[PR #85] [MERGED] Add AUTH_OIDC_RESTRICT_VISIBILITY Feature #116

New issue

Closed

opened 2026-05-07 00:19:00 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-07 00:19:00 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/glenndehaan/unifi-voucher-site/pull/85
Author: @bjoerrrrn
Created: 7/30/2025
Status: ✅ Merged
Merged: 7/30/2025
Merged by: @glenndehaan

Base: master ← Head: pr-cleanup

📝 Commits (4)

6951b99 Merging PIN_OIDC_USER_TO_OWN_DOMAIN System to PR-Branch
62db3af Cleanup code prior to pull request
131f726 Cleanup code prior to pull request
0c9aeac Updated to . Fixed bulk-print.ejs notes view. Updated details.ejs view with additional voucher metadata. Updated voucher.ejs notes view. Created notes.js utils for extracting voucher notes and metadata. Updated docker-compose.yml. Updated README.md. Implemented voucher note check for seperator misuse. Implemented new notes-metadata embed. Implemented new voucher filter within existing chain. Fixed notes sort to only filter on the notes not the metadata. Removed unused variable forward to voucher.ejs

📊 Changes

8 files changed (+91 additions, -15 deletions)

View changed files

📝 README.md (+14 -2)
📝 docker-compose.yml (+1 -0)
📝 modules/variables.js (+1 -0)
📝 server.js (+30 -5)
📝 template/components/bulk-print.ejs (+2 -2)
📝 template/components/details.ejs (+24 -4)
📝 template/voucher.ejs (+2 -2)
➕ utils/notes.js (+17 -0)

📄 Description

This pull request introduces the PIN_OIDC_USER_TO_OWN_DOMAIN feature, which restricts voucher visibility and assignment based on the authenticated OIDC user's email domain. When enabled, users can only see and manage vouchers associated with their own domain.

Key Changes

Voucher Creation:
When a voucher is created and the feature is enabled, the user's email domain (from OIDC) is appended to the voucher note, separated by |||. If a note is already provided, it is combined with the domain.
Voucher Filtering:
On the voucher overview page, if the feature is enabled, only vouchers with a note matching the user's domain (either as the whole note or after the ||| separator) are shown.
Domain Extraction:
The domain is extracted from the authenticated user's email address via OIDC.
Backward Compatibility:
If the feature is disabled, the application behaves as before, showing all vouchers.

Motivation

This feature is intended for multi-tenant environments where users from different organizations should only access vouchers relevant to their own domain, improving security and data separation.

Implementation Details

The logic for combining the note and domain is in the /voucher POST route.
The filtering logic is in the /vouchers GET route.
The feature is controlled by the PIN_OIDC_USER_TO_OWN_DOMAIN variable.

Testing

Verified that users only see vouchers for their domain when the feature is enabled.
Confirmed that voucher creation correctly appends the domain.
Ensured that disabling the feature restores the previous behavior.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/glenndehaan/unifi-voucher-site/pull/85 **Author:** [@bjoerrrrn](https://github.com/bjoerrrrn) **Created:** 7/30/2025 **Status:** ✅ Merged **Merged:** 7/30/2025 **Merged by:** [@glenndehaan](https://github.com/glenndehaan) **Base:** `master` ← **Head:** `pr-cleanup` --- ### 📝 Commits (4) - [`6951b99`](https://github.com/glenndehaan/unifi-voucher-site/commit/6951b99191e8cf20e2aee3eb30ce445c428e54d8) Merging PIN_OIDC_USER_TO_OWN_DOMAIN System to PR-Branch - [`62db3af`](https://github.com/glenndehaan/unifi-voucher-site/commit/62db3af6db10b2ca0098c72536bf9a8827446599) Cleanup code prior to pull request - [`131f726`](https://github.com/glenndehaan/unifi-voucher-site/commit/131f726d1c6f543ec8bb98e0c296367699942bbb) Cleanup code prior to pull request - [`0c9aeac`](https://github.com/glenndehaan/unifi-voucher-site/commit/0c9aeac7a59e958a0b7d7ca2279454042c90a40b) Updated to . Fixed bulk-print.ejs notes view. Updated details.ejs view with additional voucher metadata. Updated voucher.ejs notes view. Created notes.js utils for extracting voucher notes and metadata. Updated docker-compose.yml. Updated README.md. Implemented voucher note check for seperator misuse. Implemented new notes-metadata embed. Implemented new voucher filter within existing chain. Fixed notes sort to only filter on the notes not the metadata. Removed unused variable forward to voucher.ejs ### 📊 Changes **8 files changed** (+91 additions, -15 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+14 -2) 📝 `docker-compose.yml` (+1 -0) 📝 `modules/variables.js` (+1 -0) 📝 `server.js` (+30 -5) 📝 `template/components/bulk-print.ejs` (+2 -2) 📝 `template/components/details.ejs` (+24 -4) 📝 `template/voucher.ejs` (+2 -2) ➕ `utils/notes.js` (+17 -0) </details> ### 📄 Description This pull request introduces the `PIN_OIDC_USER_TO_OWN_DOMAIN` feature, which restricts voucher visibility and assignment based on the authenticated OIDC user's email domain. When enabled, users can only see and manage vouchers associated with their own domain. --- ### Key Changes - **Voucher Creation:** When a voucher is created and the feature is enabled, the user's email domain (from OIDC) is appended to the voucher note, separated by `|||`. If a note is already provided, it is combined with the domain. - **Voucher Filtering:** On the voucher overview page, if the feature is enabled, only vouchers with a note matching the user's domain (either as the whole note or after the `|||` separator) are shown. - **Domain Extraction:** The domain is extracted from the authenticated user's email address via OIDC. - **Backward Compatibility:** If the feature is disabled, the application behaves as before, showing all vouchers. --- ### Motivation This feature is intended for multi-tenant environments where users from different organizations should only access vouchers relevant to their own domain, improving security and data separation. --- ### Implementation Details - The logic for combining the note and domain is in the `/voucher` POST route. - The filtering logic is in the `/vouchers` GET route. - The feature is controlled by the `PIN_OIDC_USER_TO_OWN_DOMAIN` variable. --- ### Testing - Verified that users only see vouchers for their domain when the feature is enabled. - Confirmed that voucher creation correctly appends the domain. - Ensured that disabling the feature restores the previous behavior. --- --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>