🛂 feat(oauth): add domain restriction on social login (#2512)

api/server/middleware/checkDomainAllowed.js

@@ -0,0 +1,25 @@
+const { isDomainAllowed } = require('~/server/services/AuthService');
+const { logger } = require('~/config');
+
+/**
+ * Checks the domain's social login is allowed
+ *
+ * @async
+ * @function
+ * @param {Object} req - Express request object.
+ * @param {Object} res - Express response object.
+ * @param {Function} next - Next middleware function.
+ *
+ * @returns {Promise<function|Object>} - Returns a Promise which when resolved calls next middleware if the domain's email is allowed
+ */
+const checkDomainAllowed = async (req, res, next = () => {}) => {
+  const email = req?.user?.email;
+  if (email && !(await isDomainAllowed(email))) {
+    logger.error(`[Social Login] [Social Login not allowed] [Email: ${email}]`);
+    return res.redirect('/login');
+  } else {
+    return next();
+  }
+};
+
+module.exports = checkDomainAllowed;

api/server/middleware/index.js

@@ -1,5 +1,6 @@
 const abortMiddleware = require('./abortMiddleware');
 const checkBan = require('./checkBan');
+const checkDomainAllowed = require('./checkDomainAllowed');
 const uaParser = require('./uaParser');
 const setHeaders = require('./setHeaders');
 const loginLimiter = require('./loginLimiter');
@@ -38,4 +39,5 @@ module.exports = {
   validateModel,
   moderateText,
   noIndex,
+  checkDomainAllowed,
 };

api/server/routes/oauth.js

@@ -4,7 +4,7 @@ const passport = require('passport');
 const express = require('express');
 const router = express.Router();
 const { setAuthTokens } = require('~/server/services/AuthService');
-const { loginLimiter, checkBan } = require('~/server/middleware');
+const { loginLimiter, checkBan, checkDomainAllowed } = require('~/server/middleware');
 const { logger } = require('~/config');
 
 const domains = {
@@ -16,6 +16,7 @@ router.use(loginLimiter);
 
 const oauthHandler = async (req, res) => {
   try {
+    await checkDomainAllowed(req, res);
     await checkBan(req, res);
     if (req.banned) {
       return;