From 69badf6139155284d868c85077f720a2f099e982 Mon Sep 17 00:00:00 2001
From: Usama Sadiq <usama7274@gmail.com>
Date: Thu, 4 Jun 2026 19:02:15 +0500
Subject: [PATCH 1/2] Update PR template to standard format

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/pull_request_template.md | 39 +++++++++++++++++++-------------
 1 file changed, 23 insertions(+), 16 deletions(-)

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index fa445360f0a..7c4ba90c765 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,20 +1,27 @@
-### Description
-<!-- Provide a detailed description of the changes in this PR -->
+## Related Ticket
+<!-- Link the Plane ticket: https://foss-pm.local.moneta.dev/... -->
 
-### Type of Change
-<!-- Put an 'x' in the boxes that apply -->
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] Feature (non-breaking change which adds functionality)
-- [ ] Improvement (change that would cause existing functionality to not work as expected)
-- [ ] Code refactoring
-- [ ] Performance improvements
-- [ ] Documentation update
+## Description
+<!-- What changed and why? Link related issues: FIX #123 -->
 
-### Screenshots and Media (if applicable)
-<!-- Add screenshots to help explain your changes, ideally showcasing before and after -->
+## Type of Change
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Improvement / Enhancement
+- [ ] Refactoring
+- [ ] Performance improvement
+- [ ] Documentation
+- [ ] Infrastructure / CI
 
-### Test Scenarios 
-<!-- Please describe the tests that you ran to verify your changes -->
+## Testing
+<!-- How did you verify the change? -->
+- [ ] Tested locally
+- [ ] New / updated tests included
 
-### References
-<!-- Link related issues if there are any -->
\ No newline at end of file
+## Screenshots
+<!-- If applicable, add before/after screenshots -->
+
+## Checklist
+- [ ] No lint or build errors
+- [ ] All existing tests pass
+- [ ] Documentation updated (if needed)

From a7e62a1ce4e694ef0d9b9faef8f6f222bbf7f352 Mon Sep 17 00:00:00 2001
From: Usama Sadiq <usama7274@gmail.com>
Date: Tue, 7 Jul 2026 23:23:00 +0500
Subject: [PATCH 2/2] Add corporate_id check to ProxyAuth middleware

---
 .../authentication/middleware/proxy_auth.py   | 28 +++++++++++++++++++
 apps/api/plane/settings/common.py             |  1 +
 2 files changed, 29 insertions(+)

diff --git a/apps/api/plane/authentication/middleware/proxy_auth.py b/apps/api/plane/authentication/middleware/proxy_auth.py
index 4d19a5dfa8b..4dce5939790 100644
--- a/apps/api/plane/authentication/middleware/proxy_auth.py
+++ b/apps/api/plane/authentication/middleware/proxy_auth.py
@@ -4,10 +4,12 @@
 
 from uuid import uuid4
 
+import jwt
 from django.conf import settings
 from django.contrib.auth import logout
 from django.contrib.auth.hashers import make_password
 from django.db import IntegrityError
+from django.http import JsonResponse
 
 from plane.authentication.middleware.proxy_auth_utils import (
     _coerce_bypass_paths,
@@ -36,6 +38,29 @@
 }
 
 
+def _check_corporate_id(request) -> bool:
+    """Verify the caller's access token contains a corporate_id matching this deployment.
+
+    When SMB_CORPORATE_ID is configured, only corporate mPass tokens whose
+    ``custom:corporate_id`` claim matches are allowed through. Individual
+    (non-corporate) tokens are rejected. When SMB_CORPORATE_ID is not set,
+    the check is skipped entirely for backward compatibility.
+    """
+    expected = getattr(settings, "SMB_CORPORATE_ID", None)
+    if not expected:
+        return True
+    access_token = request.META.get("HTTP_X_AUTH_REQUEST_ACCESS_TOKEN")
+    if not access_token:
+        return False
+    try:
+        claims = jwt.decode(access_token, options={"verify_signature": False})
+    except Exception:
+        return False
+    if claims.get("custom:is_corporate") != "true":
+        return False
+    return claims.get("custom:corporate_id") == expected
+
+
 class ProxyAuthMiddleware:
     """
     Django middleware for mPass proxy authentication.
@@ -82,6 +107,9 @@ def __call__(self, request):
         if not email:
             return self.get_response(request)
 
+        if not _check_corporate_id(request):
+            return JsonResponse({"error": "access_denied"}, status=403)
+
         user = self._resolve_user(email)
 
         # Respect deactivated accounts — mPass authentication does not
diff --git a/apps/api/plane/settings/common.py b/apps/api/plane/settings/common.py
index 6713c9340e2..7a5446b3799 100644
--- a/apps/api/plane/settings/common.py
+++ b/apps/api/plane/settings/common.py
@@ -106,6 +106,7 @@
 # SMB portal hostname segment (landing / logout redirects) vs default Plane workspace slug
 SMB_NAME = os.environ.get("SMB_NAME")
 SMB_DEFAULT_WORKSPACE_NAME = os.environ.get("SMB_DEFAULT_WORKSPACE_NAME") or SMB_NAME
+SMB_CORPORATE_ID = os.environ.get("SMB_CORPORATE_ID")
 
 # Middlewares
 MIDDLEWARE = [