feat(auth): add ACKIFY_ORGANISATION_DOMAIN to restrict document creation by email domain

When set, only users whose email matches the organisation domain can create
documents. Admins bypass this restriction. Empty value preserves current
behavior (all users allowed). Exposed in admin settings UI and install script.

Author: btouchard

.env.example

@@ -1,6 +1,9 @@
 # Application Configuration
 ACKIFY_BASE_URL=https://sign.your-domain.com
 ACKIFY_ORGANISATION="Your Organization Name"
+# Optional: Restrict document creation to users with this email domain
+# Leave empty to allow all authenticated users to create documents
+# ACKIFY_ORGANISATION_DOMAIN=your-company.com
 ACKIFY_LOG_LEVEL=info
 ACKIFY_LOG_FORMAT=classic
 

backend/internal/application/services/config_service.go

@@ -366,6 +366,7 @@ func (s *ConfigService) seedFromENV(ctx context.Context) error {
 	general := models.GeneralConfig{
 		Organisation:       s.envConfig.App.Organisation,
 		OnlyAdminCanCreate: s.envConfig.App.OnlyAdminCanCreate,
+		OrganisationDomain: s.envConfig.App.OrganisationDomain,
 		AllowedDomains:     s.envConfig.App.AllowedDomains,
 	}
 	if err := s.upsertSection(ctx, models.ConfigCategoryGeneral, general, nil, "system"); err != nil {

backend/internal/presentation/api/config/handler.go

@@ -27,11 +27,12 @@ func NewHandler(configProvider configProvider) *Handler {
 
 // Response represents the public configuration exposed to the frontend
 type Response struct {
-	SMTPEnabled        bool `json:"smtpEnabled"`
-	StorageEnabled     bool `json:"storageEnabled"`
-	OnlyAdminCanCreate bool `json:"onlyAdminCanCreate"`
-	OAuthEnabled       bool `json:"oauthEnabled"`
-	MagicLinkEnabled   bool `json:"magicLinkEnabled"`
+	SMTPEnabled        bool   `json:"smtpEnabled"`
+	StorageEnabled     bool   `json:"storageEnabled"`
+	OnlyAdminCanCreate bool   `json:"onlyAdminCanCreate"`
+	OrganisationDomain string `json:"organisationDomain"`
+	OAuthEnabled       bool   `json:"oauthEnabled"`
+	MagicLinkEnabled   bool   `json:"magicLinkEnabled"`
 }
 
 // HandleGetConfig handles GET /api/v1/config
@@ -42,6 +43,7 @@ func (h *Handler) HandleGetConfig(w http.ResponseWriter, r *http.Request) {
 		SMTPEnabled:        cfg.SMTP.IsConfigured(),
 		StorageEnabled:     cfg.Storage.IsEnabled(),
 		OnlyAdminCanCreate: cfg.General.OnlyAdminCanCreate,
+		OrganisationDomain: cfg.General.OrganisationDomain,
 		OAuthEnabled:       cfg.OIDC.Enabled,
 		MagicLinkEnabled:   cfg.MagicLink.Enabled,
 	}

backend/pkg/config/config.go

@@ -67,6 +67,7 @@ type AppConfig struct {
 	SecureCookies      bool
 	AdminEmails        []string
 	OnlyAdminCanCreate bool
+	OrganisationDomain string   // If set, only users with this email domain can create documents
 	AllowedDomains     []string // Whitelist of allowed domains for document URLs (supports wildcards like *.company.com)
 	SMTPEnabled        bool     // True if SMTP is configured (for email reminders)
 	AuthRateLimit      int      // Global auth rate limit (requests per minute), default: 5
@@ -238,6 +239,9 @@ func Load() (*Config, error) {
 	// Parse admin-only document creation flag
 	config.App.OnlyAdminCanCreate = getEnvBool("ACKIFY_ONLY_ADMIN_CAN_CREATE", false)
 
+	// Parse organisation domain for document creation restriction
+	config.App.OrganisationDomain = strings.TrimSpace(getEnv("ACKIFY_ORGANISATION_DOMAIN", ""))
+
 	// Parse allowed domains whitelist for document URLs
 	allowedDomainsStr := getEnv("ACKIFY_ALLOWED_DOMAINS", "")
 	if allowedDomainsStr != "" {

backend/pkg/models/tenant_config.go

@@ -57,6 +57,7 @@ type TenantConfig struct {
 type GeneralConfig struct {
 	Organisation       string   `json:"organisation"`
 	OnlyAdminCanCreate bool     `json:"only_admin_can_create"`
+	OrganisationDomain string   `json:"organisation_domain"`
 	AllowedDomains     []string `json:"allowed_domains"`
 }
 

backend/pkg/web/auth/simple_authorizer.go

@@ -44,11 +44,18 @@ func (a *SimpleAuthorizer) IsAdmin(_ context.Context, userEmail string) bool {
 
