Promote foss-sandbox to foss-main: corporate-id middleware + PR template

.github/pull_request_template.md

@@ -1,20 +1,27 @@
-### Description
-<!-- Provide a detailed description of the changes in this PR -->
+## Related Ticket
+<!-- Link the Plane ticket: https://foss-pm.local.moneta.dev/... -->
 
-### Type of Change
-<!-- Put an 'x' in the boxes that apply -->
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] Feature (non-breaking change which adds functionality)
-- [ ] Improvement (change that would cause existing functionality to not work as expected)
-- [ ] Code refactoring
-- [ ] Performance improvements
-- [ ] Documentation update
+## Description
+<!-- What changed and why? Link related issues: FIX #123 -->
 
-### Screenshots and Media (if applicable)
-<!-- Add screenshots to help explain your changes, ideally showcasing before and after -->
+## Type of Change
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Improvement / Enhancement
+- [ ] Refactoring
+- [ ] Performance improvement
+- [ ] Documentation
+- [ ] Infrastructure / CI
 
-### Test Scenarios 
-<!-- Please describe the tests that you ran to verify your changes -->
+## Testing
+<!-- How did you verify the change? -->
+- [ ] Tested locally
+- [ ] New / updated tests included
 
-### References
-<!-- Link related issues if there are any -->
+## Screenshots
+<!-- If applicable, add before/after screenshots -->
+
+## Checklist
+- [ ] No lint or build errors
+- [ ] All existing tests pass
+- [ ] Documentation updated (if needed)

apps/api/plane/authentication/middleware/proxy_auth.py

@@ -4,10 +4,12 @@
 
 from uuid import uuid4
 
+import jwt
 from django.conf import settings
 from django.contrib.auth import logout
 from django.contrib.auth.hashers import make_password
 from django.db import IntegrityError
+from django.http import JsonResponse
 
 from plane.authentication.middleware.proxy_auth_utils import (
     _coerce_bypass_paths,
@@ -36,6 +38,29 @@
 }
 
 
+def _check_corporate_id(request) -> bool:
+    """Verify the caller's access token contains a corporate_id matching this deployment.
+
+    When SMB_CORPORATE_ID is configured, only corporate mPass tokens whose
+    ``custom:corporate_id`` claim matches are allowed through. Individual
+    (non-corporate) tokens are rejected. When SMB_CORPORATE_ID is not set,
+    the check is skipped entirely for backward compatibility.
+    """
+    expected = getattr(settings, "SMB_CORPORATE_ID", None)
+    if not expected:
+        return True
+    access_token = request.META.get("HTTP_X_AUTH_REQUEST_ACCESS_TOKEN")
+    if not access_token:
+        return False
+    try:
+        claims = jwt.decode(access_token, options={"verify_signature": False})
+    except Exception:
+        return False
+    if claims.get("custom:is_corporate") != "true":
+        return False
+    return claims.get("custom:corporate_id") == expected
+
+
 class ProxyAuthMiddleware:
     """
     Django middleware for mPass proxy authentication.
@@ -82,6 +107,9 @@ def __call__(self, request):
         if not email:
             return self.get_response(request)
 
+        if not _check_corporate_id(request):
+            return JsonResponse({"error": "access_denied"}, status=403)
+
         user = self._resolve_user(email)
 
         # Respect deactivated accounts — mPass authentication does not

apps/api/plane/settings/common.py

@@ -106,6 +106,7 @@
 # SMB portal hostname segment (landing / logout redirects) vs default Plane workspace slug
 SMB_NAME = os.environ.get("SMB_NAME")
 SMB_DEFAULT_WORKSPACE_NAME = os.environ.get("SMB_DEFAULT_WORKSPACE_NAME") or SMB_NAME
+SMB_CORPORATE_ID = os.environ.get("SMB_CORPORATE_ID")
 
 # Middlewares
 MIDDLEWARE = [