Function isEmailAllowed

apps/sim/lib/core/security/deployment.ts:116–133

(email: string, allowedEmails: string[])

 * sides, so callers don't need to normalize before calling.
 */
export function isEmailAllowed(email: string, allowedEmails: string[]): boolean {
  const normalizedEmail = email.trim().toLowerCase()
  const normalizedAllowed = allowedEmails.map((allowed) => allowed.trim().toLowerCase())

  if (normalizedAllowed.includes(normalizedEmail)) {
    return true
  }

  const atIndex = normalizedEmail.indexOf('@')
  if (atIndex > 0) {
    const domain = normalizedEmail.substring(atIndex + 1)
    if (domain && normalizedAllowed.some((allowed) => allowed === `@${domain}`)) {
      return true
    }
  }

  return false
}