ReactNode;
+};
+
+const errorCodeMessages: {
+  [key in EAuthErrorCodes]: { title: string; message: (email?: string | undefined) => ReactNode };
+} = {
+  // global
+  [EAuthErrorCodes.INSTANCE_NOT_CONFIGURED]: {
+    title: `Instance not configured`,
+    message: () => `Instance not configured. Please contact your administrator.`,
+  },
+  [EAuthErrorCodes.SIGNUP_DISABLED]: {
+    title: `Sign up disabled`,
+    message: () => `Sign up disabled. Please contact your administrator.`,
+  },
+  [EAuthErrorCodes.INVALID_PASSWORD]: {
+    title: `Invalid password`,
+    message: () => `Invalid password. Please try again.`,
+  },
+  [EAuthErrorCodes.SMTP_NOT_CONFIGURED]: {
+    title: `SMTP not configured`,
+    message: () => `SMTP not configured. Please contact your administrator.`,
+  },
+
+  // email check in both sign up and sign in
+  [EAuthErrorCodes.INVALID_EMAIL]: {
+    title: `Invalid email`,
+    message: () => `Invalid email. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.EMAIL_REQUIRED]: {
+    title: `Email required`,
+    message: () => `Email required. Please try again.`,
+  },
+
+  // sign up
+  [EAuthenticationErrorCodes.USER_ALREADY_EXIST]: {
+    title: `User already exists`,
+    message: (email = undefined) => (
+      <div>
+        Your account is already registered.&nbsp;
+        <Link
+          className="underline underline-offset-4 font-medium hover:font-bold transition-all"
+          href={`/sign-in${email ? `?email=${email}` : ``}`}
+        >
+          Sign In
+        </Link>
+        &nbsp;now.
+      </div>
+    ),
+  },
+  [EAuthenticationErrorCodes.REQUIRED_EMAIL_PASSWORD_SIGN_UP]: {
+    title: `Email and password required`,
+    message: () => `Email and password required. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.AUTHENTICATION_FAILED_SIGN_UP]: {
+    title: `Authentication failed`,
+    message: () => `Authentication failed. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.INVALID_EMAIL_SIGN_UP]: {
+    title: `Invalid email`,
+    message: () => `Invalid email. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED]: {
+    title: `Email and code required`,
+    message: () => `Email and code required. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.INVALID_EMAIL_MAGIC_SIGN_UP]: {
+    title: `Invalid email`,
+    message: () => `Invalid email. Please try again.`,
+  },
+
+  // sign in
+  [EAuthenticationErrorCodes.USER_ACCOUNT_DEACTIVATED]: {
+    title: `User account deactivated`,
+    message: () => <div>Your account is deactivated. Contact support@plane.so.</div>,
+  },
+  [EAuthenticationErrorCodes.USER_DOES_NOT_EXIST]: {
+    title: `User does not exist`,
+    message: (email = undefined) => (
+      <div>
+        No account found.&nbsp;
+        <Link
+          className="underline underline-offset-4 font-medium hover:font-bold transition-all"
+          href={`/${email ? `?email=${email}` : ``}`}
+        >
+          Create one
+        </Link>
+        &nbsp;to get started.
+      </div>
+    ),
+  },
+  [EAuthenticationErrorCodes.REQUIRED_EMAIL_PASSWORD_SIGN_IN]: {
+    title: `Email and password required`,
+    message: () => `Email and password required. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.AUTHENTICATION_FAILED_SIGN_IN]: {
+    title: `Authentication failed`,
+    message: () => `Authentication failed. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.INVALID_EMAIL_SIGN_IN]: {
+    title: `Invalid email`,
+    message: () => `Invalid email. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED]: {
+    title: `Email and code required`,
+    message: () => `Email and code required. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.INVALID_EMAIL_MAGIC_SIGN_IN]: {
+    title: `Invalid email`,
+    message: () => `Invalid email. Please try again.`,
+  },
+
+  // Both Sign in and Sign up
+  [EAuthenticationErrorCodes.INVALID_MAGIC_CODE]: {
+    title: `Authentication failed`,
+    message: () => `Invalid magic code. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.EXPIRED_MAGIC_CODE]: {
+    title: `Expired magic code`,
+    message: () => `Expired magic code. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.EMAIL_CODE_ATTEMPT_EXHAUSTED]: {
+    title: `Expired magic code`,
+    message: () => `Expired magic code. Please try again.`,
+  },
+
+  // Oauth
+  [EAuthenticationErrorCodes.GOOGLE_NOT_CONFIGURED]: {
+    title: `Google not configured`,
+    message: () => `Google not configured. Please contact your administrator.`,
+  },
+  [EAuthenticationErrorCodes.GITHUB_NOT_CONFIGURED]: {
+    title: `GitHub not configured`,
+    message: () => `GitHub not configured. Please contact your administrator.`,
+  },
+  [EAuthenticationErrorCodes.GOOGLE_OAUTH_PROVIDER_ERROR]: {
+    title: `Google OAuth provider error`,
+    message: () => `Google OAuth provider error. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.GITHUB_OAUTH_PROVIDER_ERROR]: {
+    title: `GitHub OAuth provider error`,
+    message: () => `GitHub OAuth provider error. Please try again.`,
+  },
+
+  // Reset Password
+  [EAuthenticationErrorCodes.INVALID_PASSWORD_TOKEN]: {
+    title: `Invalid password token`,
+    message: () => `Invalid password token. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.EXPIRED_PASSWORD_TOKEN]: {
