(
sso: SsoConfig,
user: { email: string; emailVerified: boolean },
)
| 21 | // Without the verified check, anyone could register an IdP account with a |
| 22 | // made-up allowlisted address and walk in. |
| 23 | export const isAdmitted = ( |
| 24 | sso: SsoConfig, |
| 25 | user: { email: string; emailVerified: boolean }, |
| 26 | ): boolean => { |
| 27 | if (!user.emailVerified) return false; |
| 28 | const domain = emailDomain(user.email); |
| 29 | return domain !== null && sso.allowedDomains.includes(domain); |
| 30 | }; |
| 31 | |
| 32 | // The genericOAuth registration for the configured provider, derived from its |
| 33 | // OIDC discovery document. For Google with a single allowed domain, `hd` |
no test coverage detected