Scope admin access to this site with a SITE_ADMINS allowlist #26

Merged

martin merged 1 commit from claw/site-admins-allowlist into main

2026-09-21 14:57:03 +00:00

martin commented

2026-09-21 14:56:57 +00:00

Owner

Admin access was gated purely on Bio-ID's org-wide admin / super_admin roles, so letting someone edit this marketing site meant making them an admin of every other insureco service.

SITE_ADMINS is set on this service with tawa config set and matches a Bio-ID email (case-insensitive) or bioId. The role check stays as a fallback, so a mistyped allowlist cannot lock the platform team out, and an empty or junk list admits nobody on its own.

Also authorizes before minting the session in the OAuth callback — a rejected user was previously left holding a valid cookie that every /admin page then bounced.

Verified: tsc --noEmit clean; the gate exercised over ten cases (admin role with and without a list, listed email in mixed case, listed bioId, unlisted member, null session, junk list, blank email).

🤖 Generated with Claude Code

Admin access was gated purely on Bio-ID's org-wide `admin` / `super_admin` roles, so letting someone edit this marketing site meant making them an admin of every other insureco service. `SITE_ADMINS` is set on this service with `tawa config set` and matches a Bio-ID email (case-insensitive) or bioId. The role check stays as a fallback, so a mistyped allowlist cannot lock the platform team out, and an empty or junk list admits nobody on its own. Also authorizes before minting the session in the OAuth callback — a rejected user was previously left holding a valid cookie that every /admin page then bounced. Verified: `tsc --noEmit` clean; the gate exercised over ten cases (admin role with and without a list, listed email in mixed case, listed bioId, unlisted member, null session, junk list, blank email). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

martin added 1 commit

2026-09-21 14:56:57 +00:00

feat: scope admin access to this site with a SITE_ADMINS allowlist e11993269f

isAdmin() only passed accounts carrying Bio-ID's org-wide admin /
super_admin roles, so the only way to let someone edit this marketing
site was to make them an admin of every other insureco service.

Add SITE_ADMINS, set on this service with `tawa config set`, matching a
Bio-ID email (case-insensitive) or bioId. The role check stays as a
fallback so a mistyped allowlist cannot lock the platform team out, and
an empty or junk list admits nobody on its own.

Also authorize before minting the session in the OAuth callback — a
rejected user was left holding a valid cookie that every /admin page
then had to bounce.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>