+    title: `Expired password token`,
+    message: () => `Expired password token. Please try again.`,
+  },
+
+  // Change password
+
+  [EAuthenticationErrorCodes.MISSING_PASSWORD]: {
+    title: `Password required`,
+    message: () => `Password required. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.INCORRECT_OLD_PASSWORD]: {
+    title: `Incorrect old password`,
+    message: () => `Incorrect old password. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.INVALID_NEW_PASSWORD]: {
+    title: `Invalid new password`,
+    message: () => `Invalid new password. Please try again.`,
+  },
+
+  // set password
+  [EAuthenticationErrorCodes.PASSWORD_ALREADY_SET]: {
+    title: `Password already set`,
+    message: () => `Password already set. Please try again.`,
+  },
+
+  // admin
+  [EAuthenticationErrorCodes.ADMIN_ALREADY_EXIST]: {
+    title: `Admin already exists`,
+    message: () => `Admin already exists. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.REQUIRED_ADMIN_EMAIL_PASSWORD_FIRST_NAME]: {
+    title: `Email, password and first name required`,
+    message: () => `Email, password and first name required. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.INVALID_ADMIN_EMAIL]: {
+    title: `Invalid admin email`,
+    message: () => `Invalid admin email. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.INVALID_ADMIN_PASSWORD]: {
+    title: `Invalid admin password`,
+    message: () => `Invalid admin password. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.REQUIRED_ADMIN_EMAIL_PASSWORD]: {
+    title: `Email and password required`,
+    message: () => `Email and password required. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.ADMIN_AUTHENTICATION_FAILED]: {
+    title: `Authentication failed`,
+    message: () => `Authentication failed. Please try again.`,
+  },
+  [EAuthenticationErrorCodes.ADMIN_USER_ALREADY_EXIST]: {
+    title: `Admin user already exists`,
+    message: () => (
+      <div>
+        Admin user already exists.&nbsp;
+        <Link className="underline underline-offset-4 font-medium hover:font-bold transition-all" href={`/admin`}>
+          Sign In
+        </Link>
+        &nbsp;now.
+      </div>
+    ),
+  },
+  [EAuthenticationErrorCodes.ADMIN_USER_DOES_NOT_EXIST]: {
+    title: `Admin user does not exist`,
+    message: () => (
+      <div>
+        Admin user does not exist.&nbsp;
+        <Link className="underline underline-offset-4 font-medium hover:font-bold transition-all" href={`/admin`}>
+          Sign In
+        </Link>
+        &nbsp;now.
+      </div>
+    ),
+  },
+};
+
+export const authErrorHandler = (
+  errorCode: EAuthenticationErrorCodes,
+  email?: string | undefined
+): TAuthErrorInfo | undefined => {
+  const bannerAlertErrorCodes = [
+    EAuthenticationErrorCodes.INSTANCE_NOT_CONFIGURED,
+    EAuthenticationErrorCodes.INVALID_EMAIL,
+    EAuthenticationErrorCodes.EMAIL_REQUIRED,
+    EAuthenticationErrorCodes.SIGNUP_DISABLED,
+    EAuthenticationErrorCodes.INVALID_PASSWORD,
+    EAuthenticationErrorCodes.SMTP_NOT_CONFIGURED,
+    EAuthenticationErrorCodes.USER_ALREADY_EXIST,
+    EAuthenticationErrorCodes.AUTHENTICATION_FAILED_SIGN_UP,
+    EAuthenticationErrorCodes.REQUIRED_EMAIL_PASSWORD_SIGN_UP,
+    EAuthenticationErrorCodes.INVALID_EMAIL_SIGN_UP,
+    EAuthenticationErrorCodes.INVALID_EMAIL_MAGIC_SIGN_UP,
+    EAuthenticationErrorCodes.MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED,
+    EAuthenticationErrorCodes.USER_DOES_NOT_EXIST,
+    EAuthenticationErrorCodes.AUTHENTICATION_FAILED_SIGN_IN,
+    EAuthenticationErrorCodes.REQUIRED_EMAIL_PASSWORD_SIGN_IN,
+    EAuthenticationErrorCodes.INVALID_EMAIL_SIGN_IN,
+    EAuthenticationErrorCodes.INVALID_EMAIL_MAGIC_SIGN_IN,
+    EAuthenticationErrorCodes.MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED,
+    EAuthenticationErrorCodes.INVALID_MAGIC_CODE,
+    EAuthenticationErrorCodes.EXPIRED_MAGIC_CODE,
+    EAuthenticationErrorCodes.EMAIL_CODE_ATTEMPT_EXHAUSTED,
+    EAuthenticationErrorCodes.GOOGLE_NOT_CONFIGURED,
+    EAuthenticationErrorCodes.GITHUB_NOT_CONFIGURED,
+    EAuthenticationErrorCodes.GOOGLE_OAUTH_PROVIDER_ERROR,
+    EAuthenticationErrorCodes.GITHUB_OAUTH_PROVIDER_ERROR,
+    EAuthenticationErrorCodes.INVALID_PASSWORD_TOKEN,
+    EAuthenticationErrorCodes.EXPIRED_PASSWORD_TOKEN,
+    EAuthenticationErrorCodes.INCORRECT_OLD_PASSWORD,
+    EAuthenticationErrorCodes.INVALID_NEW_PASSWORD,
+    EAuthenticationErrorCodes.PASSWORD_ALREADY_SET,
+    EAuthenticationErrorCodes.ADMIN_ALREADY_EXIST,
+    EAuthenticationErrorCodes.REQUIRED_ADMIN_EMAIL_PASSWORD_FIRST_NAME,
+    EAuthenticationErrorCodes.INVALID_ADMIN_EMAIL,
+    EAuthenticationErrorCodes.INVALID_ADMIN_PASSWORD,
+    EAuthenticationErrorCodes.REQUIRED_ADMIN_EMAIL_PASSWORD,
+    EAuthenticationErrorCodes.ADMIN_AUTHENTICATION_FAILED,
+    EAuthenticationErrorCodes.ADMIN_USER_ALREADY_EXIST,
+    EAuthenticationErrorCodes.ADMIN_USER_DOES_NOT_EXIST,
+  ];
+
+  if (bannerAlertErrorCodes.includes(errorCode))
+    return {
+      type: EErrorAlertType.BANNER_ALERT,
+      code: errorCode,
+      title: errorCodeMessages[errorCode]?.title || "Error",
+      message: errorCodeMessages[errorCode]?.message(email) || "Something went wrong. Please try again.",
+    };
+
+  return undefined;
+};

