feat(auth): Google-only sign-in; atomic invite redemption

Password and GitHub sign-in are switched off while a Workspace allow-list
(GOOGLE_ALLOWED_DOMAIN) is configured; everyone allowed in has Google.

- email sign-in, sign-up and password reset are refused server-side and
  hidden on the login and invite pages; ALLOW_PASSWORD_LOGIN=true is a
  break-glass that restores password sign-in for existing users only
- password sign-up stays off even with the break-glass: it trusts a typed
  email, so whoever holds an invite link could create the invitee's
  account with their own password and Google would later link into it
- GitHub is refused when starting sign-in and in the callback, since a
  GitHub email stays verified after someone leaves the company
- installs without an allow-list (local dev, self-hosting) keep passwords
- auth.providers tells the UI which methods to offer

Invite redemption now runs in one transaction (claim invite, upsert
membership, create grants). A failed grant insert previously left a
project-limited invitee as a member with no grants, i.e. access to every
project, and a retry treated them as already unrestricted. The invite is
claimed first so concurrent redemptions cannot both grant. Verified on dev
Postgres by forcing a foreign-key failure: nothing was left behind and the
invite stayed redeemable.

Author: ayushjhanwar-png

apps/api/src/controllers/oauth-callback.controller.tsx

@@ -10,6 +10,7 @@ import {
   github,
   google,
   isEmailDomainAllowed,
+  isGithubLoginEnabled,
   parseGoogleIdentity,
   setSessionTokenCookie,
 } from '@openpanel/auth';
@@ -430,7 +431,8 @@ export async function githubCallback(req: FastifyRequest, reply: FastifyReply) {
     const inviteId = req.cookies.inviteId;
     const tokens = await github.validateAuthorizationCode(code);
     const githubUser = await fetchGithubUser(tokens.accessToken());
-    if (!isEmailDomainAllowed(githubUser.email)) {
+    // Belt and braces: signInOAuth already refuses GitHub with an allow-list
+    if (!isGithubLoginEnabled() || !isEmailDomainAllowed(githubUser.email)) {
       throw new LogError(
         `Sign in with your ${describeAllowedDomains()} Google account`,
       );

apps/start/src/routes/_login.login.tsx

@@ -3,7 +3,9 @@ import { SignInEmailForm } from '@/components/auth/sign-in-email-form';
 import { SignInGoogle } from '@/components/auth/sign-in-google';
 import { LogoSquare } from '@/components/logo';
 import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert';
+import { useTRPC } from '@/integrations/trpc/react';
 import { PAGE_TITLES, createTitle } from '@/utils/title';
+import { useQuery } from '@tanstack/react-query';
 import { createFileRoute, redirect } from '@tanstack/react-router';
 import { AlertCircle } from 'lucide-react';
 import { z } from 'zod';
@@ -25,6 +27,8 @@ export const Route = createFileRoute('/_login/login')({
 
 function LoginPage() {
   const { error, correlationId, inviteId } = Route.useSearch();
+  const trpc = useTRPC();
+  const { data: providers } = useQuery(trpc.auth.providers.queryOptions());
 
   return (
     <div className="col gap-8 w-full text-left">
@@ -59,8 +63,12 @@ function LoginPage() {
       <div className="space-y-4">
         <SignInGoogle type="sign-in" inviteId={inviteId} />
       </div>
-      <Or />
-      <SignInEmailForm inviteId={inviteId} />
+      {providers?.password && (
+        <>
+          <Or />
+          <SignInEmailForm inviteId={inviteId} />
+        </>
+      )}
     </div>
   );
 }

apps/start/src/routes/_public.onboarding.tsx

@@ -46,6 +46,7 @@ export const Route = createFileRoute('/_public/onboarding')({
 function Component() {
   const { inviteId } = Route.useSearch();
   const trpc = useTRPC();
+  const { data: providers } = useQuery(trpc.auth.providers.queryOptions());
   const { data: invite } = useQuery(
     trpc.organization.getInvite.queryOptions(
       {
@@ -105,13 +106,17 @@ function Component() {
         <div className="space-y-6">
           <SignInGoogle type="sign-up" inviteId={inviteId} />
 
