51 lines
1.7 KiB
Bash
Executable File
51 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eo pipefail
|
|
[[ $DOKKU_TRACE ]] && set -x
|
|
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
|
|
|
|
cmd-google-auth-allow() {
|
|
declare desc="allow a domain or address to sign in"
|
|
local cmd="google-auth:allow"
|
|
[[ "$1" == "$cmd" ]] && shift 1
|
|
|
|
if [[ $# -eq 0 ]]; then
|
|
dokku_log_info2 "google-auth allow list"
|
|
local listed found=false
|
|
while IFS= read -r listed; do
|
|
[[ -z "$listed" ]] && continue
|
|
dokku_log_verbose "$listed (domain)"
|
|
found=true
|
|
done < <(fn-ga-global-get-list allowed-domains)
|
|
while IFS= read -r listed; do
|
|
[[ -z "$listed" ]] && continue
|
|
dokku_log_verbose "$listed"
|
|
found=true
|
|
done < <(fn-ga-global-get-list allowed-emails)
|
|
[[ "$found" == "false" ]] && dokku_log_verbose "(empty — nobody can sign in)"
|
|
return 0
|
|
fi
|
|
|
|
local entry
|
|
for entry in "$@"; do
|
|
fn-ga-validate-list-entry "$entry" ||
|
|
dokku_log_fail "invalid entry '$entry' — use a domain (signal.org) or a full address (guest@partner.com), with no spaces or commas"
|
|
entry="${entry,,}"
|
|
if [[ "$(fn-ga-allow-entry-kind "$entry")" == "domain" ]]; then
|
|
entry="${entry#@}"
|
|
[[ "$entry" == *.* ]] || dokku_log_fail "'$entry' does not look like a domain"
|
|
fn-ga-global-list-add allowed-domains "$entry"
|
|
dokku_log_info1 "allowed domain: $entry (any verified account at $entry)"
|
|
else
|
|
fn-ga-global-list-add allowed-emails "$entry"
|
|
dokku_log_info1 "allowed: $entry"
|
|
if fn-ga-global-list-contains denied-emails "$entry"; then
|
|
dokku_log_warn "$entry is on the deny list, which wins — run: dokku google-auth:undeny $entry"
|
|
fi
|
|
fi
|
|
done
|
|
|
|
fn-ga-reload-service-config
|
|
}
|
|
|
|
cmd-google-auth-allow "$@"
|