Add OAuth allowed domain restrictions

[RamezWasfy]

Summary

• Add OAUTH_ALLOWED_DOMAINS support for domain-restricted OAuth sign-in/sign-up
• Allow OAuth start when registration is closed if a provider domain allowlist is configured
• Enforce the allowlist in OAuth callbacks, including Google hosted-domain (hd) validation
• Document the env var and add auth helper coverage

Validation

• pnpm --filter @openpanel/auth run typecheck
• pnpm --filter @openpanel/trpc run typecheck
• pnpm --filter @openpanel/api run typecheck
• pnpm exec ultracite check packages/auth/src/oauth-allowed-domains.ts packages/auth/oauth-allowed-domains.test.ts packages/trpc/src/routers/auth.ts apps/api/src/controllers/oauth-callback.controller.tsx apps/public/content/docs/self-hosting/environment-variables.mdx self-hosting/.env.template
• Direct Node smoke test for OAuth domain helper

Note: the repo Vitest workspace global setup requires local Postgres and ClickHouse services, so the focused Vitest run cannot complete in this local worktree without those services.

Summary by CodeRabbit

• New Features

  • Added optional OAuth email-domain allowlists for Google and GitHub sign-in and registration.
  • Google sign-ins now validate both the email domain and hosted domain.
  • Allowed OAuth registration can proceed even when general registration is disabled.

• Documentation

  • Documented OAUTH_ALLOWED_DOMAINS, including configuration and provider-specific behavior.
  • Added the setting to the self-hosting environment template.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

RamezWasfy seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1dfe922a-38bd-4615-91f0-418632d42fba

📥 Commits

Reviewing files that changed from the base of the PR and between f72310c and 9d5f2bd.

📒 Files selected for processing (7)

• apps/api/src/controllers/oauth-callback.controller.tsx
• apps/public/content/docs/self-hosting/environment-variables.mdx
• packages/auth/oauth-allowed-domains.test.ts
• packages/auth/src/index.ts
• packages/auth/src/oauth-allowed-domains.ts
• packages/trpc/src/routers/auth.ts
• self-hosting/.env.template

---

📝 Walkthrough

Walkthrough

Changes

OAuth domain allowlisting

Layer / File(s)	Summary
OAuth domain contract and validation packages/auth/src/oauth-allowed-domains.ts, packages/auth/src/index.ts, packages/auth/oauth-allowed-domains.test.ts	Adds normalized domain parsing, provider-specific configuration, email-domain extraction, GitHub and Google authorization rules, public exports, and Vitest coverage.
OAuth registration eligibility packages/trpc/src/routers/auth.ts	Allows GitHub or Google registration when configured domains permit it. Email OAuth keeps the existing registration checks.
OAuth callback enforcement apps/api/src/controllers/oauth-callback.controller.tsx	Validates GitHub and Google users before account lookup. Google callbacks now include the hosted-domain claim.
OAuth domain configuration self-hosting/.env.template, apps/public/content/docs/self-hosting/environment-variables.mdx	Documents OAUTH_ALLOWED_DOMAINS and adds it to the environment template and quick-reference list.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Mergeability Score: ⚪ Minimal · up to 9d5f2

The PR adds configurable OAuth domain restrictions and callback validation without any identified merge-blocking correctness, security, or availability risk; no actionable risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant GoogleOAuthProvider
  participant OAuthCallbackController
  participant isOAuthUserAllowedByDomain
  participant AccountLookup
  GoogleOAuthProvider->>OAuthCallbackController: return email and hosted domain
  OAuthCallbackController->>isOAuthUserAllowedByDomain: validate OAuth user domain
  isOAuthUserAllowedByDomain-->>OAuthCallbackController: authorization result
  OAuthCallbackController->>AccountLookup: continue after authorized callback

Loading

Suggested reviewers: lindesvard

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding OAuth allowed-domain restrictions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}