feat: restricted signup by email domain #863
Conversation
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including You can disable this status message by setting the WalkthroughA new environment variable, Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant AuthSystem
participant Database
participant Env
User->>AuthSystem: Attempt sign-in
AuthSystem->>Database: Check if user exists
Database-->>AuthSystem: User found? (yes/no)
alt User is new
AuthSystem->>Env: Get CAP_ALLOWED_SIGNUP_DOMAINS
AuthSystem->>AuthSystem: isEmailAllowedForSignup(user.email, allowedDomains)
alt Domain allowed
AuthSystem-->>User: Allow sign-in
else Domain not allowed
AuthSystem-->>User: Block sign-in
end
else User exists
AuthSystem-->>User: Allow sign-in
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/database/auth/auth-options.tsx (1)
173-192: Well-implemented domain restriction logic.The signIn callback correctly:
- Exempts existing users from domain restrictions
- Only applies checks to new signups
- Uses proper database queries and utility functions
- Includes appropriate logging
Consider enhancing the logging to include the rejected domain for better debugging:
- console.log(`Signup blocked for email domain: ${user.email}`); + console.log(`Signup blocked for email domain: ${user.email?.split('@')[1]} (email: ${user.email})`);
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (5)
.env.example(1 hunks)packages/database/auth/auth-options.tsx(2 hunks)packages/database/auth/domain-utils.ts(1 hunks)packages/database/package.json(1 hunks)packages/env/server.ts(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Build Desktop (aarch64-apple-darwin, macos-latest)
- GitHub Check: Clippy
- GitHub Check: Build Desktop (x86_64-pc-windows-msvc, windows-latest)
🔇 Additional comments (6)
packages/env/server.ts (1)
48-48: LGTM - Environment variable correctly configured.The addition of
CAP_ALLOWED_SIGNUP_DOMAINSas an optional string follows the existing pattern and is appropriately positioned in the schema..env.example (1)
68-71: Excellent documentation for the new environment variable.Clear explanation with a practical example. Commenting out by default is the right approach for optional functionality.
packages/database/auth/domain-utils.ts (4)
3-19: Solid main function with proper default behavior.The function correctly handles the case where no domain restrictions are configured (returns true) and uses appropriate helper functions for validation.
21-30: Good email domain extraction logic.Using
lastIndexOf("@")is correct for handling edge cases in email addresses, and validating with zod before extraction ensures robustness.
32-37: Well-implemented domain parsing with normalization.The function properly splits, trims, normalizes case, and filters invalid domains. The approach is thorough and handles malformed input gracefully.
39-41: Appropriate domain validation using zod.Using
z.hostname()for domain validation is the right approach and provides reliable validation.
|
We'll probably expose this in a UI at some point but this works for now! |
Closes #821
Changes:
CAP_ALLOWED_SIGNUP_DOMAINSenvironment variable for domain-restricted signup.signIncallback with existing user bypass (existing users can always signin)Test build:
ghcr.io/mogita/cap-web:restricted-signup.1Summary by CodeRabbit