-          <Or className="my-6" />
+          {providers?.passwordSignUp && (
+            <>
+              <Or className="my-6" />
 
-          <div className="flex items-center gap-2 font-semibold mb-4 text-lg">
-            <MailIcon className="size-4" />
-            Or create a password
-          </div>
-          <SignUpEmailForm inviteId={inviteId} />
+              <div className="flex items-center gap-2 font-semibold mb-4 text-lg">
+                <MailIcon className="size-4" />
+                Or create a password
+              </div>
+              <SignUpEmailForm inviteId={inviteId} />
+            </>
+          )}
         </div>
       )}
     </div>

packages/auth/src/domain-policy.test.ts

@@ -3,6 +3,9 @@ import {
   DomainPolicyError,
   getEmailDomain,
   isEmailDomainAllowed,
+  isGithubLoginEnabled,
+  isPasswordLoginEnabled,
+  isPasswordSignUpEnabled,
   parseAllowedDomains,
   parseGoogleIdentity,
 } from './domain-policy';
@@ -132,3 +135,64 @@ describe('parseGoogleIdentity', () => {
     ).toBe('x@gmail.com');
   });
 });
+
+describe('isPasswordLoginEnabled', () => {
+  it('is off when a Workspace allow-list is configured', () => {
+    expect(
+      isPasswordLoginEnabled({ GOOGLE_ALLOWED_DOMAIN: 'dashverse.ai' }),
+    ).toBe(false);
+  });
+
+  it('can be switched back on as a break-glass', () => {
+    expect(
+      isPasswordLoginEnabled({
+        GOOGLE_ALLOWED_DOMAIN: 'dashverse.ai',
+        ALLOW_PASSWORD_LOGIN: 'true',
+      }),
+    ).toBe(true);
+  });
+
+  it('stays on without an allow-list (local dev, self-hosting)', () => {
+    expect(isPasswordLoginEnabled({})).toBe(true);
+  });
+
+  it('can be switched off explicitly without an allow-list', () => {
+    expect(isPasswordLoginEnabled({ ALLOW_PASSWORD_LOGIN: 'false' })).toBe(
+      false,
+    );
+  });
+});
+
+describe('isPasswordSignUpEnabled', () => {
+  it('is off with an allow-list, even with the sign-in break-glass on', () => {
+    expect(
+      isPasswordSignUpEnabled({
+        GOOGLE_ALLOWED_DOMAIN: 'dashverse.ai',
+        ALLOW_PASSWORD_LOGIN: 'true',
+      }),
+    ).toBe(false);
+  });
+
+  it('follows password sign-in without an allow-list', () => {
+    expect(isPasswordSignUpEnabled({})).toBe(true);
+    expect(isPasswordSignUpEnabled({ ALLOW_PASSWORD_LOGIN: 'false' })).toBe(
+      false,
+    );
+  });
+});
+
+describe('isGithubLoginEnabled', () => {
+  it('is off with an allow-list even when GitHub is configured', () => {
+    expect(
+      isGithubLoginEnabled({
+        GOOGLE_ALLOWED_DOMAIN: 'dashverse.ai',
+        GITHUB_CLIENT_ID: 'gh',
+      }),
+    ).toBe(false);
+  });
+
+  it('needs a GitHub client id without an allow-list', () => {
+    expect(isGithubLoginEnabled({})).toBe(false);
+    expect(isGithubLoginEnabled({ GITHUB_CLIENT_ID: 'gh' })).toBe(true);
+  });
+});

