fix(auth): provision invitees server-side when signups are disabled (#1404)
* fix(auth): provision invitees server-side when signups are disabled Self-hosted installations with GoTrue disable_signup broke the invite flow silently: invitees without an account were routed to /register, where supabase.auth.signUp fails with "Signups not allowed for this instance", surfaced only as a generic toast. New server-only env flag AUTH_SIGNUPS_DISABLED (documented in .env.example) mirrors the GoTrue setting. When true, POST /api/company/members/invite checks check_email_exists and, for invitees without an account, provisions one via auth.admin.inviteUserByEmail with a redirect back to /invite/<token>, before the Resend email and before the invitation row is written so a provisioning failure leaves nothing half-created and the admin can retry. The response now carries user_provisioned alongside email_sent, and a provisioning failure returns 502 with a Swedish message mapped through getErrorMessage instead of a silently-successful invite. /auth/callback now routes type=invite verifications to /reset-password (the existing set-password surface) instead of dropping the passwordless user on the dashboard, and preserves the invite token from next=/invite/<token> as the pre-auth invite cookie so the existing reset-password invite handoff accepts the membership right after the password is saved. getErrorMessage learns two GoTrue patterns: "Signups not allowed" (account creation closed on this installation, contact your inviter or administrator) so the /register dead end is explained even for flows that bypass provisioning, and "Error sending ... email" (GoTrue SMTP not configured) so the 502 above is actionable. Hosted is untouched: the flag is unset there and every new code path is gated on it. Fixes #1335 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(auth): restore check_email_exists RPC and harden self-host invite config Adversarial review of #1404 found that the check_email_exists function the invite flow depends on does not exist anywhere: it shipped in PR #229 and was lost in the #244 migration consolidation before ever reaching prod (verified missing on the hosted production database directly). Today app/api/team/accept destructures only { data } from the RPC call, so alreadyHasAccount is silently null on every deployment and the invite page routes even existing-account invitees toward /register. - New migration 20260804140000 restores the function exactly as originally shipped: SECURITY DEFINER over auth.users, EXECUTE revoked from PUBLIC, anon and authenticated, granted to service_role only (prevents email enumeration). Fixes hosted prod behavior too once applied. - New tests/pg/check-email-exists.pg.test.ts locks in existence, case-insensitive matching, false-for-unknown, and the role grants. - .env.docker.example gains the AUTH_SIGNUPS_DISABLED block self-hosters actually use; both env templates now note that the GoTrue redirect URI allow-list must include /invite/* or the invite email redirect silently falls back to SITE_URL. - Invite route test for the existsError branch: RPC failure logs a warning and provisioning proceeds anyway (GoTrue is authoritative). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(auth): mask invitee email in provisioning-failure log (#1335) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
co-authored by
Claude Fable 5
Jakob Wennberg
Claude Fable 5
Jakob Wennberg
parent
a9242551eb
commit
2296c0cd59
@@ -1,12 +1,19 @@
|
||||
/**
|
||||
* Tests for POST /api/company/members/invite.
|
||||
*/
|
||||
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
||||
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
|
||||
import { NextResponse } from 'next/server'
|
||||
import { createQueuedMockSupabase, createMockRequest, parseJsonResponse } from '@/tests/helpers'
|
||||
|
||||
const { supabase: serviceSupabase, enqueue, reset } = createQueuedMockSupabase()
|
||||
|
||||
// The queued mock's auth object only carries getUser; the provisioning path
|
||||
// (AUTH_SIGNUPS_DISABLED=true) also calls auth.admin.inviteUserByEmail.
