[BUG] GitHub OAuth login bypasses USER_EMAIL_ALLOWED_DOMAINS entirely

[mereshow]

Describe the bug

GitHub OAuth login bypasses USER_EMAIL_ALLOWED_DOMAINS entirely. Even when the setting is correctly configured and enforced for standard email/password registration, users can still register and log in via GitHub using any email domain. The github_login_func in services.py never calls validate_user_email_allowed_domains, so the domain restriction has no effect on the OAuth flow.

How can we reproduce the behavior

1. Deploy Taiga using the official Docker setup with taiga-contrib-github-auth enabled.
2. Configure USER_EMAIL_ALLOWED_DOMAINS to restrict registration to a specific domain (e.g. ['yourdomain.com']) — see [taiga-back issue #link] for the additional fix required to make this setting work at all in Docker.
3. Confirm the restriction works for standard registration: attempting to register with a disallowed email domain shows "You email domain is not allowed".
4. Click "Sign in with GitHub" and authenticate with a GitHub account whose primary email is from a disallowed domain (e.g. user@gmail.com).
5. Login and account creation succeed — the domain restriction is not enforced.

Workarounds

Bind-mount a patched services.py into the container. Add the domain check in github_login_func right after connector.me() resolves the primary email:

from taiga.base.api.fields import validate_user_email_allowed_domains, InvalidEmailValidationError

def github_login_func(request):
    code = request.DATA.get('code', None)
    token = request.DATA.get('token', None)
    email, user_info = connector.me(code)

    try:
        validate_user_email_allowed_domains(email)
    except InvalidEmailValidationError:
        raise exc.WrongArguments(_("You email domain is not allowed"))

    user = github_register(
        username=user_info.username,
        email=email,
        full_name=user_info.full_name,
        github_id=user_info.id,
        bio=user_info.bio,
        token=token
    )
    data = make_auth_response_data(user)
    return data

Note: this fix depends on USER_EMAIL_ALLOWED_DOMAINS being correctly loaded in taiga-back — see taiga-back issue #157.

Screenshots

N/A

Taiga environment

Self-hosted via Docker (official taiga-docker setup). No error logs — the bypass is silent, the OAuth flow simply never reaches the domain validator.

Desktop (please complete the following information):

• OS: N/A (server-side bug)
• Browser: N/A
• Version: taiga-contrib-github-auth 6.8 (tested March 2026)

Additional context

The validate_user_email_allowed_domains function exists in taiga-back (taiga/base/api/fields.py) and is correctly used in standard registration and email change flows. The GitHub auth connector in services.py was simply never updated to call it. The same issue likely affects taiga-contrib-gitlab-auth for the same reason.