How should we restrict access to out SaaS instance?

[cfarvidson]

@kempe-codelabs and I talked today.

We started talking about how we should restrict access to our SaaS instance. And enable this functionality for everyone.

It would solve both the SaaS problem (only paying customers can use the app) and restrict access on dev/staging environments.

My thoughts

1. I think that this should be a core feature that you should be able to toggle with an environment variable (something like FEATURE_ACCESS_RESTRICTED_ENABLED)

• My reasoning behind this is that if you are self-hosting your instance this might be totally overkill.

2. I would like it to be set on the installations.

• We could add something like a boolean column on the installations table. enabled or maybe something named better.

3. We could build a couple of api endpoints toggles this on installations. These new endpoints could then be used by our SaaS marketing/gateway site to enable/disable new customers.

[cfarvidson]

@kempe-codelabs What are your thoughts on this? 😊

[kempe-codelabs]

I think that for MVP it is simpler to have the boolean column on user account level (FEATURE_EMAIL_CONFIRMATION_ENABLED ?). Then we don't need any additional api endpoints. I'm also thinking that restrictions on installations will be more tied to the pricing model whereas the restriction on user could be tied to email confirmation (which we might want anyway to prevent bot/spam?).

[cfarvidson]

And email confirmation is that the user will get an email to confirm the account?

I don’t think the bots will be an issue since we use GitHub as login provider. I think that if we use email/password bots might be an issue.

[cfarvidson]

I just had an idea that might be a compromise.

@kempe-codelabs What do you think about adding 2 new tables (models). AllowedDomains and AllowedEmails. And then we could have a feature flag that, if toggled would check if either the domain or email matched at login.

I think that could enable us to proactively add future users. If we only have a Boolean on the user that would make us have to activate the user after creation.

[kempe-codelabs]

Sounds good!

[cfarvidson]

Nice!

[cfarvidson]

I'm closing his discussion. We will move it to another more codelabs specific forum.