[waleedlatif1]

Summary

• fix(auth): refuse account creation from disposable email domains for every provider #9516 vendored the union of the auto-generated disposable/disposable-email-domains list (~98.5k) and the curated CC0 disposable-email-domains blocklist. The auto-generated list includes real companies and ISP mail (railway.com, namecheap.com, q.com, yandex.net, cafe24.com, domain.com…) and public suffixes (msk.ru, it.com, pp.ua, dyndns.org, ddns.net…) which, with parent-domain matching, refused every *.msk.ru company
• Ship only the curated CC0 list (the one PyPI uses), generated by bun run vendor:disposable-email-domains from the same pinned commit: entries that aren't a registrable domain under tldts (ICANN or private suffixes) are dropped, relays moved out of runtime, and a commented list of real providers removed (21cn.com, hola.org, sify.com). 10,079 domains (was 98,687); the Tranco top-20k intersection is 7, all genuinely disposable/dynamic-DNS
• Never gate org-controlled provisioning: SCIM (/admin/create-user, whose 403 made IdPs retry forever) and SSO callbacks (domain-verified providers) skip the check; email signup, social OAuth and generic OAuth stay gated
• Domain is taken after the last @ with a trailing dot stripped; fail-open on load error kept
• Email/password signup now shows the disposable-email message on the email field instead of "Failed to create account"

Type of Change

• Bug fix

Testing

• disposable.test.ts: listed/subdomain/case/trailing-dot/quoted-@ refused; company.msk.ru, acme.it.com, railway.com, relays and gmail allowed; invariant that the JSON contains no public suffix. 8 cases fail on the old code and list
• disposable-email-gate.test.ts (real betterAuth + memory adapter + admin plugin): disposable email signup refused with DISPOSABLE_EMAIL, company.msk.ru signup succeeds, SCIM createUser succeeds, SSO callback paths skip, social/generic OAuth gated; disabling the skip turns SCIM and SSO red
• Targeted type-check of changed files, biome; full gate in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 31, 2026 6:15pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issue was found.

Summary

Narrows disposable-email blocking to the curated list and exempts SSO and SCIM account creation.

• Hosted account creation skips the disposable check for organization provisioning.
• Disposable-email checks now match a curated set of domains.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Account creation] --> B[Existing access checks]
  B --> C{Hosted deployment?}
  C -->|No| G[Continue account creation]
  C -->|Yes| D{SSO callback or admin create?}
  D -->|Yes| G
  D -->|No| E[Normalize email domain]
  E --> F{Domain or parent listed?}
  F -->|Yes| H[Refuse with DISPOSABLE_EMAIL]
  F -->|No or list load fails| G

Loading

_{Reviews (1) · Last reviewed commit: "fix(auth): block only curated disposable..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 10 files

<sub>This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic</sub>