Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Email blacklist for api and sign up #17724

Draft
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

sean-brydon
Copy link
Member

What does this PR do?

PR adds blacklist.

Mandatory Tasks (DO NOT REMOVE)

  • I have self-reviewed the code (A decent size PR without self-review might be rejected).
  • I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
  • I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

Add an email domain to blacklist. Try to signup (account should get locked).

Create an account:
Lock account in DB. Try to use api key

Checklist

  • I haven't read the contributing guide
  • My code doesn't follow the style guidelines of this project
  • I haven't commented my code, particularly in hard-to-understand areas
  • I haven't checked if my changes generate no new warnings

@graphite-app graphite-app bot requested a review from a team November 18, 2024 15:35
@dosubot dosubot bot added api area: API, enterprise API, access token, OAuth authentication area: authentication, auth, google sign in, password, SAML, password reset, can't log in ✨ feature New feature or request labels Nov 18, 2024
@keithwillcode keithwillcode added consumer core area: core, team members only labels Nov 18, 2024
@sean-brydon sean-brydon added foundation high-risk Requires approval by Foundation team labels Nov 18, 2024
@graphite-app graphite-app bot requested a review from a team November 18, 2024 15:36
Copy link

graphite-app bot commented Nov 18, 2024

Graphite Automations

"Add consumer team as reviewer" took an action on this PR • (11/18/24)

1 reviewer was added to this PR based on Keith Williams's automation.

"Add foundation team as reviewer" took an action on this PR • (11/18/24)

1 reviewer was added to this PR based on Keith Williams's automation.

@@ -42,6 +43,10 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => {
req.userId = apiKey.userId;
const { isAdmin, scope } = await isAdminGuard(req);

const userIsLockedOrBlocked = await isLockedOrBlocked(req);

if (userIsLockedOrBlocked) return res.status(401).json({ error: "User is locked or blocked" });
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's make this more generic. "You are not authorized to perform this request."

Copy link
Contributor

@keithwillcode keithwillcode left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This adds another round trip to the DB on every request. Going to refactor it to not have this.

@keithwillcode keithwillcode marked this pull request as draft November 20, 2024 16:00
Copy link

vercel bot commented Nov 20, 2024

The latest updates on your projects. Learn more about Vercel for Git ↗︎

2 Skipped Deployments
Name Status Preview Comments Updated (UTC)
cal ⬜️ Ignored (Inspect) Visit Preview Nov 20, 2024 4:21pm
calcom-web-canary ⬜️ Ignored (Inspect) Visit Preview Nov 20, 2024 4:21pm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
api area: API, enterprise API, access token, OAuth authentication area: authentication, auth, google sign in, password, SAML, password reset, can't log in consumer core area: core, team members only ✨ feature New feature or request foundation high-risk Requires approval by Foundation team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants