greyson/dokkku-google-auth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow per-app allow/deny.

Browse Source
This commit is contained in:
Greyson Parrelli
2026-08-06 13:53:24 -04:00
parent c15a1cc14c
commit 8ce2919627
19 changed files with 1151 additions and 187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
subcommands/report
+41 -5
View File
@@ -5,10 +5,11 @@ source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
fn-ga-report-app() {
declare APP="$1"
local pattern found
dokku_log_info2 "$APP google-auth information"
if fn-google-auth-app-enabled "$APP"; then
dokku_log_verbose "Enabled: true"
local pattern found=false
found=false
while IFS= read -r pattern; do
[[ -z "$pattern" ]] && continue
if [[ "$found" == "false" ]]; then
@@ -19,14 +20,49 @@ fn-ga-report-app() {
fi
done < <(fn-ga-excludes "$APP")
[[ "$found" == "false" ]] && dokku_log_verbose "Excluded: (none)"
else
dokku_log_verbose "Enabled: false"
fi
# Access lists are worth showing either way: they are often set before an app
# is enabled, and they persist across disable/enable.
local allow_entries=()
while IFS= read -r pattern; do
[[ -n "$pattern" ]] && allow_entries+=("$pattern (domain)")
done < <(fn-ga-list-get "$APP" allowed-domains)
while IFS= read -r pattern; do
[[ -n "$pattern" ]] && allow_entries+=("$pattern")
done < <(fn-ga-list-get "$APP" allowed-emails)
if [[ ${#allow_entries[@]} -eq 0 ]]; then
dokku_log_verbose "Allowed: (inherits the global allow list)"
else
dokku_log_verbose "Allowed: ${allow_entries[0]} (replaces the global allow list)"
local i
for ((i = 1; i < ${#allow_entries[@]}; i++)); do
dokku_log_verbose " ${allow_entries[i]}"
done
fi
found=false
while IFS= read -r pattern; do
[[ -z "$pattern" ]] && continue
if [[ "$found" == "false" ]]; then
dokku_log_verbose "Denied: $pattern"
found=true
else
dokku_log_verbose " $pattern"
fi
done < <(fn-ga-list-get "$APP" denied-emails)
[[ "$found" == "false" ]] && dokku_log_verbose "Denied: (none beyond the global deny list)"
if fn-google-auth-app-enabled "$APP"; then
if [[ -f "$(fn-ga-conf-path "$APP")" ]]; then
dokku_log_verbose "Nginx: $(fn-ga-conf-path "$APP")"
else
dokku_log_verbose "Nginx: (config pending; will be written on next deploy)"
fi
else
dokku_log_verbose "Enabled: false"
fi
return 0
}
cmd-google-auth-report() {
@@ -53,9 +89,9 @@ cmd-google-auth-report() {
dokku_log_verbose "Client secret: $([[ -n "$(fn-ga-global-get client-secret)" ]] && echo '(set)' || echo '(unset)')"
dokku_log_verbose "Auth host: $(fn-ga-global-get auth-host '(unset)')"
dokku_log_verbose "Callback URL: https://$(fn-ga-global-get auth-host '<auth-host>')${GOOGLE_AUTH_ROUTE_PREFIX}/callback"
dokku_log_verbose "Allowed domains: $(fn-ga-global-get-list allowed-domains | paste -sd' ' -)"
dokku_log_verbose "Allowed domains: $(fn-ga-global-get-list allowed-domains | paste -sd' ' -) (global default)"
dokku_log_verbose "Allowed emails: $(fn-ga-global-get-list allowed-emails | paste -sd' ' -)"
dokku_log_verbose "Denied emails: $(fn-ga-global-get-list denied-emails | paste -sd' ' -)"
dokku_log_verbose "Denied emails: $(fn-ga-global-get-list denied-emails | paste -sd' ' -) (applies to every app)"
dokku_log_verbose "Session TTL: $(fn-ga-global-get session-ttl 24h)"
dokku_log_verbose "Service port: 127.0.0.1:$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
if fn-ga-service-running; then