packages/constants/src/index.ts

@@ -0,0 +1 @@
+export * from "./auth";

space/components/accounts/auth-forms/unique-code.tsx

@@ -151,6 +151,7 @@ export const UniqueCodeForm: React.FC<Props> = (props) => {
           placeholder="gets-sets-flys"
           className="h-[46px] w-full border border-onboarding-border-100 !bg-onboarding-background-200 pr-12 placeholder:text-onboarding-text-400"
           autoFocus
+          autoComplete="off"
         />
         <div className="flex w-full items-center justify-between px-1 text-xs">
           <p className="flex items-center gap-1 font-medium text-green-700">

space/components/issues/navbar/index.tsx

@@ -40,7 +40,7 @@ const IssueNavbar: FC<IssueNavbarProps> = observer((props) => {
   useEffect(() => {
     if (workspaceSlug && projectId && settings) {
       const viewsAcceptable: string[] = [];
-      let currentBoard: TIssueBoardKeys | null = null;
+      const currentBoard: TIssueBoardKeys | null = null;
 
       if (settings?.views?.list) viewsAcceptable.push("list");
       if (settings?.views?.kanban) viewsAcceptable.push("kanban");
@@ -48,19 +48,19 @@ const IssueNavbar: FC<IssueNavbarProps> = observer((props) => {
       if (settings?.views?.gantt) viewsAcceptable.push("gantt");
       if (settings?.views?.spreadsheet) viewsAcceptable.push("spreadsheet");
 
