add resource whitelist auth method

2026-02-10 20:02:26 +00:00 · 2024-12-16 22:40:42 -05:00
parent 998fab6d0a
commit 207a7b8a39
20 changed files with 970 additions and 739 deletions
--- a/server/auth/actions.ts
+++ b/server/auth/actions.ts
@@ -49,9 +49,7 @@ export enum ActionsEnum {
    // addUserAction = "addUserAction",
    // removeUserAction = "removeUserAction",
    // removeUserSite = "removeUserSite",
-    getOrgUser = "getOrgUser",
-    setResourceAuthMethods = "setResourceAuthMethods",
-    getResourceAuthMethods = "getResourceAuthMethods",
+    getOrgUser = "getOrgUser"
 }

 export async function checkUserActionPermission(
--- a/server/auth/resource.ts
+++ b/server/auth/resource.ts
@@ -16,10 +16,10 @@ export async function createResourceSession(opts: {
    resourceId: number;
    passwordId?: number;
    pincodeId?: number;
-    whitelistId: number;
+    whitelistId?: number;
    usedOtp?: boolean;
 }): Promise<ResourceSession> {
-    if (!opts.passwordId && !opts.pincodeId) {
+    if (!opts.passwordId && !opts.pincodeId && !opts.whitelistId) {
        throw new Error(
            "At least one of passwordId or pincodeId must be provided"
        );
@@ -35,8 +35,7 @@ export async function createResourceSession(opts: {
        resourceId: opts.resourceId,
        passwordId: opts.passwordId || null,
        pincodeId: opts.pincodeId || null,
-        whitelistId: opts.whitelistId,
-        usedOtp: opts.usedOtp || false
+        whitelistId: opts.whitelistId || null
    };

    await db.insert(resourceSessions).values(session);
@@ -129,7 +128,6 @@ export async function invalidateAllSessions(
                    eq(resourceSessions.whitelistId, method.whitelistId)
                )
            );
-
    }
    if (!method?.passwordId && !method?.pincodeId && !method?.whitelistId) {
        await db
--- a/server/db/schema.ts
+++ b/server/db/schema.ts
@@ -46,7 +46,7 @@ export const resources = sqliteTable("resources", {
        .notNull()
        .default(false),
    sso: integer("sso", { mode: "boolean" }).notNull().default(true),
-    otpEnabled: integer("otpEnabled", { mode: "boolean" })
+    emailWhitelistEnabled: integer("emailWhitelistEnabled", { mode: "boolean" })
        .notNull()
        .default(false)
 });
@@ -282,7 +282,6 @@ export const resourceSessions = sqliteTable("resourceSessions", {
    resourceId: integer("resourceId")
        .notNull()
        .references(() => resources.resourceId, { onDelete: "cascade" }),
-    usedOtp: integer("usedOtp", { mode: "boolean" }).notNull().default(false),
    expiresAt: integer("expiresAt").notNull(),
    passwordId: integer("passwordId").references(
        () => resourcePassword.passwordId,
@@ -297,23 +296,20 @@ export const resourceSessions = sqliteTable("resourceSessions", {
        }
    ),
    whitelistId: integer("whitelistId").references(
-        () => resourceWhitelistedEmail.whitelistId,
+        () => resourceWhitelist.whitelistId,
        {
            onDelete: "cascade"
        }
    )
 });

-export const resourceWhitelistedEmail = sqliteTable(
-    "resourceWhitelistedEmail",
-    {
-        whitelistId: integer("id").primaryKey({ autoIncrement: true }),
-        email: text("email").primaryKey(),
-        resourceId: integer("resourceId")
-            .notNull()
-            .references(() => resources.resourceId, { onDelete: "cascade" })
-    }
-);
+export const resourceWhitelist = sqliteTable("resourceWhitelist", {
+    whitelistId: integer("id").primaryKey({ autoIncrement: true }),
+    email: text("email").notNull(),
+    resourceId: integer("resourceId")
+        .notNull()
+        .references(() => resources.resourceId, { onDelete: "cascade" })
+});

