greyson/dokkku-google-auth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow per-app allow/deny.

Browse Source
This commit is contained in:
Greyson Parrelli
2026-08-06 13:53:24 -04:00
parent c15a1cc14c
commit 8ce2919627
19 changed files with 1151 additions and 187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
subcommands/unallow
+27 -17
View File
@@ -4,47 +4,57 @@ set -eo pipefail
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
cmd-google-auth-unallow() {
declare desc="remove a domain or address from the allow list"
declare desc="remove a domain or address from an allow list"
local cmd="google-auth:unallow"
[[ "$1" == "$cmd" ]] && shift 1
[[ $# -gt 0 ]] || dokku_log_fail "usage: dokku google-auth:unallow <domain|address...> (see: dokku google-auth:allow)"
fn-ga-resolve-scope "$cmd" "${1:-}"
local scope="$GA_SCOPE"
shift 1 || true
[[ $# -gt 0 ]] || dokku_log_fail "usage: dokku $cmd <app>|--global <domain|address...>"
# Lowercase, drop any leading "@", and de-duplicate so the lockout check
# below counts each entry once.
local entries=()
mapfile -t entries < <(printf '%s\n' "$@" | tr '[:upper:]' '[:lower:]' | sed 's/^@//' | awk '!seen[$0]++')
# Refuse before touching anything if this would leave the allow list empty,
# which locks everyone out of every enabled app.
local entry total present=0
total=$(($(fn-ga-global-list-count allowed-domains) + $(fn-ga-global-list-count allowed-emails)))
total=$(($(fn-ga-list-count "$scope" allowed-domains) + $(fn-ga-list-count "$scope" allowed-emails)))
for entry in "${entries[@]}"; do
fn-ga-global-list-contains allowed-domains "$entry" && present=$((present + 1))
fn-ga-global-list-contains allowed-emails "$entry" && present=$((present + 1))
fn-ga-list-contains "$scope" allowed-domains "$entry" && present=$((present + 1))
fn-ga-list-contains "$scope" allowed-emails "$entry" && present=$((present + 1))
done
if [[ $((total - present)) -le 0 ]]; then
dokku_log_fail "that would empty the allow list and lock everyone out; add the replacement first with: dokku google-auth:allow <domain|address>"
# Emptying the global list locks everyone out of every enabled app, so refuse
# before touching anything. Emptying an app's list is fine — it falls back to
# the global one.
if [[ "$scope" == "global" && $((total - present)) -le 0 ]]; then
dokku_log_fail "that would empty the global allow list and lock everyone out; add the replacement first with: dokku google-auth:allow --global <domain|address>"
fi
local removed
for entry in "${entries[@]}"; do
removed=false
if fn-ga-global-list-contains allowed-domains "$entry"; then
fn-ga-global-list-remove allowed-domains "$entry"
dokku_log_info1 "removed allowed domain: $entry"
if fn-ga-list-contains "$scope" allowed-domains "$entry"; then
fn-ga-list-remove "$scope" allowed-domains "$entry"
dokku_log_info1 "removed allowed domain $(fn-ga-scope-label "$scope"): $entry"
removed=true
fi
if fn-ga-global-list-contains allowed-emails "$entry"; then
fn-ga-global-list-remove allowed-emails "$entry"
dokku_log_info1 "removed: $entry"
if fn-ga-list-contains "$scope" allowed-emails "$entry"; then
fn-ga-list-remove "$scope" allowed-emails "$entry"
dokku_log_info1 "removed $(fn-ga-scope-label "$scope"): $entry"
removed=true
fi
[[ "$removed" == "true" ]] || dokku_log_warn "$entry was not on the allow list"
[[ "$removed" == "true" ]] || dokku_log_warn "$entry was not on the allow list $(fn-ga-scope-label "$scope")"
done
if [[ "$scope" != "global" && $((total - present)) -le 0 ]]; then
dokku_log_info1 "$scope has no allow entries left and now uses the global allow list"
fi
dokku_log_verbose "removed users lose access on their next request; existing sessions are not honored"
fn-ga-reload-service-config
fn-ga-apply-list-change "$scope"
}
cmd-google-auth-unallow "$@"