@splyntra/dashboard 1.0.0 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@splyntra/dashboard",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Splyntra open dashboard — the composable source the commercial cloud build overlays. Published as source (not a prebuilt library): consumers compose it with their overlays + `next build`.",
   "license": "AGPL-3.0-only",
   "repository": {

package/src/auth.ts

@@ -11,11 +11,22 @@ import { registeredAuthProviders, registeredSignInHooks } from "@/lib/auth-exten
 
 export const { handlers, auth, signIn, signOut } = NextAuth({
   ...authConfig,
-  events: {
-    async signIn({ user, account }) {
+  callbacks: {
+    ...authConfig.callbacks,
+    // Sign-in guards run BEFORE a session is issued and can DENY sign-in. The
+    // cloud build registers one that persists/links the OAuth identity (refusing
+    // unverified-email linking) and fails closed — so a user never ends up with a
+    // session but no backing user row. Open edition registers none (always true).
+    async signIn({ user, account, profile }) {
       for (const hook of registeredSignInHooks()) {
-        await hook(user as { id?: string; email?: string | null }, account);
+        try {
+          const ok = await hook(user as { id?: string; email?: string | null }, account, profile);
+          if (ok === false) return false;
+        } catch {
+          return false; // fail closed
+        }
       }
+      return true;
     },
   },
   providers: [

package/src/lib/auth-extensions.ts

@@ -12,7 +12,15 @@ import type { NextAuthConfig } from "next-auth";
 
 type Provider = NonNullable<NextAuthConfig["providers"]>[number];
 type SignInUser = { id?: string; email?: string | null; name?: string | null };
-type SignInHook = (user: SignInUser, account: unknown) => Promise<void> | void;
+// A sign-in guard runs in the next-auth `signIn` callback (it can DENY sign-in).
+// Return false (or throw) to reject; void/true allows. Used by the cloud build to
+// link the OAuth identity and refuse unverified-email linking — and to fail
+// closed if persistence fails (so a user never gets a session with no backing row).
+type SignInHook = (
+  user: SignInUser,
+  account: unknown,
+  profile: unknown
+) => Promise<boolean | void> | boolean | void;
 
 const extraProviders: Provider[] = [];
 const signInHooks: SignInHook[] = [];