Depot API & v4 (#298)

* feat: nginx + torrential basics & services system

* fix: lint + i18n

* fix: update torrential to remove openssl

* feat: add torrential to Docker build

* feat: move to self hosted runner

* fix: move off self-hosted runner

* fix: update nginx.conf

* feat: torrential cache invalidation

* fix: update torrential for cache invalidation

* feat: integrity check task

* fix: lint

* feat: move to version ids

* fix: client fixes and client-side checks

* feat: new depot apis and version id fixes

* feat: update torrential

* feat: droplet bump and remove unsafe update functions

* fix: lint

* feat: v4 featureset: emulators, multi-launch commands

* fix: lint

* fix: mobile ui for game editor

* feat: launch options

* fix: lint

* fix: remove axios, use $fetch

* feat: metadata and task api improvements

* feat: task actions

* fix: slight styling issue

* feat: fix style and lints

* feat: totp backend routes

* feat: oidc groups

* fix: update drop-base

* feat: creation of passkeys & totp

* feat: totp signin

* feat: webauthn mfa/signin

* feat: launch selecting ui

* fix: manually running tasks

* feat: update add company game modal to use new SelectorGame

* feat: executor selector

* fix(docker): update rust to rust nightly for torrential build (#305)

* feat: new version ui

* feat: move package lookup to build time to allow for deno dev

* fix: lint

* feat: localisation cleanup

* feat: apply localisation cleanup

* feat: potential i18n refactor logic

* feat: remove args from commands

* fix: lint

* fix: lockfile

---------

Co-authored-by: Aden Lindsay <140392385+AdenMGB@users.noreply.github.com>

server/internal/auth/oidc/index.ts

@@ -45,6 +45,7 @@ export class OIDCManager {
   private clientSecret: string;
   private externalUrl: string;
 
+  private userGroup?: string = process.env.OIDC_USER_GROUP;
   private adminGroup?: string = process.env.OIDC_ADMIN_GROUP;
   private usernameClaim: keyof OIDCUserInfo =
     (process.env.OIDC_USERNAME_CLAIM as keyof OIDCUserInfo) ??
@@ -204,11 +205,11 @@ export class OIDCManager {
         },
       });
 
-      const user = await this.fetchOrCreateUser(userinfo);
+      const userOrError = await this.fetchOrCreateUser(userinfo);
 
-      if (typeof user === "string") return user;
+      if (typeof userOrError === "string") return userOrError;
 
-      return { user, options: session.options };
+      return { user: userOrError, options: session.options };
     } catch (e) {
       logger.error(e);
       return `Request to identity provider failed: ${e}`;
@@ -236,6 +237,19 @@ export class OIDCManager {
     if (!username)
       return "Invalid username claim in OIDC response: " + this.usernameClaim;
 
+    const isAdmin =
+      userinfo.groups !== undefined &&
+      this.adminGroup !== undefined &&
+      userinfo.groups.includes(this.adminGroup);
+
+    const isUser = this.userGroup
+      ? userinfo.groups !== undefined &&
+        userinfo.groups.includes(this.userGroup)
+      : true;
+
+    if (!(isAdmin || isUser))
+      return "Not authorized to access this application.";
+
     /*
     const takenUsername = await prisma.user.count({
       where: {
@@ -274,11 +288,6 @@ export class OIDCManager {
       );
     }
 
-    const isAdmin =
-      userinfo.groups !== undefined &&
-      this.adminGroup !== undefined &&
-      userinfo.groups.includes(this.adminGroup);
-
     const created = await prisma.linkedAuthMec.create({
       data: {
         mec: AuthMec.OpenID,