 export const resourceOtp = sqliteTable("resourceOtp", {
    otpId: integer("otpId").primaryKey({
--- a/server/routers/external.ts
+++ b/server/routers/external.ts
@@ -18,7 +18,7 @@ import {
    verifyRoleAccess,
    verifySetResourceUsers,
    verifyUserAccess,
-    getUserOrgs,
+    getUserOrgs
 } from "@server/middlewares";
 import { verifyUserHasAction } from "../middlewares/verifyUserHasAction";
 import { ActionsEnum } from "@server/auth/actions";
@@ -43,51 +43,51 @@ authenticated.get(
    "/org/:orgId",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.getOrg),
-    org.getOrg,
+    org.getOrg
 );
 authenticated.post(
    "/org/:orgId",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.updateOrg),
-    org.updateOrg,
+    org.updateOrg
 );
 authenticated.delete(
    "/org/:orgId",
    verifyOrgAccess,
    verifyUserIsOrgOwner,
-    org.deleteOrg,
+    org.deleteOrg
 );

 authenticated.put(
    "/org/:orgId/site",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.createSite),
-    site.createSite,
+    site.createSite
 );
 authenticated.get(
    "/org/:orgId/sites",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.listSites),
-    site.listSites,
+    site.listSites
 );
 authenticated.get(
    "/org/:orgId/site/:niceId",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.getSite),
-    site.getSite,
+    site.getSite
 );

 authenticated.get(
    "/org/:orgId/pick-site-defaults",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.createSite),
-    site.pickSiteDefaults,
+    site.pickSiteDefaults
 );
 authenticated.get(
    "/site/:siteId",
    verifySiteAccess,
    verifyUserHasAction(ActionsEnum.getSite),
-    site.getSite,
+    site.getSite
 );
 // authenticated.get(
 //     "/site/:siteId/roles",
@@ -99,38 +99,38 @@ authenticated.post(
    "/site/:siteId",
    verifySiteAccess,
    verifyUserHasAction(ActionsEnum.updateSite),
-    site.updateSite,
+    site.updateSite
 );
 authenticated.delete(
    "/site/:siteId",
    verifySiteAccess,
    verifyUserHasAction(ActionsEnum.deleteSite),
-    site.deleteSite,
+    site.deleteSite
 );

 authenticated.put(
    "/org/:orgId/site/:siteId/resource",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.createResource),
-    resource.createResource,
+    resource.createResource
 );
 authenticated.get(
    "/site/:siteId/resources",
    verifyUserHasAction(ActionsEnum.listResources),
-    resource.listResources,
+    resource.listResources
 );
 authenticated.get(
    "/org/:orgId/resources",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.listResources),
-    resource.listResources,
+    resource.listResources
 );

 authenticated.post(
    "/org/:orgId/create-invite",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.inviteUser),
-    user.inviteUser,
+    user.inviteUser
 ); // maybe make this /invite/create instead
 authenticated.post("/invite/accept", user.acceptInvite);

@@ -138,77 +138,77 @@ authenticated.get(
    "/resource/:resourceId/roles",
    verifyResourceAccess,
    verifyUserHasAction(ActionsEnum.listResourceRoles),
-    resource.listResourceRoles,
+    resource.listResourceRoles
 );

 authenticated.get(
    "/resource/:resourceId/users",
    verifyResourceAccess,
    verifyUserHasAction(ActionsEnum.listResourceUsers),
-    resource.listResourceUsers,
+    resource.listResourceUsers
 );

 authenticated.get(
    "/resource/:resourceId",
    verifyResourceAccess,
    verifyUserHasAction(ActionsEnum.getResource),
-    resource.getResource,
+    resource.getResource
 );
 authenticated.post(
    "/resource/:resourceId",
    verifyResourceAccess,
    verifyUserHasAction(ActionsEnum.updateResource),
-    resource.updateResource,
+    resource.updateResource
 );
 authenticated.delete(
    "/resource/:resourceId",
    verifyResourceAccess,
    verifyUserHasAction(ActionsEnum.deleteResource),
-    resource.deleteResource,
+    resource.deleteResource
 );

 authenticated.put(
    "/resource/:resourceId/target",
    verifyResourceAccess,
    verifyUserHasAction(ActionsEnum.createTarget),
-    target.createTarget,
+    target.createTarget
 );
 authenticated.get(
    "/resource/:resourceId/targets",
    verifyResourceAccess,
    verifyUserHasAction(ActionsEnum.listTargets),
-    target.listTargets,
+    target.listTargets
 );
 authenticated.get(
    "/target/:targetId",
    verifyTargetAccess,
    verifyUserHasAction(ActionsEnum.getTarget),
-    target.getTarget,
+    target.getTarget
 );
 authenticated.post(
    "/target/:targetId",
    verifyTargetAccess,
    verifyUserHasAction(ActionsEnum.updateTarget),
-    target.updateTarget,
+    target.updateTarget
 );
 authenticated.delete(
    "/target/:targetId",
    verifyTargetAccess,
    verifyUserHasAction(ActionsEnum.deleteTarget),
-    target.deleteTarget,
+    target.deleteTarget
 );

