User adding is now configured and should work

This commit is contained in:
Moritz Graf
2026-04-26 17:33:32 +02:00
parent 6d43326562
commit b260255980
6 changed files with 389 additions and 26 deletions
+4 -26
View File
@@ -94,7 +94,7 @@ resource "google_identity_platform_config" "default" {
}
email {
enabled = false # We only want Google Sign-In
enabled = true
}
}
@@ -105,7 +105,7 @@ resource "google_identity_platform_config" "default" {
resource "google_identity_platform_default_supported_idp_config" "google" {
provider = google-beta
project = var.project_id
enabled = true
enabled = false
idp_id = "google.com"
client_id = data.google_secret_manager_secret_version.oauth_client_id.secret_data
client_secret = data.google_secret_manager_secret_version.oauth_client_secret.secret_data
@@ -130,28 +130,6 @@ resource "google_firestore_database" "database" {
depends_on = [google_project_service.firestore]
}
# Allowlist Configuration Document
resource "google_firestore_document" "allowlist" {
provider = google-beta
project = var.project_id
database = google_firestore_database.database.name
collection = "config"
document_id = "allowlist"
# Serialize the list of emails into a JSON string map for the fields
fields = jsonencode({
emails = {
arrayValue = {
values = [
for email in var.allowed_users : {
stringValue = email
}
]
}
}
})
}
# Firestore Security Rules
resource "google_firebaserules_ruleset" "firestore" {
provider = google
@@ -163,8 +141,8 @@ resource "google_firebaserules_ruleset" "firestore" {
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /config/allowlist {
allow read: if request.auth != null;
match /{document=**} {
allow read, write: if false;
}
}
}