Skip to content

feat(auth): env-gate email/password and Google hd #138

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
aiandwebservices-cyber wants to merge 18 commits into from
Closed

feat(auth): env-gate email/password and Google hd #138

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
52a57ed
Merge pull request #74 from trycompai/main
carhartlewis Aug 7, 2026
1561073
chore: release release
github-actions[bot] Aug 7, 2026
5074fc4
Merge pull request #75 from trycompai/release-please--branches--release
carhartlewis Aug 7, 2026
3c20d80
Merge pull request #77 from trycompai/main
carhartlewis Aug 7, 2026
808b835
Merge pull request #79 from trycompai/main
carhartlewis Aug 7, 2026
407280a
Merge pull request #81 from trycompai/main
carhartlewis Aug 7, 2026
c26a08d
Merge pull request #84 from trycompai/main
carhartlewis Aug 7, 2026
d585dc3
Merge pull request #90 from trycompai/main
carhartlewis Aug 8, 2026
d0299d9
Merge pull request #98 from trycompai/main
carhartlewis Aug 11, 2026
7d4a573
Merge pull request #107 from trycompai/main
carhartlewis Aug 11, 2026
56f4eeb
Merge pull request #116 from trycompai/main
github-actions[bot] Aug 11, 2026
57001e6
Merge pull request #119 from trycompai/main
github-actions[bot] Aug 11, 2026
ad1d702
Merge pull request #122 from trycompai/main
github-actions[bot] Aug 11, 2026
fc0c594
Merge pull request #127 from trycompai/main
github-actions[bot] Aug 11, 2026
4ffe150
Merge pull request #130 from trycompai/main
github-actions[bot] Aug 11, 2026
14cd220
Merge pull request #135 from trycompai/main
github-actions[bot] Aug 11, 2026
6ff0724
feat(auth): add EMAIL_PASSWORD_ENABLED and GOOGLE_DISABLE_HD env flags
aiandwebservices-cyber Aug 12, 2026
2212e3c
feat(auth): wire email/password and Google hd to env flags
aiandwebservices-cyber Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions packages/auth/src/auth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,9 @@ if (env.google) {

accessType: "offline",

...(primaryWorkspaceDomain() ? { hd: primaryWorkspaceDomain() } : {}),
...(!env.googleDisableHd && primaryWorkspaceDomain()
? { hd: primaryWorkspaceDomain() }
: {}),
};
}

Expand Down Expand Up @@ -72,7 +74,7 @@ export const auth = betterAuth({
}),

emailAndPassword: {
enabled: false,
enabled: env.emailAndPasswordEnabled,

@cubic-dev-ai cubic-dev-ai Bot Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Enabling email/password for the first time via EMAIL_PASSWORD_ENABLED introduces an account-linking edge case. account.accountLinking.trustedProviders still lists only GOOGLE and MICROSOFT, not the email/password ("credential") provider. Better Auth auto-links a provider to an existing user by email only when the provider is in trustedProviders (or supplies email_verified); email/password does not satisfy that. So once a workspace user has an account created via Google, signing in later with email/password on the same address won't auto-link and can surface an "unable to link account" / conflicting-account flow. Worth deciding explicitly how this should behave before rolling the flag out on the aisales deploy. If email/password should be treated as the same identity, add the credential provider id to trustedProviders; otherwise confirm the manual-linking UX is acceptable and document it.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At packages/auth/src/auth.ts, line 77:

<comment>Enabling email/password for the first time via EMAIL_PASSWORD_ENABLED introduces an account-linking edge case. account.accountLinking.trustedProviders still lists only GOOGLE and MICROSOFT, not the email/password ("credential") provider. Better Auth auto-links a provider to an existing user by email only when the provider is in trustedProviders (or supplies email_verified); email/password does not satisfy that. So once a workspace user has an account created via Google, signing in later with email/password on the same address won't auto-link and can surface an "unable to link account" / conflicting-account flow. Worth deciding explicitly how this should behave before rolling the flag out on the aisales deploy. If email/password should be treated as the same identity, add the credential provider id to trustedProviders; otherwise confirm the manual-linking UX is acceptable and document it.</comment>

<file context>
@@ -72,7 +74,7 @@ export const auth = betterAuth({
 
 	emailAndPassword: {
-		enabled: false,
+		enabled: env.emailAndPasswordEnabled,
 	},
 
</file context>
Fix with cubic

},

socialProviders,
Expand Down
9 changes: 9 additions & 0 deletions packages/auth/src/env.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,11 @@ const optional = (key: string): string | undefined => {
return value && value.length > 0 ? value : undefined;
};

const flag = (key: string): boolean => {
const value = optional(key)?.toLowerCase();
return value === "true" || value === "1";
};

const pair = (
idKey: string,
secretKey: string,
Expand Down Expand Up @@ -65,6 +70,10 @@ export const env = {
cookieDomain: optional("AUTH_COOKIE_DOMAIN"),
trustedOrigins: [...new Set([...appUrls, apiUrl])],
isProduction: process.env.NODE_ENV === "production",
/** Opt-in: set EMAIL_PASSWORD_ENABLED=true on a deploy to allow email/password auth. */
emailAndPasswordEnabled: flag("EMAIL_PASSWORD_ENABLED"),

@cubic-dev-ai cubic-dev-ai Bot Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Turbo-managed deployments silently ignore both opt-ins, leaving email/password disabled and the Google hosted-domain restriction enabled even when the deploy notes set these variables. Adding both names to the root globalPassThroughEnv (or every relevant task's pass-through list) would make the runtime flags available.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At packages/auth/src/env.ts, line 74:

<comment>Turbo-managed deployments silently ignore both opt-ins, leaving email/password disabled and the Google hosted-domain restriction enabled even when the deploy notes set these variables. Adding both names to the root `globalPassThroughEnv` (or every relevant task's pass-through list) would make the runtime flags available.</comment>

<file context>
@@ -65,6 +70,10 @@ export const env = {
 	trustedOrigins: [...new Set([...appUrls, apiUrl])],
 	isProduction: process.env.NODE_ENV === "production",
+	/** Opt-in: set EMAIL_PASSWORD_ENABLED=true on a deploy to allow email/password auth. */
+	emailAndPasswordEnabled: flag("EMAIL_PASSWORD_ENABLED"),
+	/** Opt-in: set GOOGLE_DISABLE_HD=true to omit Google hosted-domain restriction. */
+	googleDisableHd: flag("GOOGLE_DISABLE_HD"),
</file context>
Fix with cubic

/** Opt-in: set GOOGLE_DISABLE_HD=true to omit Google hosted-domain restriction. */
googleDisableHd: flag("GOOGLE_DISABLE_HD"),
} as const;

export function isGoogleConfigured(): boolean {
Expand Down
Loading