* fix: allow invited users to sign up when registration is disabled
Move sign-up restriction logic from better-auth's disableSignUp config
to the existing user.create.before database hook, which already checks
for pending invitations. The frontend signup and login pages now detect
invite flows (?next=/invite/...) and bypass the disabled UI accordingly.
Closes#411
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add regression tests for sign-up hook invite bypass
Verify that the user.create.before database hook correctly:
- allows sign-up when registration is not disabled
- blocks sign-up when disabled and no invitation exists
- allows sign-up when disabled but a pending invitation exists
- respects BETTER_AUTH_ALLOWED_DOMAINS in combination with invites
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add OIDC/social sign-up path coverage for invite bypass
Address review suggestion: add explicit tests verifying the
user.create.before hook handles OIDC/social sign-ups the same way as
email/password — invited users are allowed, uninvited users are blocked.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: replace presigned URL uploads with backend upload endpoints
* feat: update avatar upload to use new endpoint
* refactor: use createS3Client in auth hooks
* feat: generate presigned URLs for avatars
* fix: show avatar image in user menu
* fix: hide tooltip if content is empty
* fix: support external avatar URLs in generateAvatarUrl
* fix: remove content type restriction on attachments
* feat(cloud): add free trial
* fix: center workspace name icon when collapsed
* feat: add 14 day free trial notice to pricing page
* feat: hide upgrade button when on active subscription
* chore: translations
The `/social-providers` endpoint should return a list of the provider ids, not their names.
This was found when trying to use the microsoft endpoint and the endpoint was returning `"microsoft entraid"`, when the `AuthForm` expects it to just be `"microsoft"`.
* feat: add password reset functionality with email template and credentials config
* feat: add authentication configuration options and improve development setup
* feat: add password-based authentication and signup control flags
* feat: update auth form to support name field
* fix: prevent password icon from overlaying the input text
---------
Co-authored-by: Henry <henry_ball@hotmail.co.uk>
* feat: add account deletion functionality with cascade delete for workspace relations
* fix: add cascade delete to workspace user foreign key constraints
* fix: change onDelete action to set null for user references in schema
* feat: tweak design
---------
Co-authored-by: Henry <henry_ball@hotmail.co.uk>
Co-authored-by: Henry <30578846+hjball@users.noreply.github.com>
* feat: add S3 avatar upload during user creation from social provider
* chore: remove console.log and update storage config for local development
* refactor: move avatar upload to after user creation and use user ID for filename
* feat: update avatar storage path