-      if (board) {
-        if (viewsAcceptable.includes(board.toString())) {
-          currentBoard = board.toString() as TIssueBoardKeys;
-        } else {
-          if (viewsAcceptable && viewsAcceptable.length > 0) {
-            currentBoard = viewsAcceptable[0] as TIssueBoardKeys;
-          }
-        }
-      } else {
-        if (viewsAcceptable && viewsAcceptable.length > 0) {
-          currentBoard = viewsAcceptable[0] as TIssueBoardKeys;
-        }
-      }
+      //     if (board) {
+      //       if (viewsAcceptable.includes(board.toString())) {
+      //         currentBoard = board.toString() as TIssueBoardKeys;
+      //       } else {
+      //         if (viewsAcceptable && viewsAcceptable.length > 0) {
+      //           currentBoard = viewsAcceptable[0] as TIssueBoardKeys;
+      //         }
+      //       }
+      //     } else {
+      //       if (viewsAcceptable && viewsAcceptable.length > 0) {
+      //         currentBoard = viewsAcceptable[0] as TIssueBoardKeys;
+      //       }
+      //     }
 
       if (currentBoard) {
         if (activeLayout === null || activeLayout !== currentBoard) {

space/helpers/authentication.helper.tsx

@@ -39,12 +39,12 @@ export enum EAuthenticationErrorCodes {
   INVALID_EMAIL = "5012",
   EMAIL_REQUIRED = "5013",
   // Sign Up
+  USER_ACCOUNT_DEACTIVATED = "5019",
   USER_ALREADY_EXIST = "5003",
   REQUIRED_EMAIL_PASSWORD_SIGN_UP = "5015",
   AUTHENTICATION_FAILED_SIGN_UP = "5006",
   INVALID_EMAIL_SIGN_UP = "5017",
   MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED = "5023",
-  INVALID_EMAIL_MAGIC_SIGN_UP = "5019",
   // Sign In
   USER_DOES_NOT_EXIST = "5004",
   REQUIRED_EMAIL_PASSWORD_SIGN_IN = "5014",
@@ -140,12 +140,14 @@ const errorCodeMessages: {
     title: `Email and code required`,
     message: () => `Email and code required. Please try again.`,
   },
-  [EAuthenticationErrorCodes.INVALID_EMAIL_MAGIC_SIGN_UP]: {
-    title: `Invalid email`,
-    message: () => `Invalid email. Please try again.`,
-  },
 
   // sign in
+
+  [EAuthenticationErrorCodes.USER_ACCOUNT_DEACTIVATED]: {
+    title: `User account deactivated`,
+    message: () => <div>Your account is deactivated. Please reach out to support@plane.so</div>,
+  },
+
   [EAuthenticationErrorCodes.USER_DOES_NOT_EXIST]: {
     title: `User does not exist`,
     message: (email = undefined) => (
@@ -250,7 +252,6 @@ export const authErrorHandler = (
     EAuthenticationErrorCodes.AUTHENTICATION_FAILED_SIGN_UP,
     EAuthenticationErrorCodes.INVALID_EMAIL_SIGN_UP,
     EAuthenticationErrorCodes.MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED,
-    EAuthenticationErrorCodes.INVALID_EMAIL_MAGIC_SIGN_UP,
     EAuthenticationErrorCodes.AUTHENTICATION_FAILED_SIGN_IN,
     EAuthenticationErrorCodes.INVALID_EMAIL_SIGN_IN,
     EAuthenticationErrorCodes.INVALID_EMAIL_MAGIC_SIGN_IN,
@@ -273,6 +274,7 @@ export const authErrorHandler = (
     EAuthenticationErrorCodes.REQUIRED_EMAIL_PASSWORD_SIGN_UP,
     EAuthenticationErrorCodes.REQUIRED_EMAIL_PASSWORD_SIGN_IN,
     EAuthenticationErrorCodes.MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED,
+    EAuthenticationErrorCodes.USER_ACCOUNT_DEACTIVATED,
   ];
 
   if (toastAlertErrorCodes.includes(errorCode))

