The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jun 15, 2026 11:33pm

PR Summary

High Risk
Changes authentication entry points (new OAuth provider, signup restrictions, and server-side sign-up blocking), which are security-sensitive and affect who can create accounts.

Overview
Adds Microsoft as a social sign-in/sign-up option end-to-end: Better Auth microsoft provider (when credentials are set and not disabled), microsoftAvailable on the provider checker/API contract, and buttons on login, signup, social login, and the landing auth modal. DISABLE_MICROSOFT_AUTH can hide Microsoft even with credentials configured.

Introduces DISABLE_EMAIL_SIGNUP to block new email/password registrations on the server (/sign-up/email) while leaving email login unchanged. Signup UI gates the email form on emailSignupEnabled (from that flag); the auth modal only shows “Continue with email” on the login view, not signup.

Updates the Microsoft brand icon SVG. Includes a generated copilot tool-schema key style tweak (quoted keys → bare identifiers) with no behavioral change.

^{Reviewed by Cursor Bugbot for commit e6d4bf2. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

This PR adds Microsoft as a first-class OAuth provider and restricts new registrations to OAuth-only by hiding the email/password signup form while leaving email login untouched. The change is well-layered: server-side guard (isEmailSignupDisabled in the Better Auth before hook), feature-flag, env-var, API contract, and every UI surface (auth modal, signup form, login form, landing modal) are all updated consistently.

• Microsoft OAuth is conditionally registered in Better Auth only when both credentials are present and the disable flag is off, following the same pattern as the existing Google/GitHub providers.
• emailEnabled on the signup path now AND-gates the NEXT_PUBLIC_EMAIL_PASSWORD_SIGNUP_ENABLED client flag with the new server-side emailSignupEnabled prop, preventing the email form from rendering even if the public env var is permissive.
• The MicrosoftIcon SVG is refreshed with official brand colours; the tool-schemas-v1.ts file receives a cosmetic cleanup removing unnecessary bracket syntax from string literal keys.

Confidence Score: 5/5

Safe to merge — the email signup restriction is enforced at three independent layers so no single misconfiguration can bypass it, and the Microsoft OAuth wiring mirrors the existing Google/GitHub pattern throughout.

All changed paths are straightforward additions that follow established patterns. The dual-layer email-signup guard is solid. No broken auth flows, no data exposure, no regressions in the login path.

No files require special attention. The SVG coordinate/viewBox mismatch in icons.tsx and the hardcoded provider list in the auth hook error message are cosmetic nits.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User opens auth modal] --> B{view === signup?}
    B -- yes --> C[Show OAuth buttons only]
    B -- no / login --> D[Show OAuth buttons + Continue with email]
    C --> E[OAuth redirect]
    D --> F{Email clicked?}
    F -- yes --> G[Redirect to /login page]
    F -- no --> E
    H[User visits /signup directly] --> I{emailEnabled?}
    I -- yes --> J[Show email/password form + OAuth buttons]
    I -- no --> K[Show OAuth buttons only]
    J --> L[POST /sign-up/email]
    L --> M{isEmailSignupDisabled in Better Auth hook?}
    M -- yes --> N[403 FORBIDDEN]
    M -- no --> O[Account created]
    K --> E

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[User opens auth modal] --> B{view === signup?}
    B -- yes --> C[Show OAuth buttons only]
    B -- no / login --> D[Show OAuth buttons + Continue with email]
    C --> E[OAuth redirect]
    D --> F{Email clicked?}
    F -- yes --> G[Redirect to /login page]
    F -- no --> E
    H[User visits /signup directly] --> I{emailEnabled?}
    I -- yes --> J[Show email/password form + OAuth buttons]
    I -- no --> K[Show OAuth buttons only]
    J --> L[POST /sign-up/email]
    L --> M{isEmailSignupDisabled in Better Auth hook?}
    M -- yes --> N[403 FORBIDDEN]
    M -- no --> O[Account created]
    K --> E

_{Reviews (2): Last reviewed commit: "fix(config): restore isHosted hostname c..." | Re-trigger Greptile}

@greptile review