Admin ENV Update

[vbhayden]

#issue - There does not currently seem to be a way of specifying an admin user through environment variables.

This update will allow for two optional environment variables:

• AUTH_ALLOW_ENV_ADMINS
• AUTH_ENV_ADMIN_EMAILS

which will add the admin signature to their sheets when the corresponding users log in.

Security Impact: An improperly configured OIDC system may allow users to manually set their email address to that of the configured administrator.
Presumptive Impact: This will enable the use of an admin account for the Platform One deployment of CaSS, allowing for several PII concerns to be mitigated through the on-request removal of personal information.

[vbhayden]

Afternoon @Lomilar, this is the minor update to allow for an admin signature based on their email -- lmk if there are any adjustments needed etc.

Thanks!

[Lomilar]

       let considerUserAnAdmin = AUTH_ALLOW_ENV_ADMINS && AUTH_ENV_ADMIN_EMAILS.includes(email);

This can be easily broken by somehow setting my email address to ".com"

You'll want exact matching with a comma separated list of email addresses.

[vbhayden]

That's how it works yeah, the AUTH_ENV_ADMIN_EMAILS is an array parsed from

function interpretAdminCSV(envCSV) {
    if (envCSV == undefined || typeof envCSV !== "string" || envCSV === "")
        return [];

    return envCSV.split(",");
}

const AUTH_ENV_ADMIN_EMAILS = interpretAdminCSV(process.env.AUTH_ENV_ADMIN_EMAILS);

making it an array inclusion check and not a string inclusion check etc.

[vbhayden]

Updated the names to be less confusing with the const names vs. env names.

[Lomilar]

Got it.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud