feat: restrict users

numerique-gouv · Jan 20, 2024 · 49d7b2c · 49d7b2c
1 parent 7274d2e
commit 49d7b2c
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 8 deletions.
diff --git a/src/common/env.ts b/src/common/env.ts
@@ -32,6 +32,7 @@ export default z
       .string()
       .trim()
       .default("ES256"),
+    ALLOWED_USERS: z.string().trim().default(""),
     API_AUTH_PASSWORD: z.string().trim(),
     API_AUTH_URL: z.string().trim().url().default("localhost:3001"),
     API_AUTH_USERNAME: z.string().trim(),

diff --git a/src/legacy/route.tsx b/src/legacy/route.tsx
@@ -1,6 +1,7 @@
 //
 
 import { hono_autoroute } from ":common/autorouter";
+import env from ":common/env";
 import { hyyyyyypertool_session, type Session_Context } from ":common/session";
 import { Hono } from "hono";
 import { moderations_router } from "./moderations/route";
@@ -15,6 +16,14 @@ const legacy_autoroute = await hono_autoroute({
 });
 export const legacy_router = new Hono()
   .basePath("/legacy")
+  .route("moderations", moderations_router)
+  .route("organizations", organizations_router)
+  .route("users", users_router);
+
+//
+
+export default new Hono<Session_Context>()
+  .use("*", hyyyyyypertool_session)
   .use(
     "*",
     hyyyyyypertool_session,
@@ -25,16 +34,13 @@ export const legacy_router = new Hono()
         return redirect("/");
       }
 
+      const is_allowed = env.ALLOWED_USERS.split(",").includes(userinfo.email);
+      if (!is_allowed) {
+        return redirect("/");
+      }
+
       return next();
     },
   )
-  .route("moderations", moderations_router)
-  .route("organizations", organizations_router)
-  .route("users", users_router);
-
-//
-
-export default new Hono<Session_Context>()
-  .use("*", hyyyyyypertool_session)
   .route("", legacy_autoroute)
   .route("", legacy_router);