improvement(auth): tighten the disposable-email signup gate and cover its failure modes

Author: waleedlatif1

apps/sim/app/oauth-error/page.tsx

@@ -52,11 +52,11 @@ const FRIENDLY: Record<string, string> = {
    */
   [SSO_REQUIRED_ERROR_CODE]: SSO_REQUIRED_MESSAGE,
   /**
-   * Account creation refused for a disposable email domain. Better Auth 1.7 redirects with the
-   * error's code; 1.6 redirects with its message, spaces joined by underscores.
+   * A disposable email domain refused at account creation. Better Auth 1.7 redirects with the
+   * error's code, 1.6 with its message slugged (spaces to underscores), so both keys map here.
    */
   [DISPOSABLE_EMAIL_ERROR_CODE]: DISPOSABLE_EMAIL_MESSAGE,
-  [DISPOSABLE_EMAIL_MESSAGE.split(' ').join('_')]: DISPOSABLE_EMAIL_MESSAGE,
+  [DISPOSABLE_EMAIL_MESSAGE.replaceAll(' ', '_')]: DISPOSABLE_EMAIL_MESSAGE,
   /** The provider returned no email claim, so there is nothing to sign in as. */
   email_not_found:
     'Your identity provider didn’t share an email address with us, so we couldn’t complete sign-in. Please contact your administrator.',

apps/sim/lib/auth/auth.ts

@@ -362,6 +362,7 @@ export const auth = betterAuth({
         before: async (user) => {
           const accessControl = await getAccessControlConfig()
           if (isEmailBlockedByAccessControl(user.email, accessControl)) {
+            // Plain Error, so OAuth shows only a generic failure, not that this email is blocked.
             throw new Error('Sign-ups from this email are not allowed.')
           }
           if (isHosted && (await isDisposableEmail(user.email))) {

apps/sim/lib/messaging/email/disposable.test.ts

@@ -0,0 +1,60 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const DOMAINS_MODULE = '@/lib/messaging/email/disposable-email-domains.json'
+
+async function loadChecker() {
+  vi.resetModules()
+  return (await import('@/lib/messaging/email/disposable')).isDisposableEmail
+}
+
+afterEach(() => {
+  vi.doUnmock(DOMAINS_MODULE)
+})
+
+describe('isDisposableEmail', () => {
+  it('refuses a listed domain and any subdomain of it, whatever the case or padding', async () => {
+    const isDisposableEmail = await loadChecker()
+
+    expect(await isDisposableEmail('a@mailinator.com')).toBe(true)
+    expect(await isDisposableEmail('a@inbox.mailinator.com')).toBe(true)
+    expect(await isDisposableEmail('  A@MailInator.COM ')).toBe(true)
+  })
+
+  it('allows mainstream providers and mail relays, including relay aliases upstream lists', async () => {
+    const isDisposableEmail = await loadChecker()
+
+    for (const email of [
+      'a@gmail.com',
+      'a@outlook.com',
+      'a@proton.me',
+      'a@addy.to',
+      'a@someone.mozmail.com',
+      'a@someone.anonaddy.com',
+      'a@privaterelay.appleid.com',
+    ]) {
+      expect(await isDisposableEmail(email), email).toBe(false)
+    }
+  })
+
+  it('allows an address with no domain instead of throwing', async () => {
+    const isDisposableEmail = await loadChecker()
+
+    for (const email of [undefined, null, '', 'no-at-sign', 'a@']) {
+      expect(await isDisposableEmail(email)).toBe(false)
+    }
+  })
+
+  it('allows the signup when the list cannot load, and loads it on the next call', async () => {
+    let failLoad = true
+    vi.doMock(DOMAINS_MODULE, () => {
+      if (failLoad) throw new Error('chunk load failed')
+      return { default: ['mailinator.com'] }
+    })
+    const isDisposableEmail = await loadChecker()
+
+    expect(await isDisposableEmail('a@mailinator.com')).toBe(false)
+
+    failLoad = false
+    expect(await isDisposableEmail('a@mailinator.com')).toBe(true)
+  })
+})

apps/sim/lib/messaging/email/disposable.ts

@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { normalizeEmail } from '@sim/utils/string'
 
 const logger = createLogger('DisposableEmail')
 
@@ -66,11 +67,11 @@ function loadDisposableDomains(): Promise<ReadonlySet<string>> {
  * mainstream providers (Gmail, Outlook, iCloud, Proton), none of which belong here.
  */
 export async function isDisposableEmail(email: string | null | undefined): Promise<boolean> {
-  const domain = email?.split('@')[1]?.trim().toLowerCase()
+  const domain = email ? normalizeEmail(email).split('@')[1] : undefined
   if (!domain) return false
 
   const labels = domain.split('.')
-  const candidates = labels.slice(0, -1).map((_, i) => labels.slice(i).join('.'))
+  const candidates = Array.from({ length: labels.length - 1 }, (_, i) => labels.slice(i).join('.'))
   if (candidates.some((candidate) => MAIL_RELAY_DOMAINS.has(candidate))) return false
 
   let domains: ReadonlySet<string>