Client configuration option to not search on any Attester domains except a whitelist

[tomholub]

See https://flowcrypt.com/docs/business/org-rules.html

One of our customer has the following rule set up: disallow_attester_search_for_domains: ["*"] meaning don't use Attester to search public keys for any recipient domain. They would like to be able to add an exception to this for some domains, to be able to say "don't search anywhere except do use attester to search for public keys of users on domain example1.com and example2.com" which we don't currently support.

There are a few ways to approach this:

option 1 - add a way to define negative items

eg disallow_attester_search_for_domains: ["*", "!example1.com", "!example2.com"]

or disallow_attester_search_for_domains: ["*", "^example1.com", "^example2.com"]

or disallow_attester_search_for_domains: ["*", "-example1.com", "-example2.com"]

advantage - I find it clearer what is going on, all related config in one place

disadvantage - ^, ! or - are quire arbitrary choices. A minor form of string parsing involved

could be more explicit like

or disallow_attester_search_for_domains: ["*", "allow:example1.com", "allow:example2.com"]

option 2 - add another configuration

disallow_attester_search_for_domains: ["*"], 
always_allow_attester_search_for_domains: ["example1.com", "example2.com"]

where always_allow_attester_search_for_domains overrides the wildcard in disallow_attester_search_for_domains

advantage - more explicit, no string parsing

disadvantage - one more client configuration which is not meaningful on its own, and is only meaningful when * is used in disallow_attester_search_for_domains - seems too narrow scope to have another client configuration

[tomholub]

what do you think about these choices? @sosnovsky @ioanmo226 @DenBond7

(something like this will be done across client apps)

[DenBond7]

@tomholub using regex on the customer side sounds difficult? Do customers have a special person for managing that or do it themselves?

[sosnovsky]

What about adding allow_attester_search_only_for_domains option?

If it's set then app will ignore disallow_attester_search_for_domains option and search only in listed domains.

So we don't need to set disallow_attester_search_for_domains: ["*"], which fixes disadvantage of option 2 - add another configuration

[tomholub]

Regex would probably be the most flexible but also complicated.

Let's go with what Roman suggests.

What about adding allow_attester_search_only_for_domains option?

If it's set then app will ignore disallow_attester_search_for_domains option and search only in listed domains.

Plus add an appropriate test.

[tomholub]

@ioanmo226 do you think you could also implement it on the browser extension? I've filed an isssue FlowCrypt/flowcrypt-browser#4476 / https://github.com/FlowCrypt/flowcrypt-browser/invitations