 authenticated.put(
    "/org/:orgId/role",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.createRole),
-    role.createRole,
+    role.createRole
 );
 authenticated.get(
    "/org/:orgId/roles",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.listRoles),
-    role.listRoles,
+    role.listRoles
 );
 // authenticated.get(
 //     "/role/:roleId",
@@ -227,14 +227,14 @@ authenticated.delete(
    "/role/:roleId",
    verifyRoleAccess,
    verifyUserHasAction(ActionsEnum.deleteRole),
-    role.deleteRole,
+    role.deleteRole
 );
 authenticated.post(
    "/role/:roleId/add/:userId",
    verifyRoleAccess,
    verifyUserAccess,
    verifyUserHasAction(ActionsEnum.addUserRole),
-    user.addUserRole,
+    user.addUserRole
 );

 // authenticated.put(
@@ -264,7 +264,7 @@ authenticated.post(
    verifyResourceAccess,
    verifyRoleAccess,
    verifyUserHasAction(ActionsEnum.setResourceRoles),
-    resource.setResourceRoles,
+    resource.setResourceRoles
 );

 authenticated.post(
@@ -272,21 +272,35 @@ authenticated.post(
    verifyResourceAccess,
    verifySetResourceUsers,
    verifyUserHasAction(ActionsEnum.setResourceUsers),
-    resource.setResourceUsers,
+    resource.setResourceUsers
 );

 authenticated.post(
    `/resource/:resourceId/password`,
    verifyResourceAccess,
-    verifyUserHasAction(ActionsEnum.setResourceAuthMethods),
-    resource.setResourcePassword,
+    verifyUserHasAction(ActionsEnum.updateResource), // REVIEW: group all resource related updates under update resource?
+    resource.setResourcePassword
 );

 authenticated.post(
    `/resource/:resourceId/pincode`,
    verifyResourceAccess,
-    verifyUserHasAction(ActionsEnum.setResourceAuthMethods),
-    resource.setResourcePincode,
+    verifyUserHasAction(ActionsEnum.updateResource),
+    resource.setResourcePincode
+);
+
+authenticated.post(
+    `/resource/:resourceId/whitelist`,
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.updateResource),
+    resource.setResourceWhitelist
+);
+
+authenticated.get(
+    `/resource/:resourceId/whitelist`,
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.getResource),
+    resource.getResourceWhitelist
 );

 unauthenticated.get("/resource/:resourceId/auth", resource.getResourceAuthInfo);
@@ -327,14 +341,14 @@ authenticated.get(
    "/org/:orgId/users",
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.listUsers),
-    user.listUsers,
+    user.listUsers
 );
 authenticated.delete(
    "/org/:orgId/user/:userId",
    verifyOrgAccess,
    verifyUserAccess,
    verifyUserHasAction(ActionsEnum.removeUser),
-    user.removeUserOrg,
+    user.removeUserOrg
 );

 // authenticated.put(
@@ -375,8 +389,8 @@ authRouter.use(
    rateLimitMiddleware({
        windowMin: 10,
        max: 75,
-        type: "IP_AND_PATH",
-    }),
+        type: "IP_AND_PATH"
+    })
 );

 authRouter.put("/signup", auth.signup);
@@ -388,22 +402,23 @@ authRouter.post("/2fa/enable", verifySessionUserMiddleware, auth.verifyTotp);
 authRouter.post(
    "/2fa/request",
    verifySessionUserMiddleware,
-    auth.requestTotpSecret,
+    auth.requestTotpSecret
 );
 authRouter.post("/2fa/disable", verifySessionUserMiddleware, auth.disable2fa);
 authRouter.post("/verify-email", verifySessionMiddleware, auth.verifyEmail);
 authRouter.post(
    "/verify-email/request",
    verifySessionMiddleware,
-    auth.requestEmailVerificationCode,
+    auth.requestEmailVerificationCode
 );
 authRouter.post(
    "/change-password",
    verifySessionUserMiddleware,
-    auth.changePassword,
+    auth.changePassword
 );
 authRouter.post("/reset-password/request", auth.requestPasswordReset);
 authRouter.post("/reset-password/", auth.resetPassword);

 authRouter.post("/resource/:resourceId/password", resource.authWithPassword);
 authRouter.post("/resource/:resourceId/pincode", resource.authWithPincode);
+authRouter.post("/resource/:resourceId/whitelist", resource.authWithWhitelist);
--- a/server/routers/resource/authWithPassword.ts
+++ b/server/routers/resource/authWithPassword.ts
@@ -1,10 +1,10 @@
 import { verify } from "@node-rs/argon2";
 import { generateSessionToken } from "@server/auth";
 import db from "@server/db";
-import { orgs, resourceOtp, resourcePassword, resources } from "@server/db/schema";
+import { orgs, resourcePassword, resources } from "@server/db/schema";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/utils/response";
-import { and, eq } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -13,14 +13,10 @@ import {
    createResourceSession,
    serializeResourceSessionCookie
 } from "@server/auth/resource";
-import logger from "@server/logger";
 import config from "@server/config";
-import { isValidOtp, sendResourceOtpEmail } from "@server/auth/resourceOtp";

 export const authWithPasswordBodySchema = z.object({
-    password: z.string(),
-    email: z.string().email().optional(),
-    otp: z.string().optional()
+    password: z.string()
 });

 export const authWithPasswordParamsSchema = z.object({
@@ -28,8 +24,6 @@ export const authWithPasswordParamsSchema = z.object({
 });

 export type AuthWithPasswordResponse = {
-    otpRequested?: boolean;
-    otpSent?: boolean;
    session?: string;
 };

@@ -61,7 +55,7 @@ export async function authWithPassword(
    }

    const { resourceId } = parsedParams.data;
-    const { email, password, otp } = parsedBody.data;
+    const { password } = parsedBody.data;

    try {
        const [result] = await db
@@ -119,69 +113,11 @@ export async function authWithPassword(
            );
        }

-        if (resource.otpEnabled) {
-            if (otp && email) {
-                const isValidCode = await isValidOtp(
-                    email,
-                    resource.resourceId,
-                    otp
-                );
-                if (!isValidCode) {
-                    return next(
-                        createHttpError(HttpCode.UNAUTHORIZED, "Incorrect OTP")
-                    );
-                }
-
-                await db
-                    .delete(resourceOtp)
-                    .where(
-                        and(
-                            eq(resourceOtp.email, email),
-                            eq(resourceOtp.resourceId, resource.resourceId)
-                        )
-                    );
-            } else if (email) {
-                try {
-                    await sendResourceOtpEmail(
-                        email,
-                        resource.resourceId,
-                        resource.name,
-                        org.name
-                    );
-                    return response<AuthWithPasswordResponse>(res, {
-                        data: { otpSent: true },
-                        success: true,
-                        error: false,
-                        message: "Sent one-time otp to email address",
-                        status: HttpCode.ACCEPTED
-                    });
-                } catch (e) {
-                    logger.error(e);
-                    return next(
-                        createHttpError(
-                            HttpCode.INTERNAL_SERVER_ERROR,
-                            "Failed to send one-time otp. Make sure the email address is correct and try again."
-                        )
-                    );
-                }
-            } else {
-                return response<AuthWithPasswordResponse>(res, {
-                    data: { otpRequested: true },
-                    success: true,
-                    error: false,
-                    message: "One-time otp required to complete authentication",
-                    status: HttpCode.ACCEPTED
-                });
-            }
-        }
-
        const token = generateSessionToken();
        await createResourceSession({
            resourceId,
            token,
-            passwordId: definedPassword.passwordId,
-            usedOtp: otp !== undefined,
-            email
+            passwordId: definedPassword.passwordId
        });
        const cookieName = `${config.server.resource_session_cookie_name}_${resource.resourceId}`;
        const cookie = serializeResourceSessionCookie(
--- a/server/routers/resource/authWithPincode.ts
+++ b/server/routers/resource/authWithPincode.ts
@@ -5,7 +5,8 @@ import {
    orgs,
    resourceOtp,
    resourcePincode,
-    resources
+    resources,
+    resourceWhitelist
 } from "@server/db/schema";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/utils/response";
@@ -24,9 +25,7 @@ import { AuthWithPasswordResponse } from "./authWithPassword";
 import { isValidOtp, sendResourceOtpEmail } from "@server/auth/resourceOtp";

 export const authWithPincodeBodySchema = z.object({
-    pincode: z.string(),
-    email: z.string().email().optional(),
-    otp: z.string().optional()
+    pincode: z.string()
 });

 export const authWithPincodeParamsSchema = z.object({
@@ -34,8 +33,6 @@ export const authWithPincodeParamsSchema = z.object({
 });

 export type AuthWithPincodeResponse = {
-    otpRequested?: boolean;
-    otpSent?: boolean;
    session?: string;
 };

