From d6f2e21e908d182e238f1ed51da7e38d9ec8d531 Mon Sep 17 00:00:00 2001
From: Nikolai Emil Damm <ned@devantler.tech>
Date: Sat, 18 Jul 2026 22:27:48 +0200
Subject: [PATCH] fix(dex): restrict github connector to maintainers

---
 k8s/bases/infrastructure/controllers/dex/helm-release.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/k8s/bases/infrastructure/controllers/dex/helm-release.yaml b/k8s/bases/infrastructure/controllers/dex/helm-release.yaml
index 849ec7f85..e3f2322b7 100644
--- a/k8s/bases/infrastructure/controllers/dex/helm-release.yaml
+++ b/k8s/bases/infrastructure/controllers/dex/helm-release.yaml
@@ -156,3 +156,9 @@ spec:
             useLoginAsID: false
             orgs:
               - name: devantler-tech
+                # Actual Budget authenticates directly against Dex, without
+                # oauth2-proxy's allowed_groups layer. Restrict the shared
+                # GitHub connector to the same maintainer team so native OIDC
+                # apps cannot be accessed by every organization member.
+                teams:
+                  - maintainers