From a3421b42730685d4338621d36efdc97e56f5d983 Mon Sep 17 00:00:00 2001 From: Waleed Latif Date: Tue, 21 Jul 2026 23:16:45 -0700 Subject: [PATCH 1/2] fix(auth): gate email-otp auto-signup behind DISABLE_EMAIL_SIGNUP --- apps/sim/lib/auth/auth.ts | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/apps/sim/lib/auth/auth.ts b/apps/sim/lib/auth/auth.ts index ea2d1f0b227..4e6153907a5 100644 --- a/apps/sim/lib/auth/auth.ts +++ b/apps/sim/lib/auth/auth.ts @@ -768,6 +768,13 @@ export const auth = betterAuth({ }, emailAndPassword: { enabled: true, + /** + * Same flag that hides the email/password signup form (DISABLE_EMAIL_SIGNUP). + * Blocks /sign-up/email at the better-auth layer so ripping out the frontend + * form cannot be bypassed by calling the endpoint directly. Existing users + * can still sign in. + */ + disableSignUp: isEmailSignupDisabled, requireEmailVerification: isEmailVerificationEnabled, /** * When someone signs up with an already-registered email, better-auth returns a @@ -891,11 +898,6 @@ export const auth = betterAuth({ }) } - if (isEmailSignupDisabled && ctx.path.startsWith('/sign-up/email')) - throw new APIError('FORBIDDEN', { - message: 'Email sign-up is disabled. Please use Google, Microsoft, or GitHub.', - }) - const isSignIn = ctx.path.startsWith('/sign-in') const isSignUp = ctx.path.startsWith('/sign-up') @@ -1039,6 +1041,14 @@ export const auth = betterAuth({ throw error } }, + /** + * Without this, /sign-in/email-otp auto-registers any unknown email — + * bypassing the signup gate entirely (no captcha, no /sign-up path). + * Gated by the same DISABLE_EMAIL_SIGNUP flag as the signup form; when + * set, better-auth also silently skips sending OTPs to unknown emails + * (enumeration-safe) while existing users keep OTP sign-in. + */ + disableSignUp: isEmailSignupDisabled, sendVerificationOnSignUp: false, otpLength: 6, // Explicitly set the OTP length expiresIn: 15 * 60, // 15 minutes in seconds From ba919229e076689c024930e3a3e2a0eeed2a6b1e Mon Sep 17 00:00:00 2001 From: Waleed Latif Date: Tue, 21 Jul 2026 23:18:43 -0700 Subject: [PATCH 2/2] fix(auth): also close otp auto-signup under DISABLE_REGISTRATION --- apps/sim/lib/auth/auth.ts | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/apps/sim/lib/auth/auth.ts b/apps/sim/lib/auth/auth.ts index 4e6153907a5..a18c757f6c2 100644 --- a/apps/sim/lib/auth/auth.ts +++ b/apps/sim/lib/auth/auth.ts @@ -1044,11 +1044,13 @@ export const auth = betterAuth({ /** * Without this, /sign-in/email-otp auto-registers any unknown email — * bypassing the signup gate entirely (no captcha, no /sign-up path). - * Gated by the same DISABLE_EMAIL_SIGNUP flag as the signup form; when - * set, better-auth also silently skips sending OTPs to unknown emails - * (enumeration-safe) while existing users keep OTP sign-in. + * Gated by the same DISABLE_EMAIL_SIGNUP flag as the signup form (and by + * DISABLE_REGISTRATION, whose /sign-up path check has the same blind + * spot); when set, better-auth also silently skips sending OTPs to + * unknown emails (enumeration-safe) while existing users keep OTP + * sign-in. */ - disableSignUp: isEmailSignupDisabled, + disableSignUp: isEmailSignupDisabled || isRegistrationDisabled, sendVerificationOnSignUp: false, otpLength: 6, // Explicitly set the OTP length expiresIn: 15 * 60, // 15 minutes in seconds