greyson/dokkku-google-auth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow per-app allow/deny.

Browse Source
This commit is contained in:
Greyson Parrelli
2026-08-06 13:53:24 -04:00
parent c15a1cc14c
commit 8ce2919627
19 changed files with 1151 additions and 187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
subcommands/allow
+33 -13
View File
@@ -4,28 +4,41 @@ set -eo pipefail
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
cmd-google-auth-allow() {
declare desc="allow a domain or address to sign in"
declare desc="allow a domain or address to sign in, globally or for one app"
local cmd="google-auth:allow"
[[ "$1" == "$cmd" ]] && shift 1
fn-ga-resolve-scope "$cmd" "${1:-}"
local scope="$GA_SCOPE"
shift 1 || true
if [[ $# -eq 0 ]]; then
dokku_log_info2 "google-auth allow list"
dokku_log_info2 "google-auth allow list ($(fn-ga-scope-label "$scope"))"
local listed found=false
while IFS= read -r listed; do
[[ -z "$listed" ]] && continue
dokku_log_verbose "$listed (domain)"
found=true
done < <(fn-ga-global-get-list allowed-domains)
done < <(fn-ga-list-get "$scope" allowed-domains)
while IFS= read -r listed; do
[[ -z "$listed" ]] && continue
dokku_log_verbose "$listed"
found=true
done < <(fn-ga-global-get-list allowed-emails)
[[ "$found" == "false" ]] && dokku_log_verbose "(empty — nobody can sign in)"
done < <(fn-ga-list-get "$scope" allowed-emails)
if [[ "$found" == "false" ]]; then
if [[ "$scope" == "global" ]]; then
dokku_log_verbose "(empty — nobody can sign in)"
else
dokku_log_verbose "(none — $scope uses the global allow list)"
fi
fi
return 0
fi
local entry
local entry inherited=false
[[ "$scope" != "global" && "$(fn-ga-list-count "$scope" allowed-domains)" -eq 0 &&
"$(fn-ga-list-count "$scope" allowed-emails)" -eq 0 ]] && inherited=true
for entry in "$@"; do
fn-ga-validate-list-entry "$entry" ||
dokku_log_fail "invalid entry '$entry' — use a domain (signal.org) or a full address (guest@partner.com), with no spaces or commas"
@@ -33,18 +46,25 @@ cmd-google-auth-allow() {
if [[ "$(fn-ga-allow-entry-kind "$entry")" == "domain" ]]; then
entry="${entry#@}"
[[ "$entry" == *.* ]] || dokku_log_fail "'$entry' does not look like a domain"
fn-ga-global-list-add allowed-domains "$entry"
dokku_log_info1 "allowed domain: $entry (any verified account at $entry)"
fn-ga-list-add "$scope" allowed-domains "$entry"
dokku_log_info1 "allowed domain $(fn-ga-scope-label "$scope"): $entry (any verified account at $entry)"
else
fn-ga-global-list-add allowed-emails "$entry"
dokku_log_info1 "allowed: $entry"
if fn-ga-global-list-contains denied-emails "$entry"; then
dokku_log_warn "$entry is on the deny list, which wins — run: dokku google-auth:undeny $entry"
fn-ga-list-add "$scope" allowed-emails "$entry"
dokku_log_info1 "allowed $(fn-ga-scope-label "$scope"): $entry"
if fn-ga-list-contains "$scope" denied-emails "$entry" ||
fn-ga-list-contains global denied-emails "$entry"; then
dokku_log_warn "$entry is on a deny list, which wins — run: dokku google-auth:undeny $(fn-ga-scope-arg "$scope") $entry"
fi
fi
done
fn-ga-reload-service-config
# The first entry an app gets takes it off the global list entirely, which is
# easy to do by accident.
if [[ "$inherited" == "true" ]]; then
dokku_log_warn "$scope no longer uses the global allow list — only the entries above can sign in to it"
fi
fn-ga-apply-list-change "$scope"
}
cmd-google-auth-allow "$@"