v0.7.66: provenance logs, nuqs consolidation

Author: waleedlatif1

.claude/rules/sim-url-state.md

@@ -34,7 +34,7 @@ Put state in the URL **only** when it is *all* of: shareable, deep-linkable, boo
 ## Anti-patterns (forbidden)
 
 - Direct `useSearchParams().get(...)` or `new URLSearchParams(window.location.search)` to **read** state.
-- Hand-built query strings + `router.replace`/`router.push` to **mutate** state.
+- Hand-built query strings + `router.replace`/`router.push` to **mutate** state. **If the target path equals the current path, it is a query mutation, not a navigation** — even when written as a full path template. Re-serializing the path by hand is lossy by construction: it drops every param the template forgets. Use the nuqs setter (`setParams({ key: null }, { history: 'replace', scroll: false })`) — `null` always removes the key, and only the params you name are touched. Both options are already nuqs defaults (see "Conventions"); write them explicitly because a group whose shared options set `history: 'push'` (e.g. `filesUrlKeys`) would otherwise push a back-stack entry for a strip.
 - `window.history.replaceState`/`pushState` to mutate a param.
 - Duplicating URL state into a store and syncing it with effects / `popstate` listeners.
 - High-frequency or large state in the URL (cursor, pan/zoom, un-debounced keystrokes, big JSON blobs).
@@ -44,7 +44,7 @@ These reads/mutations are **not** anti-patterns and stay as-is:
 
 - **Outbound URL builders** — `new URLSearchParams({...})` to construct a `href`, a download endpoint, an external WebSocket/API URL, or a `window.open(_, '_blank')` destination.
 - **Route navigations** — `router.push('/path/[id]?folderId=x')` that changes the route *path*, not just the current query. A nuqs setter only mutates the query on the current path; cross-path navigation stays on `router`.
-- **Read-once auth / redirect signals** — `token`, `callbackUrl`, `redirect`, `error`, `invite_flow`, `upgraded`, `redirect_workflow`, etc. These are navigation signals consumed once (often read-then-strip), not synced view-state. Leave them on `useSearchParams`.
+- **Read-once auth / redirect signals** — `token`, `callbackUrl`, `redirect`, `error`, `invite_flow`, `new` (invite signup flow), `upgraded`, `redirect_workflow`, etc. These are navigation signals consumed once (often read-then-strip), not synced view-state. Leave them on `useSearchParams`. Key names are per-surface: files' `new` is a genuine nuqs param (`files/search-params.ts`), while invite's `new` is a one-shot signup signal.
 
 ## Per-feature `search-params.ts` — single source of truth
 
@@ -128,7 +128,22 @@ If a client param must be re-read server-side after a change, set `shallow: fals
 
 ## Suspense boundary
 
-`useQueryState`/`useQueryStates` read `useSearchParams` internally, so any client component using them must sit under a `<Suspense>` boundary (Next.js requirement). Wrap the page entry with a real-chrome fallback so a suspend never flashes a blank frame — see `apps/sim/app/workspace/[workspaceId]/files/page.tsx`.
+`useQueryState`/`useQueryStates` read `useSearchParams` internally, so any client component using them must sit under a `<Suspense>` boundary (Next.js requirement). Wrap the page entry with a real-chrome fallback so a suspend never flashes a blank frame.
+
+**Never `fallback={null}` on a page entry.** The route's co-located `loading.tsx` default export *is* the correct fallback — one skeleton serves both the route-level navigation transition (which Next renders automatically) and the in-page suspend (which this boundary renders). If the segment has no `loading.tsx`, add one; the route transition needs it anyway. Import it absolutely (`sim-imports.md`):
+
+```typescript
+import { KnowledgeBase } from '@/app/workspace/[workspaceId]/knowledge/[id]/base'
+import KnowledgeBaseLoading from '@/app/workspace/[workspaceId]/knowledge/[id]/loading'
+
+<Suspense fallback={<KnowledgeBaseLoading />}>
+  <KnowledgeBase id={id} knowledgeBaseName={kbName || 'Knowledge Base'} />
+</Suspense>
+```
+
+Reference: `apps/sim/app/workspace/[workspaceId]/knowledge/[id]/page.tsx`.
+
+This applies to **page entries**. An inner `<Suspense>` wrapping a `lazy()` component is the exception: there `fallback={null}` is correct, precisely so the suspend resolves at the nearest boundary instead of flashing the whole route — see `sim-imports.md`, "Code-splitting through barrels".
 
