Add explict allow deny commands.
This commit is contained in:
Greyson Parrelli
Executable
+50
@@ -0,0 +1,50 @@
|
||||
#!/usr/bin/env bash
|
||||
set -eo pipefail
|
||||
[[ $DOKKU_TRACE ]] && set -x
|
||||
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
|
||||
|
||||
cmd-google-auth-allow() {
|
||||
declare desc="allow a domain or address to sign in"
|
||||
local cmd="google-auth:allow"
|
||||
[[ "$1" == "$cmd" ]] && shift 1
|
||||
|
||||
if [[ $# -eq 0 ]]; then
|
||||
dokku_log_info2 "google-auth allow list"
|
||||
local listed found=false
|
||||
while IFS= read -r listed; do
|
||||
[[ -z "$listed" ]] && continue
|
||||
dokku_log_verbose "$listed (domain)"
|
||||
found=true
|
||||
done < <(fn-ga-global-get-list allowed-domains)
|
||||
while IFS= read -r listed; do
|
||||
[[ -z "$listed" ]] && continue
|
||||
dokku_log_verbose "$listed"
|
||||
found=true
|
||||
done < <(fn-ga-global-get-list allowed-emails)
|
||||
[[ "$found" == "false" ]] && dokku_log_verbose "(empty — nobody can sign in)"
|
||||
return 0
|
||||
fi
|
||||
|
||||
local entry
|
||||
for entry in "$@"; do
|
||||
fn-ga-validate-list-entry "$entry" ||
|
||||
dokku_log_fail "invalid entry '$entry' — use a domain (signal.org) or a full address (guest@partner.com), with no spaces or commas"
|
||||
entry="${entry,,}"
|
||||
if [[ "$(fn-ga-allow-entry-kind "$entry")" == "domain" ]]; then
|
||||
entry="${entry#@}"
|
||||
[[ "$entry" == *.* ]] || dokku_log_fail "'$entry' does not look like a domain"
|
||||
fn-ga-global-list-add allowed-domains "$entry"
|
||||
dokku_log_info1 "allowed domain: $entry (any verified account at $entry)"
|
||||
else
|
||||
fn-ga-global-list-add allowed-emails "$entry"
|
||||
dokku_log_info1 "allowed: $entry"
|
||||
if fn-ga-global-list-contains denied-emails "$entry"; then
|
||||
dokku_log_warn "$entry is on the deny list, which wins — run: dokku google-auth:undeny $entry"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
fn-ga-reload-service-config
|
||||
}
|
||||
|
||||
cmd-google-auth-allow "$@"
|
||||
Vendored
+25
-2
@@ -8,7 +8,8 @@ cmd-google-auth-configure() {
|
||||
local cmd="google-auth:configure"
|
||||
[[ "$1" == "$cmd" ]] && shift 1
|
||||
|
||||
local domains=() emails=() domains_given=false emails_given=false
|
||||
local domains=() emails=() denied=()
|
||||
local domains_given=false emails_given=false denied_given=false
|
||||
local old_port
|
||||
old_port="$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
|
||||
|
||||
@@ -44,6 +45,17 @@ cmd-google-auth-configure() {
|
||||
emails+=("${2,,}")
|
||||
shift 2
|
||||
;;
|
||||
--deny-email)
|
||||
[[ -n "${2:-}" ]] || dokku_log_fail "--deny-email requires a value"
|
||||
[[ "$2" == *@* ]] || dokku_log_fail "--deny-email takes a full address (got '$2'); denying a whole domain means removing its --allow-domain"
|
||||
denied_given=true
|
||||
denied+=("${2,,}")
|
||||
shift 2
|
||||
;;
|
||||
--clear-deny-emails)
|
||||
denied_given=true
|
||||
shift 1
|
||||
;;
|
||||
--session-ttl)
|
||||
[[ "${2:-}" =~ ^[0-9]+(h|m|s)$ ]] || dokku_log_fail "--session-ttl must look like 24h, 30m, or 3600s"
|
||||
fn-ga-global-set session-ttl "$2"