|
||||
const inviteUserByEmailMock = vi.fn()
|
||||
Object.assign(serviceSupabase.auth, {
|
||||
admin: { inviteUserByEmail: inviteUserByEmailMock },
|
||||
})
|
||||
|
||||
const requireAuthMock = vi.fn()
|
||||
vi.mock('@/lib/auth/require-auth', () => ({
|
||||
requireAuth: (...args: unknown[]) => requireAuthMock(...args),
|
||||
@@ -59,6 +66,7 @@ function post(body: unknown) {
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks()
|
||||
reset()
|
||||
delete process.env.AUTH_SIGNUPS_DISABLED
|
||||
requireAuthMock.mockResolvedValue({
|
||||
user: { id: 'user-1', email: 'owner@example.com' },
|
||||
supabase: {},
|
||||
@@ -67,6 +75,11 @@ beforeEach(() => {
|
||||
requireWriteMock.mockResolvedValue({ ok: true })
|
||||
isConfiguredMock.mockReturnValue(true)
|
||||
sendEmailMock.mockResolvedValue({ success: true, messageId: 'msg-1' })
|
||||
inviteUserByEmailMock.mockResolvedValue({ data: { user: { id: 'new-user' } }, error: null })
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
delete process.env.AUTH_SIGNUPS_DISABLED
|
||||
})
|
||||
|
||||
describe('POST /api/company/members/invite', () => {
|
||||
@@ -140,3 +153,160 @@ describe('POST /api/company/members/invite', () => {
|
||||
expect(body.data.email_sent).toBe(false)
|
||||
})
|
||||
})
|
||||
|
||||
describe('POST /api/company/members/invite: AUTH_SIGNUPS_DISABLED provisioning', () => {
|
||||
it('leaves behavior unchanged when the flag is unset: no existence check, no admin call', async () => {
|
||||
enqueue({ data: { role: 'owner' } }) // caller membership
|
||||
enqueue({ data: [] }) // existing members
|
||||
enqueue({ data: null }) // existing invite
|
||||
enqueue({ data: { name: 'Acme AB' } }) // company name
|
||||
enqueue({ data: null }) // insert invitation
|
||||
|
||||
const { status, body } = await parseJsonResponse<{
|
||||
data: { email_sent: boolean; user_provisioned: boolean }
|
||||
}>(await post({ email: 'client@example.com' }))
|
||||
|
||||
expect(status).toBe(200)
|
||||
expect(body.data.email_sent).toBe(true)
|
||||
expect(body.data.user_provisioned).toBe(false)
|
||||
expect(serviceSupabase.rpc).not.toHaveBeenCalled()
|
||||
expect(inviteUserByEmailMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('flag on + account exists: skips provisioning, invite proceeds normally', async () => {
|
||||
process.env.AUTH_SIGNUPS_DISABLED = 'true'
|
||||
enqueue({ data: { role: 'owner' } }) // caller membership
|
||||
enqueue({ data: [] }) // existing members
|
||||
enqueue({ data: null }) // existing invite
|
||||
enqueue({ data: { name: 'Acme AB' } }) // company name
|
||||
enqueue({ data: true }) // rpc check_email_exists -> account exists
|
||||
enqueue({ data: null }) // insert invitation
|
||||
|
||||
const { status, body } = await parseJsonResponse<{
|
||||
data: { email_sent: boolean; user_provisioned: boolean }
|
||||
}>(await post({ email: 'client@example.com' }))
|
||||
|
||||
expect(status).toBe(200)
|
||||
expect(serviceSupabase.rpc).toHaveBeenCalledWith('check_email_exists', {
|
||||
email_to_check: 'client@example.com',
|
||||
})
|
||||
expect(inviteUserByEmailMock).not.toHaveBeenCalled()
|
||||
expect(body.data.email_sent).toBe(true)
|
||||
expect(body.data.user_provisioned).toBe(false)
|
||||
})
|
||||
|
||||
it('flag on + no account: provisions via admin invite with the invite redirect', async () => {
|
||||
process.env.AUTH_SIGNUPS_DISABLED = 'true'
|
||||
enqueue({ data: { role: 'owner' } }) // caller membership
|
||||
enqueue({ data: [] }) // existing members
|
||||
enqueue({ data: null }) // existing invite
|
||||
enqueue({ data: { name: 'Acme AB' } }) // company name
|
||||
enqueue({ data: false }) // rpc check_email_exists -> no account
|
||||
enqueue({ data: null }) // insert invitation
|
||||
|
||||
const { status, body } = await parseJsonResponse<{
|
||||
data: { email_sent: boolean; user_provisioned: boolean }
|
||||
}>(await post({ email: 'Client@Example.com' }))
|
||||
|
||||
expect(status).toBe(200)
|
||||
expect(inviteUserByEmailMock).toHaveBeenCalledTimes(1)
|
||||
// Provision with the lowercased email (the invitation row and GoTrue
|
||||
// both lowercase; /api/team/accept enforces exact email match) and a
|
||||
// redirect that lands back on this invitation.
