feat(auth): ship magic link as a real production sign-in method (LAC-3800) - #66
Open
lacymorrow wants to merge 1 commit into
Open
lacymorrow wants to merge 1 commit into
lacymorrow wants to merge 1 commit into
Conversation
…3800) Remove the NODE_ENV guard that disabled the Resend provider in production builds; downstreams inheriting it got a working magic link in dev and a sign-in page with no way in once deployed. - AUTH_RESEND_ENABLED now requires RESEND_API_KEY + RESEND_FROM_EMAIL (a sender on a Resend-verified domain) and works in production - Provider gating aligned with the flag (was AUTH_RESEND_KEY) and sends from RESEND_FROM_EMAIL instead of siteConfig.email.support - New AUTH_ALLOWED_EMAILS allowlist enforced in the Auth.js signIn callback, which runs before sendVerificationRequest, so unknown addresses get AccessDenied and no email is ever sent Mirrors the same change in premium shipkit (lacymorrow/shipkit). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Paperclip issue: LAC-3800 (mirrors the premium shipkit change; keeps downstreams from re-inheriting the dev-only guard)
NODE_ENV !== "production"term fromAUTH_RESEND_ENABLED: downstreams withRESEND_API_KEYset got a working magic link in dev and a sign-in page with no way in once deployed (Keepsake hit this 2026-09-08, keepsake@a322834).AUTH_RESEND_ENABLEDnow requiresRESEND_API_KEY+RESEND_FROM_EMAIL(a sender on a Resend-verified domain); off withDISABLE_AUTH_RESEND.AUTH_RESEND_KEY) and sends fromRESEND_FROM_EMAILinstead ofsiteConfig.email.support.AUTH_ALLOWED_EMAILSallowlist (comma-separated addresses/domains) enforced in the Auth.jssignIncallback. Auth.js runssignInbeforesendVerificationRequest, so unknown addresses getAccessDeniedand no email is ever sent..env.example+ env schema document the new vars.Rate limiting is premium-shipkit-only (bones has no Upstash dependency); the allowlist is dependency-free.
Testing
pnpm vitest run tests/unit/magic-link-allowlist.test.ts: 6 passedtsc --noEmit: clean🤖 Generated with Claude Code