Create missing Plane profile on proxy auth for pre-existing users - #47
Merged
Conversation
The profile was only created for newly created users, so users provisioned outside the signup path - such as the JIRA import - never got one. That made /api/users/me/profile/ return 404 and bounced the client back to the login page in a loop.
Ensure the profile on the already-authenticated short-circuit path too, gated on a session flag, so users holding a live session are healed instead of looping until the session expires. Collapse the now-dead IntegrityError re-raise.
Complete onboarding for profiles healed on the short-circuit path, set the session flag after login to avoid a redundant re-check, and cover both behaviours with tests.
Gate onboarding on the profile's is_onboarded flag rather than on whether this request created it, so profiles restored by an out-of-band backfill are onboarded too.
…fill Create missing Plane profile on proxy auth for pre-existing users
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Promotes the proxy auth fix for users who have no Profile row.
Users provisioned outside Plane's signup path, such as those inserted by the JIRA migration, had no
profilesrow, so/api/users/me/profile/and/api/users/me/settings/returned 404. The web client'sfetchCurrentUserbootstrap runs those fetches inside aPromise.all, so one 404 rejected the whole thing,isAuthenticatedwent false, andauthentication-wrapper.tsxredirected back to the OAuth sign in. oauth2-proxy still held a valid session and redirected straight back, producing an infinite login loop. This affected 58 of 75 users on production.ProxyAuthMiddlewareonly created a Profile whenget_or_createreportedcreated=True, so an already existing user never got one on any number of logins.Changes:
_resolve_userand keeps looping until the session expires, which is up to 7 days./onboarding.user_loginto skip a redundant recheck on the next request.try/except ... raisein theIntegrityErrorhandler.Production data was already repaired out of band on 2026-07-27. This is the durable fix that stops the class of bug recurring for any externally provisioned user. It changes application code, so the plane-api image needs a rebuild and the container needs recreating.
Testing
test_creates_missing_profile_for_authenticated_user,test_completes_onboarding_for_existing_unonboarded_profileandtest_profile_check_is_cached_for_the_sessiontoplane/authentication/tests/test_proxy_auth.py.