fix(auth): skip email verification when no mail provider is configured

Signup pushed /verify unconditionally, stranding self-hosted deployments
with no mail provider on a screen no email could ever satisfy. Derive one
server-side effective value (verification enabled AND deliverable) and read
it from Better Auth enforcement, signup routing, and the verify page.

Author: TheodoreSpeaks

apps/sim/app/(auth)/auth-redirect.test.ts

@@ -0,0 +1,59 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { buildAuthCrossLink, resolvePostSignupDestination } from '@/app/(auth)/auth-redirect'
+
+describe('resolvePostSignupDestination', () => {
+  it('routes to the verify hop when verification is enforceable', () => {
+    expect(
+      resolvePostSignupDestination({ emailVerificationEnabled: true, redirectUrl: '' })
+    ).toEqual({ kind: 'verify' })
+  })
+
+  it('keeps the verify hop owning the callback URL when verification is enforceable', () => {
+    expect(
+      resolvePostSignupDestination({
+        emailVerificationEnabled: true,
+        redirectUrl: '/invite/abc',
+      })
+    ).toEqual({ kind: 'verify' })
+  })
+
+  /**
+   * Regression guard: signup used to push `/verify` unconditionally, stranding
+   * self-hosted deployments with no mail provider on a screen no email can
+   * satisfy.
+   */
+  it('never routes to verify when no mail provider is configured', () => {
+    expect(
+      resolvePostSignupDestination({ emailVerificationEnabled: false, redirectUrl: '' })
+    ).toEqual({ kind: 'workspace' })
+  })
+
+  it('preserves the callback URL when verification is not enforceable', () => {
+    expect(
+      resolvePostSignupDestination({
+        emailVerificationEnabled: false,
+        redirectUrl: '/cli/auth?callback=http%3A%2F%2F127.0.0.1%3A9000&state=xyz',
+      })
+    ).toEqual({
+      kind: 'redirect',
+      url: '/cli/auth?callback=http%3A%2F%2F127.0.0.1%3A9000&state=xyz',
+    })
+  })
+})
+
+describe('buildAuthCrossLink', () => {
+  it('carries the invite flow and callback URL across the login/signup hop', () => {
+    expect(buildAuthCrossLink('/login', { callbackUrl: '/invite/abc', isInviteFlow: true })).toBe(
+      '/login?invite_flow=true&callbackUrl=%2Finvite%2Fabc'
+    )
+  })
+
+  it('drops the query entirely when nothing needs carrying', () => {
+    expect(buildAuthCrossLink('/signup', { callbackUrl: null, isInviteFlow: false })).toBe(
+      '/signup'
+    )
+  })
+})

apps/sim/app/(auth)/auth-redirect.ts

@@ -5,6 +5,44 @@
  */
 export const POST_AUTH_REDIRECT_STORAGE_KEY = 'postAuthRedirectUrl'
 
+/** Route the verify hop lives at, entered only from signup. */
+export const VERIFY_FROM_SIGNUP_ROUTE = '/verify?fromSignup=true'
+
+/** Default post-auth destination when no callback URL was carried in. */
+export const DEFAULT_POST_AUTH_ROUTE = '/workspace'
+
+/**
+ * Where a successful email signup goes next.
+ * - `verify`: the verification hop, which owns the post-auth redirect from there
+ * - `redirect`: the validated callback URL the visitor arrived with
+ * - `workspace`: the default destination
+ */
+export type PostSignupDestination =
+  | { kind: 'verify' }
+  | { kind: 'redirect'; url: string }
+  | { kind: 'workspace' }
+
+interface PostSignupDestinationParams {
+  /** The server-derived effective flag — verification enabled AND deliverable. */
+  emailVerificationEnabled: boolean
+  /** Callback URL that already passed `validateCallbackUrl`, or `''`. */
+  redirectUrl: string
+}
+
+/**
+ * `/verify` is a destination only when the deployment can actually deliver the
+ * code. A deployment with no mail provider would otherwise strand every new
+ * account on a screen no email can ever satisfy, so signup continues straight
+ * to the normal post-auth destination instead.
+ */
+export function resolvePostSignupDestination({
+  emailVerificationEnabled,
+  redirectUrl,
+}: PostSignupDestinationParams): PostSignupDestination {
+  if (emailVerificationEnabled) return { kind: 'verify' }
+  return redirectUrl ? { kind: 'redirect', url: redirectUrl } : { kind: 'workspace' }
+}
+
 interface AuthCrossLinkParams {
   /** Validated post-auth destination to carry over, or null to drop it. */
   callbackUrl: string | null

