Dex error

membership/members/tests/test_membership.py

@@ -274,6 +274,35 @@ class IdentityTests(TestCase):
         self.assertContains(response, "could not be verified")
         self.assertNotIn("account_id", self.client.session)
 
+    @patch("members.views.dex")
+    @patch("members.views.link_identity")
+    def test_database_failure_logs_only_safe_sqlstate_and_recovery_hint(self, link, dex):
+        from django.db import ProgrammingError
+        from psycopg.errors import InsufficientPrivilege, UndefinedColumn, UndefinedTable
+
+        dex.return_value.authorize_access_token.return_value = {"id_token": "private-token", "userinfo": self.claims()}
+        for cause, expected, hint in (
+            (UndefinedColumn("private SQL and email alice@example.org"), "42703", "members.0004_dex_login_identity"),
+            (UndefinedTable("private SQL"), "42P01", "undefined_table"),
+            (InsufficientPrivilege("private SQL"), "42501", "insufficient_privilege"),
+            (None, "unknown", "matching application/migration images"),
+        ):
+            with self.subTest(sqlstate=expected):
+                error = ProgrammingError("private database details")
+                error.__cause__ = cause
+                link.side_effect = error
+                with self.assertLogs("members.views", level="ERROR") as logs:
+                    response = self.client.get("/members/oidc/callback/?code=private-code")
+                self.assertContains(response, "could not be verified")
+                self.assertNotIn("account_id", self.client.session)
+                output = " ".join(logs.output)
+                self.assertIn(f"sqlstate={expected}", output)
+                self.assertIn(hint, output)
+                for private in ("private", "alice@example.org", "Traceback"):
+                    self.assertNotIn(private, output)
+                self.assertNotIn("sqlstate", response.content.decode())
+        self.assertFalse(Account.objects.exists())
+
     @patch("members.views.dex")
     @patch("members.directory.Connection")
     @override_settings(LDAP_URL="", LDAP_BIND_DN="", LDAP_BIND_PASSWORD="", LDAP_PASSWORD_SCHEME="{CRYPT}")

membership/members/views.py

@@ -12,7 +12,7 @@ from authlib.integrations.django_client import OAuth
 from django.conf import settings
 from django.core.validators import validate_email
 from django.core.mail import send_mail
-from django.db import transaction
+from django.db import ProgrammingError, transaction
 from django.http import HttpResponse
 from django.shortcuts import get_object_or_404, redirect, render
 from django.db.models import Q
@@ -213,6 +213,18 @@ def callback(request):
         expires_at = proof.get("expires_at") if isinstance(proof, dict) else None
         registration_account_id = proof.get("account_id") if isinstance(expires_at, (int, float)) and expires_at > timezone.now().timestamp() else None
         account = link_identity(token.get("userinfo") or {}, registration_account_id=registration_account_id)
+    except ProgrammingError as exc:
+        # PostgreSQL diagnostics and SQL text can contain identity data. Log
+        # only a validated SQLSTATE, never the exception message or traceback.
+        sqlstate = getattr(exc.__cause__, "sqlstate", None)
+        sqlstate = sqlstate if isinstance(sqlstate, str) and re.fullmatch(r"[0-9A-Z]{5}", sqlstate) else "unknown"
+        hint = {
+            "42703": "undefined_column: check pending migrations, especially members.0004_dex_login_identity, against the web database",
+            "42P01": "undefined_table: check migrations and the configured database/schema",
+            "42501": "insufficient_privilege: check database role permissions",
+        }.get(sqlstate, "check database schema, permissions and matching application/migration images")
+        logger.error("Membership database failure during Dex callback kind=ProgrammingError sqlstate=%s; %s", sqlstate, hint)
+        return page(request, title="Sign-in could not be verified", message="Try signing in again, or contact the administrator.")
     except Exception as exc:
         logger.error("Dex callback rejected kind=%s", type(exc).__name__)
         return page(request, title="Sign-in could not be verified", message="Try signing in again, or contact the administrator.")