mirror of
https://github.com/makeplane/plane.git
synced 2026-07-09 20:10:06 +02:00
1e8f3630c7
* fix(auth): restore activation flow and narrow deactivation guard (GHSA-rmmf-rj2q-3rrg) PR #9290 introduced two regressions in adapter/base.py: 1. is_signup = bool(user) was inverted — True when the user EXISTS means the IDP sync ran on signup instead of login, and the callback received the wrong value. Fixed to is_signup = not bool(user) matching EE. 2. The deactivation check blocked ALL inactive users, including accounts provisioned with is_active=False that have never completed a first login. Fixed by adding `and user.last_login_time is not None` — only accounts that have previously logged in (and were then explicitly deactivated by an admin) are rejected. Provisioned/never-logged-in accounts still pass through to save_user_data(). 3. Restore is_active=True and user_activation_email in save_user_data() so provisioned accounts are properly activated on first login. Co-authored-by: Plane AI <noreply@plane.so> * fix(auth): save before email, use last_logout_time as deactivation discriminator Two CR fixes on PR #9304: 1. save_user_data(): capture was_inactive flag, save() first, then send activation email as a best-effort side-effect so a failed enqueue cannot abort account activation. 2. complete_login_or_signup(): switch deactivation discriminator from last_login_time to last_logout_time. The deactivation endpoint always sets last_logout_time, making it a direct signal of explicit deactivation. A provisioned account that was never deactivated has last_logout_time=None and is correctly allowed through for first login, even if it also has no last_login_time. Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>