Add restrict signup based on domain

backend/src/db/migrations/20240205200732_invite-only.ts

@@ -7,6 +7,7 @@ export async function up(knex: Knex): Promise<void> {
   if (isTablePresent) {
     await knex.schema.alterTable(TableName.SuperAdmin, (t) => {
       t.boolean("inviteOnlySignUp").defaultTo(false);
+      t.string("allowSpecificDomainSignUp");
     });
   }
 }
@@ -17,4 +18,10 @@ export async function down(knex: Knex): Promise<void> {
       t.dropColumn("inviteOnlySignUp");
     });
   }
+
+  if (await knex.schema.hasColumn(TableName.SuperAdmin, "allowSpecificDomainSignUp")) {
+    await knex.schema.alterTable(TableName.SuperAdmin, (t) => {
+      t.dropColumn("allowSpecificDomainSignUp");
+    });
+  }
 }

backend/src/db/schemas/super-admin.ts

@@ -12,6 +12,7 @@ export const SuperAdminSchema = z.object({
   initialized: z.boolean().default(false).nullable().optional(),
   allowSignUp: z.boolean().default(true).nullable().optional(),
   inviteOnlySignUp: z.boolean().default(false).nullable().optional(),
+  allowSpecificDomainSignUp: z.string().nullable().optional(),
   createdAt: z.date(),
   updatedAt: z.date()
 });

backend/src/server/routes/v1/admin-router.ts

@@ -32,7 +32,8 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
     schema: {
       body: z.object({
         allowSignUp: z.boolean().optional(),
-        inviteOnlySignUp: z.boolean().optional()
+        inviteOnlySignUp: z.boolean().optional(),
+        allowSpecificDomainSignUp: z.string().optional()
       }),
       response: {
         200: z.object({

backend/src/server/routes/v1/sso-router.ts

@@ -55,7 +55,7 @@ export const registerSsoRouter = async (server: FastifyZodProvider) => {
               lastName: profile?.name?.familyName || "",
               authMethod: AuthMethod.GOOGLE,
               callbackPort: req.query.state as string,
-              isSignupAllowed: Boolean(serverCfg.allowSignUp)
+              serverCfg
             });
             cb(null, { isUserCompleted, providerAuthToken });
           } catch (error) {
@@ -91,7 +91,8 @@ export const registerSsoRouter = async (server: FastifyZodProvider) => {
               lastName: "",
               authMethod: AuthMethod.GITHUB,
               callbackPort: req.query.state as string,
-              isSignupAllowed: Boolean(serverCfg.allowSignUp)
+              serverCfg
+              // isSignupAllowed: Boolean(serverCfg.allowSignUp)
             });
             return cb(null, { isUserCompleted, providerAuthToken });
           } catch (error) {
@@ -127,7 +128,8 @@ export const registerSsoRouter = async (server: FastifyZodProvider) => {
               lastName: "",
               authMethod: AuthMethod.GITLAB,
               callbackPort: req.query.state as string,
-              isSignupAllowed: Boolean(serverCfg.allowSignUp)
+              serverCfg
+              // isSignupAllowed: Boolean(serverCfg.allowSignUp)
             });
 
             return cb(null, { isUserCompleted, providerAuthToken });

backend/src/server/routes/v3/signup-router.ts

@@ -23,8 +23,16 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      await server.services.signup.beginEmailSignupProcess(req.body.email);
-      return { message: `Sent an email verification code to ${req.body.email}` };
+      const { email } = req.body;
+      const config = await server.services.superAdmin.initServerCfg();
+
+      if (config?.allowSpecificDomainSignUp) {
+        const domain = email.split("@")[1];
+
+        if (domain !== config.allowSpecificDomainSignUp) throw new Error(`Unsupported email domain (${domain}).`);
+      }
+      await server.services.signup.beginEmailSignupProcess(email);
+      return { message: `Sent an email verification code to ${email}` };
     }
   });
 

backend/src/services/auth/auth-login-service.ts

@@ -261,20 +261,25 @@ export const authLoginServiceFactory = ({ userDAL, tokenService, smtpService }:
   /*
    * OAuth2 login for google,github, and other oauth2 provider
    * */
-  const oauth2Login = async ({
-    email,
-    firstName,
-    lastName,
-    authMethod,
-    callbackPort,
-    isSignupAllowed
-  }: TOauthLoginDTO) => {
+  const oauth2Login = async ({ email, firstName, lastName, authMethod, callbackPort, serverCfg }: TOauthLoginDTO) => {
     let user = await userDAL.findUserByEmail(email);
     const appCfg = getConfig();
-    const isOauthSignUpDisabled = !isSignupAllowed && !user;
-    if (isOauthSignUpDisabled) throw new BadRequestError({ message: "User signup disabled", name: "Oauth 2 login" });
 
     if (!user) {
+      // Create a new user based on oAuth
+      if (!serverCfg?.allowSignUp)
+        throw new BadRequestError({ message: "User signup disabled", name: "Oauth 2 login" });
+
+      if (serverCfg?.allowSpecificDomainSignUp) {
+        const domain = email.split("@")[1];
+
+        if (domain !== serverCfg.allowSpecificDomainSignUp)
+          throw new BadRequestError({
+            message: `User email domain (${domain}) is not supported`,
+            name: "Oauth 2 login"
+          });
+      }
+
       user = await userDAL.create({ email, firstName, lastName, authMethods: [authMethod] });
     }
     const isLinkingRequired = !user?.authMethods?.includes(authMethod);

backend/src/services/auth/auth-login-type.ts

@@ -1,3 +1,5 @@
+import { TSuperAdmin } from "@app/db/schemas/super-admin";
+
 import { AuthMethod } from "./auth-type";
 
 export type TLoginGenServerPublicKeyDTO = {
@@ -29,4 +31,5 @@ export type TOauthLoginDTO = {
   authMethod: AuthMethod;
   callbackPort?: string;
   isSignupAllowed?: boolean;
+  serverCfg?: TSuperAdmin;
 };