Add ability to restrict cauth sites to members of specific group(s)

If no groups are specified, work just like before where every user can
log in to every site. Existing limited sites had the list of users
defined locally on the machine, but it seems reasonable to be able to
control this centrally as well.

Author: mhagander

pgweb/account/admin.py

@@ -20,6 +20,13 @@ class Meta:
         model = CommunityAuthSite
         exclude = ()
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+        self.fields['org'].widget.can_add_related = False
+        self.fields['org'].widget.can_change_related = False
+        self.fields['require_groups'].widget.can_add_related = False
+
     def clean_cryptkey(self):
         x = None
         try:

pgweb/account/migrations/0011_communityauthsite_require_groups.py

@@ -0,0 +1,19 @@
+# Generated by Django 5.2.10 on 2026-05-22 19:23
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('account', '0010_communityauthsite_version'),
+        ('auth', '0012_alter_user_first_name_max_length'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='communityauthsite',
+            name='require_groups',
+            field=models.ManyToManyField(blank=True, help_text='Require membership in at least one of the specified groups in order to log in', to='auth.group'),
+        ),
+    ]

pgweb/account/models.py

@@ -1,5 +1,5 @@
 from django.db import models
-from django.contrib.auth.models import User
+from django.contrib.auth.models import User, Group
 
 
 class CommunityAuthOrg(models.Model):
@@ -29,6 +29,8 @@ class CommunityAuthSite(models.Model):
                                        help_text="Supports receiving http POSTs with changes to accounts")
     push_ssh = models.BooleanField(null=False, blank=False, default=False,
                                    help_text="Wants to receive SSH keys in push changes")
+    require_groups = models.ManyToManyField(Group, blank=True,
+                                            help_text="Require membership in at least one of the specified groups in order to log in")
 
     def __str__(self):
         return self.name

pgweb/account/views.py

@@ -675,11 +675,16 @@ def communityauth(request, siteid):
             },
         )(request)
 
-    # When we reach this point, the user *has* already been authenticated.
-    # The request variable "su" *may* contain a suburl and should in that
-    # case be passed along to the site we're authenticating for. And of
-    # course, we fill a structure with information about the user.
+    # At this point, the user has been authenticated.
 
+    # If this site is group-restricted, verify it
+    if site.require_groups.exists() and not site.require_groups.filter(id__in=request.user.groups.all()).exists():
+        return render_pgweb(request, 'account', 'account/communityauth_nogroup.html', {
+            'site': site,
+        })
+
+    # Make sure we have some data to fill in before we redirect, so downstream consumers
+    # don't need to verify that.
     if request.user.first_name == '' or request.user.last_name == '' or request.user.email == '':
         return render_pgweb(request, 'account', 'account/communityauth_noinfo.html', {
         })

templates/account/communityauth_nogroup.html

@@ -0,0 +1,7 @@
+{%extends "base/page.html"%}
+{%block contents%}
+<h1>Access denied</h1>
+<p>
+  You do not have access to {{ site.name }}.
+</p>
+{%endblock%}