fix(auth): check all emails for domain/email access#829
Merged
Conversation
📝 WalkthroughWalkthroughGitHub App setup instructions add a read-only email permission step. Access control now evaluates multiple emails instead of one. GitHub sign-in fetches verified emails and uses them in static allowlist checks. ChangesGitHub email access flow
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
packages/web/src/lib/access-control.test.ts (1)
203-226: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a multiple-email exact allowlist regression.
This block proves “any email” works for domains, but not for
allowedEmails. Add the exact-email case so the coreALLOWED_EMAILSpath is covered too.Suggested test addition
describe("when user has multiple emails", () => { const config = { allowedDomains: ["company.com"], allowedUsers: [], allowedEmails: [], unsafeAllowAllUsers: false, }; + it("allows access when any email exactly matches the email allowlist", () => { + expect( + checkAccessAllowed( + { ...config, allowedDomains: [], allowedEmails: ["user@company.com"] }, + { + emails: ["user@personal.com", "user@company.com"], + } + ) + ).toBe(true); + }); + it("allows access when any email matches the domain", () => {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/web/src/lib/access-control.test.ts` around lines 203 - 226, The multiple-email coverage in checkAccessAllowed currently verifies only the allowedDomains path, so add a regression test in the same describe block for allowedEmails to confirm that access is granted when any email exactly matches an entry in allowedEmails and denied when none do. Use the existing checkAccessAllowed helper and the config shape in access-control.test.ts so the ALLOWED_EMAILS behavior is covered alongside the domain-based case.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/web/src/lib/auth.ts`:
- Around line 318-323: The GitHub email lookup in auth.ts only runs when allowed
domains are configured, so exact-email allowlists miss secondary verified GitHub
addresses. Update the email resolution logic around the fetchGitHubEmails call
in the auth flow to also fetch GitHub emails whenever ALLOWED_EMAILS is in use
for GitHub providers, then match against the returned verified emails instead of
falling back only to user.email. Keep the change localized to the existing
email-selection branch so the allowlist check can use the full GitHub email set.
- Around line 67-74: The new fetchGitHubEmails sign-in path can hang or throw,
so it should fail closed with a bounded request and error handling. Update
fetchGitHubEmails to use an explicit timeout in milliseconds via a named
constant, and catch any fetch/json/network errors so the function returns an
empty list instead of rejecting. Keep the change localized to fetchGitHubEmails
in auth.ts and make sure the timeout/default is defined once with a clear
unit-bearing name.
---
Nitpick comments:
In `@packages/web/src/lib/access-control.test.ts`:
- Around line 203-226: The multiple-email coverage in checkAccessAllowed
currently verifies only the allowedDomains path, so add a regression test in the
same describe block for allowedEmails to confirm that access is granted when any
email exactly matches an entry in allowedEmails and denied when none do. Use the
existing checkAccessAllowed helper and the config shape in
access-control.test.ts so the ALLOWED_EMAILS behavior is covered alongside the
domain-based case.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0a98a684-f465-47ee-be71-df87964d8308
📒 Files selected for processing (6)
.claude/skills/onboarding/SKILL.mddocs/GETTING_STARTED.mdpackages/web/src/lib/access-control.test.tspackages/web/src/lib/access-control.tspackages/web/src/lib/auth.test.tspackages/web/src/lib/auth.ts
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/web/src/lib/auth.ts`:
- Around line 291-296: The sign-in flow in auth.ts is making two identical
GitHub email lookups for the same access token, once in the profile request
handler and again in the allowlist check. Update the request handler in the auth
profile flow to fetch verified emails once and attach/reuse that result as
metadata for the sign-in step. Then change the allowlist validation logic to
consume the existing verified email data instead of calling
getVerifiedGitHubEmails again, using the request and sign-in code paths as the
coordination points.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c5e1e23e-62c5-4f58-b677-5a026def171a
📒 Files selected for processing (6)
.claude/skills/onboarding/SKILL.mddocs/GETTING_STARTED.mdpackages/web/src/lib/access-control.test.tspackages/web/src/lib/access-control.tspackages/web/src/lib/auth.test.tspackages/web/src/lib/auth.ts
✅ Files skipped from review due to trivial changes (1)
- docs/GETTING_STARTED.md
🚧 Files skipped from review as they are similar to previous changes (2)
- packages/web/src/lib/access-control.ts
- packages/web/src/lib/access-control.test.ts
GitHub OAuth only exposes the primary email in the NextAuth user object. Users whose primary GitHub email is personal (not their work address) were silently denied even with a valid domain in ALLOWED_EMAIL_DOMAINS. Now the signIn callback fetches all verified emails from /user/emails (already authorized by the user:email scope) and passes the full list to checkAccessAllowed, which checks each one against the domain allowlist. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ColeMurray
approved these changes
Jun 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
GitHub OAuth only exposes the primary email in the NextAuth user object. Users with multiple email addressses were silently denied even with a valid domain in
ALLOWED_EMAIL_DOMAINS. Use cases:Now the signIn callback fetches all verified emails from
/user/emails(already authorized by theuser:emailscope) and passes the full list togetAccessAllowReason, which checks each one against the domain/email allowlists.Summary by CodeRabbit