feat: google workspace limit access to a single group

[owengo]

Pull Request Template

⚠️ Documentation Updates Notice:

• Kindly note that documentation updates are managed in this repository: librechat.ai
  feat: GOOGLE_WORKSPACE_GROUP allows to restrict access to a google group  LibreChat-AI/librechat.ai#159

Summary

#1746
When google login is configured for a workspace account the feature permits to restricts logins to members of a group.

Change Type

Please delete any irrelevant options.

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

Testing

• If the GOOGLE_WORKSPACE_GROUP is not defined in the .env,or if it's empty, nothing changes: all members of the workspace account can login and no extra scopes are required in the oauth2 consent screen.
• When GOOGLE_WORKSPACE_GROUP is set:
  • all oauth2 consent screen require the extra 'https://www.googleapis.com/auth/cloud-identity.groups.readonly' scope permission aka: "See any Cloud Identity Groups that you can access, including group members and their emails"
  • at login, if the user:
    • is allowed to list the members of the configured group
    • is member of the configured group
      • access is granted normally
    • else
      • access is refused and user is redirected to the login page at the end of oauth process

Test Configuration:

The feature works with google workspaces accounts. A group must be created in the workspace account and member of the group must be allowed to see the members of the group.
The email address of the group has to be configured in the .env as GOOGLE_WORKSPACE_GROUP=
Note that the group can contain other groups and all member of the included groups will also be allowed.

Checklist

Please delete any irrelevant options.

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• I have made pertinent documentation changes
• My changes do not introduce new warnings
• A pull request for updating the documentation has been submitted.