Merge pull request #82 from AustralianBioCommons/sbp-register-whitelist

AAI-386: Restrict user registration to a restricted list of domains [SBP]

Author: minh-biocommons

.env.example

@@ -17,6 +17,8 @@ ADMIN_ROLES='["Admin", "GalaxyAdmin"]'
 SEND_EMAIL=False
 # AAI Portal URL for admin links in emails
 AAI_PORTAL_URL=https://aaiportal.example.com
+# Allowed email domains for SBP registration (note the JSON list syntax)
+SBP_ALLOWED_EMAIL_DOMAINS='["gmail.com", "outlook.com", "example.com", "yahoo.com"]'
 # URL of Galaxy instance, for making calls to Galaxy API
 GALAXY_URL=https://galaxy.example.com
 GALAXY_API_KEY=api-key

config.py

@@ -21,6 +21,23 @@ class Settings(BaseSettings):
     cors_allowed_origins: str
     # AAI Portal URL for admin links in emails
     aai_portal_url: str = "https://aaiportal.test.biocommons.org.au"
+    # Allowed email domains for SBP registration
+    sbp_allowed_email_domains: list[str] = [
+        # UNSW
+        "unsw.edu.au", "ad.unsw.edu.au", "student.unsw.edu.au",
+        # BioCommons
+        "biocommons.org.au",
+        # USyd
+        "sydney.edu.au", "uni.sydney.edu.au",
+        # WEHI
+        "wehi.edu.au",
+        # Monash
+        "monash.edu", "student.monash.edu",
+        # Griffith
+        "griffith.edu.au", "griffithuni.edu.au",
+        # UoM
+        "unimelb.edu.au", "student.unimelb.edu.au"
+    ]
 
     model_config = SettingsConfigDict(env_file=".env", extra="ignore")
 

routers/sbp_register.py

@@ -1,5 +1,6 @@
 import logging
 
+from email_validator import EmailNotValidError, validate_email
 from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException
 from httpx import HTTPStatusError
 from sqlmodel import Session
@@ -24,6 +25,15 @@
     route_class=RegistrationRoute
 )
 
+def validate_sbp_email_domain(email: str, settings: Settings) -> bool:
+    try:
+        validated_email = validate_email(email)
+        domain = validated_email.domain.lower()
+        allowed_domains_lower = [domain.lower() for domain in settings.sbp_allowed_email_domains]
+        return domain in allowed_domains_lower
+    except EmailNotValidError:
+        return False
+
 
 def send_approval_email(registration: SBPRegistrationRequest, settings: Settings):
     """Send email notification about new SBP registration."""
@@ -62,6 +72,18 @@ async def register_sbp_user(
 ):
     """Register a new SBP user."""
 
+    # Validate email domain
+    if not validate_sbp_email_domain(registration.email, settings):
+        logger.warning(f"SBP registration rejected for email domain: {registration.email}")
+        allowed_domains_str = ", ".join(settings.sbp_allowed_email_domains)
+        response = RegistrationErrorResponse(
+            message=(
+                "Email domain not approved for SBP registration. "
+                f"Please use an email from an approved domain: {allowed_domains_str}."
+            )
+        )
+        return JSONResponse(status_code=400, content=response.model_dump(mode="json"))
+
     # Create Auth0 user data
     user_data = BiocommonsRegisterData.from_sbp_registration(
         registration=registration

tests/test_sbp_register.py

@@ -9,6 +9,7 @@
     PlatformMembership,
     PlatformMembershipHistory,
 )
+from routers.sbp_register import validate_sbp_email_domain
 from schemas.biocommons import BiocommonsRegisterData
 from tests.datagen import (
     Auth0UserDataFactory,
@@ -23,7 +24,7 @@ def valid_registration_data():
         username="testuser",
         first_name="Test",
         last_name="User",
-        email="test@example.com",
+        email="test@unsw.edu.au",
         reason="Need access to SBP resources",
         password="SecurePass123!",
     ).model_dump()
@@ -37,6 +38,34 @@ def test_to_biocommons_register_data():
     assert register_data.app_metadata.registration_from == "sbp"
 
 
+def test_validate_sbp_email_domain_function():
+    from unittest.mock import Mock
+    mock_settings = Mock()
+    mock_settings.sbp_allowed_email_domains = [
+        "unsw.edu.au", "ad.unsw.edu.au", "student.unsw.edu.au",
+        "biocommons.org.au",
+        "sydney.edu.au", "uni.sydney.edu.au",
+        "wehi.edu.au",
+        "monash.edu", "student.monash.edu",
+        "griffith.edu.au", "griffithuni.edu.au",
+        "unimelb.edu.au", "student.unimelb.edu.au"
+    ]
+
+    # Test approved domains
+    assert validate_sbp_email_domain("user@unsw.edu.au", mock_settings)
+    assert validate_sbp_email_domain("user@biocommons.org.au", mock_settings)
+    assert validate_sbp_email_domain("user@sydney.edu.au", mock_settings)
+    assert validate_sbp_email_domain("USER@UNSW.EDU.AU", mock_settings)
+
+    # Test rejected domains
+    assert not validate_sbp_email_domain("user@gmail.com", mock_settings)
+    assert not validate_sbp_email_domain("user@unsw.com", mock_settings)
+    assert not validate_sbp_email_domain("user@biocommons.org", mock_settings)
+    assert not validate_sbp_email_domain("user@evilunsw.edu.au", mock_settings)
+    assert not validate_sbp_email_domain("user@malicious.biocommons.org.au", mock_settings)
+    assert not validate_sbp_email_domain("user@fakeunimelb.edu.au", mock_settings)
+
+
 def test_successful_registration(
     test_client, valid_registration_data, mock_auth0_client, test_db_session
 ):
@@ -136,3 +165,14 @@ def test_registration_email_format(test_client, valid_registration_data):
     details = response.json()
     errors = details["field_errors"]
     assert "email" in [error["field"] for error in errors]
+
+
+def test_registration_rejected_email_domains(test_client, valid_registration_data, mock_auth0_client):
+    data = valid_registration_data.copy()
+    data["email"] = "user@gmail.com"
+
+    response = test_client.post("/sbp/register", json=data)
+
+    assert response.status_code == 400
+    assert "Email domain not approved for SBP registration" in response.json()["message"]
+    assert not mock_auth0_client.create_user.called