What is the best practice to setup a white list for signup?

[stimw]

I hope to allow only a small team to sign in only use email without OAuth, but I'm not sure what the best practice is.

This question might sound a bit silly, but the task timeline is too tight, so I have no choice but to seek help from the community.

[deadcoder0904]

In my app, I have an IS_ADMIN environment variable that has many comma-separated emails like:

IS_ADMIN=boss@pm.me,hr@pm.me

Then I only show a specific route to those with emails from IS_ADMIN.

Its really simple.

I did grep -rni IS_ADMIN src/ & I got this:

src/app/db/schema.ts:30:        isAdmin: integer("is_admin").default(0),
src/app/admin/upload-pdf/route.ts:7:import { checkIfAdmin } from "@/app/db/users"
src/app/admin/upload-pdf/route.ts:20:           const isAdmin = await checkIfAdmin(user.id)
src/app/admin/upload-pdf/route.ts:22:           if (!isAdmin) {
src/app/lib/isAdmin.ts:5:export const isAdmin = (email: string): number => Number(ADMIN.includes(email))