[comp] Production Deploy

apps/api/src/auth/auth.server.ts

@@ -18,6 +18,10 @@ import { ac, allRoles } from '@trycompai/auth';
 import { createAuthMiddleware } from 'better-auth/api';
 import { Redis } from '@upstash/redis';
 import type { AccessControl } from 'better-auth/plugins/access';
+import {
+  resolveMicrosoftEmail,
+  type MicrosoftEmailClaims,
+} from './microsoft-email';
 
 const MAGIC_LINK_EXPIRES_IN_SECONDS = 60 * 60; // 1 hour
 
@@ -184,6 +188,13 @@ if (
     clientSecret: process.env.AUTH_MICROSOFT_CLIENT_SECRET,
     tenantId: process.env.AUTH_MICROSOFT_TENANT_ID || 'common',
     prompt: 'select_account',
+    // Microsoft Entra often omits the `email` claim for work/school accounts,
+    // which makes better-auth abort sign-in with `email_not_found`. Fall back to
+    // the username/UPN claims so these users can sign in. Accounts that DO return
+    // an `email` claim are unaffected. See ./microsoft-email.ts.
+    mapProfileToUser: (profile: MicrosoftEmailClaims) => ({
+      email: resolveMicrosoftEmail(profile),
+    }),
   };
 }
 

apps/api/src/auth/microsoft-email.spec.ts

@@ -0,0 +1,84 @@
+import { resolveMicrosoftEmail } from './microsoft-email';
+
+describe('resolveMicrosoftEmail', () => {
+  it('returns the email claim unchanged when present (no regression for working accounts)', () => {
+    expect(
+      resolveMicrosoftEmail({
+        email: 'real@corp.com',
+        preferred_username: 'login@corp.onmicrosoft.com',
+        upn: 'upn@corp.com',
+      }),
+    ).toBe('real@corp.com');
+  });
+
+  it('falls back to preferred_username when the email claim is missing', () => {
+    expect(
+      resolveMicrosoftEmail({
+        preferred_username: 'login@corp.com',
+        upn: 'upn@corp.com',
+      }),
+    ).toBe('login@corp.com');
+  });
+
+  it('falls back to upn when email and preferred_username are missing', () => {
+    expect(resolveMicrosoftEmail({ upn: 'upn@corp.com' })).toBe('upn@corp.com');
+  });
+
+  it('returns undefined when no identifier is present (still fails loudly)', () => {
+    expect(resolveMicrosoftEmail({})).toBeUndefined();
+  });
+
+  it('treats empty / whitespace-only claims as missing and falls back', () => {
+    expect(
+      resolveMicrosoftEmail({ email: '   ', preferred_username: 'login@corp.com' }),
+    ).toBe('login@corp.com');
+  });
+
+  it('handles null claims (Entra may send null) and falls back', () => {
+    expect(
+      resolveMicrosoftEmail({
+        email: null,
+        preferred_username: null,
+        upn: 'upn@corp.com',
+      }),
+    ).toBe('upn@corp.com');
+  });
+
+  it('trims surrounding whitespace from the chosen value', () => {
+    expect(resolveMicrosoftEmail({ email: '  real@corp.com  ' })).toBe(
+      'real@corp.com',
+    );
+  });
+
+  it('returns undefined when every claim is empty/whitespace', () => {
+    expect(
+      resolveMicrosoftEmail({ email: '', preferred_username: '  ', upn: '' }),
+    ).toBeUndefined();
+  });
+
+  it('prefers preferred_username over upn when both are present (and email absent)', () => {
+    expect(
+      resolveMicrosoftEmail({ preferred_username: 'pref@corp.com', upn: 'upn@corp.com' }),
+    ).toBe('pref@corp.com');
+  });
+
+  it('does not crash on a non-string claim (untrusted JWT) and falls back', () => {
+    // The decoded ID token is attacker-influenced; a non-string claim must not
+    // throw (e.g. .trim() on a number). Cast through unknown to simulate it.
+    const malformed = {
+      email: 12345,
+      preferred_username: { spoofed: true },
+      upn: 'upn@corp.com',
+    } as unknown as Parameters<typeof resolveMicrosoftEmail>[0];
+    expect(resolveMicrosoftEmail(malformed)).toBe('upn@corp.com');
+  });
+
+  it('returns undefined when all claims are present but none are usable strings', () => {
+    const malformed = {
+      email: 0,
+      preferred_username: null,
+      upn: false,
+    } as unknown as Parameters<typeof resolveMicrosoftEmail>[0];
+    expect(resolveMicrosoftEmail(malformed)).toBeUndefined();
+  });
+});

apps/api/src/auth/microsoft-email.ts

@@ -0,0 +1,51 @@
+/**
+ * Resolve a usable email address for a Microsoft (Entra ID) sign-in.
+ *
+ * better-auth's built-in `microsoft` provider derives the user's email solely
+ * from the ID token's `email` claim (see `@better-auth/core`
+ * `social-providers/microsoft-entra-id`: `email: user.email`). Microsoft Entra
+ * only emits that claim when the account has a `mail` attribute set, or when
+ * `email` is configured as an optional claim in the app registration. Many
+ * work/school accounts therefore arrive with NO `email` claim — and better-auth
+ * then aborts the sign-in with `error=email_not_found`, bouncing the user to the
+ * API root (Swagger) instead of the app.
+ *
+ * We fall back to the username claims (`preferred_username`, then `upn`), which
+ * are the email-form login for Entra accounts. This mirrors better-auth's own
+ * `microsoftEntraId` generic-oauth helper (`profile.email ?? profile.preferred_username`).
+ *
+ * Safety:
+ * - When Microsoft DOES return an `email` claim, this returns it unchanged —
+ *   accounts that already work are unaffected.
+ * - The input is a decoded, attacker-influenced JWT, so each claim is validated
+ *   to actually be a non-empty string at runtime (a malformed token with a
+ *   non-string claim must not crash sign-in).
+ * - Returns `undefined` only when no usable identifier is present, so a
+ *   genuinely identifier-less account still fails loudly rather than signing in
+ *   with an empty email.
+ */
+export interface MicrosoftEmailClaims {
+  email?: string | null;
+  preferred_username?: string | null;
+  upn?: string | null;
+}
+
+function firstNonEmptyString(...values: unknown[]): string | undefined {
+  for (const value of values) {
+    if (typeof value === 'string') {
+      const trimmed = value.trim();
+      if (trimmed) return trimmed;
+    }
+  }
+  return undefined;
+}
+
+export function resolveMicrosoftEmail(
+  profile: MicrosoftEmailClaims,
+): string | undefined {
+  return firstNonEmptyString(
+    profile.email,
+    profile.preferred_username,
+    profile.upn,
+  );
+}