@@ -67,7 +64,7 @@ export async function authWithPincode(
    }

    const { resourceId } = parsedParams.data;
-    const { email, pincode, otp } = parsedBody.data;
+    const { pincode } = parsedBody.data;

    try {
        const [result] = await db
@@ -124,69 +121,11 @@ export async function authWithPincode(
            );
        }

-        if (resource.otpEnabled) {
-            if (otp && email) {
-                const isValidCode = await isValidOtp(
-                    email,
-                    resource.resourceId,
-                    otp
-                );
-                if (!isValidCode) {
-                    return next(
-                        createHttpError(HttpCode.UNAUTHORIZED, "Incorrect OTP")
-                    );
-                }
-
-                await db
-                    .delete(resourceOtp)
-                    .where(
-                        and(
-                            eq(resourceOtp.email, email),
-                            eq(resourceOtp.resourceId, resource.resourceId)
-                        )
-                    );
-            } else if (email) {
-                try {
-                    await sendResourceOtpEmail(
-                        email,
-                        resource.resourceId,
-                        resource.name,
-                        org.name
-                    );
-                    return response<AuthWithPasswordResponse>(res, {
-                        data: { otpSent: true },
-                        success: true,
-                        error: false,
-                        message: "Sent one-time otp to email address",
-                        status: HttpCode.ACCEPTED
-                    });
-                } catch (e) {
-                    logger.error(e);
-                    return next(
-                        createHttpError(
-                            HttpCode.INTERNAL_SERVER_ERROR,
-                            "Failed to send one-time otp. Make sure the email address is correct and try again."
-                        )
-                    );
-                }
-            } else {
-                return response<AuthWithPasswordResponse>(res, {
-                    data: { otpRequested: true },
-                    success: true,
-                    error: false,
-                    message: "One-time otp required to complete authentication",
-                    status: HttpCode.ACCEPTED
-                });
-            }
-        }
-
        const token = generateSessionToken();
        await createResourceSession({
            resourceId,
            token,
-            pincodeId: definedPincode.pincodeId,
-            usedOtp: otp !== undefined,
-            email
+            pincodeId: definedPincode.pincodeId
        });
        const cookieName = `${config.server.resource_session_cookie_name}_${resource.resourceId}`;
        const cookie = serializeResourceSessionCookie(
--- a/server/routers/resource/authWithWhitelist.ts
+++ b/server/routers/resource/authWithWhitelist.ts
@@ -0,0 +1,200 @@
+import { generateSessionToken } from "@server/auth";
+import db from "@server/db";
+import {
+    orgs,
+    resourceOtp,
+    resourcePassword,
+    resources,
+    resourceWhitelist
+} from "@server/db/schema";
+import HttpCode from "@server/types/HttpCode";
+import response from "@server/utils/response";
+import { eq, and } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import {
+    createResourceSession,
+    serializeResourceSessionCookie
+} from "@server/auth/resource";
+import config from "@server/config";
+import { isValidOtp, sendResourceOtpEmail } from "@server/auth/resourceOtp";
+import logger from "@server/logger";
+
+const authWithWhitelistBodySchema = z.object({
+    email: z.string().email(),
+    otp: z.string().optional()
+});
+
+const authWithWhitelistParamsSchema = z.object({
+    resourceId: z.string().transform(Number).pipe(z.number().int().positive())
+});
+
+export type AuthWithWhitelistResponse = {
+    otpSent?: boolean;
+    session?: string;
+};
+
+export async function authWithWhitelist(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    const parsedBody = authWithWhitelistBodySchema.safeParse(req.body);
+
+    if (!parsedBody.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedBody.error).toString()
+            )
+        );
+    }
+
+    const parsedParams = authWithWhitelistParamsSchema.safeParse(req.params);