packages/auth/src/domain-policy.ts

@@ -106,3 +106,47 @@ export function parseGoogleIdentity(
     lastName: typeof data.family_name === 'string' ? data.family_name : '',
   };
 }
+
+/**
+ * Whether email/password sign-in, sign-up and reset are available.
+ *
+ * With a Google Workspace allow-list configured everyone allowed in has a
+ * Google account, so passwords are off: one less way in to guess at.
+ * ALLOW_PASSWORD_LOGIN=true turns them back on (break-glass if Google sign-in
+ * is unavailable); without an allow-list (local dev, self-hosting) they stay
+ * on so an install without Google OAuth still works.
+ */
+export function isPasswordLoginEnabled(env: Env = process.env as Env): boolean {
+  if (
+    env.ALLOW_PASSWORD_LOGIN !== undefined &&
+    env.ALLOW_PASSWORD_LOGIN !== ''
+  ) {
+    return env.ALLOW_PASSWORD_LOGIN === 'true';
+  }
+  return getAllowedEmailDomains(env).length === 0;
+}
+
+/**
+ * Whether new accounts may be created with a password.
+ *
+ * Never with a Workspace allow-list: a password sign-up trusts a typed email,
+ * so whoever holds an invite link could create the invitee's account with
+ * their own password, and Google would later link into it. The
+ * ALLOW_PASSWORD_LOGIN break-glass only restores sign-in for existing users.
+ */
+export function isPasswordSignUpEnabled(
+  env: Env = process.env as Env,
+): boolean {
+  return (
+    getAllowedEmailDomains(env).length === 0 && isPasswordLoginEnabled(env)
+  );
+}
+
+/**
+ * GitHub sign-in proves nothing about Workspace membership, and a GitHub
+ * email stays verified after someone leaves the company, so it is unavailable
+ * whenever a Workspace allow-list is configured.
+ */
+export function isGithubLoginEnabled(env: Env = process.env as Env): boolean {
+  return getAllowedEmailDomains(env).length === 0 && !!env.GITHUB_CLIENT_ID;
+}

packages/db/src/services/organization.invite.test.ts

@@ -3,27 +3,34 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 const mocks = vi.hoisted(() => ({
   inviteFindUnique: vi.fn(),
   inviteFindMany: vi.fn(),
-  inviteDelete: vi.fn(),
+  inviteDeleteMany: vi.fn(),
   memberFindUnique: vi.fn(),
   memberUpsert: vi.fn(),
   projectAccessFindMany: vi.fn(),
-  projectAccessCreate: vi.fn(),
+  projectAccessCreateMany: vi.fn(),
+  transaction: vi.fn(),
 }));
 
 vi.mock('../prisma-client', () => {
   const client = {
     invite: {
       findUnique: mocks.inviteFindUnique,
       findMany: mocks.inviteFindMany,
-      delete: mocks.inviteDelete,
+      deleteMany: mocks.inviteDeleteMany,
     },
     member: { findUnique: mocks.memberFindUnique, upsert: mocks.memberUpsert },
     projectAccess: {
       findMany: mocks.projectAccessFindMany,
-      create: mocks.projectAccessCreate,
+      createMany: mocks.projectAccessCreateMany,
     },
   };
-  return { db: { ...client, $primary: () => client } };
+  // Interactive transaction: run the callback against the same client
+  mocks.transaction.mockImplementation((fn: (tx: unknown) => unknown) =>
+    fn(client),
+  );
+  return {
+    db: { ...client, $primary: () => client, $transaction: mocks.transaction },
+  };
 });
 
 vi.mock('./access.service', () => ({
@@ -54,6 +61,8 @@ beforeEach(() => {
   mocks.memberFindUnique.mockResolvedValue(null);
   mocks.memberUpsert.mockResolvedValue({ id: 'm1' });
   mocks.projectAccessFindMany.mockResolvedValue([]);
+  mocks.inviteDeleteMany.mockResolvedValue({ count: 1 });
+  mocks.projectAccessCreateMany.mockResolvedValue({ count: 0 });
 });
 
 describe('connectUserToOrganization', () => {
@@ -70,7 +79,10 @@ describe('connectUserToOrganization', () => {
         }),
       }),
     );
-    expect(mocks.inviteDelete).toHaveBeenCalledWith({ where: { id: 'inv1' } });
+    expect(mocks.inviteDeleteMany).toHaveBeenCalledWith({
+      where: { id: 'inv1' },
+    });
+    expect(mocks.transaction).toHaveBeenCalledTimes(1);
   });
 
