Function assertStagingAccess

shared/auth/api-key.ts:61–83

(
    env: {
        ENVIRONMENT?: string;
        STAGING_ALLOWED_GITHUB_IDS?: string;
        STAGING_ALLOWED_EMAILS?: string;
    },
    user:
        | { githubId?: number | null; email?: string | null }
        | null
        | undefined,
)

 * against pre-existing sessions/keys that predate the lockdown. See #11137.
 */
export function assertStagingAccess(
    env: {
        ENVIRONMENT?: string;
        STAGING_ALLOWED_GITHUB_IDS?: string;
        STAGING_ALLOWED_EMAILS?: string;
    },
    user:
        | { githubId?: number | null; email?: string | null }
        | null
        | undefined,
): void {
    if (env.ENVIRONMENT !== "staging") return;
    const allowedGithubIds = parseGithubIdList(env.STAGING_ALLOWED_GITHUB_IDS);
    const allowedEmails = parseEmailList(env.STAGING_ALLOWED_EMAILS);
    const ghId = user?.githubId;
    const email = normalizeEmail(user?.email);
    if (
        (!ghId || !allowedGithubIds.has(Number(ghId))) &&
        (!email || !allowedEmails.has(email))
    ) {
        throw new StagingAccessDeniedError();
    }
}

export function parseEmailList(raw: string | undefined | null): Set<string> {
    if (!raw) return new Set();