Make allowed email domains configurable via AVAILABLE_DOMAINS env var

[louisremi]

Summary

Makes the email domains accepted for the mock SAML login configurable via a new AVAILABLE_DOMAINS environment variable (a comma-separated list), instead of the hardcoded example.com / example.org.

When the variable is unset, it defaults to example.com,example.org, so existing behavior is unchanged out of the box.

Motivation

When self-hosting Mock SAML for SSO testing, it's often useful to accept additional/organization-specific email domains without forking and editing the source. A single env var makes the running container configurable.

Changes

• lib/env.ts — parse AVAILABLE_DOMAINS (trim entries, drop empties) and expose availableDomains on the shared config object.
• pages/api/saml/auth.ts — validate the email's domain against config.availableDomains. This also adds a missing return on the 403 response — previously the request continued and a SAML response was still generated for a denied email.
• pages/saml/login.tsx — pass the domains to the client via getServerSideProps (the var is intentionally not NEXT_PUBLIC_-prefixed, so it stays server-side). The domain dropdown options, the default selection, and the info-box text are now all derived from the configured list.
• pages/namespace/[namespace]/saml/login.tsx — re-export getServerSideProps so the namespaced login route receives the prop too.
• .env.example — document the new variable.

Backward compatibility

Fully backward compatible — with AVAILABLE_DOMAINS unset, the allowed domains remain example.com and example.org.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • SAML login now uses a configurable, comma-separated domain allowlist from environment settings, replacing hardcoded domains.
  • The login screen dynamically lists and explains the allowed domains based on server-provided configuration.
• Bug Fixes
  • Improved request validation: malformed email addresses are rejected with a clear “Invalid email” response.
• Documentation
  • Updated the environment template to include the new domain allowlist setting.

[vercel]

@louisremi is attempting to deploy a commit to the ory Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4b243594-80af-4728-9e73-ad8814245318

📥 Commits

Reviewing files that changed from the base of the PR and between 0334c10 and 5c9cb1a.

📒 Files selected for processing (2)

• lib/env.ts
• pages/api/saml/auth.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• lib/env.ts
• pages/api/saml/auth.ts

---

📝 Walkthrough

Walkthrough

Adds a configurable AVAILABLE_DOMAINS environment variable that replaces hardcoded domain allowlists. The env var is parsed in lib/env.ts into config.availableDomains, consumed by the SAML auth API handler for 403 enforcement, and passed via getServerSideProps to the login page for dynamic UI rendering.

Changes

Configurable SAML domain allowlist

Layer / File(s)	Summary
AVAILABLE_DOMAINS env var and config parsing .env.example, lib/env.ts	Adds AVAILABLE_DOMAINS to .env.example with comments documenting comma-separated defaults. lib/env.ts defines defaultDomains, parses AVAILABLE_DOMAINS by splitting on commas, trimming entries, filtering empties, and falling back to defaults if parsing yields no valid domains, then exposes the result as availableDomains: string[] on the exported config object.
Auth enforcement and login UI using config.availableDomains pages/api/saml/auth.ts, pages/saml/login.tsx, pages/namespace/[namespace]/saml/login.tsx	The auth handler adds email validation for strict local@domain format, extracts the domain, and checks it against config.availableDomains, returning HTTP 403 on mismatch instead of hardcoded suffix checks. The login page defines LoginProps, accepts availableDomains as a prop, initializes domain state from the first available domain, dynamically renders domain <select> options and allowed-domains info text from availableDomains, exports getServerSideProps to supply the prop from config, and the namespace-scoped login route re-exports that getServerSideProps.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Make allowed email domains configurable via AVAILABLE_DOMAINS env var' directly summarizes the main change: introducing a configurable environment variable for email domain allowlisting, replacing hardcoded domains.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@lib/env.ts`:
- Around line 9-12: The availableDomains variable in lib/env.ts can become an
empty array if AVAILABLE_DOMAINS is set to only whitespace or commas, causing
availableDomains[0] to be undefined downstream in pages/saml/login.tsx. After
the filter operation in the availableDomains assignment, add validation to
ensure the array is never empty by either providing a fallback to the default
domains (example.com,example.org) if the parsed array is empty, or throwing an
error to fail-fast on invalid configuration.

In `@pages/api/saml/auth.ts`:
- Around line 12-14: The email domain extraction using email.split('@')[1] lacks
proper validation, allowing potential security bypasses and crashes. Add
validation to ensure email is a string with exactly one @ symbol before
extracting the domain, then normalize the extracted domain to lowercase before
checking it against config.availableDomains to prevent case-sensitivity issues
and ensure safe authorization checks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 01d53149-5c0d-481a-b606-23b3e39b9b00

📥 Commits

Reviewing files that changed from the base of the PR and between 7a2fffe and 0334c10.

📒 Files selected for processing (5)

• .env.example
• lib/env.ts
• pages/api/saml/auth.ts
• pages/namespace/[namespace]/saml/login.tsx
• pages/saml/login.tsx