chore(config): reconcile OAUTH_SUPER_ADMIN env var name with the code (PMS-682) #461

Merged

longjacksonle merged 1 commit from chore/PMS-682-oauth-super-admin-env-drift into main

2026-07-24 16:00:10 +02:00

longjacksonle commented

2026-07-24 15:58:28 +02:00

Owner

Reconciles the OAUTH_SUPER_ADMIN_* env var drift found while investigating PMS-637.

The code reads OAUTH_SUPER_ADMIN_EMAILS (exact-email allowlist, src/main.rs:147, enforced by is_allowlisted_email in src/modules/auth/service.rs), but .env.example, compose.dev.yml, and docs/quickstart.md all documented OAUTH_SUPER_ADMIN_DOMAINS with domain-allowlist wording. The documented var was dead and the effective var undocumented, so an operator copying the sample set a no-op var and could believe domain-level auto-promotion worked when only exact-email matches do.

This PR renames every doc/config occurrence to OAUTH_SUPER_ADMIN_EMAILS and rewrites the comments to state exact-email (not domain) semantics plus the fail-closed empty default.

Behavior-preserving: the value is left empty. The old _DOMAINS=niceguyit.biz never took effect because the code only ever read the unset _EMAILS, so dev was already fail-closed empty. A domain string as an exact-email would match nothing anyway.

Docs-match-code (fix option 1 from the ticket). No Rust changes; docker compose -f compose.dev.yml config validates. The quickstart's super_admin verification uses the ADMIN_EMAIL bootstrap admin, not the Google allowlist, so it is unaffected.

Acceptance:

.env.example and code agree on the env var name and exact-email semantics.
No dead documented var and no undocumented effective var for OAuth super-admin auto-promotion.

Closes PMS-682.

Reconciles the `OAUTH_SUPER_ADMIN_*` env var drift found while investigating PMS-637. The code reads `OAUTH_SUPER_ADMIN_EMAILS` (exact-email allowlist, `src/main.rs:147`, enforced by `is_allowlisted_email` in `src/modules/auth/service.rs`), but `.env.example`, `compose.dev.yml`, and `docs/quickstart.md` all documented `OAUTH_SUPER_ADMIN_DOMAINS` with domain-allowlist wording. The documented var was dead and the effective var undocumented, so an operator copying the sample set a no-op var and could believe domain-level auto-promotion worked when only exact-email matches do. This PR renames every doc/config occurrence to `OAUTH_SUPER_ADMIN_EMAILS` and rewrites the comments to state exact-email (not domain) semantics plus the fail-closed empty default. Behavior-preserving: the value is left empty. The old `_DOMAINS=niceguyit.biz` never took effect because the code only ever read the unset `_EMAILS`, so dev was already fail-closed empty. A domain string as an exact-email would match nothing anyway. Docs-match-code (fix option 1 from the ticket). No Rust changes; `docker compose -f compose.dev.yml config` validates. The quickstart's `super_admin` verification uses the `ADMIN_EMAIL` bootstrap admin, not the Google allowlist, so it is unaffected. Acceptance: - [x] `.env.example` and code agree on the env var name and exact-email semantics. - [x] No dead documented var and no undocumented effective var for OAuth super-admin auto-promotion. Closes PMS-682.

longjacksonle added 1 commit

2026-07-24 15:58:28 +02:00

chore(config): reconcile OAUTH_SUPER_ADMIN env var name with the code (PMS-682)

E2E / Playwright against staging (pull_request) Successful in 39s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 1m40s

Details

Create release / Gate (release-branch merges only) (pull_request) Successful in 1s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Integration / integration tests (pull_request) Successful in 6m5s

Details

006bd813bb

The code reads OAUTH_SUPER_ADMIN_EMAILS (an exact-email allowlist, src/main.rs:147 enforced by is_allowlisted_email in src/modules/auth/service.rs), but .env.example, compose.dev.yml, and docs/quickstart.md all documented OAUTH_SUPER_ADMIN_DOMAINS with domain-allowlist wording. The documented var was dead (nothing read it) and the effective var was undocumented, so an operator copying the sample set a no-op var and could believe domain-level auto-promotion worked when only exact-email matches do.

Rename every doc/config occurrence to OAUTH_SUPER_ADMIN_EMAILS and rewrite the comments to state exact-email (not domain) semantics and the fail-closed empty default. The value is left empty, which preserves current behavior exactly: the old _DOMAINS=niceguyit.biz never took effect because the code only ever read the unset _EMAILS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WDCg5oWRUicf3pVrUR3CqX

longjacksonle scheduled this pull request to auto merge when all checks succeed

2026-07-24 15:59:27 +02:00