Implement allow list for account creation

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index f79c284e3e499bf6b70475b0380141034032e316..961be4024657a5eb80d206440461035f780a33af 100644 (file)
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -355,6 +355,8 @@ class UsersController < ApplicationController
                    domain_mx_servers(domain)
                  end
 
+    return true if Acl.allow_account_creation(request.remote_ip, :domain => domain, :mx => mx_servers)
+
     blocked = Acl.no_account_creation(request.remote_ip, :domain => domain, :mx => mx_servers)
 
     blocked ||= SIGNUP_IP_LIMITER && !SIGNUP_IP_LIMITER.allow?(request.remote_ip)

diff --git a/app/models/acl.rb b/app/models/acl.rb
index a65c3a35ad68977fe1a1da5f6296c280006145a0..26285cef38ac0825ab237a7ba955a6118761d137 100644 (file)
--- a/app/models/acl.rb
+++ b/app/models/acl.rb
@@ -41,6 +41,15 @@ class Acl < ApplicationRecord
     match(address, options).exists?(:k => "no_account_creation")
   end
 
+  def self.allow_account_creation(address, options = {})
+    acls = Acl.where("address >>= ?", address)
+              .and(Acl.where(:k => "allow_account_creation"))
+    acls = acls.and(Acl.where(:domain => options[:domain])) if options[:domain]
+    acls = acls.and(Acl.where(:mx => options[:mx])) if options[:mx]
+
+    !acls.empty?
+  end
+
   def self.no_note_comment(address, domain = nil)
     match(address, :domain => domain).exists?(:k => "no_note_comment")
   end

diff --git a/test/models/acl_test.rb b/test/models/acl_test.rb
index 88d1c0e7d028f4b3675139f24766a0a36828ec6a..33601df2b60fbce8d36c521b30727cc2f47536ee 100644 (file)
--- a/test/models/acl_test.rb
+++ b/test/models/acl_test.rb
@@ -27,4 +27,17 @@ class AclTest < ActiveSupport::TestCase
     create(:acl, :mx => "mail.example.com", :k => "no_account_creation")
     assert Acl.no_account_creation("192.168.1.1", :mx => "mail.example.com")
   end
+
+  def test_allowed_account_creation
+    assert_not Acl.allow_account_creation("192.168.1.1", :domain => "example.com", :mx => "mail.example.com")
+    create(:acl, :address => "192.168.1.1", :domain => "example.com", :mx => "mail.example.com", :k => "allow_account_creation")
+
+    assert_not Acl.allow_account_creation("192.168.1.2")
+    assert Acl.allow_account_creation("192.168.1.1")
+
+    assert_not Acl.allow_account_creation("192.168.1.2", :domain => "example.com", :mx => "mail.example.com")
+    assert_not Acl.allow_account_creation("192.168.1.1", :domain => "example1.com", :mx => "mail.example.com")
+    assert_not Acl.allow_account_creation("192.168.1.1", :domain => "example.com", :mx => "mail1.example.com")
+    assert Acl.allow_account_creation("192.168.1.1", :domain => "example.com", :mx => "mail.example.com")
+  end
 end