mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-07-28 00:48:07 +00:00
09e25b8a32
* fix(auth): let deployments close local self-registration The OIDC provisioning policy (allowed_email_domains, require_verified_email, auto_create_users) is enforced only in the SSO callback via get_or_provision_oidc_user. POST /api/v1/auth/register creates a local account without consulting any of it, and nothing can turn that path off, so a deployment declaring an email-domain allowlist can still be joined by any address through local registration. Add auth.local.allow_registration (default true, so existing deployments are unchanged) and gate /register on it before the account is created. Report the flag from /setup-status so the login page stops offering a signup entry the Gateway will reject. /initialize is deliberately not gated: it is the bootstrap path, guarded by admin_count == 0, and closing it would leave a fresh install unable to create its first admin. An unreadable config.yaml falls back to the pre-gate default (open) rather than making these two endpoints a hard dependency on the file. * docs(auth): align registration-gate fallback wording with the FileNotFoundError catch
47 lines
1.3 KiB
Python
47 lines
1.3 KiB
Python
"""Typed error definitions for auth module.
|
|
|
|
AuthErrorCode: exhaustive enum of all auth failure conditions.
|
|
TokenError: exhaustive enum of JWT decode failures.
|
|
AuthErrorResponse: structured error payload for HTTP responses.
|
|
"""
|
|
|
|
from enum import StrEnum
|
|
|
|
from pydantic import BaseModel
|
|
|
|
|
|
class AuthErrorCode(StrEnum):
|
|
"""Exhaustive list of auth error conditions."""
|
|
|
|
INVALID_CREDENTIALS = "invalid_credentials"
|
|
TOKEN_EXPIRED = "token_expired"
|
|
TOKEN_INVALID = "token_invalid"
|
|
USER_NOT_FOUND = "user_not_found"
|
|
EMAIL_ALREADY_EXISTS = "email_already_exists"
|
|
PROVIDER_NOT_FOUND = "provider_not_found"
|
|
NOT_AUTHENTICATED = "not_authenticated"
|
|
SYSTEM_ALREADY_INITIALIZED = "system_already_initialized"
|
|
REGISTRATION_DISABLED = "registration_disabled"
|
|
|
|
|
|
class TokenError(StrEnum):
|
|
"""Exhaustive list of JWT decode failure reasons."""
|
|
|
|
EXPIRED = "expired"
|
|
INVALID_SIGNATURE = "invalid_signature"
|
|
MALFORMED = "malformed"
|
|
|
|
|
|
class AuthErrorResponse(BaseModel):
|
|
"""Structured error response — replaces bare `detail` strings."""
|
|
|
|
code: AuthErrorCode
|
|
message: str
|
|
|
|
|
|
def token_error_to_code(err: TokenError) -> AuthErrorCode:
|
|
"""Map TokenError to AuthErrorCode — single source of truth."""
|
|
if err == TokenError.EXPIRED:
|
|
return AuthErrorCode.TOKEN_EXPIRED
|
|
return AuthErrorCode.TOKEN_INVALID
|