+
+    if (!parsedParams.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedParams.error).toString()
+            )
+        );
+    }
+
+    const { resourceId } = parsedParams.data;
+    const { email, otp } = parsedBody.data;
+
+    try {
+        const [result] = await db
+            .select()
+            .from(resourceWhitelist)
+            .where(
+                and(
+                    eq(resourceWhitelist.resourceId, resourceId),
+                    eq(resourceWhitelist.email, email)
+                )
+            )
+            .leftJoin(
+                resources,
+                eq(resources.resourceId, resourceWhitelist.resourceId)
+            )
+            .leftJoin(orgs, eq(orgs.orgId, resources.orgId))
+            .limit(1);
+
+        const resource = result?.resources;
+        const org = result?.orgs;
+        const whitelistedEmail = result?.resourceWhitelist;
+
+        if (!whitelistedEmail) {
+            return next(
+                createHttpError(
+                    HttpCode.UNAUTHORIZED,
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Email is not whitelisted"
+                    )
+                )
+            );
+        }
+
+        if (!org) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Resource does not exist")
+            );
+        }
+
+        if (!resource) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Resource does not exist")
+            );
+        }
+
+        if (otp && email) {
+            const isValidCode = await isValidOtp(
+                email,
+                resource.resourceId,
+                otp
+            );
+            if (!isValidCode) {
+                return next(
+                    createHttpError(HttpCode.UNAUTHORIZED, "Incorrect OTP")
+                );
+            }
+
+            await db
+                .delete(resourceOtp)
+                .where(
+                    and(
+                        eq(resourceOtp.email, email),
+                        eq(resourceOtp.resourceId, resource.resourceId)
+                    )
+                );
+        } else if (email) {
+            try {
+                await sendResourceOtpEmail(
+                    email,
+                    resource.resourceId,
+                    resource.name,
+                    org.name
+                );
+                return response<AuthWithWhitelistResponse>(res, {
+                    data: { otpSent: true },
+                    success: true,
+                    error: false,
+                    message: "Sent one-time otp to email address",
+                    status: HttpCode.ACCEPTED
+                });
+            } catch (e) {
+                logger.error(e);
+                return next(
+                    createHttpError(
+                        HttpCode.INTERNAL_SERVER_ERROR,
+                        "Failed to send one-time otp. Make sure the email address is correct and try again."
+                    )
+                );
+            }
+        } else {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Email is required for whitelist authentication"
+                )
+            );
+        }
+
+        const token = generateSessionToken();
+        await createResourceSession({
+            resourceId,
+            token,
+            whitelistId: whitelistedEmail.whitelistId
+        });
+        const cookieName = `${config.server.resource_session_cookie_name}_${resource.resourceId}`;
+        const cookie = serializeResourceSessionCookie(
+            cookieName,
+            token,
+            resource.fullDomain
+        );
+        res.appendHeader("Set-Cookie", cookie);
+
+        return response<AuthWithWhitelistResponse>(res, {
+            data: {
+                session: token
+            },
+            success: true,
+            error: false,
+            message: "Authenticated with resource successfully",
+            status: HttpCode.OK
+        });
+    } catch (e) {
+        throw e;
+        logger.error(e);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to authenticate with resource"
+            )
+        );
+    }
+}
--- a/server/routers/resource/getResourceAuthInfo.ts
+++ b/server/routers/resource/getResourceAuthInfo.ts
@@ -24,6 +24,7 @@ export type GetResourceAuthInfoResponse = {
    sso: boolean;
    blockAccess: boolean;
    url: string;
+    whitelist: boolean;
 };

