Skip to content

Add User Blocking System with Smart Session Management#388

Merged
Dharp02 merged 3 commits into
mainfrom
block-someone-from-team
Jun 28, 2026
Merged

Add User Blocking System with Smart Session Management#388
Dharp02 merged 3 commits into
mainfrom
block-someone-from-team

Conversation

@Dharp02

@Dharp02 Dharp02 commented Jun 27, 2026

Copy link
Copy Markdown
Collaborator

Implement comprehensive user blocking functionality with organization-level granularity and intelligent blocking logic that handles multi-org scenarios.

Backend Changes:

  • Add Better Auth hooks to prevent blocked users from signing in (all auth methods)
  • Add session.create hook to block users blocked from ALL their orgs
  • Add user.create hook to prevent signup with blocked email addresses
  • Auto-cleanup stale blocking records when user is re-added to org
  • Auto-readd users as members when unblocking
  • Add block/unblock endpoints with reason tracking
  • Add migration for user.blocked field (array of org-level blocks)
  • Add activity log events for blocking/unblocking

Frontend Changes:

  • Add blockMessage to session context to expose blocking errors
  • Display user-friendly blocking messages in LoginForm
  • Add Block/Unblock UI in OrganizationMembersPage with reason dialog
  • Handle blocking errors for both email and GitHub OAuth sign-in
  • Prevent blocked emails from creating new accounts

Blocking Behavior:

  • User blocked from SOME orgs → can sign in, blocked orgs invisible
  • User blocked from ALL orgs → cannot sign in at all, clear error message
  • Stale blocks (user re-added manually) → ignored and cleaned up automatically
  • GitHub OAuth → blocked via same session hook as email auth
  • Unblocking → automatically restores org membership

Tests:

  • All 26 organization tests pass including enhanced unblock verification

Implement comprehensive user blocking functionality with organization-level
granularity and intelligent blocking logic that handles multi-org scenarios.

Backend Changes:
- Add Better Auth hooks to prevent blocked users from signing in (all auth methods)
- Add session.create hook to block users blocked from ALL their orgs
- Add user.create hook to prevent signup with blocked email addresses
- Auto-cleanup stale blocking records when user is re-added to org
- Auto-readd users as members when unblocking
- Add block/unblock endpoints with reason tracking
- Add migration for user.blocked field (array of org-level blocks)
- Add activity log events for blocking/unblocking

Frontend Changes:
- Add blockMessage to session context to expose blocking errors
- Display user-friendly blocking messages in LoginForm
- Add Block/Unblock UI in OrganizationMembersPage with reason dialog
- Handle blocking errors for both email and GitHub OAuth sign-in
- Prevent blocked emails from creating new accounts

Blocking Behavior:
- User blocked from SOME orgs → can sign in, blocked orgs invisible
- User blocked from ALL orgs → cannot sign in at all, clear error message
- Stale blocks (user re-added manually) → ignored and cleaned up automatically
- GitHub OAuth → blocked via same session hook as email auth
- Unblocking → automatically restores org membership

Tests:
- All 26 organization tests pass including enhanced unblock verification
@Dharp02 Dharp02 self-assigned this Jun 28, 2026
@Dharp02 Dharp02 merged commit 56a0b60 into main Jun 28, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Org and Team Admins should be able to block someone from team and overall huddle to block someone from tracking time

1 participant