#437 Refuse Deactivated Accounts Before Sending An OTP

[b-at-neu]

Closes #437

Refuses deactivated accounts at the login email step, before an OTP is requested.

Scope changed after testing — read this first

This PR originally provisioned a Neon Auth user before requesting the OTP, on the premise (from #435) that Neon skips its send.otp webhook for addresses with no neon_auth.user row. That premise was tested on 2026-08-15 and is false. With webhooks disabled so Neon delivers mail itself, an address with 0 rows in neon_auth.user — still 0 after the request — received its OTP normally, alongside a control address that already had a row.

The actual outage was upstream: Neon's send.otp dispatch fails silently, returning 200 {"success":true} while no request reaches the endpoint and no email is sent, with built-in delivery suppressed because the event is subscribed. On the same branch and config, send.magic_link returns 502 WEBHOOK_DELIVERY_FAILED. Webhooks are now disabled on dev and production, so sign-in and sign-up work via Neon's built-in email. Re-enabling branded email is tracked in #448.

So the provisioning half is gone. What remains is the deactivated-account refusal, which stands on its own.

Changes

• prisma/actions/auth.ts — checkSignInAllowed: zod-validated email, case-insensitive lookup for a soft-deleted User, returns { error } if found. No auth check (pre-auth surface, covered by the middleware's public rate-limit tier). No Neon API call.
• components/features/login-view.tsx — called before sendVerificationOtp; the error surfaces as a toast and the form stays on the email step.
• lib/constants.ts — adds signInEmailSchema, shared by the action and the form resolver.
• lib/auth/admin.ts / prisma/actions/users.ts / components/features/create-user-dialog.tsx — createNeonAuthUser now requires name, and the admin create-user form requires one. Neon rejects a nameless create with 400 [body.name] Invalid input: expected string, received null despite its OpenAPI spec marking name optional. This was a latent bug from Allow Admins To Create User Accounts #239: a blank name in that dialog failed with no explanation. Unrelated to the login path, fixed here because it surfaced during this work.

Why the deactivated check matters on its own

Soft-deleted rows deliberately keep their email and neonAuthId. Without this check a deactivated user receives an OTP, authenticates successfully, then hits if (row.deletedAt) return null in resolveRealUser and is bounced to /login with no explanation — an unexplained loop.

Accepted tradeoff: the response now differs for deactivated accounts, so it is possible to probe which addresses were deactivated. Acceptable for an internal tool, and the message avoids confirming more than necessary.

Testing

• prettier:check, eslint:check, tsc:check clean
• Deactivate a user in /users, sign out, submit that email → exactly Your account has been deactivated. Please contact an administrator., still on step 1, no email received
• Same address with different capitalization → same refusal
• Active account signs in unchanged
• Never-seen address signs up unchanged
• Admin create-user with a blank name → inline field error; with a name → succeeds

Notes for review

• resolveRealUser is no longer touched by this PR — the guard added for the name placeholder was removed along with the placeholder.
• Reviewers of earlier cycles: the provisioning logic, AUTH_NAME_PLACEHOLDER, and the resolveRealUser change are all gone. The name-required fixes remain and are the only thing outside the login path.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aplio	Ready	Preview	Aug 16, 2026 2:45pm

[b-at-neu]

Code Review — Cycle 1 · needs revision

2 open — 2 🟡 Low (see inline)

[b-at-neu]

Revision — Cycle 1

fixed R1-L1, R1-L2 · 6793dab

[b-at-neu]

Code Review — Cycle 2 · needs revision

1 open — 1 🟡 Low (see inline)

[b-at-neu]

Revision — Cycle 2

fixed R2-L1 · c71339f

[b-at-neu]

Code Review — Cycle 6 · approved

0 open — clean

[b-at-neu]

Revision — Cycle 6

comment cleanup (human-directed, not a review finding): 4 deleted, 3 condensed, 0 kept as 2-line exceptions · a8077f6

[b-at-neu]

Code Review — Cycle 7 · approved

0 open — clean

[b-at-neu]

Code Review — Cycle 8 · approved

0 open — clean