 export async function getResourceAuthInfo(
@@ -79,6 +80,7 @@ export async function getResourceAuthInfo(
                sso: resource.sso,
                blockAccess: resource.blockAccess,
                url,
+                whitelist: resource.emailWhitelistEnabled
            },
            success: true,
            error: false,
--- a/server/routers/resource/getResourceWhitelist.ts
+++ b/server/routers/resource/getResourceWhitelist.ts
@@ -0,0 +1,64 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { resourceWhitelist, users } from "@server/db/schema"; // Assuming these are the correct tables
+import { eq } from "drizzle-orm";
+import response from "@server/utils/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+
+const getResourceWhitelistSchema = z.object({
+    resourceId: z.string().transform(Number).pipe(z.number().int().positive())
+});
+
+async function queryWhitelist(resourceId: number) {
+    return await db
+        .select({
+            email: resourceWhitelist.email
+        })
+        .from(resourceWhitelist)
+        .where(eq(resourceWhitelist.resourceId, resourceId));
+}
+
+export type GetResourceWhitelistResponse = {
+    whitelist: NonNullable<Awaited<ReturnType<typeof queryWhitelist>>>;
+};
+
+export async function getResourceWhitelist(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = getResourceWhitelistSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+
+        const whitelist = await queryWhitelist(resourceId);
+
+        return response<GetResourceWhitelistResponse>(res, {
+            data: {
+                whitelist
+            },
+            success: true,
+            error: false,
+            message: "Resource whitelist retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
--- a/server/routers/resource/index.ts
+++ b/server/routers/resource/index.ts
@@ -12,3 +12,6 @@ export * from "./authWithPassword";
 export * from "./getResourceAuthInfo";
 export * from "./setResourcePincode";
 export * from "./authWithPincode";
+export * from "./setResourceWhitelist";
+export * from "./getResourceWhitelist";
+export * from "./authWithWhitelist";
--- a/server/routers/resource/listResources.ts
+++ b/server/routers/resource/listResources.ts
@@ -62,6 +62,7 @@ function queryResources(
                passwordId: resourcePassword.passwordId,
                pincodeId: resourcePincode.pincodeId,
                sso: resources.sso,
+                whitelist: resources.emailWhitelistEnabled
            })
            .from(resources)
            .leftJoin(sites, eq(resources.siteId, sites.siteId))
@@ -91,6 +92,7 @@ function queryResources(
                passwordId: resourcePassword.passwordId,
                sso: resources.sso,
                pincodeId: resourcePincode.pincodeId,
+                whitelist: resources.emailWhitelistEnabled
            })
            .from(resources)
            .leftJoin(sites, eq(resources.siteId, sites.siteId))
--- a/server/routers/resource/setResourceWhitelist.ts
+++ b/server/routers/resource/setResourceWhitelist.ts
@@ -0,0 +1,120 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { resources, resourceWhitelist } from "@server/db/schema";
+import response from "@server/utils/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { and, eq } from "drizzle-orm";
+
+const setResourceWhitelistBodySchema = z.object({
+    emails: z.array(z.string().email()).max(50)
+});
+
+const setResourceWhitelistParamsSchema = z.object({
+    resourceId: z.string().transform(Number).pipe(z.number().int().positive())
+});
+
+export async function setResourceWhitelist(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = setResourceWhitelistBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { emails } = parsedBody.data;
+
+        const parsedParams = setResourceWhitelistParamsSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId));
+
+        if (!resource) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Resource not found")
+            );
+        }
+
+        if (!resource.emailWhitelistEnabled) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Email whitelist is not enabled for this resource"
+                )
+            );
+        }
+
+        const whitelist = await db
+            .select()
+            .from(resourceWhitelist)
+            .where(eq(resourceWhitelist.resourceId, resourceId));
+
+        await db.transaction(async (trx) => {
+            // diff the emails
+            const existingEmails = whitelist.map((w) => w.email);
+
+            const emailsToAdd = emails.filter(
+                (e) => !existingEmails.includes(e)
+            );
+            const emailsToRemove = existingEmails.filter(
+                (e) => !emails.includes(e)
+            );
+
+            for (const email of emailsToAdd) {
+                await trx.insert(resourceWhitelist).values({
+                    email,
+                    resourceId
+                });
+            }
+
+            for (const email of emailsToRemove) {
+                await trx
+                    .delete(resourceWhitelist)
+                    .where(
+                        and(
+                            eq(resourceWhitelist.resourceId, resourceId),
+                            eq(resourceWhitelist.email, email)
+                        )
+                    );
+            }
+
+            return response(res, {
+                data: {},
+                success: true,
+                error: false,
+                message: "Whitelist set for resource successfully",
+                status: HttpCode.CREATED
+            });
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
--- a/server/routers/resource/updateResource.ts
+++ b/server/routers/resource/updateResource.ts
@@ -21,6 +21,7 @@ const updateResourceBodySchema = z
        ssl: z.boolean().optional(),
        sso: z.boolean().optional(),
        blockAccess: z.boolean().optional(),
+        emailWhitelistEnabled: z.boolean().optional(),
        // siteId: z.number(),
    })
    .strict()