apps/sim/app/(auth)/signup/page.tsx

@@ -1,5 +1,6 @@
 import type { Metadata } from 'next'
 import { isEmailSignupDisabled, isRegistrationDisabled } from '@/lib/core/config/env-flags'
+import { isEmailVerificationEffectivelyEnabled } from '@/lib/messaging/email/verification'
 import { getOAuthProviderStatus } from '@/app/(auth)/components/oauth-provider-checker'
 import SignupForm from '@/app/(auth)/signup/signup-form'
 
@@ -24,6 +25,7 @@ export default async function SignupPage() {
       microsoftAvailable={microsoftAvailable}
       isProduction={isProduction}
       emailSignupEnabled={!isEmailSignupDisabled}
+      emailVerificationEnabled={isEmailVerificationEffectivelyEnabled()}
     />
   )
 }

apps/sim/app/(auth)/signup/signup-form.tsx

@@ -11,7 +11,13 @@ import { isSsoEnabled } from '@/lib/core/config/env-flags'
 import { validateCallbackUrl } from '@/lib/core/security/input-validation'
 import { quickValidateEmail } from '@/lib/messaging/email/validation'
 import { captureClientEvent, captureEvent } from '@/lib/posthog/client'
-import { buildAuthCrossLink, POST_AUTH_REDIRECT_STORAGE_KEY } from '@/app/(auth)/auth-redirect'
+import {
+  buildAuthCrossLink,
+  DEFAULT_POST_AUTH_ROUTE,
+  POST_AUTH_REDIRECT_STORAGE_KEY,
+  resolvePostSignupDestination,
+  VERIFY_FROM_SIGNUP_ROUTE,
+} from '@/app/(auth)/auth-redirect'
 import {
   AuthDivider,
   AuthField,
@@ -86,6 +92,8 @@ interface SignupFormProps {
   microsoftAvailable: boolean
   isProduction: boolean
   emailSignupEnabled: boolean
+  /** Server-derived: verification is enabled AND a mail provider is configured. */
+  emailVerificationEnabled: boolean
 }
 
 function SignupFormContent({
@@ -94,6 +102,7 @@ function SignupFormContent({
   microsoftAvailable,
   isProduction,
   emailSignupEnabled,
+  emailVerificationEnabled,
 }: SignupFormProps) {
   const router = useRouter()
   const searchParams = useSearchParams()
@@ -343,18 +352,29 @@ function SignupFormContent({
         logger.error('Failed to refresh session after signup:', sessionError)
       }
 
+      const destination = resolvePostSignupDestination({ emailVerificationEnabled, redirectUrl })
+
       if (typeof window !== 'undefined') {
-        sessionStorage.setItem('verificationEmail', emailValue)
-        if (redirectUrl) {
-          sessionStorage.setItem(POST_AUTH_REDIRECT_STORAGE_KEY, redirectUrl)
-        } else {
-          // Clear any leftover from an earlier signup in this tab — otherwise a
-          // signup with no callbackUrl inherits the previous CLI/invite destination.
-          sessionStorage.removeItem(POST_AUTH_REDIRECT_STORAGE_KEY)
+        // Clear any leftover from an earlier signup in this tab — otherwise a
+        // signup with no callbackUrl inherits the previous CLI/invite destination.
+        sessionStorage.removeItem('verificationEmail')
+        sessionStorage.removeItem(POST_AUTH_REDIRECT_STORAGE_KEY)
+
+        if (destination.kind === 'verify') {
+          sessionStorage.setItem('verificationEmail', emailValue)
+          if (redirectUrl) sessionStorage.setItem(POST_AUTH_REDIRECT_STORAGE_KEY, redirectUrl)
         }
       }
 
