Repository navigation
fix: make verified admin email an opt-in policy - #18
Merged
Merged
Conversation
This was referenced Oct 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
Server.RequireVerifiedAdminEmailas an opt-in policy for non-empty admin allowlists. HTTP admin gates andJawsAuth.IsAdminrequire a verified standardemailclaim when enabled. The default preserves provider-trusting behavior; the docs explain its limits, including Microsoft's guidance against using Entra email claims for authorization. Ordinary login and empty-list behavior remain unchanged.Email parsing uses Go's
net/mail.ParseAddress. Parsed session addresses are not parsed again, preserving literal characters in quoted local parts. Matching ignores ASCII case and preserves non-ASCII characters. UserInfo fallback requires a matching non-empty subject; verification transfers to an existing email only when the raw email claims match exactly, including case and whitespace. Session email and verification writes share the admin-check lock during refresh and logout.Validation:
go test -race ./...,go vet ./...,go build ./...,golangci-lint run,staticcheck ./..., andgosec ./...passed from both module roots. Tests cover quoted addresses, ASCII/Unicode distinctions, exact claim pairing, default and strict policies, and concurrent session updates. The final PR 17 redirect-limit commit is included, keeping code and docs at 8192 bytes.Closes #6