mirror of
https://github.com/btouchard/ackify.git
synced 2026-02-11 16:28:52 -06:00
fb33fd424d
- Move service initialization (MagicLink, Email, i18n) to main.go - Change signature lookup from user_sub to email for cross-auth consistency - Remove OauthService wrapper, simplify auth layer - Pass parent context to workers for graceful shutdown - Fix IP extraction from RemoteAddr with port - Add compact mode to SignatureList component - Update Cypress tests with new data-testid attributes
49 lines
1.3 KiB
Go
49 lines
1.3 KiB
Go
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
package auth
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
|
|
"github.com/btouchard/ackify-ce/backend/pkg/web"
|
|
)
|
|
|
|
// SimpleAuthorizer is an authorization implementation based on a list of admin emails.
|
|
// This is the default authorizer for Community Edition.
|
|
type SimpleAuthorizer struct {
|
|
adminEmails map[string]bool
|
|
onlyAdminCanCreate bool
|
|
}
|
|
|
|
// NewSimpleAuthorizer creates a new simple authorizer.
|
|
func NewSimpleAuthorizer(adminEmails []string, onlyAdminCanCreate bool) *SimpleAuthorizer {
|
|
emailMap := make(map[string]bool, len(adminEmails))
|
|
for _, email := range adminEmails {
|
|
normalized := strings.ToLower(strings.TrimSpace(email))
|
|
if normalized != "" {
|
|
emailMap[normalized] = true
|
|
}
|
|
}
|
|
return &SimpleAuthorizer{
|
|
adminEmails: emailMap,
|
|
onlyAdminCanCreate: onlyAdminCanCreate,
|
|
}
|
|
}
|
|
|
|
// IsAdmin implements web.Authorizer.
|
|
func (a *SimpleAuthorizer) IsAdmin(_ context.Context, userEmail string) bool {
|
|
normalized := strings.ToLower(strings.TrimSpace(userEmail))
|
|
return a.adminEmails[normalized]
|
|
}
|
|
|
|
// CanCreateDocument implements web.Authorizer.
|
|
func (a *SimpleAuthorizer) CanCreateDocument(ctx context.Context, userEmail string) bool {
|
|
if !a.onlyAdminCanCreate {
|
|
return true
|
|
}
|
|
return a.IsAdmin(ctx, userEmail)
|
|
}
|
|
|
|
// Compile-time interface check.
|
|
var _ web.Authorizer = (*SimpleAuthorizer)(nil)
|