space/package.json

@@ -22,6 +22,7 @@
     "@plane/rich-text-editor": "*",
     "@plane/types": "*",
     "@plane/ui": "*",
+    "@plane/constants": "*",
     "@sentry/nextjs": "^7.108.0",
     "axios": "^1.3.4",
     "clsx": "^2.0.0",

web/components/account/auth-forms/auth-root.tsx

@@ -92,7 +92,7 @@ export const AuthRoot: FC<TAuthRoot> = observer((props) => {
         }
       })
       .catch((error) => {
-        const errorhandler = authErrorHandler(error?.error_code.toString(), data?.email || undefined);
+        const errorhandler = authErrorHandler(error?.error_code?.toString(), data?.email || undefined);
         if (errorhandler?.type) setErrorInfo(errorhandler);
       });
   };

web/components/project/publish-project/modal.tsx

@@ -62,7 +62,7 @@ export const PublishProjectModal: React.FC<Props> = observer((props) => {
   const [isUpdateRequired, setIsUpdateRequired] = useState(false);
 
   // const plane_deploy_url = instance?.config?.space_base_url || "";
-  const SPACE_URL = SPACE_BASE_URL + SPACE_BASE_PATH;
+  const SPACE_URL = (SPACE_BASE_URL === "" ? window.location.origin : SPACE_BASE_URL) + SPACE_BASE_PATH;
 
   // router
   const router = useRouter();

web/helpers/authentication.helper.tsx

@@ -45,6 +45,7 @@ export enum EAuthenticationErrorCodes {
   INVALID_EMAIL_MAGIC_SIGN_UP = "5050",
   MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED = "5055",
   // Sign In
+  USER_ACCOUNT_DEACTIVATED = "5019",
   USER_DOES_NOT_EXIST = "5060",
   AUTHENTICATION_FAILED_SIGN_IN = "5065",
   REQUIRED_EMAIL_PASSWORD_SIGN_IN = "5070",
@@ -65,6 +66,7 @@ export enum EAuthenticationErrorCodes {
   EXPIRED_PASSWORD_TOKEN = "5130",
   // Change password
   INCORRECT_OLD_PASSWORD = "5135",
+  MISSING_PASSWORD = "5138",
   INVALID_NEW_PASSWORD = "5140",
   // set passowrd
   PASSWORD_ALREADY_SET = "5145",
@@ -155,6 +157,11 @@ const errorCodeMessages: {
   },
 
   // sign in
+  [EAuthenticationErrorCodes.USER_ACCOUNT_DEACTIVATED]: {
+    title: `User account deactivated`,
+    message: () => <div>Your account is deactivated. Contact support@plane.so.</div>,
+  },
+
   [EAuthenticationErrorCodes.USER_DOES_NOT_EXIST]: {
     title: `User does not exist`,
     message: (email = undefined) => (
@@ -234,6 +241,10 @@ const errorCodeMessages: {
   },
 
   // Change password
+  [EAuthenticationErrorCodes.MISSING_PASSWORD]: {
+    title: `Password required`,
+    message: () => `Password required. Please try again.`,
+  },
   [EAuthenticationErrorCodes.INCORRECT_OLD_PASSWORD]: {
     title: `Incorrect old password`,
     message: () => `Incorrect old password. Please try again.`,
@@ -343,6 +354,7 @@ export const authErrorHandler = (
     EAuthenticationErrorCodes.ADMIN_AUTHENTICATION_FAILED,
     EAuthenticationErrorCodes.ADMIN_USER_ALREADY_EXIST,
     EAuthenticationErrorCodes.ADMIN_USER_DOES_NOT_EXIST,
+    EAuthenticationErrorCodes.USER_ACCOUNT_DEACTIVATED,
   ];
 
   if (bannerAlertErrorCodes.includes(errorCode))

web/package.json

@@ -30,6 +30,7 @@
     "@plane/rich-text-editor": "*",
     "@plane/types": "*",
     "@plane/ui": "*",
+    "@plane/constants": "*",
     "@popperjs/core": "^2.11.8",
     "@sentry/nextjs": "^7.108.0",
     "axios": "^1.1.3",

