Allow multiple email domains for sign-in (altafhvali.com, gmail.com)

RAG_Products/api.py

@@ -18,7 +18,7 @@ from fastapi.responses import FileResponse
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel, Field
 
-from RAG_Products.config import SIMILAR_K, OPENROUTER_API_KEY, ALLOWED_ORIGINS, ALLOWED_EMAIL_DOMAIN
+from RAG_Products.config import SIMILAR_K, OPENROUTER_API_KEY, ALLOWED_ORIGINS, ALLOWED_EMAIL_DOMAINS
 from RAG_Products.graph import get_graph
 from RAG_Products.similar import find_similar, doc_to_dict
 from RAG_Products.models import llm_groq
@@ -120,14 +120,18 @@ def _resolve_user(authorization, fallback):
     """Prefer the verified Firebase uid from the Bearer token; else the
     client-supplied id (used in local/no-auth mode).
 
-    Enforces ALLOWED_EMAIL_DOMAIN: a signed-in user whose email isn't on that
-    domain is rejected outright (403), never silently downgraded to anonymous.
+    Enforces ALLOWED_EMAIL_DOMAINS: a signed-in user whose email isn't on one
+    of those domains is rejected outright (403), never silently downgraded to
+    anonymous.
     """
     if authorization and authorization.lower().startswith("bearer "):
         uid, email = storage.verify_token(authorization[7:].strip())
         if uid:
-            if ALLOWED_EMAIL_DOMAIN and not (email or "").lower().endswith("@" + ALLOWED_EMAIL_DOMAIN):
-                raise HTTPException(403, f"Sign-in is restricted to @{ALLOWED_EMAIL_DOMAIN} accounts.")
+            if ALLOWED_EMAIL_DOMAINS and not any(
+                (email or "").lower().endswith("@" + d) for d in ALLOWED_EMAIL_DOMAINS
+            ):
+                allowed = ", ".join("@" + d for d in ALLOWED_EMAIL_DOMAINS)
+                raise HTTPException(403, f"Sign-in is restricted to {allowed} accounts.")
             return uid
     return fallback or "default"
 

RAG_Products/config.py

@@ -57,9 +57,13 @@ FIREBASE_CREDENTIALS_JSON = os.getenv("FIREBASE_CREDENTIALS_JSON")
 FIREBASE_PROJECT_ID = os.getenv("FIREBASE_PROJECT_ID")
 CHATS_LOCAL_PATH = BASE_DIR / "Data" / "chats.json"  # fallback store
 
-# Only emails on this domain may sign in (any Firebase provider — Google or
-# email/password). Empty string disables the restriction.
-ALLOWED_EMAIL_DOMAIN = os.getenv("ALLOWED_EMAIL_DOMAIN", "altafhvali.com")
+# Only emails on these domains may sign in (any Firebase provider — Google or
+# email/password). Comma-separated; empty string disables the restriction.
+ALLOWED_EMAIL_DOMAINS = [
+    d.strip().lower() for d in
+    os.getenv("ALLOWED_EMAIL_DOMAINS", "altafhvali.com,gmail.com").split(",")
+    if d.strip()
+]
 
 # CORS: comma-separated origins allowed to call the API (the Vercel frontend).
 # "*" is fine since there are no cookies; restrict to your domain for safety.

RAG_Products/static/config.js

@@ -14,6 +14,6 @@ window.FIREBASE_CONFIG = {
   appId: "1:201860800907:web:26114586af1b4a42704f8e"
 };
 
-// Only this email domain may sign in (must match ALLOWED_EMAIL_DOMAIN on the
-// backend — this is just a fast client-side check, the backend enforces it).
-window.ALLOWED_EMAIL_DOMAIN = "altafhvali.com";
+// Only these email domains may sign in (must match ALLOWED_EMAIL_DOMAINS on
+// the backend — this is just a fast client-side check, the backend enforces it).
+window.ALLOWED_EMAIL_DOMAINS = ["altafhvali.com", "gmail.com"];

RAG_Products/static/index.html

@@ -583,10 +583,11 @@
       fbAuth = firebase.auth();
       gateSign(); renderAuth(null);
       fbAuth.onAuthStateChanged(async (user) => {
-        const domain = window.ALLOWED_EMAIL_DOMAIN;
-        if (user && domain && !(user.email || '').toLowerCase().endsWith('@' + domain.toLowerCase())) {
+        const domains = window.ALLOWED_EMAIL_DOMAINS || [];
+        const email = (user && user.email || '').toLowerCase();
+        if (user && domains.length && !domains.some(d => email.endsWith('@' + d.toLowerCase()))) {
           await fbAuth.signOut();
-          gateSign(`Sign-in is restricted to @${domain} accounts.`);
+          gateSign(`Sign-in is restricted to ${domains.map(d => '@' + d).join(', ')} accounts.`);
           return;
         }
         authUser = user;