fix(auth): support dynamic OSS callbacks and LangBot Account copy (#2428)

* fix(auth): support dynamic OSS callbacks and LangBot Account copy

* style(web): format LangBot Account copy

---------

Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com>

Author: dadachann

src/langbot/pkg/api/http/controller/groups/user.py

@@ -15,11 +15,9 @@
 @group.group_class('user', '/api/v1/user')
 class UserRouterGroup(group.RouterGroup):
     @staticmethod
-    def _origin(value: str) -> tuple[str, str, int | None] | None:
-        parsed = urlsplit(value)
-        if parsed.scheme not in {'http', 'https'} or not parsed.hostname:
-            return None
-        return parsed.scheme, parsed.hostname.casefold(), parsed.port
+    def _is_loopback_host(hostname: str) -> bool:
+        normalized = hostname.casefold().rstrip('.')
+        return normalized in {'localhost', '127.0.0.1', '::1'}
 
     def _validate_space_redirect_uri(self, redirect_uri: str, *, bind: bool) -> str:
         parsed = urlsplit(redirect_uri)
@@ -38,17 +36,12 @@ def _validate_space_redirect_uri(self, redirect_uri: str, *, bind: bool) -> str:
             if query != {'mode': ['bind']}:
                 raise ValueError('Invalid Space binding redirect_uri')
         elif query:
-            raise ValueError('Invalid Space login redirect_uri')
-
-        redirect_origin = self._origin(redirect_uri)
-        api_config = self.ap.instance_config.data.get('api', {})
-        trusted_origins = {
-            self._origin(str(api_config.get(config_key, '') or '').strip())
-            for config_key in ('webui_url', 'webhook_prefix')
-        }
-        trusted_origins.discard(None)
-        if redirect_origin not in trusted_origins:
-            raise ValueError('Untrusted redirect_uri origin')
+            raise ValueError('Invalid LangBot Account login redirect_uri')
+
+        # OSS instances can live behind arbitrary domains and gateway ports.
+        # Accept any HTTPS callback, plus HTTP only for local development.
+        if parsed.scheme == 'http' and not self._is_loopback_host(parsed.hostname):
+            raise ValueError('Insecure redirect_uri origin')
         return redirect_uri
 
     async def initialize(self) -> None:
@@ -416,7 +409,7 @@ async def _() -> str:
                     'Bind the LangBot Account with the same email as this local Account',
                 )
             except ValueError:
-                return self.http_status(400, -1, 'Space account binding failed')
+                return self.http_status(400, -1, 'LangBot Account binding failed')
             except Exception:
                 raise
 

src/langbot/pkg/api/http/service/user.py

@@ -114,7 +114,7 @@ async def issue_space_oauth_state(
         if purpose == 'login' and account_uuid is not None:
             raise ValueError('Login state cannot be bound to an Account')
         if purpose != 'login' and launch_workspace_uuid is not None:
-            raise ValueError('Launch Workspace state is only valid for Space login')
+            raise ValueError('Launch Workspace state is only valid for LangBot Account login')
         if ttl_seconds <= 0:
             raise ValueError('OAuth state lifetime must be positive')
 
@@ -327,7 +327,7 @@ async def register_invited_account(
         normalized_email = normalize_email(user_email)
         if self._uses_control_plane_directory():
             raise ControlPlaneDirectoryRequiredError(
-                'Cloud invitation registration must use a Space account to preserve control-plane identity'
+                'Cloud invitation registration must use a LangBot Account to preserve control-plane identity'
             )
         invitation, _ = await self.ap.workspace_collaboration_service.inspect_invitation(invitation_token)
         if invitation.normalized_email != normalized_email:
@@ -394,7 +394,7 @@ async def authenticate(self, user_email: str, password: str) -> str | None:
 
         # Check if this user has a local password set
         if not user_obj.password:
-            raise ValueError('请使用 Space 账户登录')
+            raise ValueError('请使用 LangBot 账号登录')
 
         await self._verify_password(user_obj.password, password)
 
