Allow per-app allow/deny.
This commit is contained in:
Greyson Parrelli
+33
-13
@@ -4,28 +4,41 @@ set -eo pipefail
|
||||
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
|
||||
|
||||
cmd-google-auth-allow() {
|
||||
declare desc="allow a domain or address to sign in"
|
||||
declare desc="allow a domain or address to sign in, globally or for one app"
|
||||
local cmd="google-auth:allow"
|
||||
[[ "$1" == "$cmd" ]] && shift 1
|
||||
|
||||
fn-ga-resolve-scope "$cmd" "${1:-}"
|
||||
local scope="$GA_SCOPE"
|
||||
shift 1 || true
|
||||
|
||||
if [[ $# -eq 0 ]]; then
|
||||
dokku_log_info2 "google-auth allow list"
|
||||
dokku_log_info2 "google-auth allow list ($(fn-ga-scope-label "$scope"))"
|
||||
local listed found=false
|
||||
while IFS= read -r listed; do
|
||||
[[ -z "$listed" ]] && continue
|
||||
dokku_log_verbose "$listed (domain)"
|
||||
found=true
|
||||
done < <(fn-ga-global-get-list allowed-domains)
|
||||
done < <(fn-ga-list-get "$scope" allowed-domains)
|
||||
while IFS= read -r listed; do
|
||||
[[ -z "$listed" ]] && continue
|
||||
dokku_log_verbose "$listed"
|
||||
found=true
|
||||
done < <(fn-ga-global-get-list allowed-emails)
|
||||
[[ "$found" == "false" ]] && dokku_log_verbose "(empty — nobody can sign in)"
|
||||
done < <(fn-ga-list-get "$scope" allowed-emails)
|
||||
if [[ "$found" == "false" ]]; then
|
||||
if [[ "$scope" == "global" ]]; then
|
||||
dokku_log_verbose "(empty — nobody can sign in)"
|
||||
else
|
||||
dokku_log_verbose "(none — $scope uses the global allow list)"
|
||||
fi
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
|
||||
local entry
|
||||
local entry inherited=false
|
||||
[[ "$scope" != "global" && "$(fn-ga-list-count "$scope" allowed-domains)" -eq 0 &&
|
||||
"$(fn-ga-list-count "$scope" allowed-emails)" -eq 0 ]] && inherited=true
|
||||
|
||||
for entry in "$@"; do
|
||||
fn-ga-validate-list-entry "$entry" ||
|
||||
dokku_log_fail "invalid entry '$entry' — use a domain (signal.org) or a full address (guest@partner.com), with no spaces or commas"
|
||||
@@ -33,18 +46,25 @@ cmd-google-auth-allow() {
|
||||
if [[ "$(fn-ga-allow-entry-kind "$entry")" == "domain" ]]; then
|
||||
entry="${entry#@}"
|
||||
[[ "$entry" == *.* ]] || dokku_log_fail "'$entry' does not look like a domain"
|
||||
fn-ga-global-list-add allowed-domains "$entry"
|
||||
dokku_log_info1 "allowed domain: $entry (any verified account at $entry)"
|
||||
fn-ga-list-add "$scope" allowed-domains "$entry"
|
||||
dokku_log_info1 "allowed domain $(fn-ga-scope-label "$scope"): $entry (any verified account at $entry)"
|
||||
else
|
||||
fn-ga-global-list-add allowed-emails "$entry"
|
||||
dokku_log_info1 "allowed: $entry"
|
||||
if fn-ga-global-list-contains denied-emails "$entry"; then
|
||||
dokku_log_warn "$entry is on the deny list, which wins — run: dokku google-auth:undeny $entry"
|
||||
fn-ga-list-add "$scope" allowed-emails "$entry"
|
||||
dokku_log_info1 "allowed $(fn-ga-scope-label "$scope"): $entry"
|
||||
if fn-ga-list-contains "$scope" denied-emails "$entry" ||
|
||||
fn-ga-list-contains global denied-emails "$entry"; then
|
||||
dokku_log_warn "$entry is on a deny list, which wins — run: dokku google-auth:undeny $(fn-ga-scope-arg "$scope") $entry"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