   it('refuses an invite addressed to someone else', async () => {
@@ -81,7 +93,7 @@ describe('connectUserToOrganization', () => {
       connectUserToOrganization({ user, inviteId: 'inv1' }),
     ).rejects.toThrow('different email address');
     expect(mocks.memberUpsert).not.toHaveBeenCalled();
-    expect(mocks.inviteDelete).not.toHaveBeenCalled();
+    expect(mocks.inviteDeleteMany).not.toHaveBeenCalled();
   });
 
   it('refuses an expired invite', async () => {
@@ -98,21 +110,46 @@ describe('connectUserToOrganization', () => {
       invite({ projectAccess: ['frameo', 'studio'] }),
     );
     await connectUserToOrganization({ user, inviteId: 'inv1' });
-    expect(mocks.projectAccessCreate).toHaveBeenCalledTimes(2);
-    expect(mocks.projectAccessCreate).toHaveBeenCalledWith({
-      data: expect.objectContaining({ projectId: 'frameo', level: 'write' }),
+    expect(mocks.projectAccessCreateMany).toHaveBeenCalledWith({
+      data: [
+        expect.objectContaining({ projectId: 'frameo', level: 'write' }),
+        expect.objectContaining({ projectId: 'studio', level: 'write' }),
+      ],
     });
   });
 
+  it('fails as a whole (inside the transaction) if a grant insert fails', async () => {
+    mocks.inviteFindUnique.mockResolvedValue(
+      invite({ projectAccess: ['frameo'] }),
+    );
+    mocks.projectAccessCreateMany.mockRejectedValue(new Error('db down'));
+    await expect(
+      connectUserToOrganization({ user, inviteId: 'inv1' }),
+    ).rejects.toThrow('db down');
+    // Membership, invite claim and grants all ran in the one transaction, so
+    // Postgres rolls back all of them and the invite can be redeemed again.
+    expect(mocks.transaction).toHaveBeenCalledTimes(1);
+    expect(mocks.memberUpsert).toHaveBeenCalledTimes(1);
+  });
+
+  it('refuses an invite that was already used concurrently', async () => {
+    mocks.inviteFindUnique.mockResolvedValue(invite());
+    mocks.inviteDeleteMany.mockResolvedValue({ count: 0 });
+    await expect(
+      connectUserToOrganization({ user, inviteId: 'inv1' }),
+    ).rejects.toThrow('Invite already used');
+    expect(mocks.memberUpsert).not.toHaveBeenCalled();
+  });
+
   it('never narrows an existing member who already sees every project', async () => {
     mocks.memberFindUnique.mockResolvedValue({ id: 'm1' });
     mocks.projectAccessFindMany.mockResolvedValue([]);
     mocks.inviteFindUnique.mockResolvedValue(
       invite({ projectAccess: ['frameo'] }),
     );
     await connectUserToOrganization({ user, inviteId: 'inv1' });
-    expect(mocks.projectAccessCreate).not.toHaveBeenCalled();
-    expect(mocks.inviteDelete).toHaveBeenCalled();
+    expect(mocks.projectAccessCreateMany).not.toHaveBeenCalled();
+    expect(mocks.inviteDeleteMany).toHaveBeenCalled();
   });
 
   it('adds only missing grants to an existing restricted member', async () => {
@@ -122,9 +159,8 @@ describe('connectUserToOrganization', () => {
       invite({ projectAccess: ['frameo', 'studio'] }),
     );
     await connectUserToOrganization({ user, inviteId: 'inv1' });
-    expect(mocks.projectAccessCreate).toHaveBeenCalledTimes(1);
-    expect(mocks.projectAccessCreate).toHaveBeenCalledWith({
-      data: expect.objectContaining({ projectId: 'studio' }),
+    expect(mocks.projectAccessCreateMany).toHaveBeenCalledWith({
+      data: [expect.objectContaining({ projectId: 'studio' })],
     });
   });
 });