Add explict allow deny commands.

2026-08-06 10:45:45 -04:00
parent a3f0f8a1be
commit c15a1cc14c
15 changed files with 566 additions and 13 deletions
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+cmd-google-auth-allow() {
+  declare desc="allow a domain or address to sign in"
+  local cmd="google-auth:allow"
+  [[ "$1" == "$cmd" ]] && shift 1
+
+  if [[ $# -eq 0 ]]; then
+    dokku_log_info2 "google-auth allow list"
+    local listed found=false
+    while IFS= read -r listed; do
+      [[ -z "$listed" ]] && continue
+      dokku_log_verbose "$listed (domain)"
+      found=true
+    done < <(fn-ga-global-get-list allowed-domains)
+    while IFS= read -r listed; do
+      [[ -z "$listed" ]] && continue
+      dokku_log_verbose "$listed"
+      found=true
+    done < <(fn-ga-global-get-list allowed-emails)
+    [[ "$found" == "false" ]] && dokku_log_verbose "(empty — nobody can sign in)"
+    return 0
+  fi
+
+  local entry
+  for entry in "$@"; do
+    fn-ga-validate-list-entry "$entry" ||
+      dokku_log_fail "invalid entry '$entry' — use a domain (signal.org) or a full address (guest@partner.com), with no spaces or commas"
+    entry="${entry,,}"
+    if [[ "$(fn-ga-allow-entry-kind "$entry")" == "domain" ]]; then
+      entry="${entry#@}"
+      [[ "$entry" == *.* ]] || dokku_log_fail "'$entry' does not look like a domain"
+      fn-ga-global-list-add allowed-domains "$entry"
+      dokku_log_info1 "allowed domain: $entry (any verified account at $entry)"
+    else
+      fn-ga-global-list-add allowed-emails "$entry"
+      dokku_log_info1 "allowed: $entry"
+      if fn-ga-global-list-contains denied-emails "$entry"; then
+        dokku_log_warn "$entry is on the deny list, which wins — run: dokku google-auth:undeny $entry"
+      fi
+    fi
+  done
+
+  fn-ga-reload-service-config
+}
+
+cmd-google-auth-allow "$@"