superadmin.ts25 lines · main

1	import { env } from '../env.js';
2
3	/**
4	* Env-pinned superadmin allowlist (BRIVEN_SUPERADMIN_EMAILS, comma-separated).
5	*
6	* Operator requirement: ONLY the email(s) set in the environment may ever be
7	* treated as platform admin — the users.isAdmin DB flag alone is not enough,
8	* so a "grant admin" click (or a compromised admin session flipping the flag
9	* on another account) can never widen who sees or reaches the cockpit.
10	*
11	* When the env var is unset the check is permissive (DB flag decides) so
12	* local dev keeps working; production sets it in Dokploy.
13	*/
14	const allowlist: ReadonlySet<string> | null = env.BRIVEN_SUPERADMIN_EMAILS
15	? new Set(
16	env.BRIVEN_SUPERADMIN_EMAILS.split(',')
17	.map((e) => e.trim().toLowerCase())
18	.filter(Boolean),
19	)
20	: null;
21
22	export function isSuperadminEmail(email: string | null | undefined): boolean {
23	if (!allowlist) return true;
24	return !!email && allowlist.has(email.toLowerCase());
25	}