fn-ga-reload-service-config
|
||||
# The first entry an app gets takes it off the global list entirely, which is
|
||||
# easy to do by accident.
|
||||
if [[ "$inherited" == "true" ]]; then
|
||||
dokku_log_warn "$scope no longer uses the global allow list — only the entries above can sign in to it"
|
||||
fi
|
||||
|
||||
fn-ga-apply-list-change "$scope"
|
||||
}
|
||||
|
||||
cmd-google-auth-allow "$@"
|
||||
|
||||
+16
-6
@@ -8,15 +8,25 @@ cmd-google-auth-deny() {
|
||||
local cmd="google-auth:deny"
|
||||
[[ "$1" == "$cmd" ]] && shift 1
|
||||
|
||||
fn-ga-resolve-scope "$cmd" "${1:-}"
|
||||
local scope="$GA_SCOPE"
|
||||
shift 1 || true
|
||||
|
||||
if [[ $# -eq 0 ]]; then
|
||||
dokku_log_info2 "google-auth deny list"
|
||||
dokku_log_info2 "google-auth deny list ($(fn-ga-scope-label "$scope"))"
|
||||
local listed found=false
|
||||
while IFS= read -r listed; do
|
||||
[[ -z "$listed" ]] && continue
|
||||
dokku_log_verbose "$listed"
|
||||
found=true
|
||||
done < <(fn-ga-global-get-list denied-emails)
|
||||
done < <(fn-ga-list-get "$scope" denied-emails)
|
||||
[[ "$found" == "false" ]] && dokku_log_verbose "(empty)"
|
||||
if [[ "$scope" != "global" ]]; then
|
||||
while IFS= read -r listed; do
|
||||
[[ -z "$listed" ]] && continue
|
||||
dokku_log_verbose "$listed (global)"
|
||||
done < <(fn-ga-list-get global denied-emails)
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
|
||||
@@ -26,13 +36,13 @@ cmd-google-auth-deny() {
|
||||
dokku_log_fail "invalid entry '$entry' — use a full address (former@signal.org), with no spaces or commas"
|
||||
entry="${entry,,}"
|
||||
[[ "$entry" == *@* ]] ||
|
||||
dokku_log_fail "google-auth:deny takes a full address, not a domain; to stop allowing all of '$entry', run: dokku google-auth:unallow $entry"
|
||||
fn-ga-global-list-add denied-emails "$entry"
|
||||
dokku_log_info1 "denied: $entry ($(fn-ga-global-list-count denied-emails) denied)"
|
||||
dokku_log_fail "google-auth:deny takes a full address, not a domain; to stop allowing all of '$entry', run: dokku google-auth:unallow $(fn-ga-scope-arg "$scope") $entry"
|
||||
fn-ga-list-add "$scope" denied-emails "$entry"
|
||||
dokku_log_info1 "denied $(fn-ga-scope-label "$scope"): $entry"
|
||||
done
|
||||
|
||||
dokku_log_verbose "denied users lose access on their next request; existing sessions are not honored"
|
||||
fn-ga-reload-service-config
|
||||
fn-ga-apply-list-change "$scope"
|
||||
}
|
||||
|
||||
cmd-google-auth-deny "$@"
|
||||
|
||||
+41
-5
@@ -5,10 +5,11 @@ source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
|
||||
|
||||
fn-ga-report-app() {
|
||||
declare APP="$1"
|
||||
local pattern found
|
||||
dokku_log_info2 "$APP google-auth information"
|
||||
if fn-google-auth-app-enabled "$APP"; then
|
||||
dokku_log_verbose "Enabled: true"
|
||||
local pattern found=false
|
||||
found=false
|
||||
while IFS= read -r pattern; do
|
||||
[[ -z "$pattern" ]] && continue
|
||||
if [[ "$found" == "false" ]]; then
|
||||
@@ -19,14 +20,49 @@ fn-ga-report-app() {
|
||||
fi
|
||||
done < <(fn-ga-excludes "$APP")
|
||||
[[ "$found" == "false" ]] && dokku_log_verbose "Excluded: (none)"
|
||||
else
|
||||
dokku_log_verbose "Enabled: false"
