fix(auth): gate email-otp auto-signup behind DISABLE_EMAIL_SIGNUP

[waleedlatif1]

Summary

• `DISABLE_EMAIL_SIGNUP` only blocked the `/sign-up/email` path, but better-auth's email-otp plugin auto-registers any unknown email on `/sign-in/email-otp` — so new accounts could still be created with the flag set
• Wire the same flag into better-auth's native `disableSignUp` option on both `emailAndPassword` and the `emailOTP` plugin, and drop the now-redundant path-string check in the before-hook
• With `disableSignUp` set, the OTP plugin also skips sending sign-in codes to unknown emails (enumeration-safe) while existing users keep OTP sign-in, email/password sign-in, and the verify-email flow unchanged; social/SSO signup is unaffected

Type of Change

• Bug fix

Testing

Verified against better-auth 1.6.13 source: unknown-email OTP sign-in rejects instead of creating a user; existing-user OTP sign-in, email/password sign-in, and email verification paths unchanged. Typecheck and lint pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 22, 2026 6:18am

[cursor]

PR Summary

Medium Risk
Touches authentication signup gates; behavior change is intentional but could block legitimate OTP-first signups when flags are set.

Overview
Closes a signup bypass where DISABLE_EMAIL_SIGNUP only blocked /sign-up/email, while better-auth’s email-OTP flow could still auto-create accounts for unknown emails on /sign-in/email-otp (skipping captcha and the normal sign-up path).

The same env flags are now wired into better-auth’s native disableSignUp on emailAndPassword (isEmailSignupDisabled) and emailOTP (isEmailSignupDisabled || isRegistrationDisabled), so direct API calls cannot bypass the UI gate. The redundant /sign-up/email path check in the auth before hook is removed in favor of the plugin-level enforcement.

With signup disabled, OTP sign-in for existing users is unchanged; unknown emails no longer get OTPs in an enumeration-safe way. Social/SSO registration is untouched.

^{Reviewed by Cursor Bugbot for commit ba91922. Configure here.}

[greptile-apps]

Greptile Summary

This PR closes email signup paths that bypassed registration settings. The main changes are:

• Applies DISABLE_EMAIL_SIGNUP through Better Auth's native email/password signup control.
• Blocks email-OTP auto-registration when email signup or all registration is disabled.
• Removes the redundant path-based email signup check.

Confidence Score: 5/5

This looks safe to merge.

• The native email/password setting blocks direct email registration.
• The email-OTP setting covers unknown-user account creation under both registration flags.
• No blocking issue was found in the updated authentication path.

Important Files Changed

Filename	Overview
apps/sim/lib/auth/auth.ts	Moves email registration enforcement to Better Auth's native signup controls and covers email-OTP auto-registration.

_{Reviews (2): Last reviewed commit: "fix(auth): also close otp auto-signup un..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ba91922. Configure here.}