|
||||
@@ -75,9 +87,20 @@ cmd-google-auth-configure() {
|
||||
esac
|
||||
done
|
||||
|
||||
# Replace the allow lists only when new values were passed.
|
||||
# Replace the allow/deny lists only when new values were passed.
|
||||
[[ "$domains_given" == "true" ]] && fn-ga-global-set-list allowed-domains "${domains[@]}"
|
||||
[[ "$emails_given" == "true" ]] && fn-ga-global-set-list allowed-emails "${emails[@]}"
|
||||
[[ "$denied_given" == "true" ]] && fn-ga-global-set-list denied-emails "${denied[@]}"
|
||||
|
||||
# Deny wins over allow; surface the contradiction instead of silently
|
||||
# ignoring the allow entry.
|
||||
local addr
|
||||
while IFS= read -r addr; do
|
||||
[[ -z "$addr" ]] && continue
|
||||
if fn-ga-global-get-list allowed-emails | grep -qxF "$addr"; then
|
||||
dokku_log_warn "$addr is in both the allow and deny lists; it will be denied"
|
||||
fi
|
||||
done < <(fn-ga-global-get-list denied-emails)
|
||||
|
||||
# First run: generate the cookie secret automatically.
|
||||
if [[ -z "$(fn-ga-global-get cookie-secret)" ]]; then
|
||||
|
||||
Executable
+38
@@ -0,0 +1,38 @@
|
||||
#!/usr/bin/env bash
|
||||
set -eo pipefail
|
||||
[[ $DOKKU_TRACE ]] && set -x
|
||||
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
|
||||
|
||||
cmd-google-auth-deny() {
|
||||
declare desc="block an address even if the allow list covers it"
|
||||
local cmd="google-auth:deny"
|
||||
[[ "$1" == "$cmd" ]] && shift 1
|
||||
|
||||
if [[ $# -eq 0 ]]; then
|
||||
dokku_log_info2 "google-auth deny list"
|
||||
local listed found=false
|
||||
while IFS= read -r listed; do
|
||||
[[ -z "$listed" ]] && continue
|
||||
dokku_log_verbose "$listed"
|
||||
found=true
|
||||
done < <(fn-ga-global-get-list denied-emails)
|
||||
[[ "$found" == "false" ]] && dokku_log_verbose "(empty)"
|
||||
return 0
|
||||
fi
|
||||
|
||||
local entry
|
||||
for entry in "$@"; do
|
||||
fn-ga-validate-list-entry "$entry" ||
|
||||
dokku_log_fail "invalid entry '$entry' — use a full address (former@signal.org), with no spaces or commas"
|
||||
entry="${entry,,}"
|
||||
[[ "$entry" == *@* ]] ||
|
||||
dokku_log_fail "google-auth:deny takes a full address, not a domain; to stop allowing all of '$entry', run: dokku google-auth:unallow $entry"
|
||||
fn-ga-global-list-add denied-emails "$entry"
|
||||
dokku_log_info1 "denied: $entry ($(fn-ga-global-list-count denied-emails) denied)"
|
||||
done
|
||||
|
||||
dokku_log_verbose "denied users lose access on their next request; existing sessions are not honored"
|
||||
fn-ga-reload-service-config
|
||||
}
|
||||
|
||||
cmd-google-auth-deny "$@"
|
||||
@@ -55,6 +55,7 @@ cmd-google-auth-report() {
|
||||
dokku_log_verbose "Callback URL: https://$(fn-ga-global-get auth-host '<auth-host>')${GOOGLE_AUTH_ROUTE_PREFIX}/callback"
|
||||
dokku_log_verbose "Allowed domains: $(fn-ga-global-get-list allowed-domains | paste -sd' ' -)"
|
||||
dokku_log_verbose "Allowed emails: $(fn-ga-global-get-list allowed-emails | paste -sd' ' -)"
|
||||
dokku_log_verbose "Denied emails: $(fn-ga-global-get-list denied-emails | paste -sd' ' -)"
|
||||
dokku_log_verbose "Session TTL: $(fn-ga-global-get session-ttl 24h)"
|
||||
dokku_log_verbose "Service port: 127.0.0.1:$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
|
||||
if fn-ga-service-running; then
|
||||
|
||||
Executable
+50
@@ -0,0 +1,50 @@
|
||||
#!/usr/bin/env bash
|
||||
set -eo pipefail
|
||||
[[ $DOKKU_TRACE ]] && set -x
|
||||
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
|
||||
|
||||
cmd-google-auth-unallow() {
|
||||
declare desc="remove a domain or address from the allow list"
|
||||
local cmd="google-auth:unallow"
|
||||
[[ "$1" == "$cmd" ]] && shift 1
|
||||
|
||||
[[ $# -gt 0 ]] || dokku_log_fail "usage: dokku google-auth:unallow <domain|address...> (see: dokku google-auth:allow)"
