Repository navigation
feat(auth): env-driven docente email allowlist - #159
Merged
Merged
Conversation
Add BUSCASAM_DOCENTE_EMAIL_ALLOWLIST: a comma-separated set of exact emails granted the `docente` role regardless of their `hd` claim. This is an escape hatch for demo / non-UNSAM accounts that must moderate, without weakening the verification gate or hardcoding addresses. role_from_claims checks the allowlist after the email_verified gate and before ROLE_BY_HD, so email_verified != True is still rejected and the hd domain map is unchanged for everyone else. Empty by default (no-op). Documented as ADR-0005 item 17 (a deliberate exception to the hd-is-sole-trust-boundary rule). Tests cover prod grant (case- insensitive), the unverified-email rejection, and non-listed Gmail. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
BUSCASAM_DOCENTE_EMAIL_ALLOWLIST— a comma-separated set of exact emails that are granted thedocenterole regardless of their Googlehd(hosted-domain) claim.Motivation: demonstrate docente-only features (moderation) with a non-UNSAM account (e.g. a personal Gmail) without owning a
@unsam.edu.araccount, and without hardcoding addresses in source.How
role_from_claims(backend/src/buscasam/core/auth.py) checks the allowlist after theemail_verifiedgate and beforeROLE_BY_HD. So:email_verified != Trueis still rejected — the override never bypasses verification.hddomain behavior.BUSCASAM_DOCENTE_EMAIL_ALLOWLISTsetting parsed into a normalized (lowercased, stripped)docente_emailsfrozenset. Empty by default → no-op.hdnot-null users column is unaffected:complete_loginalready falls back to the email domain (e.g.gmail.com) when the claim is absent.Security / docs
This is a deliberate exception to ADR-0005 item 2 (the
hdclaim as sole trust boundary). Documented as ADR-0005 item 17, with guidance to keep the list minimal and remove entries when no longer needed.Tests
backend/tests/unit/test_auth_core.py(all green):docente(case-insensitive)email_verified=False→ rejectedDeploy
After merge +
v*tag auto-deploy, set on the prod VM and restart the backend:🤖 Generated with Claude Code