feat(adapter.ts): add domain restriction functionality to control room access

feat(config.ts): introduce ALLOWED_DOMAINS configuration to specify permitted email domains

Author: gcordalis

adapter.ts

@@ -17,7 +17,8 @@ import {
   KEYCLOAK_ORIGIN_INTERNAL,
   KEYCLOAK_REALM,
   PORT,
-  PERMISSIONS_FILE
+  PERMISSIONS_FILE,
+  ALLOWED_DOMAINS
 } from "./config.ts";
 import { createContext } from "./context.ts";
 
@@ -98,6 +99,17 @@ async function generateJWT(
   }
 }
 
+// -----------------------------------------------------------------------------
+// Check if the domain is allowed to moderate the room
+// -----------------------------------------------------------------------------
+function isAllowedDomain(email: string, allowedDomains: string[]): boolean {
+  if (!allowedDomains.length) return true; // If no domains specified, allow all
+  if (!email) return false;
+
+  const domain = email.split("@")[1]?.toLowerCase();
+  return allowedDomains.some(allowed => allowed.toLowerCase() === domain);
+}
+
 // -----------------------------------------------------------------------------
 // Get the access token from Keycloak by using the short-term auth code
 //
@@ -213,6 +225,12 @@ async function tokenize(req: Request): Promise<Response> {
   const userInfo = await getUserInfo(token);
   if (!userInfo) return unauthorized();
 
+  // Check email domain
+  if (!isAllowedDomain(userInfo["email"] as string, ALLOWED_DOMAINS)) {
+    console.log(`User ${userInfo["email"]} is not allowed to access the room`);
+    return unauthorized();
+  }
+
   // Enhance userinfo
   userInfo["lobby_bypass"] = true;
   userInfo["security_bypass"] = true;
@@ -469,6 +487,7 @@ function main() {
   if (PERMISSIONS_FILE) {
     console.log(`PERMISSIONS_FILE: ${PERMISSIONS_FILE}`);
   }
+  console.log(`ALLOWED_DOMAINS: ${ALLOWED_DOMAINS}`);
 
   serve(handler, {
     hostname: HOSTNAME,

config.ts

@@ -19,3 +19,4 @@ export const HOSTNAME = Deno.env.get("HOSTNAME") || "127.0.0.1";
 export const PORT = Number(Deno.env.get("PORT") || 9000);
 export const DEBUG = Deno.env.get("DEBUG") === "true";
 export const PERMISSIONS_FILE = Deno.env.get("PERMISSIONS_FILE") || false;
+export const ALLOWED_DOMAINS = (Deno.env.get("ALLOWED_DOMAINS") || "").split(",").filter(Boolean);