|
||||
fi
|
||||
|
||||
# Access lists are worth showing either way: they are often set before an app
|
||||
# is enabled, and they persist across disable/enable.
|
||||
local allow_entries=()
|
||||
while IFS= read -r pattern; do
|
||||
[[ -n "$pattern" ]] && allow_entries+=("$pattern (domain)")
|
||||
done < <(fn-ga-list-get "$APP" allowed-domains)
|
||||
while IFS= read -r pattern; do
|
||||
[[ -n "$pattern" ]] && allow_entries+=("$pattern")
|
||||
done < <(fn-ga-list-get "$APP" allowed-emails)
|
||||
if [[ ${#allow_entries[@]} -eq 0 ]]; then
|
||||
dokku_log_verbose "Allowed: (inherits the global allow list)"
|
||||
else
|
||||
dokku_log_verbose "Allowed: ${allow_entries[0]} (replaces the global allow list)"
|
||||
local i
|
||||
for ((i = 1; i < ${#allow_entries[@]}; i++)); do
|
||||
dokku_log_verbose " ${allow_entries[i]}"
|
||||
done
|
||||
fi
|
||||
|
||||
found=false
|
||||
while IFS= read -r pattern; do
|
||||
[[ -z "$pattern" ]] && continue
|
||||
if [[ "$found" == "false" ]]; then
|
||||
dokku_log_verbose "Denied: $pattern"
|
||||
found=true
|
||||
else
|
||||
dokku_log_verbose " $pattern"
|
||||
fi
|
||||
done < <(fn-ga-list-get "$APP" denied-emails)
|
||||
[[ "$found" == "false" ]] && dokku_log_verbose "Denied: (none beyond the global deny list)"
|
||||
|
||||
if fn-google-auth-app-enabled "$APP"; then
|
||||
if [[ -f "$(fn-ga-conf-path "$APP")" ]]; then
|
||||
dokku_log_verbose "Nginx: $(fn-ga-conf-path "$APP")"
|
||||
else
|
||||
dokku_log_verbose "Nginx: (config pending; will be written on next deploy)"
|
||||
fi
|
||||
else
|
||||
dokku_log_verbose "Enabled: false"
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
cmd-google-auth-report() {
|
||||
@@ -53,9 +89,9 @@ cmd-google-auth-report() {
|
||||
dokku_log_verbose "Client secret: $([[ -n "$(fn-ga-global-get client-secret)" ]] && echo '(set)' || echo '(unset)')"
|
||||
dokku_log_verbose "Auth host: $(fn-ga-global-get auth-host '(unset)')"
|
||||
dokku_log_verbose "Callback URL: https://$(fn-ga-global-get auth-host '<auth-host>')${GOOGLE_AUTH_ROUTE_PREFIX}/callback"
|
||||
dokku_log_verbose "Allowed domains: $(fn-ga-global-get-list allowed-domains | paste -sd' ' -)"
|
||||
dokku_log_verbose "Allowed domains: $(fn-ga-global-get-list allowed-domains | paste -sd' ' -) (global default)"
|
||||
dokku_log_verbose "Allowed emails: $(fn-ga-global-get-list allowed-emails | paste -sd' ' -)"
|
||||
dokku_log_verbose "Denied emails: $(fn-ga-global-get-list denied-emails | paste -sd' ' -)"
|
||||
dokku_log_verbose "Denied emails: $(fn-ga-global-get-list denied-emails | paste -sd' ' -) (applies to every app)"
|
||||
dokku_log_verbose "Session TTL: $(fn-ga-global-get session-ttl 24h)"
|
||||
dokku_log_verbose "Service port: 127.0.0.1:$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
|
||||
if fn-ga-service-running; then
|
||||
|
||||
+27
-17
@@ -4,47 +4,57 @@ set -eo pipefail
|
||||
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
|
||||
|
||||
cmd-google-auth-unallow() {
|
||||
declare desc="remove a domain or address from the allow list"
|
||||
declare desc="remove a domain or address from an allow list"
|
||||
local cmd="google-auth:unallow"
|
||||
[[ "$1" == "$cmd" ]] && shift 1
|
||||
|
||||
[[ $# -gt 0 ]] || dokku_log_fail "usage: dokku google-auth:unallow <domain|address...> (see: dokku google-auth:allow)"
|
||||
fn-ga-resolve-scope "$cmd" "${1:-}"
|
||||
local scope="$GA_SCOPE"
|
||||
shift 1 || true
|
||||
|
||||
[[ $# -gt 0 ]] || dokku_log_fail "usage: dokku $cmd <app>|--global <domain|address...>"