@@ -825,7 +825,7 @@ async def bind_space_account(self, user_email: str, code: str) -> user.User:
         # Check if this Space account is already bound to another user
         existing_space_user = await self.get_user_by_space_account_uuid(space_account_uuid)
         if existing_space_user and existing_space_user.normalized_email != normalize_email(user_email):
-            raise ValueError('This Space account is already bound to another user')
+            raise ValueError('This LangBot Account is already bound to another user')
 
         # Update local account to Space account
         normalized_email = normalize_email(user_email)

src/langbot/pkg/entity/errors/account.py

@@ -17,4 +17,4 @@ class SpaceAccountBindingRequiredError(AccountEmailMismatchError):
     code = 'space_account_binding_required'
 
     def __str__(self) -> str:
-        return 'This local Account must bind Space from Account settings before Space login'
+        return 'This local account must bind a LangBot Account from Account settings before LangBot Account login'

tests/integration/api/test_user_space_oauth.py

@@ -165,34 +165,50 @@ async def test_bind_state_is_account_bound_and_requires_authentication(space_oau
 
 
 @pytest.mark.asyncio
-async def test_redirect_origin_and_callback_path_are_restricted(space_oauth_api):
+async def test_redirect_allows_dynamic_https_origin_and_loopback_http(space_oauth_api):
     _, client = space_oauth_api
 
-    wrong_origin = await client.get(
-        '/api/v1/user/space/authorize-url',
-        query_string={'redirect_uri': 'https://evil.example/auth/space/callback'},
-        headers={'Origin': 'http://localhost'},
-    )
-    wrong_path = await client.get(
-        '/api/v1/user/space/authorize-url',
-        query_string={'redirect_uri': 'http://localhost/arbitrary'},
-        headers={'Origin': 'http://localhost'},
-    )
-    forged_origin = await client.get(
-        '/api/v1/user/space/authorize-url',
-        query_string={'redirect_uri': 'https://evil.example/auth/space/callback'},
-        headers={'Origin': 'https://evil.example'},
-    )
-    forged_host = await client.get(
-        '/api/v1/user/space/authorize-url',
-        query_string={'redirect_uri': 'https://evil.example/auth/space/callback'},
-        headers={'Host': 'evil.example'},
-    )
+    responses = [
+        await client.get(
+            '/api/v1/user/space/authorize-url',
+            query_string={'redirect_uri': redirect_uri},
+            headers={'Origin': 'https://irrelevant.example'},
+        )
+        for redirect_uri in (
+            'https://langbot.example/auth/space/callback',
+            'https://gateway.example:8443/auth/space/callback',
+            'https://192.0.2.10/auth/space/callback',
+            'http://localhost:5300/auth/space/callback',
+            'http://127.0.0.1:5300/auth/space/callback',
+            'http://[::1]:5300/auth/space/callback',
+        )
+    ]
+
+    assert all(response.status_code == 200 for response in responses)
+    payloads = [await response.get_json() for response in responses]
+    assert all(payload['code'] == 0 for payload in payloads)
+
+
+@pytest.mark.asyncio
+async def test_redirect_rejects_insecure_remote_origin_and_invalid_callback_shape(space_oauth_api):
+    _, client = space_oauth_api
+
+    responses = [
+        await client.get(
+            '/api/v1/user/space/authorize-url',
+            query_string={'redirect_uri': redirect_uri},
+        )
+        for redirect_uri in (
+            'http://langbot.example/auth/space/callback',
+            'https://langbot.example/arbitrary',
+            'https://langbot.example/auth/space/callback?next=https://evil.example',
+            'https://user@langbot.example/auth/space/callback',
+            'https://langbot.example/auth/space/callback#fragment',
+        )
+    ]
 
-    assert (await wrong_origin.get_json())['code'] == 1
-    assert (await wrong_path.get_json())['code'] == 1
-    assert (await forged_origin.get_json())['code'] == 1
-    assert (await forged_host.get_json())['code'] == 1
+    payloads = [await response.get_json() for response in responses]
+    assert all(payload['code'] == 1 for payload in payloads)
 
 
 @pytest.mark.asyncio

tests/unit_tests/api/service/test_user_service.py

@@ -377,7 +377,7 @@ async def test_authenticate_space_user_without_password_raises_error(self):
         service = UserService(ap)
 
         # Execute & Verify
-        with pytest.raises(ValueError, match='请使用 Space 账户登录'):
+        with pytest.raises(ValueError, match='请使用 LangBot 账号登录'):
             await service.authenticate('space@example.com', 'password')
 
 
@@ -726,7 +726,7 @@ async def test_cloud_invitation_registration_requires_space_identity(self):
         )
         service = UserService(ap)
 
-        with pytest.raises(ControlPlaneDirectoryRequiredError, match='Space account'):
+        with pytest.raises(ControlPlaneDirectoryRequiredError, match='LangBot Account'):
             await service.register_invited_account('invite-token', 'member@example.com', 'password')
 
     async def test_create_or_update_new_space_user_first_init(self):

