coulomb/vergabe-teilnahme
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Route rejected company sign-in to central account recovery
All checks were successful
Application acceptance / application-tests (push) Successful in 1m8s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 30s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-12 10:34:44 +02:00
parent c1727ed14d
commit c067993037
5 changed files with 54 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

13
vergabe_teilnahme/apps/accounts/views.py
View file

@ -19,6 +19,13 @@ from .forms import AuthenticationForm
from .models import Mitarbeiter, OIDCIdentity
def account_recovery():
response = redirect(settings.NETKINGDOM_ACCOUNT_PORTAL_URL.rstrip("/") + "/access-recovery")
response["Cache-Control"] = "no-store"
response["Referrer-Policy"] = "no-referrer"
return response
def context(**extra):
return {"company_name": settings.COMPANY_DISPLAY_NAME, **extra}
@ -71,7 +78,7 @@ def oidc_callback(request):
raise oidc.LoginRejectedError("Authorization was not completed")
verified = oidc.complete(pending, request.GET.get("state", ""), request.GET.get("code", ""))
except (ValueError, jwt.PyJWTError, URLError, TimeoutError, OSError, ImproperlyConfigured):
return render(request, "accounts/welcome.html", context(login_error=True), status=403)
return account_recovery()
request.session["oidc_confirm"] = verified
# Remove the authorization code from the address bar before displaying identity.
return redirect("accounts:oidc_confirm")
@ -91,7 +98,7 @@ def oidc_confirm(request):
or verified.get("client") != settings.NETKINGDOM_CLIENT_ID
):
request.session.pop("oidc_confirm", None)
return render(request, "accounts/welcome.html", context(login_error=True), status=403)
return account_recovery()
if request.method == "GET":
return render(request, "accounts/confirm.html", context(identity_label=verified["label"]))
if request.method != "POST":
@ -129,7 +136,7 @@ def oidc_confirm(request):
if not user.is_active or user.is_staff or user.is_superuser:
raise oidc.LoginRejectedError("Product account is not admitted")
except (IntegrityError, oidc.LoginRejectedError):
return render(request, "accounts/welcome.html", context(login_error=True), status=403)
return account_recovery()
login(request, user, backend="django.contrib.auth.backends.ModelBackend")
request.session["oidc_expires"] = verified["expires"]
request.session["oidc_binding"] = [verified["issuer"], verified["tenant"], verified["client"]]