Let branch previews sign in with Discord through dev

[ryanbarlow97]

Branch previews (<slug>.tfminecraft.net) could not sign anyone in: Discord only returns players to registered callbacks, and a new branch name never is one. Previews now sign in through dev, the way OpenFront's branch sites all use api.openfront.dev.

How it works

1. The preview's /auth/discord/start puts a random state in its state cookie and sends the browser to dev's /api/auth/preview/start with the state, its origin and the return path.
2. Dev accepts only https://<slug>.<PREVIEW_SIGN_IN_DOMAIN> origins with an unreserved slug. Without a dev session it signs the player in with Discord first; the callback brings them back to the same route.
3. Dev refreshes the guild check with its bot, stores a hashed single-use ticket for that preview (120 seconds) and redirects to the preview's /api/auth/preview/callback.
4. The preview checks the state against its cookie and posts the ticket and its origin to dev's /api/auth/preview/redeem, which deletes the ticket and returns the Discord identity, website role and guild check.
5. The preview opens its own session with that role.

A player already signed in on dev goes straight through without Discord. Previews never hold the Discord secret or a dev session, and anything done there stays in the preview's copy of dev's data (the LuckPerms bridge, Patreon, CoreProtect and the Discord bot are all off on previews).

Settings

• Dev: PREVIEW_SIGN_IN_DOMAIN=tfminecraft.net in backend/.env (added before this deploys).
• Previews: SIGN_IN_SITE=https://dev.tfminecraft.net, baked into the preview backend image by the Preview workflow. Empty everywhere else.

No frontend changes: the sign-in button already points at the site's own /api/auth/discord/start.

Testing

• src/auth/test_preview_sign_in.py: 54 tests covering allowed preview origins, the preview and dev halves of the flow, single use, expiry, site binding, odd answers from dev and dev being down.
• pytest src/auth src/api/test_prod_guard.py: all pass.
• End to end needs dev running this code, so it can only be tried on a preview after merge.

Docs: TF-Minecraft/Docs#123.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 23 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 459ae809-f05d-4f4f-8ebc-7ec8a8f2784c

---

📥 Commits

Reviewing files that changed from the base of the PR and between 72998eb and 929f5b4.

---

📒 Files selected for processing (10)

• .github/workflows/preview.yml
• backend/Dockerfile
• backend/server.py
• backend/src/api/auth_routes.py
• backend/src/auth/config.py
• backend/src/auth/preview_sign_in.py
• backend/src/auth/test_discord_client.py
• backend/src/auth/test_preview_sign_in.py
• backend/src/auth/users.py
• backend/src/skins/schema.sql

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}