|
||||
expect(inviteUserByEmailMock).toHaveBeenCalledWith('client@example.com', {
|
||||
redirectTo: expect.stringContaining('/invite/tok-plain'),
|
||||
})
|
||||
expect(body.data.user_provisioned).toBe(true)
|
||||
expect(body.data.email_sent).toBe(true)
|
||||
})
|
||||
|
||||
it('flag on + provisioning fails: surfaces a Swedish error, sends nothing, logs a masked address', async () => {
|
||||
process.env.AUTH_SIGNUPS_DISABLED = 'true'
|
||||
enqueue({ data: { role: 'owner' } }) // caller membership
|
||||
enqueue({ data: [] }) // existing members
|
||||
enqueue({ data: null }) // existing invite
|
||||
enqueue({ data: { name: 'Acme AB' } }) // company name
|
||||
enqueue({ data: false }) // rpc check_email_exists -> no account
|
||||
// Mimic a real GoTrue failure (AuthApiError is an Error instance):
|
||||
// SMTP not configured is the typical self-hosted cause.
|
||||
const authError = Object.assign(new Error('Error sending invite email'), {
|
||||
code: 'unexpected_failure',
|
||||
status: 500,
|
||||
})
|
||||
inviteUserByEmailMock.mockResolvedValue({ data: { user: null }, error: authError })
|
||||
const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
|
||||
|
||||
const { status, body } = await parseJsonResponse<{ error: string }>(
|
||||
await post({ email: 'client@example.com' })
|
||||
)
|
||||
|
||||
expect(status).toBe(502)
|
||||
expect(body.error).toContain('SMTP')
|
||||
expect(sendEmailMock).not.toHaveBeenCalled()
|
||||
// The failure log carries only a masked invitee address (PII stays out
|
||||
// of the log record; the mask survives the logger's own redaction).
|
||||
const logged = consoleErrorSpy.mock.calls
|
||||
.flat()
|
||||
.map((arg) => (typeof arg === 'string' ? arg : JSON.stringify(arg)))
|
||||
.join(' ')
|
||||
expect(logged).toContain('c***@example.com')
|
||||
expect(logged).not.toContain('client@example.com')
|
||||
consoleErrorSpy.mockRestore()
|
||||
})
|
||||
|
||||
it('flag on + existence check errors (RPC missing): warns and provisions anyway', async () => {
|
||||
process.env.AUTH_SIGNUPS_DISABLED = 'true'
|
||||
enqueue({ data: { role: 'owner' } }) // caller membership
|
||||
enqueue({ data: [] }) // existing members
|
||||
enqueue({ data: null }) // existing invite
|
||||
enqueue({ data: { name: 'Acme AB' } }) // company name
|
||||
// The exact failure shape a deployment without migration
|
||||
// 20260804140000 produces: PostgREST cannot find the function.
