Is there a way to restrict google sign-ins only to a single domain? for organisations or school mails. I am using supertoken with NestJs and Vue.

Hey @shivam51 it is possible. I’ll get back in 30 mins or so

hi

You can do that by: - overriding the signinup recipe function in your recipe (I am assuming you are using ThirdParty recipe) to check the email's domain. - If the email domain doesn't match, you would return a FIELD_ERROR with custom message. Then on the frontend, you can check for this output and display the message

I blindly followed to docs. will check the recipe and get back to you in a minute

right

it would be great if you could show some code

Something like this:

js

export class SupertokensService {
  constructor(@Inject(ConfigInjectionToken) private config: AuthModuleConfig) {
    supertokens.init({
      appInfo: config.appInfo,
      supertokens: {
        connectionURI:
          'fooBar',
        apiKey: 'fooBar',
      },
      recipeList: [
        ThirdPartyEmailPassword.init({
            override: {
                functions: (oI) => {
                    return {
                        ...oI,
                        thirdPartySignInUp: async function (input) {
                            let email = input.email;
                            if (!isEmailAllowed(email)) { // your custom email check
                                return {
                                    status: "FIELD_ERROR",
                                    message: "Email not allowed to sign up / in"
                                }
                            }
                            return oI.thirdPartySignInUp(input);
                        }
                    }
                }
            },
          providers: [
            ThirdPartyEmailPassword.Google({
              clientId:
                'fooBar',
              clientSecret: 'fooBar',
            })
          ],
        }),
        Session.init(),
      ],
    });
  }
}

Hey @rp_st will it look something like this then?

yup

hey another question.

you need to do

email.id

this

email

stores the userId and if he is verified or not, for

isEmailAllowed

I would be needing the email itself right?

email.id is the email ID. Not the user Id

@rp_st this works, thanks man!

oh yea.