feat(api): Enforce AGENTA_ACCESS_* domain and email controls in OSS

[jp-agenta]

Context

OSS already parses all four access env vars (AGENTA_ACCESS_ALLOWED_DOMAINS, AGENTA_ACCESS_ALLOWED_OWNER_EMAILS, AGENTA_ACCESS_BLOCKED_DOMAINS, AGENTA_ACCESS_BLOCKED_EMAILS) through the shared AccessConfig, but never enforces them: is_auth_info_blocked() early-returns False when not running EE. Sequencing step 3 of the convergence plan (docs/designs/oss-ee-convergence/assessment-a-oss-multi-org.md).

Changes

Deletes the if not is_ee(): return False gate in is_auth_info_blocked() (oss/src/core/auth/helper.py). That is the whole change: parsing, normalization, and the exact-or-subdomain matcher are already shared, so OSS now gets identical blocklist/allowlist semantics on every auth path that calls ensure_auth_info_not_blocked.

AGENTA_ACCESS_ALLOWED_OWNER_EMAILS is enforced by can_create_organization, which moves into OSS with the org-creation PR (#4673); nothing more is needed here.

Tests / notes

• ruff format and ruff check pass.
• Unit tests in oss/tests/pytest/unit/auth/test_helper.py updated: they stubbed the now-deleted is_ee import (which would raise AttributeError) and now exercise the enforcement path both editions share.
• Note for OSS deployments with PostHog enabled: when AGENTA_ACCESS_BLOCKED_EMAILS/BLOCKED_DOMAINS are unset, the PostHog-backed fallback blocklists now also apply (same as EE).
• Shippable independently of the multi-org work.

What to QA

• OSS with AGENTA_ACCESS_BLOCKED_EMAILS=bad@x.com: signup/signin as that email is denied with "Access Denied."
• OSS with AGENTA_ACCESS_ALLOWED_DOMAINS=mycorp.com: a @mycorp.com (or subdomain) email signs in; any other domain is denied.
• Regression: OSS with none of the vars set behaves as before (everyone allowed).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agenta-documentation	Ready	Preview, Comment	Jun 14, 2026 5:40pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2919f6ed-56c2-4396-b681-23fe2b74b034

📥 Commits

Reviewing files that changed from the base of the PR and between 931297c and 23c813f.

📒 Files selected for processing (2)

• api/oss/src/core/auth/helper.py
• api/oss/tests/pytest/unit/auth/test_helper.py

💤 Files with no reviewable changes (2)

• api/oss/tests/pytest/unit/auth/test_helper.py
• api/oss/src/core/auth/helper.py

---

📝 Walkthrough

Summary by CodeRabbit

• Refactor
  • Removed enterprise-specific authorization bypasses. Authorization blocking now consistently evaluates email and domain validation rules across all configurations without special exceptions.

Walkthrough

The is_ee import is removed from api/oss/src/core/auth/helper.py and the is_ee() early-return guard inside is_auth_info_blocked is deleted. Two unit tests in test_helper.py are updated by removing the monkeypatch overrides that forced is_ee to return True.

Changes

Authorization-Blocking EE-Gating Removal

Layer / File(s)	Summary
Remove EE-gating from is_auth_info_blocked and tests api/oss/src/core/auth/helper.py, api/oss/tests/pytest/unit/auth/test_helper.py	Deletes the is_ee import and its early-return guard in is_auth_info_blocked; removes matching monkeypatch.setattr(auth_helper, "is_ee", ...) calls from test_ensure_auth_info_not_blocked_rejects_explicitly_blocked_email and test_ensure_auth_info_not_blocked_rejects_disallowed_domain.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 60.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: enabling enforcement of AGENTA_ACCESS_* environment variables in OSS by removing the EE-only gate.
Description check	✅ Passed	The description provides comprehensive context, explaining the change removes the EE gate, its impact, testing approach, and QA steps—all directly related to the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/oss-access-vars

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mmabrouk]

great work

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6407431f-ebfe-4c12-b543-cb9ebedf9e25

📥 Commits

Reviewing files that changed from the base of the PR and between a83194e and 931297c.

⛔ Files ignored due to path filters (4)

• api/uv.lock is excluded by !**/*.lock
• clients/python/uv.lock is excluded by !**/*.lock
• sdks/python/uv.lock is excluded by !**/*.lock
• services/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (19)

• api/entrypoints/worker_evaluations.py
• api/entrypoints/worker_events.py
• api/entrypoints/worker_webhooks.py
• api/oss/src/core/events/streaming.py
• api/oss/src/core/tracing/streaming.py
• api/oss/tests/legacy/conftest.py
• api/oss/tests/legacy/workflows/core/tests.py
• api/pyproject.toml
• clients/python/pyproject.toml
• docs/openapi-cleanup/research.md
• hosting/kubernetes/helm/Chart.yaml
• sdks/python/oss/tests/legacy/new_tests/conftest.py
• sdks/python/oss/tests/legacy/new_tests/workflows/core/tests.py
• sdks/python/pyproject.toml
• services/pyproject.toml
• web/ee/package.json
• web/oss/package.json
• web/package.json
• web/packages/agenta-api-client/package.json

✅ Files skipped from review due to trivial changes (10)

• sdks/python/pyproject.toml
• web/package.json
• clients/python/pyproject.toml
• web/packages/agenta-api-client/package.json
• web/ee/package.json
• web/oss/package.json
• hosting/kubernetes/helm/Chart.yaml
• services/pyproject.toml
• docs/openapi-cleanup/research.md
• api/pyproject.toml