|
||||
|
||||
# Lowercase, drop any leading "@", and de-duplicate so the lockout check
|
||||
# below counts each entry once.
|
||||
local entries=()
|
||||
mapfile -t entries < <(printf '%s\n' "$@" | tr '[:upper:]' '[:lower:]' | sed 's/^@//' | awk '!seen[$0]++')
|
||||
|
||||
# Refuse before touching anything if this would leave the allow list empty,
|
||||
# which locks everyone out of every enabled app.
|
||||
local entry total present=0
|
||||
total=$(($(fn-ga-global-list-count allowed-domains) + $(fn-ga-global-list-count allowed-emails)))
|
||||
total=$(($(fn-ga-list-count "$scope" allowed-domains) + $(fn-ga-list-count "$scope" allowed-emails)))
|
||||
for entry in "${entries[@]}"; do
|
||||
fn-ga-global-list-contains allowed-domains "$entry" && present=$((present + 1))
|
||||
fn-ga-global-list-contains allowed-emails "$entry" && present=$((present + 1))
|
||||
fn-ga-list-contains "$scope" allowed-domains "$entry" && present=$((present + 1))
|
||||
fn-ga-list-contains "$scope" allowed-emails "$entry" && present=$((present + 1))
|
||||
done
|
||||
if [[ $((total - present)) -le 0 ]]; then
|
||||
dokku_log_fail "that would empty the allow list and lock everyone out; add the replacement first with: dokku google-auth:allow <domain|address>"
|
||||
|
||||
# Emptying the global list locks everyone out of every enabled app, so refuse
|
||||
# before touching anything. Emptying an app's list is fine — it falls back to
|
||||
# the global one.
|
||||
if [[ "$scope" == "global" && $((total - present)) -le 0 ]]; then
|
||||
dokku_log_fail "that would empty the global allow list and lock everyone out; add the replacement first with: dokku google-auth:allow --global <domain|address>"
|
||||
fi
|
||||
|
||||
local removed
|
||||
for entry in "${entries[@]}"; do
|
||||
removed=false
|
||||
if fn-ga-global-list-contains allowed-domains "$entry"; then
|
||||
fn-ga-global-list-remove allowed-domains "$entry"
|
||||
dokku_log_info1 "removed allowed domain: $entry"
|
||||
if fn-ga-list-contains "$scope" allowed-domains "$entry"; then
|
||||
fn-ga-list-remove "$scope" allowed-domains "$entry"
|
||||
dokku_log_info1 "removed allowed domain $(fn-ga-scope-label "$scope"): $entry"
|
||||
removed=true
|
||||
fi
|
||||
if fn-ga-global-list-contains allowed-emails "$entry"; then
|
||||
fn-ga-global-list-remove allowed-emails "$entry"
|
||||
dokku_log_info1 "removed: $entry"
|
||||
if fn-ga-list-contains "$scope" allowed-emails "$entry"; then
|
||||
fn-ga-list-remove "$scope" allowed-emails "$entry"
|
||||
dokku_log_info1 "removed $(fn-ga-scope-label "$scope"): $entry"
|
||||
removed=true
|
||||
fi
|
||||
[[ "$removed" == "true" ]] || dokku_log_warn "$entry was not on the allow list"
|
||||
[[ "$removed" == "true" ]] || dokku_log_warn "$entry was not on the allow list $(fn-ga-scope-label "$scope")"
|
||||
done
|
||||
|
||||
if [[ "$scope" != "global" && $((total - present)) -le 0 ]]; then
|
||||
dokku_log_info1 "$scope has no allow entries left and now uses the global allow list"
