The getSocialProviders endpoint was manually pushing "oidc" to the
providers array when OIDC env vars are present, but Better Auth already
includes the OIDC provider in ctx.context.socialProviders when it is
configured. This resulted in ["oidc","oidc"] being returned from
/api/auth/social-providers, causing a duplicate provider registration
that led to a TypeError: Cannot read properties of null (reading 'id')
during the OIDC login callback, preventing all OIDC logins.
Fix: remove the manual providers.push("oidc") block as it is redundant.
* fix: allow invited users to sign up when registration is disabled
Move sign-up restriction logic from better-auth's disableSignUp config
to the existing user.create.before database hook, which already checks
for pending invitations. The frontend signup and login pages now detect
invite flows (?next=/invite/...) and bypass the disabled UI accordingly.
Closes#411
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add regression tests for sign-up hook invite bypass
Verify that the user.create.before database hook correctly:
- allows sign-up when registration is not disabled
- blocks sign-up when disabled and no invitation exists
- allows sign-up when disabled but a pending invitation exists
- respects BETTER_AUTH_ALLOWED_DOMAINS in combination with invites
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add OIDC/social sign-up path coverage for invite bypass
Address review suggestion: add explicit tests verifying the
user.create.before hook handles OIDC/social sign-ups the same way as
email/password — invited users are allowed, uninvited users are blocked.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: replace presigned URL uploads with backend upload endpoints
* feat: update avatar upload to use new endpoint
* refactor: use createS3Client in auth hooks
* feat: generate presigned URLs for avatars
* fix: show avatar image in user menu
* fix: hide tooltip if content is empty
* fix: support external avatar URLs in generateAvatarUrl
* fix: remove content type restriction on attachments
* feat(cloud): add free trial
* fix: center workspace name icon when collapsed
* feat: add 14 day free trial notice to pricing page
* feat: hide upgrade button when on active subscription
* chore: translations
The `/social-providers` endpoint should return a list of the provider ids, not their names.
This was found when trying to use the microsoft endpoint and the endpoint was returning `"microsoft entraid"`, when the `AuthForm` expects it to just be `"microsoft"`.
* feat: add password reset functionality with email template and credentials config
* feat: add authentication configuration options and improve development setup
* feat: add password-based authentication and signup control flags
* feat: update auth form to support name field
* fix: prevent password icon from overlaying the input text
---------
Co-authored-by: Henry <henry_ball@hotmail.co.uk>
* feat: add account deletion functionality with cascade delete for workspace relations
* fix: add cascade delete to workspace user foreign key constraints
* fix: change onDelete action to set null for user references in schema
* feat: tweak design
---------
Co-authored-by: Henry <henry_ball@hotmail.co.uk>
Co-authored-by: Henry <30578846+hjball@users.noreply.github.com>
* feat: add S3 avatar upload during user creation from social provider
* chore: remove console.log and update storage config for local development
* refactor: move avatar upload to after user creation and use user ID for filename
* feat: update avatar storage path