web/src/i18n/locales/en-US.ts

@@ -85,18 +85,18 @@ const enUS = {
       'Recommended: Use official stable model APIs and cloud services',
     loginLocal: 'Login with local account',
     loginWithPassword: 'Login with password',
-    spaceLoginTitle: 'Login with Space',
+    spaceLoginTitle: 'Login with LangBot Account',
     spaceLoginDescription:
       'Scan the QR code or visit the link below to authorize',
     spaceLoginUserCode: 'Your code',
     spaceLoginExpires: 'Code expires in {{seconds}} seconds',
     spaceLoginWaiting: 'Waiting for authorization...',
     spaceLoginSuccess: 'Authorization successful',
-    spaceLoginFailed: 'Space login failed',
+    spaceLoginFailed: 'LangBot Account login failed',
     spaceLoginExpired: 'Authorization code expired, please try again',
     spaceLoginCancel: 'Cancel',
     spaceLoginVisitLink: 'Visit link',
-    spaceLoginProcessing: 'Logging in with Space',
+    spaceLoginProcessing: 'Logging in with LangBot Account',
     spaceLoginProcessingDescription:
       'Please wait while we complete your login...',
     spaceLoginSuccessDescription: 'Redirecting to LangBot...',
@@ -105,7 +105,7 @@ const enUS = {
     backToLogin: 'Back to Login',
     backToHome: 'Back to Home',
     spaceAccountCannotChangePassword:
-      'Space accounts cannot change password here',
+      'LangBot Accounts cannot change password here',
     theme: 'Theme',
     changePassword: 'Change Password',
     currentPassword: 'Current Password',
@@ -254,8 +254,9 @@ const enUS = {
     llmModels: 'LLM Models',
     localProvider: 'Local',
     localProviderDescription: 'Models configured and managed locally',
-    spaceProviderDescription: 'Models synced from your Space account',
-    spaceDisabledForLocalAccount: 'Login with Space to use cloud models',
+    spaceProviderDescription: 'Models synced from your LangBot Account',
+    spaceDisabledForLocalAccount:
+      'Login with LangBot Account to use cloud models',
     syncModels: 'Sync',
     syncSuccess: 'Sync complete: {{created}} created, {{updated}} updated',
     syncError: 'Sync failed: ',
@@ -291,15 +292,15 @@ const enUS = {
     langbotModelsDescription: 'Cloud models powered by LangBot Space',
     credits: 'Credits',
     loginWithSpace: 'Login with LangBot Account',
-    loginToUseModels: 'Login with Space to use cloud models',
+    loginToUseModels: 'Login with LangBot Account to use cloud models',
     ownerMustBindSpace:
-      'The Workspace owner must connect Space for LangBot Models.',
+      'The Workspace owner must connect a LangBot Account for LangBot Models.',
     usesOwnerSpaceBilling:
-      "Uses the Workspace owner's Space billing and credits.",
+      "Uses the Workspace owner's LangBot Account billing and credits.",
     noModels: 'No models configured',
     langbotModels: 'LangBot Models',
     spaceTrialTooltip:
-      'Free trial credits available! Login with Space to access cloud models with zero configuration.',
+      'Free trial credits available! Login with LangBot Account to access cloud models with zero configuration.',
     unlockModels: 'Login to use',
     editProvider: 'Edit Provider',
     addProvider: 'Add Provider',
@@ -1218,13 +1219,13 @@ const enUS = {
     adminAccountNote:
       'The account you use here will be set as the administrator account',
     register: 'Register',
-    initWithSpace: 'Initialize with Space',
+    initWithSpace: 'Initialize with LangBot Account',
     spaceRecommended:
       'Recommended: Use official stable model APIs and cloud services',
     spaceInfoTip1:
       'Space provides unified account authentication services without uploading any of your sensitive information.',
     spaceInfoTip2:
-      'Logging in with a Space account gives you access to LangBot Models and other cloud services, including free model call credits to help you get started quickly.',
+      'Logging in with a LangBot Account gives you access to LangBot Models and other cloud services, including free model call credits to help you get started quickly.',
     spaceInfoTip3:
       'Your login method does not affect other features. You can configure and use models from other sources at any time.',
     registerLocal: 'Register local account',
@@ -1281,32 +1282,32 @@ const enUS = {
     passwordNotSet: 'Not Set',
     passwordSetDescription:
       'Password is set, you can login with email and password',
-    spaceStatus: 'Space Account',
+    spaceStatus: 'LangBot Account',
     spaceBound: 'Bound',
     spaceNotBound: 'Not Bound',
     spaceBoundDescription:
-      'Space account bound, official model APIs and cloud services available',
-    bindSpace: 'Bind Space Account',
+      'LangBot Account bound, official model APIs and cloud services available',
+    bindSpace: 'Bind LangBot Account',
     bindSpaceDescription: 'Bind to use official model APIs and cloud services',
     bindSpaceButton: 'Bind',
     bindSpaceConfirmTitle: 'Confirm Binding',
     bindSpaceConfirmDescription:
-      'You are about to bind your local instance to a Space account',
+      'You are about to bind your local instance to a LangBot Account',
     bindSpaceWarning:
-      'After binding, your login email will be changed from {{localEmail}} to the Space account email.',
-    bindSpaceSuccess: 'Space account bound successfully',
-    bindSpaceFailed: 'Failed to bind Space account',
+      'After binding, your login email will be changed from {{localEmail}} to the LangBot Account email.',
+    bindSpaceSuccess: 'LangBot Account bound successfully',
+    bindSpaceFailed: 'Failed to bind LangBot Account',
     bindSpaceInvalidState:
       'Invalid bind request. Please try again from account settings.',
     setPasswordHint: 'Set a password to login with email and password',
     spaceEmailMismatch:
-      'The Space login email does not match the local account email.',
+      'The LangBot Account login email does not match the local account email.',
     space_account_not_registeredTitle: 'Account not registered',
     space_account_not_registered:
-      'No local account is registered for this Space email. Ask the Workspace owner for an invitation.',
-    space_account_binding_requiredTitle: 'Space connection required',
+      'No local account is registered for this LangBot Account email. Ask the Workspace owner for an invitation.',
+    space_account_binding_requiredTitle: 'LangBot Account connection required',
     space_account_binding_required:
-      'This local account must connect Space from Account settings before using Space login.',
+      'This local account must connect a LangBot Account from Account settings before using LangBot Account login.',
   },
   workspace: {
     title: 'Workspace',