Skip to content

Commit

Permalink
feat: add org domain whitelisting
Browse files Browse the repository at this point in the history
  • Loading branch information
@Chief-Rishab
Chief-Rishab committed Aug 2, 2023
1 parent 6b20a5b commit c6f9c72
Show file tree
Hide file tree
Showing 2 changed files with 217 additions and 1 deletion.
174 changes: 173 additions & 1 deletion raystack/frontier/v1beta1/shield.proto → raystack/frontier/v1beta1/frontier.proto
View file
Original file line number Diff line number Diff line change
Expand Up @@ -665,7 +665,7 @@ service FrontierService {
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
tags: "Organization";
summary: "Invite user"
description: "Invite users to an organization, if the user doesn't exists, it will be created and notified. Invitations expire in 7 days";
description: "Invite users to an organization, if user is not registered on the platform, it will be notified. Invitations expire in 7 days";
};
}

Expand Down Expand Up @@ -696,6 +696,75 @@ service FrontierService {
};
}

rpc ListOrganizationDomains(ListOrganizationDomainsRequest) returns (ListOrganizationDomainsResponse) {
option (google.api.http) = {get: "/v1beta1/organizations/{org_id}/domains"};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
tags: "Organization";
summary: "List org domains";
description: "Returns all trusted domains for an organization, which are used to allow users to sign up with a specific email domain without invitation. The domain ownership must be verified before it can be used as a trusted domain. Use the verified filter to get only the verified domains.";
};
}

rpc AddOrganizationDomain(AddOrganizationDomainRequest) returns (AddOrganizationDomainResponse) {
option (google.api.http) = {
post: "/v1beta1/organizations/{org_id}/domains",
body: "*"
};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
tags: "Organization";
summary: "Add org domain";
description: "Add a domain to an organization which if verified allows all users of the same domain to be signed up to the organization without invitation. This API generates a verification token for a domain which must be added to your domain's DNS provider as a TXT record should be verified with Frontier VerifyOrgDomain API before it can be used as an Organization's trusted domain to sign up users.";
};
}

rpc RemoveOrganizationDomain(RemoveOrganizationDomainRequest) returns (RemoveOrganizationDomainResponse) {
option (google.api.http) = {delete: "/v1beta1/organizations/{org_id}/domains/{id}/remove"};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
tags: "Organization";
summary: "Remove org domain";
description: "Remove a domain from the list of an organization's trusted domains list";
};
}

rpc GetOrganizationDomain(GetOrganizationDomainRequest) returns (GetOrganizationDomainResponse) {
option (google.api.http) = {get: "/v1beta1/organizations/{org_id}/domains/{id}"};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
tags: "Organization";
summary: "Get org domain";
description: "Get a domain from the list of an organization's whitelisted domains. Returns both verified and unverified domains by their ID";
};
}

rpc VerifyOrgDomain(VerifyOrgDomainRequest) returns (VerifyOrgDomainResponse) {
option (google.api.http) = {
post: "/v1beta1/organizations/{org_id}/domains/{id}/verify",
body: "*"
};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
tags: "Organization";
summary: "Verify org domain";
description: "Verify a domain for an organization with a verification token generated by Frontier GenerateDomainVerificationToken API. The token must be added to your domain's DNS provider as a TXT record before it can be verified.";
};
}

rpc ListOrganizationsByDomain(ListOrganizationsByDomainRequest) returns (ListOrganizationsByDomainResponse) {
option (google.api.http) = {get: "/v1beta1/organizations/domains/{domain_id}"};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
tags: "Organization";
summary: "List orgs by domain";
description: "Returns all organizations that have a specific domain whitelisted. This API will return only those organizations in which the domain ownership have been verified.";
};
}

rpc JoinOrganization(JoinOrganizationRequest) returns (JoinOrganizationResponse) {
option (google.api.http) = {post: "/v1beta1/organizations/{org_id}/join"};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
tags: "Organization";
summary: "Join organization";
description: "Allows a user to join the Org if one is not a part of it. The user will only be able to join when the user email's domain matches the organization's whitelisted domains.";
};
}

rpc EnableOrganization(EnableOrganizationRequest) returns (EnableOrganizationResponse) {
option (google.api.http) = {
post: "/v1beta1/organizations/{id}/enable",
Expand Down Expand Up @@ -1688,6 +1757,109 @@ message DeleteOrganizationInvitationRequest {
string org_id = 2;
}

