mirror of
https://github.com/discourse/discourse.git
synced 2024-11-27 03:10:46 -06:00
e0a6d12c55
The previous implementation would attempt to fetch groups using the end-user's Google auth token. This only worked for admin accounts, or users with 'delegated' access to the `admin.directory.group.readonly` API. This commit changes the approach to use a single 'service account' for fetching the groups. This removes the need to add permissions to all regular user accounts. I'll be updating the [meta docs](https://meta.discourse.org/t/226850) with instructions on setting up the service account. This is technically a breaking change in behavior, but the existing implementation was marked experimental, and is currently unusable in production google workspace environments.
16 lines
466 B
Ruby
16 lines
466 B
Ruby
# frozen_string_literal: true
|
|
|
|
class GoogleOauth2HdGroupsValidator
|
|
def initialize(opts = {})
|
|
@opts = opts
|
|
end
|
|
|
|
def valid_value?(value)
|
|
@valid = value == "f" || (SiteSetting.google_oauth2_hd.present? && SiteSetting.google_oauth2_hd_groups_service_account_admin_email.present? && SiteSetting.google_oauth2_hd_groups_service_account_json.present?)
|
|
end
|
|
|
|
def error_message
|
|
I18n.t("site_settings.errors.google_oauth2_hd_groups") if !@valid
|
|
end
|
|
end
|