feat: email recipient whitelist

config/services.yaml

@@ -48,6 +48,12 @@ parameters:
     default_email_from: '%env(APP_DEFAULT_EMAIL_FROM)%'
     default_email_to: '%env(APP_DEFAULT_EMAIL_TO)%'
 
+    # Per deployment and not per environment: staging and production run the same compiled
+    # environment and differ only in their .env.local. The csv processor turns an unset
+    # variable into an empty list, which switches the filtering off - so production is
+    # unaffected without anything having to be remembered at deploy time.
+    mail_recipient_whitelist: '%env(csv:APP_MAIL_RECIPIENT_WHITELIST)%'
+
     teamer_inactive_period: '-2 years'
 
     # The stand-in PDF served instead of real uploads while the upload_replacement feature is
@@ -362,6 +368,13 @@ services:
             $logger: '@monolog.logger.api'
         tags: [ 'controller.service_arguments' ]
 
+    App\EventListener\EmailRecipientWhitelistSubscriber:
+        arguments:
+            $allowedRecipients: '%mail_recipient_whitelist%'
+            # Not the audit channel this argument is bound to by default: a mail dropped by a
+            # staging guard is a technical event and has no place in the application log table.
+            $logger: '@logger'
+
     App\Security\OAuth2\MyEpClient:
         arguments:
             $options: