Add User Blocking System with Smart Session Management#388
Merged
Conversation
Implement comprehensive user blocking functionality with organization-level granularity and intelligent blocking logic that handles multi-org scenarios. Backend Changes: - Add Better Auth hooks to prevent blocked users from signing in (all auth methods) - Add session.create hook to block users blocked from ALL their orgs - Add user.create hook to prevent signup with blocked email addresses - Auto-cleanup stale blocking records when user is re-added to org - Auto-readd users as members when unblocking - Add block/unblock endpoints with reason tracking - Add migration for user.blocked field (array of org-level blocks) - Add activity log events for blocking/unblocking Frontend Changes: - Add blockMessage to session context to expose blocking errors - Display user-friendly blocking messages in LoginForm - Add Block/Unblock UI in OrganizationMembersPage with reason dialog - Handle blocking errors for both email and GitHub OAuth sign-in - Prevent blocked emails from creating new accounts Blocking Behavior: - User blocked from SOME orgs → can sign in, blocked orgs invisible - User blocked from ALL orgs → cannot sign in at all, clear error message - Stale blocks (user re-added manually) → ignored and cleaned up automatically - GitHub OAuth → blocked via same session hook as email auth - Unblocking → automatically restores org membership Tests: - All 26 organization tests pass including enhanced unblock verification
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implement comprehensive user blocking functionality with organization-level granularity and intelligent blocking logic that handles multi-org scenarios.
Backend Changes:
Frontend Changes:
Blocking Behavior:
Tests: