Function emailDomain

apps/host-selfhost/src/auth/sso.ts:13–17

(email: string)

// The domain of a well-formed address, or null — so a malformed email can never
// match an allowlist entry (`emailDomain("@example.com")` is null, not "example.com").
export const emailDomain = (email: string): string | null => {
  const at = email.lastIndexOf("@");
  if (at <= 0 || at === email.length - 1) return null;
  return email.slice(at + 1).toLowerCase();
};

// Admission = the IdP vouches for the address (`email_verified`, mapped to
// `emailVerified` by the genericOAuth callback) AND its domain is allowlisted.