-      router.push('/verify?fromSignup=true')
+      if (destination.kind === 'verify') {
+        router.push(VERIFY_FROM_SIGNUP_ROUTE)
+      } else if (destination.kind === 'redirect') {
+        // Full navigation, matching the verify hop: the destination (invite, CLI
+        // handoff) is server-rendered and must see the fresh session cookie.
+        window.location.href = destination.url
+      } else {
+        router.push(DEFAULT_POST_AUTH_ROUTE)
+      }
     } catch (error) {
       logger.error('Signup error:', error)
       setIsLoading(false)
@@ -488,6 +508,7 @@ export default function SignupPage({
   microsoftAvailable,
   isProduction,
   emailSignupEnabled,
+  emailVerificationEnabled,
 }: SignupFormProps) {
   return (
     <Suspense
@@ -499,6 +520,7 @@ export default function SignupPage({
         microsoftAvailable={microsoftAvailable}
         isProduction={isProduction}
         emailSignupEnabled={emailSignupEnabled}
+        emailVerificationEnabled={emailVerificationEnabled}
       />
     </Suspense>
   )

apps/sim/app/(auth)/verify/page.test.tsx

@@ -0,0 +1,53 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockHasEmailService, mockIsEmailVerificationEffectivelyEnabled } = vi.hoisted(() => ({
+  mockHasEmailService: vi.fn<() => boolean>(),
+  mockIsEmailVerificationEffectivelyEnabled: vi.fn<() => boolean>(),
+}))
+
+vi.mock('@/lib/messaging/email/mailer', () => ({
+  hasEmailService: mockHasEmailService,
+}))
+
+vi.mock('@/lib/messaging/email/verification', () => ({
+  isEmailVerificationEffectivelyEnabled: mockIsEmailVerificationEffectivelyEnabled,
+}))
+
+vi.mock('@/app/(auth)/verify/verify-content', () => ({
+  VerifyContent: () => null,
+}))
+
+import VerifyPage from '@/app/(auth)/verify/page'
+
+describe('verify page', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('renders the verification experience when a mail provider is configured', () => {
+    mockHasEmailService.mockReturnValue(true)
+    mockIsEmailVerificationEffectivelyEnabled.mockReturnValue(true)
+
+    const element = VerifyPage()
+
+    expect(element.props.hasEmailService).toBe(true)
+    expect(element.props.isEmailVerificationEnabled).toBe(true)
+  })
+
+  /**
+   * The page hands the effective value down, so the verification form never
+   * renders on a deployment that cannot deliver a code — it redirects instead.
+   */
+  it('reports verification off when no mail provider is configured', () => {
+    mockHasEmailService.mockReturnValue(false)
+    mockIsEmailVerificationEffectivelyEnabled.mockReturnValue(false)
+
+    const element = VerifyPage()
+
+    expect(element.props.hasEmailService).toBe(false)
+    expect(element.props.isEmailVerificationEnabled).toBe(false)
+  })
+})

apps/sim/app/(auth)/verify/page.tsx

@@ -1,6 +1,7 @@
 import type { Metadata } from 'next'
-import { isEmailVerificationEnabled, isProd } from '@/lib/core/config/env-flags'
+import { isProd } from '@/lib/core/config/env-flags'
 import { hasEmailService } from '@/lib/messaging/email/mailer'
+import { isEmailVerificationEffectivelyEnabled } from '@/lib/messaging/email/verification'
 import { VerifyContent } from '@/app/(auth)/verify/verify-content'
 
 export const metadata: Metadata = {
@@ -16,7 +17,7 @@ export default function VerifyPage() {
     <VerifyContent
       hasEmailService={emailServiceConfigured}
       isProduction={isProd}
-      isEmailVerificationEnabled={isEmailVerificationEnabled}
+      isEmailVerificationEnabled={isEmailVerificationEffectivelyEnabled()}
     />
   )
 }