|
||||
|
||||
# Lowercase, drop any leading "@", and de-duplicate so the lockout check
|
||||
# below counts each entry once.
|
||||
local entries=()
|
||||
mapfile -t entries < <(printf '%s\n' "$@" | tr '[:upper:]' '[:lower:]' | sed 's/^@//' | awk '!seen[$0]++')
|
||||
|
||||
# Refuse before touching anything if this would leave the allow list empty,
|
||||
# which locks everyone out of every enabled app.
|
||||
local entry total present=0
|
||||
total=$(($(fn-ga-global-list-count allowed-domains) + $(fn-ga-global-list-count allowed-emails)))
|
||||
for entry in "${entries[@]}"; do
|
||||
fn-ga-global-list-contains allowed-domains "$entry" && present=$((present + 1))
|
||||
fn-ga-global-list-contains allowed-emails "$entry" && present=$((present + 1))
|
||||
done
|
||||
if [[ $((total - present)) -le 0 ]]; then
|
||||
dokku_log_fail "that would empty the allow list and lock everyone out; add the replacement first with: dokku google-auth:allow <domain|address>"
|
||||
fi
|
||||
|
||||
local removed
|
||||
for entry in "${entries[@]}"; do
|
||||
removed=false
|
||||
if fn-ga-global-list-contains allowed-domains "$entry"; then
|
||||
fn-ga-global-list-remove allowed-domains "$entry"
|
||||
dokku_log_info1 "removed allowed domain: $entry"
|
||||
removed=true
|
||||
fi
|
||||
if fn-ga-global-list-contains allowed-emails "$entry"; then
|
||||
fn-ga-global-list-remove allowed-emails "$entry"
|
||||
dokku_log_info1 "removed: $entry"
|
||||
removed=true
|
||||
fi
|
||||
[[ "$removed" == "true" ]] || dokku_log_warn "$entry was not on the allow list"
|
||||
done
|
||||
|
||||
dokku_log_verbose "removed users lose access on their next request; existing sessions are not honored"
|
||||
fn-ga-reload-service-config
|
||||
}
|
||||
|
||||
cmd-google-auth-unallow "$@"
|
||||
Executable
+32
@@ -0,0 +1,32 @@
|
||||
#!/usr/bin/env bash
|
||||
set -eo pipefail
|
||||
[[ $DOKKU_TRACE ]] && set -x
|
||||
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
|
||||
|
||||
cmd-google-auth-undeny() {
|
||||
declare desc="remove an address from the deny list"
|
||||
local cmd="google-auth:undeny"
|
||||
[[ "$1" == "$cmd" ]] && shift 1
|
||||
|
||||
[[ $# -gt 0 ]] || dokku_log_fail "usage: dokku google-auth:undeny <address...> (see: dokku google-auth:deny)"
|
||||
|
||||
local entry
|
||||
for entry in "$@"; do
|
||||
entry="${entry,,}"
|
||||
if ! fn-ga-global-list-contains denied-emails "$entry"; then
|
||||
dokku_log_warn "$entry was not on the deny list"
|
||||
continue
|
||||
fi
|
||||
fn-ga-global-list-remove denied-emails "$entry"
|
||||
dokku_log_info1 "removed from deny list: $entry"
|
||||
# Undenying only stops the explicit block; the allow list still decides.
|
||||
if ! fn-ga-global-list-contains allowed-emails "$entry" &&
|
||||
! fn-ga-global-list-contains allowed-domains "${entry#*@}"; then
|
||||
dokku_log_warn "$entry still cannot sign in — nothing on the allow list covers it (see: dokku google-auth:allow)"
|
||||
fi
|
||||
done
|
||||
|
||||
fn-ga-reload-service-config
|
||||
}
|
||||
|
||||
cmd-google-auth-undeny "$@"
|
||||
Reference in New Issue
Block a user