From 4dd96307ec1e16a02ee02e7092fca9b8e699fcd9 Mon Sep 17 00:00:00 2001 From: Nicolas Meienberger Date: Sun, 21 Jun 2026 11:50:44 +0200 Subject: [PATCH] fix(sso): allow verified invitation account linking --- app/server/modules/sso/sso.integration.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/app/server/modules/sso/sso.integration.ts b/app/server/modules/sso/sso.integration.ts index be50d709..00a4695b 100644 --- a/app/server/modules/sso/sso.integration.ts +++ b/app/server/modules/sso/sso.integration.ts @@ -170,7 +170,10 @@ async function beforeAcceptInvitation({ invitation }: AcceptInvitationHookData) export const ssoIntegration = { plugin: sso({ - trustEmailVerified: false, + // Better Auth's SSO callback only reaches our account-linking hook when the + // provider email is trusted. The hook below still enforces org membership or + // an explicit invitation intent before any existing account can be linked. + trustEmailVerified: true, providersLimit: async (user: User) => { const isOrgAdmin = await authService.isOrgAdminAnywhere(user.id); return isOrgAdmin ? 10 : 0;