MauricioApu opened a new pull request, #8984: URL: https://github.com/apache/devlake/pull/8984
### ⚠️ Pre Checklist - [x] I have read through the [Contributing Documentation](https://devlake.apache.org/community/). - [x] I have added relevant tests. - [x] I have added relevant documentation. - [x] I will add labels to the PR, such as `pr-type/bug-fix`, `pr-type/feature-development`, etc. ### Summary This PR introduces optional authorization filters to restrict OIDC logins by specific email addresses (`OIDC_ALLOW_EMAILS`) or domain suffixes (`OIDC_ALLOW_DOMAINS`). * **Default Unrestricted Behavior:** If both configuration variables are empty or omitted, login access remains entirely unrestricted. * **Case-Insensitive & Formatted Matching:** Email strings are properly trimmed of whitespace and converted to lower case to prevent user input discrepancies from blocking authentication. * **Granular Control:** Administrators can now restrict access to specific developers or entire organizational domains seamlessly. ### Does this close any open issues? None. This is a straightforward enhancement implemented directly to address an internal deployment requirement. ### Screenshots <img width="979" height="95" alt="Screenshot 2026-07-09 at 4 06 51 PM" src="https://github.com/user-attachments/assets/fd17812d-014a-421c-8d0b-9bf6facd2200"; /> ### Other Information * Tests were added under `backend/helpers/oidchelper/authorization_test.go` confirming case-insensitivity, malformed string protection, domain parsing, and default pass-through state behaviors. * Updated `.env.example` to document the new optional configuration keys. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
