allowlist
Unified identity authorization matching for the passwordless gate.
Each pattern in the configured list is one of three shapes:
- domain shortcut -
example.comor@example.com: matches any address whose domain equals it. This is the gate’s OWN semantic (a bare value means “the domain”, not “the whole address”), so it is handled here. - glob - contains
*or?, e.g.*@example.com: matched against the WHOLE address with shell-style wildcards. - regex - wrapped in slashes,
/.../ [flags]: tested against the whole address. An invalid regex never matches (it is skipped with a warning rather than throwing).
Only the first shape is this module’s business: the glob and regex shapes are
delegated to @dbx-tools/shared-core’s pattern.toPattern, which is
where that compilation lives for every allow-list in the repo (the tunnel’s
inbound-header policy uses the same one). Matching is case-insensitive
throughout.
An EMPTY list matches nobody (fail closed): an app that enables the gate but configures no patterns lets no one in, which is the safe default.