message ListOrganizationDomainsRequest{
string org_id = 1 [
(validate.rules).string.min_len = 3,
(google.api.field_behavior) = REQUIRED,
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "unique id of the organization for which whitelisted domains are to be listed"}
];
bool verified = 2 [
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "filter to list only verified domains. If not provided, all domains for an org will be listed"}
];
}

message ListOrganizationDomainsResponse{
repeated Domain domains = 1;
}

message ListOrganizationsByDomainRequest{
string domain_id = 1 [
(validate.rules).string.min_len = 3,
(google.api.field_behavior) = REQUIRED,
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "domain id or domain name to be used to list all the organizations that have this domain whitelisted"}
];
}

message ListOrganizationsByDomainResponse{
repeated Organization organizations = 1;
}

message JoinOrganizationRequest {
string id = 1 [(validate.rules).string.min_len = 3];
string user_id = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
description: "user_id is email id of user who wants to join the organization.",
example: "\"[email protected]\""
}];
}

message JoinOrganizationResponse {}

message GetOrganizationDomainRequest{
string id = 1 [
(validate.rules).string.min_len = 3,
(google.api.field_behavior) = REQUIRED,
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "unique id of the domain to be retrieved"}
];
string org_id = 2 [
(validate.rules).string.min_len = 3,
(google.api.field_behavior) = REQUIRED,
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "unique id of the organization for which whitelisted domain is to be retrieved"}
];
}

message GetOrganizationDomainResponse{
Domain domain = 1;
}

message AddOrganizationDomainRequest{
string org_id = 1 [
(validate.rules).string.min_len = 3,
(google.api.field_behavior) = REQUIRED,
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "unique id of the organization for which whitelisted domains are to be added"}
];
string domain = 2 [
(validate.rules).string.min_len = 3,
(google.api.field_behavior) = REQUIRED,
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "domain name to be added to the trusted domain list"}
];
}

message AddOrganizationDomainResponse{
Domain domain = 1;
}

message RemoveOrganizationDomainRequest{
string id = 1 [
(validate.rules).string.min_len = 3,
(google.api.field_behavior) = REQUIRED,
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "unique id of the domain to be deleted"}
];
string org_id = 2 [
(validate.rules).string.min_len = 3,
(google.api.field_behavior) = REQUIRED,
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "unique id of the organization for which whitelisted domains are to be deleted"}
];
}

message RemoveOrganizationDomainResponse{}

message VerifyOrgDomainRequest {
string org_id = 1 [
(validate.rules).string.min_len = 3,
(google.api.field_behavior) = REQUIRED,
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "unique id of the organization for which whitelisted domains are to be verified"}
];
string id = 2 [
(validate.rules).string.min_len = 3,
(google.api.field_behavior) = REQUIRED,
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "unique id of the domain to be verified"}
];
}

message VerifyOrgDomainResponse {
bool verified = 1;
}

message DeleteOrganizationInvitationResponse {}

message EnableOrganizationRequest {
Expand Down
44 changes: 44 additions & 0 deletions raystack/frontier/v1beta1/models.proto
View file
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,50 @@ message Project {
}];
}

message Domain {
string id = 1 [
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
description: "The domain id",
example: "\"943e4567-e89b-12d3-a456-426655440000\""
}
];
string name = 2 [
(validate.rules).string = {
min_len: 2,
},
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
description: "The domain name",
example: "\"raystack.org\""
}
];
string org_id = 3 [
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
description: "The organization id",
example: "\"123e4567-e89b-12d3-a456-426655440000\""
}
];
string token = 4 [
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
description: "The dns TXT record token to verify the domain",
example: "\"_frontier-challenge:1234567890123456\""
}
];
bool verified = 5 [
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
description: "true if the domain is verified, false otherwise",
example: "true"
}
];
google.protobuf.Timestamp created_at = 6 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
description: "The time the domain whitelist request was created",
example: "\"2023-06-07T05:39:56.961Z\""
}];
google.protobuf.Timestamp verified_at = 7 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
description: "The time the org domain was verified",
example: "\"2023-06-07T05:39:56.961Z\""
}];
}

message Policy {
reserved 3, 4, 7, 9;

Expand Down

0 comments on commit c6f9c72

Please sign in to comment.