fix(auth): provision invitees server-side when signups are disabled (#1404)

* fix(auth): provision invitees server-side when signups are disabled

Self-hosted installations with GoTrue disable_signup broke the invite
flow silently: invitees without an account were routed to /register,
where supabase.auth.signUp fails with "Signups not allowed for this
instance", surfaced only as a generic toast.

New server-only env flag AUTH_SIGNUPS_DISABLED (documented in
.env.example) mirrors the GoTrue setting. When true, POST
/api/company/members/invite checks check_email_exists and, for invitees
without an account, provisions one via auth.admin.inviteUserByEmail
with a redirect back to /invite/<token>, before the Resend email and
before the invitation row is written so a provisioning failure leaves
nothing half-created and the admin can retry. The response now carries
user_provisioned alongside email_sent, and a provisioning failure
returns 502 with a Swedish message mapped through getErrorMessage
instead of a silently-successful invite.

/auth/callback now routes type=invite verifications to /reset-password
(the existing set-password surface) instead of dropping the
passwordless user on the dashboard, and preserves the invite token from
next=/invite/<token> as the pre-auth invite cookie so the existing
reset-password invite handoff accepts the membership right after the
password is saved.

getErrorMessage learns two GoTrue patterns: "Signups not allowed"
(account creation closed on this installation, contact your inviter or
administrator) so the /register dead end is explained even for flows
that bypass provisioning, and "Error sending ... email" (GoTrue SMTP
not configured) so the 502 above is actionable.

Hosted is untouched: the flag is unset there and every new code path is
gated on it.

Fixes #1335

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): restore check_email_exists RPC and harden self-host invite config

Adversarial review of #1404 found that the check_email_exists function the
invite flow depends on does not exist anywhere: it shipped in PR #229 and
was lost in the #244 migration consolidation before ever reaching prod
(verified missing on the hosted production database directly). Today
app/api/team/accept destructures only { data } from the RPC call, so
alreadyHasAccount is silently null on every deployment and the invite page
routes even existing-account invitees toward /register.

- New migration 20260804140000 restores the function exactly as originally
  shipped: SECURITY DEFINER over auth.users, EXECUTE revoked from PUBLIC,
  anon and authenticated, granted to service_role only (prevents email
  enumeration). Fixes hosted prod behavior too once applied.
- New tests/pg/check-email-exists.pg.test.ts locks in existence,
  case-insensitive matching, false-for-unknown, and the role grants.
- .env.docker.example gains the AUTH_SIGNUPS_DISABLED block self-hosters
  actually use; both env templates now note that the GoTrue redirect URI
  allow-list must include /invite/* or the invite email redirect silently
  falls back to SITE_URL.
- Invite route test for the existsError branch: RPC failure logs a warning
  and provisioning proceeds anyway (GoTrue is authoritative).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): mask invitee email in provisioning-failure log (#1335)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/errors/__tests__/get-error-message.test.ts

@@ -461,3 +461,34 @@ describe('getErrorMessage: Swedish heuristic covers real route sentences', () =>
     )
   })
 })
+
+describe('getErrorMessage: GoTrue auth error patterns', () => {
+  it('maps "Signups not allowed for this instance" to the closed-installation message', () => {
+    // Shape mirrors a real AuthApiError: an Error instance carrying a GoTrue
+    // error code that the structured registry does not know.
+    const authError = Object.assign(new Error('Signups not allowed for this instance'), {
+      code: 'signup_disabled',
+      status: 422,
+    })
+    const msg = getErrorMessage(authError, { context: 'auth' })
+    expect(msg).toBe(
+      'Kontoregistrering är avstängd på den här installationen. Kontakta den som bjöd in dig eller din administratör för att få ett konto.',
+    )
+  })
+
+  it('maps a plain "Signups not allowed" string as well', () => {
+    const msg = getErrorMessage('Signups not allowed for this instance', { context: 'auth' })
+    expect(msg).toContain('avstängd på den här installationen')
+  })
+
+  it('maps GoTrue "Error sending invite email" to the SMTP guidance message', () => {
+    const authError = Object.assign(new Error('Error sending invite email'), {
+      code: 'unexpected_failure',
+      status: 500,
+    })
+    const msg = getErrorMessage(authError, { context: 'auth', statusCode: 502 })
+    expect(msg).toBe(
+      'E-postmeddelandet kunde inte skickas av autentiseringstjänsten. Kontrollera installationens SMTP-inställningar och försök igen.',
+    )
+  })
+})

lib/errors/get-error-message.ts

@@ -142,6 +142,19 @@ const ERROR_PATTERN_MAP: [RegExp, string | null][] = [
     /already has a journal entry/i,
     'Transaktionen är redan bokförd. Ångra kategoriseringen om du vill ändra den.',
   ],
+  [
+    // GoTrue rejects supabase.auth.signUp with this when the installation
+    // runs with disable_signup (closed self-hosted instances). The invitee
+    // cannot fix it themselves: point them to whoever runs the installation.
+    /signups? not allowed/i,
+    'Kontoregistrering är avstängd på den här installationen. Kontakta den som bjöd in dig eller din administratör för att få ett konto.',
+  ],
+  [
+    // GoTrue could not send its own mail (admin invite, confirmation,
+    // recovery): almost always missing SMTP configuration on self-hosted.
+    /error sending (invite|confirmation|recovery|magic link) email/i,
+    'E-postmeddelandet kunde inte skickas av autentiseringstjänsten. Kontrollera installationens SMTP-inställningar och försök igen.',
+  ],
 ]
 
 /**