|
||||
enqueue({
|
||||
data: null,
|
||||
error: {
|
||||
message: 'Could not find the function public.check_email_exists(email_to_check) in the schema cache',
|
||||
code: 'PGRST202',
|
||||
},
|
||||
}) // rpc check_email_exists -> error
|
||||
enqueue({ data: null }) // insert invitation
|
||||
|
||||
const { status, body } = await parseJsonResponse<{
|
||||
data: { email_sent: boolean; user_provisioned: boolean }
|
||||
}>(await post({ email: 'client@example.com' }))
|
||||
|
||||
// The route logs a warning and treats GoTrue as the authority: it
|
||||
// attempts provisioning anyway rather than silently skipping the
|
||||
// invitee, and a duplicate would surface from GoTrue itself.
|
||||
expect(status).toBe(200)
|
||||
expect(serviceSupabase.rpc).toHaveBeenCalledWith('check_email_exists', {
|
||||
email_to_check: 'client@example.com',
|
||||
})
|
||||
expect(inviteUserByEmailMock).toHaveBeenCalledTimes(1)
|
||||
expect(body.data.user_provisioned).toBe(true)
|
||||
expect(body.data.email_sent).toBe(true)
|
||||
})
|
||||
|
||||
it('flag on + admin reports the email already registered: treated as existing account', async () => {
|
||||
process.env.AUTH_SIGNUPS_DISABLED = 'true'
|
||||
enqueue({ data: { role: 'owner' } }) // caller membership
|
||||
enqueue({ data: [] }) // existing members
|
||||
enqueue({ data: null }) // existing invite
|
||||
enqueue({ data: { name: 'Acme AB' } }) // company name
|
||||
enqueue({ data: false }) // rpc check_email_exists -> stale answer
|
||||
enqueue({ data: null }) // insert invitation
|
||||
const authError = Object.assign(
|
||||
new Error('A user with this email address has already been registered'),
|
||||
{ code: 'email_exists', status: 422 },
|
||||
)
|
||||
inviteUserByEmailMock.mockResolvedValue({ data: { user: null }, error: authError })
|
||||
|
||||
const { status, body } = await parseJsonResponse<{
|
||||
data: { email_sent: boolean; user_provisioned: boolean }
|
||||
}>(await post({ email: 'client@example.com' }))
|
||||
|
||||
expect(status).toBe(200)
|
||||
expect(body.data.user_provisioned).toBe(false)
|
||||
expect(body.data.email_sent).toBe(true)
|
||||
})
|
||||
})
|
||||
|
||||
@@ -5,6 +5,7 @@ import { ensureInitialized } from '@/lib/init'
|
||||
import { withRouteContext } from '@/lib/api/with-route-context'
|
||||
import { validateBody } from '@/lib/api/validate'
|
||||
import { generateInviteToken, getInviteExpiry } from '@/lib/auth/invite-tokens'
|
||||
import { getErrorMessage } from '@/lib/errors/get-error-message'
|
||||
import { getEmailService } from '@/lib/email/service'
|
||||
import {
|
||||
generateInviteEmailSubject,
|
||||
@@ -23,6 +24,19 @@ const InviteSchema = z.object({
|
||||
role: z.enum(['admin', 'member', 'viewer']).default('viewer'),
|
||||
})
|
||||
|
||||
/**
|
||||
* First local-part character + *** + domain, e.g. "j***@example.com".
|
||||
* Keeps invitee PII out of the log record while leaving enough to tell
|
||||
* WHICH invite failed. The logger's own redaction would otherwise replace
|
||||
* a raw address with [REDACTED_EMAIL] (lib/observability/redact.ts); the
|
||||
* masked form does not match that email pattern, so it survives intact.
|
||||
*/
|
||||
function maskEmail(email: string): string {
|
||||
const at = email.indexOf('@')
|
||||
if (at <= 0) return '***'
|
||||
return `${email[0]}***${email.slice(at)}`
|
||||
}
|
||||
|
||||
/**
|
||||
* POST /api/company/members/invite
|
||||
* Invite a user to the current company (e.g., a client as viewer).
