From b839e6d6be9ee7a19272bce9ce20eb6f6afab475 Mon Sep 17 00:00:00 2001 From: somuai Date: Thu, 3 Sep 2026 16:40:21 +0530 Subject: [PATCH 1/4] fix(auth): enforce SSO on server-side sign-in endpoints Resolves #5288. - In better-auth hooks.before, reject /sign-in/email and /sign-in/social with FORBIDDEN when webServerSettings.enforceSSO is enabled - Prevents direct API password authentication when SSO enforcement is enabled --- packages/server/src/lib/auth.ts | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/packages/server/src/lib/auth.ts b/packages/server/src/lib/auth.ts index ab52c6ca2..ad38a4ffc 100644 --- a/packages/server/src/lib/auth.ts +++ b/packages/server/src/lib/auth.ts @@ -125,6 +125,19 @@ const createBetterAuth = () => ...(ctx.context.baseURL ? [new URL(ctx.context.baseURL).origin] : []), ...(await resolveTrustedOrigins()), ].filter(Boolean); + + if ( + !IS_CLOUD && + (ctx.path.startsWith("/sign-in/email") || + ctx.path.startsWith("/sign-in/social")) + ) { + const settings = await getWebServerSettings(); + if (settings?.enforceSSO) { + throw new APIError("FORBIDDEN", { + message: "SSO is enforced. Direct password and social sign-in are disabled.", + }); + } + } }), }, emailVerification: { From 9568a4f9f8f5541479d9be62d9edc52716756032 Mon Sep 17 00:00:00 2001 From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com> Date: Thu, 3 Sep 2026 11:10:44 +0000 Subject: [PATCH 2/4] [autofix.ci] apply automated fixes --- packages/server/src/lib/auth.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/server/src/lib/auth.ts b/packages/server/src/lib/auth.ts index ad38a4ffc..0bd5014a7 100644 --- a/packages/server/src/lib/auth.ts +++ b/packages/server/src/lib/auth.ts @@ -134,7 +134,8 @@ const createBetterAuth = () => const settings = await getWebServerSettings(); if (settings?.enforceSSO) { throw new APIError("FORBIDDEN", { - message: "SSO is enforced. Direct password and social sign-in are disabled.", + message: + "SSO is enforced. Direct password and social sign-in are disabled.", }); } } From 5faa363f7a8cdaecc397d21a296487353b857bdc Mon Sep 17 00:00:00 2001 From: "detail-app[bot]" <180357370+detail-app[bot]@users.noreply.github.com> Date: Thu, 3 Sep 2026 18:53:08 +0000 Subject: [PATCH 3/4] docs: drop stale .mcp.json reference in fix-issue skill --- .claude/skills/fix-issue/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.claude/skills/fix-issue/SKILL.md b/.claude/skills/fix-issue/SKILL.md index 226083304..9418a626b 100644 --- a/.claude/skills/fix-issue/SKILL.md +++ b/.claude/skills/fix-issue/SKILL.md @@ -16,7 +16,7 @@ No instance is running yet — start your own, isolated to this worktree: until it answers (usually ~10-15s). 3. Use `http://localhost:$PORT` as the base URL for Playwright navigation. -Note: `mcp__dokploy__*` (this repo's `.mcp.json`) resolves its URL from +Note: `mcp__dokploy__*` resolves its URL from `$DOKPLOY_BASE_URL` once, at session startup — it cannot pick up a port discovered mid-session. If those tools are unavailable or point at the wrong instance, fall back to `curl`/`gh api` for API-level checks, or ask the user From 5f10ed6884af889365d7f0a639fa22a25d3fa571 Mon Sep 17 00:00:00 2001 From: somuai Date: Fri, 4 Sep 2026 01:11:04 +0530 Subject: [PATCH 4/4] fix(auth): block passkey authentication and email signup when SSO is enforced - Include /sign-in/passkey, /passkey/verify-authentication, /passkey/generate-authenticate-options, and /sign-up/email in enforced SSO block - Prevents registered passkeys from bypassing enforced SSO policies --- packages/server/src/lib/auth.ts | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/packages/server/src/lib/auth.ts b/packages/server/src/lib/auth.ts index 0bd5014a7..10d62a5b0 100644 --- a/packages/server/src/lib/auth.ts +++ b/packages/server/src/lib/auth.ts @@ -126,16 +126,20 @@ const createBetterAuth = () => ...(await resolveTrustedOrigins()), ].filter(Boolean); - if ( - !IS_CLOUD && - (ctx.path.startsWith("/sign-in/email") || - ctx.path.startsWith("/sign-in/social")) - ) { + const isBlockedAuthPath = + ctx.path.startsWith("/sign-in/email") || + ctx.path.startsWith("/sign-in/social") || + ctx.path.startsWith("/sign-in/passkey") || + ctx.path.startsWith("/sign-up/email") || + ctx.path.startsWith("/passkey/verify-authentication") || + ctx.path.startsWith("/passkey/generate-authenticate-options"); + + if (!IS_CLOUD && isBlockedAuthPath) { const settings = await getWebServerSettings(); if (settings?.enforceSSO) { throw new APIError("FORBIDDEN", { message: - "SSO is enforced. Direct password and social sign-in are disabled.", + "SSO is enforced. Direct password, social, and passkey sign-in are disabled.", }); } }