web/pages/profile/change-password.tsx

@@ -1,12 +1,15 @@
-import { ReactElement, useEffect, useState } from "react";
+import { ReactElement, useEffect, useMemo, useState } from "react";
 import { observer } from "mobx-react";
 import { useRouter } from "next/router";
 import { Controller, useForm } from "react-hook-form";
+import { Eye, EyeOff } from "lucide-react";
 // ui
 import { Button, Input, Spinner, TOAST_TYPE, setPromiseToast, setToast } from "@plane/ui";
 // components
+import { PasswordStrengthMeter } from "@/components/account";
 import { PageHead } from "@/components/core";
 import { SidebarHamburgerToggle } from "@/components/core/sidebar";
+import { getPasswordStrength } from "@/helpers/password.helper";
 // hooks
 import { useAppTheme, useUser } from "@/hooks/store";
 // layout
@@ -14,6 +17,7 @@ import { ProfileSettingsLayout } from "@/layouts/settings-layout";
 // types
 import { NextPageWithLayout } from "@/lib/types";
 // services
+import { AuthService } from "@/services/auth.service";
 import { UserService } from "@/services/user.service";
 
 export interface FormValues {
@@ -29,9 +33,18 @@ const defaultValues: FormValues = {
 };
 
 export const userService = new UserService();
+export const authService = new AuthService();
 
 const ChangePasswordPage: NextPageWithLayout = observer(() => {
+  const [csrfToken, setCsrfToken] = useState<string | undefined>(undefined);
   const [isPageLoading, setIsPageLoading] = useState(true);
+  const [showPassword, setShowPassword] = useState({
+    oldPassword: false,
+    password: false,
+    retypePassword: false,
+  });
+  const [isPasswordInputFocused, setIsPasswordInputFocused] = useState(false);
+
   // router
   const router = useRouter();
   // store hooks
@@ -42,32 +55,54 @@ const ChangePasswordPage: NextPageWithLayout = observer(() => {
   const {
     control,
     handleSubmit,
+    watch,
     formState: { errors, isSubmitting },
+    reset,
   } = useForm<FormValues>({ defaultValues });
 
+  const oldPassword = watch("old_password");
+  const password = watch("new_password");
+  const retypePassword = watch("confirm_password");
+
+  const handleShowPassword = (key: keyof typeof showPassword) =>
+    setShowPassword((prev) => ({ ...prev, [key]: !prev[key] }));
+
   const handleChangePassword = async (formData: FormValues) => {
-    if (formData.new_password !== formData.confirm_password) {
+    try {
+      if (!csrfToken) throw new Error("csrf token not found");
+      const changePasswordPromise = userService
+        .changePassword(csrfToken, {
+          old_password: formData.old_password,
+          new_password: formData.new_password,
+        })
+        .then(() => {
+          reset(defaultValues);
+        });
+      setPromiseToast(changePasswordPromise, {
+        loading: "Changing password...",
+        success: {
+          title: "Success!",
+          message: () => "Password changed successfully.",
+        },
+        error: {
+          title: "Error!",
+          message: () => "Something went wrong. Please try again 1.",
+        },
+      });
+    } catch (err: any) {
       setToast({
         type: TOAST_TYPE.ERROR,
         title: "Error!",
-        message: "The new password and the confirm password don't match.",
+        message: err?.error ?? "Something went wrong. Please try again 2.",
       });
-      return;
     }
-    const changePasswordPromise = userService.changePassword(formData);
-    setPromiseToast(changePasswordPromise, {
-      loading: "Changing password...",
-      success: {
-        title: "Success!",
-        message: () => "Password changed successfully.",
-      },
-      error: {
-        title: "Error!",
-        message: () => "Something went wrong. Please try again.",
-      },
-    });
   };
 
+  useEffect(() => {
+    if (csrfToken === undefined)
+      authService.requestCSRFToken().then((data) => data?.csrf_token && setCsrfToken(data.csrf_token));
+  }, [csrfToken]);
+
   useEffect(() => {
     if (!currentUser) return;
 
@@ -75,6 +110,25 @@ const ChangePasswordPage: NextPageWithLayout = observer(() => {
     else setIsPageLoading(false);
   }, [currentUser, router]);
 