|
||||
@@ -97,6 +111,66 @@ export const POST = withRouteContext(
|
||||
const { token, hash } = generateInviteToken()
|
||||
const expiresAt = getInviteExpiry()
|
||||
|
||||
const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
|
||||
|
||||
// Self-hosted installations that turn public signup off in GoTrue
|
||||
// (disable_signup) set AUTH_SIGNUPS_DISABLED=true to mirror that config:
|
||||
// GoTrue offers no clean server-side read of the setting. Without this,
|
||||
// an invitee with no account is routed to /register, where
|
||||
// supabase.auth.signUp is rejected with "Signups not allowed for this
|
||||
// instance" and the invite dead-ends. Provision the account via the auth
|
||||
// admin invite API instead. Hosted keeps the flag unset: nothing in this
|
||||
// block runs and behavior is unchanged.
|
||||
const signupsDisabled = process.env.AUTH_SIGNUPS_DISABLED === 'true'
|
||||
let userProvisioned = false
|
||||
if (signupsDisabled) {
|
||||
const { data: emailExists, error: existsError } = await serviceClient.rpc(
|
||||
'check_email_exists',
|
||||
{ email_to_check: email },
|
||||
)
|
||||
if (existsError) {
|
||||
// GoTrue is the authority: attempt provisioning anyway and let a
|
||||
// duplicate surface there instead of silently skipping the invitee.
|
||||
log.warn('check_email_exists failed; attempting provisioning anyway', {
|
||||
message: existsError.message,
|
||||
})
|
||||
}
|
||||
|
||||
if (!emailExists) {
|
||||
// Provision BEFORE the invitation row is written: a failure here
|
||||
// leaves nothing half-created behind, so the admin can retry cleanly
|
||||
// after fixing the cause (typically GoTrue SMTP configuration).
|
||||
// The redirect lands the invitee back on the invite page with a
|
||||
// session; /auth/callback routes type=invite verifications to the
|
||||
// set-password surface first.
|
||||
const { error: provisionError } = await serviceClient.auth.admin.inviteUserByEmail(
|
||||
email,
|
||||
{ redirectTo: `${appUrl}/invite/${token}` },
|
||||
)
|
||||
|
||||
if (provisionError) {
|
||||
const alreadyRegistered =
|
||||
provisionError.code === 'email_exists' ||
|
||||
/already been registered/i.test(provisionError.message)
|
||||
if (!alreadyRegistered) {
|
||||
// Never report a silently-successful invite when the invitee
|
||||
// cannot actually get an account.
|
||||
log.error('invitee auth provisioning failed', new Error(provisionError.message), {
|
||||
to: maskEmail(email),
|
||||
})
|
||||
return NextResponse.json(
|
||||
{ error: getErrorMessage(provisionError, { context: 'auth', statusCode: 502 }) },
|
||||
{ status: 502 },
|
||||
)
|
||||
}
|
||||
// The account exists after all (stale check_email_exists answer):
|
||||
// proceed exactly as for an existing user.
|
||||
} else {
|
||||
userProvisioned = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Upsert invitation
|
||||
if (existingInvite) {
|
||||
const { error } = await serviceClient
|
||||
@@ -134,7 +208,6 @@ export const POST = withRouteContext(
|
||||
// Send email. email_sent is surfaced in the response so the UI can tell
|
||||
// the user when the invitation exists but the mail never went out:
|
||||
// previously a send failure was invisible (invite looked sent).
|
||||
const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
|
||||
const emailService = getEmailService()
|
||||
let emailSent = false
|
||||
if (emailService.isConfigured()) {
|
||||
@@ -172,6 +245,7 @@ export const POST = withRouteContext(
|
||||
email,
|
||||
status: 'pending',
|
||||
email_sent: emailSent,
|
||||
user_provisioned: userProvisioned,
|
||||
...(isDev && { inviteUrl: devInviteUrl }),
|
||||
},
|
||||
})
|
||||
|
||||
Reference in New Issue
Block a user