 // CanCreateDocument implements providers.Authorizer.
 func (a *SimpleAuthorizer) CanCreateDocument(ctx context.Context, userEmail string) bool {
-	cfg := a.configProvider.GetConfig()
-	if !cfg.General.OnlyAdminCanCreate {
+	if a.IsAdmin(ctx, userEmail) {
 		return true
 	}
-	return a.IsAdmin(ctx, userEmail)
+	cfg := a.configProvider.GetConfig()
+	if cfg.General.OnlyAdminCanCreate {
+		return false
+	}
+	if domain := cfg.General.OrganisationDomain; domain != "" {
+		normalized := strings.ToLower(strings.TrimSpace(userEmail))
+		return strings.HasSuffix(normalized, "@"+strings.ToLower(domain))
+	}
+	return true
 }
 
 // CanManageDocument implements providers.Authorizer.

compose.yml

@@ -26,6 +26,7 @@ services:
       ACKIFY_LOG_LEVEL: "${ACKIFY_LOG_LEVEL}"
       ACKIFY_BASE_URL: "${ACKIFY_BASE_URL}"
       ACKIFY_ORGANISATION: "${ACKIFY_ORGANISATION}"
+      ACKIFY_ORGANISATION_DOMAIN: "${ACKIFY_ORGANISATION_DOMAIN:-}"
       ACKIFY_DB_DSN: "postgres://ackify_app:${ACKIFY_APP_PASSWORD}@ackify-db:5432/ackify?sslmode=disable"
       ACKIFY_OAUTH_PROVIDER: "${ACKIFY_OAUTH_PROVIDER}"
       ACKIFY_OAUTH_CLIENT_ID: "${ACKIFY_OAUTH_CLIENT_ID}"

install/.env.example

@@ -8,6 +8,10 @@
 ACKIFY_BASE_URL=https://your-domain.com
 ACKIFY_ORGANISATION="Your Organization Name"
 
+# Optional: Restrict document creation to users with this email domain
+# Leave empty to allow all authenticated users to create documents
+# ACKIFY_ORGANISATION_DOMAIN=your-company.com
+
 # ==========================================
 # Database Configuration
 # ==========================================

install/compose.yml.template

@@ -26,6 +26,7 @@ services:
       ACKIFY_LOG_FORMAT: "${ACKIFY_LOG_FORMAT:-classic}"
       ACKIFY_BASE_URL: "${ACKIFY_BASE_URL}"
       ACKIFY_ORGANISATION: "${ACKIFY_ORGANISATION}"
+      ACKIFY_ORGANISATION_DOMAIN: "${ACKIFY_ORGANISATION_DOMAIN:-}"
       ACKIFY_ADMIN_EMAILS: "${ACKIFY_ADMIN_EMAILS}"
       ACKIFY_ONLY_ADMIN_CAN_CREATE: "${ACKIFY_ONLY_ADMIN_CAN_CREATE:-false}"
       ACKIFY_LISTEN_ADDR: ":8080"

install/install.sh

@@ -245,14 +245,19 @@ if [ "$UPDATE_MODE" = true ] && has_env "ACKIFY_BASE_URL"; then
     # Use existing values in update mode
     APP_BASE_URL=$(get_env "ACKIFY_BASE_URL")
     APP_ORGANISATION=$(get_env "ACKIFY_ORGANISATION")
+    APP_ORGANISATION_DOMAIN=$(get_env "ACKIFY_ORGANISATION_DOMAIN")
     print_header "🌐 Basic Configuration (existing)"
     print_success "Base URL: ${APP_BASE_URL}"
     print_success "Organization: ${APP_ORGANISATION}"
+    if [ -n "$APP_ORGANISATION_DOMAIN" ]; then
+        print_success "Organization Domain: ${APP_ORGANISATION_DOMAIN}"
+    fi
 else
     print_header "🌐 Basic Configuration"
     echo ""
     APP_BASE_URL=$(prompt_input "Application Base URL (e.g., https://ackify.example.com)" "http://localhost:8080")
     APP_ORGANISATION=$(prompt_input "Organization Name" "My Organization")
+    APP_ORGANISATION_DOMAIN=$(prompt_input "Organization Email Domain (e.g., company.com, leave empty to allow all)" "")
     print_success "Base configuration set"
 fi
 
@@ -889,6 +894,7 @@ cat > .env <<EOF
 # ==========================================
 ACKIFY_BASE_URL=${APP_BASE_URL}
 ACKIFY_ORGANISATION=${APP_ORGANISATION}
+ACKIFY_ORGANISATION_DOMAIN=${APP_ORGANISATION_DOMAIN}
 
 # ==========================================
 # Database Configuration