+  const isButtonDisabled = useMemo(
+    () =>
+      !isSubmitting &&
+      !!oldPassword &&
+      !!password &&
+      !!retypePassword &&
+      getPasswordStrength(password) >= 3 &&
+      password === retypePassword &&
+      password !== oldPassword
+        ? false
+        : true,
+
+    [isSubmitting, oldPassword, password, retypePassword]
+  );
+
+  const passwordSupport = password.length > 0 && (getPasswordStrength(password) < 3 || isPasswordInputFocused) && (
+    <PasswordStrengthMeter password={password} />
+  );
+
   if (isPageLoading)
     return (
       <div className="grid h-screen w-full place-items-center">
@@ -93,82 +147,126 @@ const ChangePasswordPage: NextPageWithLayout = observer(() => {
           onSubmit={handleSubmit(handleChangePassword)}
           className="mx-auto md:mt-16 mt-10 flex h-full w-full flex-col gap-8 px-4 md:px-8 pb-8 lg:w-3/5"
         >
+          <input type="hidden" name="csrfmiddlewaretoken" value={csrfToken} />
+
           <h3 className="text-xl font-medium">Change password</h3>
           <div className="grid-col grid w-full grid-cols-1 items-center justify-between gap-10 xl:grid-cols-2 2xl:grid-cols-3">
             <div className="flex flex-col gap-1 ">
               <h4 className="text-sm">Current password</h4>
-              <Controller
-                control={control}
-                name="old_password"
-                rules={{
-                  required: "This field is required",
-                }}
-                render={({ field: { value, onChange } }) => (
-                  <Input
-                    id="old_password"
-                    type="password"
-                    value={value}
-                    onChange={onChange}
-                    placeholder="Old password"
-                    className="w-full rounded-md font-medium"
-                    hasError={Boolean(errors.old_password)}
+              <div className="relative flex items-center rounded-md">
+                <Controller
+                  control={control}
+                  name="old_password"
+                  rules={{
+                    required: "This field is required",
+                  }}
+                  render={({ field: { value, onChange } }) => (
+                    <Input
+                      id="old_password"
+                      type={showPassword?.oldPassword ? "text" : "password"}
+                      value={value}
+                      onChange={onChange}
+                      placeholder="Old password"
+                      className="w-full rounded-md font-medium"
+                      hasError={Boolean(errors.old_password)}
+                    />
+                  )}
+                />
+                {showPassword?.oldPassword ? (
+                  <EyeOff
+                    className="absolute right-3 h-5 w-5 stroke-custom-text-400 hover:cursor-pointer"
+                    onClick={() => handleShowPassword("oldPassword")}
+                  />
+                ) : (
+                  <Eye
+                    className="absolute right-3 h-5 w-5 stroke-custom-text-400 hover:cursor-pointer"
+                    onClick={() => handleShowPassword("oldPassword")}
                   />
                 )}
-              />
+              </div>
+
               {errors.old_password && <span className="text-xs text-red-500">{errors.old_password.message}</span>}
             </div>
 
             <div className="flex flex-col gap-1 ">
               <h4 className="text-sm">New password</h4>
-              <Controller
-                control={control}
-                name="new_password"
-                rules={{
-                  required: "This field is required",
-                }}
-                render={({ field: { value, onChange } }) => (
-                  <Input
-                    id="new_password"
-                    type="password"
-                    value={value}
-                    placeholder="New password"
-                    onChange={onChange}
-                    className="w-full"
-                    hasError={Boolean(errors.new_password)}
+              <div className="relative flex items-center rounded-md">
+                <Controller
+                  control={control}
+                  name="new_password"
+                  rules={{
+                    required: "This field is required",
+                  }}
+                  render={({ field: { value, onChange } }) => (
+                    <Input
+                      id="new_password"
+                      type={showPassword?.password ? "text" : "password"}
+                      value={value}
+                      placeholder="New password"
+                      onChange={onChange}
+                      className="w-full"
+                      hasError={Boolean(errors.new_password)}
+                      onFocus={() => setIsPasswordInputFocused(true)}
+                      onBlur={() => setIsPasswordInputFocused(false)}
+                    />
+                  )}
+                />
+                {showPassword?.password ? (
+                  <EyeOff
+                    className="absolute right-3 h-5 w-5 stroke-custom-text-400 hover:cursor-pointer"
+                    onClick={() => handleShowPassword("password")}
+                  />
+                ) : (
+                  <Eye
+                    className="absolute right-3 h-5 w-5 stroke-custom-text-400 hover:cursor-pointer"
+                    onClick={() => handleShowPassword("password")}
                   />
                 )}
-              />
-              {errors.new_password && <span className="text-xs text-red-500">{errors.new_password.message}</span>}
+              </div>
+              {passwordSupport}
             </div>
 
             <div className="flex flex-col gap-1 ">
               <h4 className="text-sm">Confirm password</h4>
-              <Controller
-                control={control}
-                name="confirm_password"
-                rules={{
-                  required: "This field is required",
-                }}
-                render={({ field: { value, onChange } }) => (
-                  <Input
-                    id="confirm_password"
-                    type="password"
-                    placeholder="Confirm password"
-                    value={value}
-                    onChange={onChange}
-                    className="w-full"
-                    hasError={Boolean(errors.confirm_password)}
+              <div className="relative flex items-center rounded-md">
+                <Controller
+                  control={control}
+                  name="confirm_password"
+                  rules={{
+                    required: "This field is required",
+                  }}
+                  render={({ field: { value, onChange } }) => (
+                    <Input
+                      id="confirm_password"
+                      type={showPassword?.retypePassword ? "text" : "password"}
+                      placeholder="Confirm password"
+                      value={value}
+                      onChange={onChange}
+                      className="w-full"
+                      hasError={Boolean(errors.confirm_password)}
+                    />
+                  )}
+                />
+                {showPassword?.retypePassword ? (
+                  <EyeOff
+                    className="absolute right-3 h-5 w-5 stroke-custom-text-400 hover:cursor-pointer"
+                    onClick={() => handleShowPassword("retypePassword")}
+                  />
+                ) : (
+                  <Eye
+                    className="absolute right-3 h-5 w-5 stroke-custom-text-400 hover:cursor-pointer"
+                    onClick={() => handleShowPassword("retypePassword")}
                   />
                 )}
-              />
-              {errors.confirm_password && (
-                <span className="text-xs text-red-500">{errors.confirm_password.message}</span>
+              </div>
+              {!!retypePassword && password !== retypePassword && (
+                <span className="text-sm text-red-500">Passwords don{"'"}t match</span>
               )}
             </div>
           </div>
 
           <div className="flex items-center justify-between py-2">
-            <Button variant="primary" type="submit" loading={isSubmitting}>
+            <Button variant="primary" type="submit" loading={isSubmitting} disabled={isButtonDisabled}>
               {isSubmitting ? "Changing password..." : "Change password"}
             </Button>
           </div>

web/services/user.service.ts

@@ -143,8 +143,12 @@ export class UserService extends APIService {
       });
   }
 
-  async changePassword(data: { old_password: string; new_password: string; confirm_password: string }): Promise<any> {
-    return this.post(`/api/users/me/change-password/`, data)
+  async changePassword(token: string, data: { old_password: string; new_password: string }): Promise<any> {
+    return this.post(`/auth/change-password/`, data, {
+      headers: {
+        "X-CSRFTOKEN": token,
+      },
+    })
       .then((response) => response?.data)
       .catch((error) => {
         throw error?.response?.data;

yarn.lock

@@ -6917,7 +6917,7 @@ postcss@8.4.31:
     picocolors "^1.0.0"
     source-map-js "^1.0.2"
 
-postcss@^8.4.23, postcss@^8.4.38:
+postcss@^8.4.23, postcss@^8.4.29, postcss@^8.4.38:
   version "8.4.38"
   resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.4.38.tgz#b387d533baf2054288e337066d81c6bee9db9e0e"
   integrity sha512-Wglpdk03BSfXkHoQa3b/oulrotAkwrlLDRSOb9D0bN86FdRyE9lppSp33aHNPgBa0JKCoB+drFLZkQoRRYae5A==
@@ -7945,8 +7945,16 @@ streamx@^2.15.0, streamx@^2.16.1:
   optionalDependencies:
     bare-events "^2.2.0"
 
-"string-width-cjs@npm:string-width@^4.2.0", string-width@^4.1.0:
-  name string-width-cjs
+"string-width-cjs@npm:string-width@^4.2.0":
+  version "4.2.3"
+  resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
+  integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
+  dependencies:
+    emoji-regex "^8.0.0"
+    is-fullwidth-code-point "^3.0.0"
+    strip-ansi "^6.0.1"
+
+string-width@^4.1.0:
   version "4.2.3"
   resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
   integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
@@ -8026,7 +8034,14 @@ stringify-object@^3.3.0:
     is-obj "^1.0.1"
     is-regexp "^1.0.0"
 
-"strip-ansi-cjs@npm:strip-ansi@^6.0.1", strip-ansi@^6.0.0, strip-ansi@^6.0.1:
+"strip-ansi-cjs@npm:strip-ansi@^6.0.1":
+  version "6.0.1"
+  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
+  integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
+  dependencies:
+    ansi-regex "^5.0.1"
+
+strip-ansi@^6.0.0, strip-ansi@^6.0.1:
   version "6.0.1"
   resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
   integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==