ecarjat locks KairosVista's Mike to Google sign-in only

Email-and-password is gone; access is now Google OAuth, gated to an allowlist of approved email domains.

securitymulti-tenant

On the KairosVista deployment of Mike, ecarjat has ripped out the traditional email-and-password forms and replaced them with a single Google sign-in button. The login and signup pages are reskinned to KairosVista's dark navy identity, complete with a new logo.

The more interesting move sits behind the button. Even after Google vouches for a user, the backend checks the email against a configurable list of approved addresses and domains - anyone outside the allowlist is bounced with a permission error. The fork also reads the user's name and organisation straight from their Google profile, inferring the firm from the email domain, so user records populate themselves on first sign-in rather than asking people to fill in another form.

So what Legal-ops leads evaluating Mike for a single firm or a closed pilot group should look here: it's a clean pattern for locking the tool to your own domain without building auth from scratch.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

4 commits from ecarjat/mike, oldest first. Source extracted verbatim from the harvested git log.

SHA Subject Author Date
a7a41386 Add Google OAuth login Emmanuel Carjat 2026-05-10 ↗ GitHub
13e0a83b Restrict auth to KairosVista Google users Emmanuel Carjat 2026-05-10 ↗ GitHub
786591a2 Match KairosVista auth layout Emmanuel Carjat 2026-05-10 ↗ GitHub
8393b109 Backfill OAuth profiles and reduce audit findings Emmanuel Carjat 2026-05-10 ↗ GitHub

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-397.md from inside the repo you want the changes in.

⬇ Download capture-thread-397.md