|
||||
fi
|
||||
|
||||
dokku_log_verbose "removed users lose access on their next request; existing sessions are not honored"
|
||||
fn-ga-reload-service-config
|
||||
fn-ga-apply-list-change "$scope"
|
||||
}
|
||||
|
||||
cmd-google-auth-unallow "$@"
|
||||
|
||||
+23
-11
@@ -4,29 +4,41 @@ set -eo pipefail
|
||||
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
|
||||
|
||||
cmd-google-auth-undeny() {
|
||||
declare desc="remove an address from the deny list"
|
||||
declare desc="remove an address from a deny list"
|
||||
local cmd="google-auth:undeny"
|
||||
[[ "$1" == "$cmd" ]] && shift 1
|
||||
|
||||
[[ $# -gt 0 ]] || dokku_log_fail "usage: dokku google-auth:undeny <address...> (see: dokku google-auth:deny)"
|
||||
fn-ga-resolve-scope "$cmd" "${1:-}"
|
||||
local scope="$GA_SCOPE"
|
||||
shift 1 || true
|
||||
|
||||
[[ $# -gt 0 ]] || dokku_log_fail "usage: dokku $cmd <app>|--global <address...>"
|
||||
|
||||
local entry
|
||||
for entry in "$@"; do
|
||||
entry="${entry,,}"
|
||||
if ! fn-ga-global-list-contains denied-emails "$entry"; then
|
||||
dokku_log_warn "$entry was not on the deny list"
|
||||
if ! fn-ga-list-contains "$scope" denied-emails "$entry"; then
|
||||
dokku_log_warn "$entry was not on the deny list $(fn-ga-scope-label "$scope")"
|
||||
# A global denial cannot be lifted per app; say so rather than let the
|
||||
# operator think the address is unblocked now.
|
||||
if [[ "$scope" != "global" ]] && fn-ga-list-contains global denied-emails "$entry"; then
|
||||
dokku_log_warn "$entry is denied globally, which no app can override — run: dokku google-auth:undeny --global $entry"
|
||||
fi
|
||||
continue
|
||||
fi
|
||||
fn-ga-global-list-remove denied-emails "$entry"
|
||||
dokku_log_info1 "removed from deny list: $entry"
|
||||
# Undenying only stops the explicit block; the allow list still decides.
|
||||
if ! fn-ga-global-list-contains allowed-emails "$entry" &&
|
||||
! fn-ga-global-list-contains allowed-domains "${entry#*@}"; then
|
||||
dokku_log_warn "$entry still cannot sign in — nothing on the allow list covers it (see: dokku google-auth:allow)"
|
||||
fn-ga-list-remove "$scope" denied-emails "$entry"
|
||||
dokku_log_info1 "removed from the deny list $(fn-ga-scope-label "$scope"): $entry"
|
||||
if [[ "$scope" != "global" ]] && fn-ga-list-contains global denied-emails "$entry"; then
|
||||
dokku_log_warn "$entry is still denied globally — run: dokku google-auth:undeny --global $entry"
|
||||
continue
|
||||
fi
|
||||
# Undenying only lifts the block; the allow lists still decide.
|
||||
if ! fn-ga-email-effectively-allowed "$scope" "$entry"; then
|
||||
dokku_log_warn "$entry still cannot sign in — nothing on the allow list covers it (see: dokku google-auth:allow $(fn-ga-scope-arg "$scope"))"
|
||||
fi
|
||||
done
|
||||
|
||||
fn-ga-reload-service-config
|
||||
fn-ga-apply-list-change "$scope"
|
||||
}
|
||||
|
||||
cmd-google-auth-undeny "$@"
|
||||
|
||||
Reference in New Issue
Block a user