apps/sim/lib/auth/auth.ts

@@ -90,6 +90,7 @@ import { sendEmail } from '@/lib/messaging/email/mailer'
 import { getFromEmailAddress, getPersonalEmailFrom } from '@/lib/messaging/email/utils'
 import { quickValidateEmail } from '@/lib/messaging/email/validation'
 import { validateSignupEmailMx } from '@/lib/messaging/email/validation.server'
+import { isEmailVerificationEffectivelyEnabled } from '@/lib/messaging/email/verification'
 import { scheduleLifecycleEmail } from '@/lib/messaging/lifecycle'
 import { getMicrosoftRefreshTokenExpiry, isMicrosoftProvider } from '@/lib/oauth/microsoft'
 import { extractSlackTeamId, fanOutSlackTokenChain } from '@/lib/oauth/slack'
@@ -792,7 +793,7 @@ export const auth = betterAuth({
      * can still sign in.
      */
     disableSignUp: isEmailSignupDisabled,
-    requireEmailVerification: isEmailVerificationEnabled,
+    requireEmailVerification: isEmailVerificationEffectivelyEnabled(),
     /**
      * When someone signs up with an already-registered email, better-auth returns a
      * generic success response (OWASP enumeration protection) instead of leaking that
@@ -1459,7 +1460,7 @@ export const auth = betterAuth({
           organization({
             allowUserToCreateOrganization: async () => false,
             disableOrganizationDeletion: true,
-            requireEmailVerificationOnInvitation: isEmailVerificationEnabled,
+            requireEmailVerificationOnInvitation: isEmailVerificationEffectivelyEnabled(),
             organizationHooks: {
               afterCreateOrganization: async ({ organization, user }) => {
                 logger.info('[organizationHooks.afterCreateOrganization] Organization created', {

apps/sim/lib/messaging/email/verification.test.ts

@@ -0,0 +1,45 @@
+/**
+ * @vitest-environment node
+ */
+import { resetEnvFlagsMock, setEnvFlags } from '@sim/testing'
+import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockHasEmailService } = vi.hoisted(() => ({
+  mockHasEmailService: vi.fn<() => boolean>(),
+}))
+
+vi.mock('@/lib/messaging/email/mailer', () => ({
+  hasEmailService: mockHasEmailService,
+}))
+
+import { isEmailVerificationEffectivelyEnabled } from '@/lib/messaging/email/verification'
+
+describe('isEmailVerificationEffectivelyEnabled', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetEnvFlagsMock()
+  })
+
+  afterAll(resetEnvFlagsMock)
+
+  it('requires verification when it is enabled and a mail provider is configured', () => {
+    setEnvFlags({ isEmailVerificationEnabled: true })
+    mockHasEmailService.mockReturnValue(true)
+
+    expect(isEmailVerificationEffectivelyEnabled()).toBe(true)
+  })
+
+  it('does not require verification when no mail provider is configured', () => {
+    setEnvFlags({ isEmailVerificationEnabled: true })
+    mockHasEmailService.mockReturnValue(false)
+
+    expect(isEmailVerificationEffectivelyEnabled()).toBe(false)
+  })
+
+  it('does not require verification when the feature is disabled', () => {
+    setEnvFlags({ isEmailVerificationEnabled: false })
+    mockHasEmailService.mockReturnValue(true)
+
+    expect(isEmailVerificationEffectivelyEnabled()).toBe(false)
+  })
+})

apps/sim/lib/messaging/email/verification.ts

@@ -0,0 +1,15 @@
+import { isEmailVerificationEnabled } from '@/lib/core/config/env-flags'
+import { hasEmailService } from '@/lib/messaging/email/mailer'
+
+/**
+ * Whether email verification is actually enforceable on this deployment.
+ *
+ * `EMAIL_VERIFICATION_ENABLED` alone only says the operator wants verification;
+ * without a configured mail provider no code can ever be delivered, so
+ * enforcing it locks every new account out behind a screen it cannot satisfy.
+ * This is the single server-derived value Better Auth enforcement, signup
+ * routing, and the verify page all read, so they cannot disagree.
+ */
+export function isEmailVerificationEffectivelyEnabled(): boolean {
+  return isEmailVerificationEnabled && hasEmailService()
+}