ecarjat replaces email/password auth with Google OAuth restricted to KairosVista domain
ecarjat ships a four-commit sequence that strips email/password login, adds Google OAuth, and locks access to `kairosvista.com` email addresses at the backend middleware level. The domain-gating mechanism is cleanly written and no-ops when left unconfigured.
The first commit (a7a4138) adds a Google OAuth button alongside the existing forms. The second (13e0a83) removes the email/password forms entirely and adds AUTH_ALLOWED_EMAILS and AUTH_ALLOWED_EMAIL_DOMAINS CSV env vars. These are read in backend/src/middleware/auth.ts inside requireAuth - after Supabase has already verified the token, a 403 is returned if the user's email doesn't match either list. When both lists are empty, the check passes unconditionally. The Google OAuth call also passes hd: "kairosvista.com" as a query parameter, which pre-filters the Google account picker, though this is a UX hint rather than a security boundary. The third commit (786591a) reskins the auth pages to the KairosVista dark navy / neutral-950 design.
The fourth commit (8393b10) backfills OAuth user metadata into profiles. requireAuth exposes res.locals.userMetadata, and GET /user/profile extracts full_name, name, display_name, or user_name fields from it. Organisation is inferred from the email domain (@kairosvista.com → "KairosVista"). Any blank display_name or organisation fields on the user_profiles row are updated on every profile fetch.
The same commit bumps multer from ^1.4.5-lts.2 to ^2.1.1 - multer v2 has breaking API changes so review the changelog before merging. mammoth goes to ^1.12.0, @anthropic-ai/sdk to 0.95.1. @supabase/auth-helpers-nextjs is removed from production dependencies; the fork now uses @supabase/supabase-js directly for auth.
Spotted something wrong? Or know the PR text has fresher detail than the writeup above?