 ## Debounced text inputs
 

apps/docs/content/docs/en/platform/self-hosting/authentication.mdx

@@ -84,7 +84,7 @@ See the [SSO guide](/platform/enterprise/sso) for identity-provider setup and th
 
 | Variable | Effect |
 |---|---|
-| `DISABLE_REGISTRATION=true` | Blocks email/password registration |
+| `DISABLE_REGISTRATION=true` | Blocks all new accounts — email/password, email OTP, and social sign-in. Only existing accounts can sign in, including to accept a workspace invitation. SSO is unaffected |
 | `DISABLE_EMAIL_SIGNUP=true` | Blocks new email/password registrations; existing email login keeps working |
 | `ALLOWED_LOGIN_DOMAINS` | Comma-separated domain allowlist, e.g. `acme.com,acme.co.uk`. Gates email sign-**in** as well as signup |
 | `ALLOWED_LOGIN_EMAILS` | Comma-separated address allowlist, applied the same way |
@@ -93,7 +93,9 @@ See the [SSO guide](/platform/enterprise/sso) for identity-provider setup and th
 | `BLOCKED_EMAIL_MX_HOSTS` | MX-host substrings to block; used only with the above |
 
 <Callout type="warn">
-  These controls gate the **email/password** path. A first-time sign-in through Google, GitHub, or Microsoft creates an account through the social provider and is not filtered by them. If you need a hard boundary, disable the social providers you have not vetted (`DISABLE_GOOGLE_AUTH`, `DISABLE_GITHUB_AUTH`, `DISABLE_MICROSOFT_AUTH`) or restrict membership at the identity provider and use SSO.
+  `ALLOWED_LOGIN_DOMAINS`, `ALLOWED_LOGIN_EMAILS`, and `SIGNUP_MX_VALIDATION_ENABLED` gate the **email/password** path only. A first-time sign-in through Google, GitHub, or Microsoft creates an account through the social provider and is not filtered by them. To restrict who may sign in through a social provider, disable the ones you have not vetted (`DISABLE_GOOGLE_AUTH`, `DISABLE_GITHUB_AUTH`, `DISABLE_MICROSOFT_AUTH`) or restrict membership at the identity provider and use SSO.
+
+  `DISABLE_REGISTRATION` and `BLOCKED_SIGNUP_DOMAINS` apply to every path, social included.
 </Callout>
 
 For a company deployment, the usual pairing is domain-restricted signup plus SSO:

apps/docs/content/docs/en/platform/self-hosting/environment-variables.mdx

@@ -107,7 +107,7 @@ See [Authentication](/platform/self-hosting/authentication).
 
 | Variable | Description |
 |----------|-------------|
-| `DISABLE_REGISTRATION` | Set `true` to disable new user signups entirely |
+| `DISABLE_REGISTRATION` | Set `true` to block all new accounts, including social sign-in. Invitations still work for people who already have an account. SSO is unaffected |
 | `DISABLE_EMAIL_SIGNUP` | Block new email/password registrations; existing email login keeps working |
 | `ALLOWED_LOGIN_DOMAINS` | Restrict signups to domains (comma-separated) |
 | `ALLOWED_LOGIN_EMAILS` | Restrict signups to specific emails (comma-separated) |

apps/sim/app/(auth)/auth-redirect.test.ts

@@ -2,7 +2,11 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
-import { buildAuthCrossLink, resolvePostSignupDestination } from '@/app/(auth)/auth-redirect'
+import {
+  buildAuthCrossLink,
+  resolveAuthRedirect,
+  resolvePostSignupDestination,
+} from '@/app/(auth)/auth-redirect'
 
 describe('resolvePostSignupDestination', () => {
   it('routes to the verify hop when verification is enforceable', () => {
@@ -56,4 +60,50 @@ describe('buildAuthCrossLink', () => {
       '/signup'
     )
   })
+
+  it('marks a new user so the invite page leads with account creation', () => {
+    expect(
+      buildAuthCrossLink('/signup', {
+        callbackUrl: '/invite/abc',
+        isInviteFlow: true,
+        isNewUser: true,
+      })
+    ).toBe('/signup?invite_flow=true&callbackUrl=%2Finvite%2Fabc&new=true')
+  })
+
+  it('omits the new-user marker by default', () => {
+    expect(buildAuthCrossLink('/signup', { callbackUrl: null, isInviteFlow: true })).not.toContain(
+      'new=true'
+    )
+  })
+})
+
+describe('resolveAuthRedirect', () => {
+  const NONE = { redirect: null, callbackUrl: null, inviteFlow: null }
+
+  it('prefers redirect over callbackUrl', () => {
+    expect(resolveAuthRedirect({ ...NONE, redirect: '/a', callbackUrl: '/b' }).rawCallbackUrl).toBe(
+      '/a'
+    )
+  })
+
+  it('falls through an empty redirect to callbackUrl', () => {
+    expect(
+      resolveAuthRedirect({ ...NONE, redirect: '', callbackUrl: '/invite/abc' }).rawCallbackUrl
+    ).toBe('/invite/abc')
+  })
+
+  it('reports no destination when nothing was carried', () => {
+    expect(resolveAuthRedirect(NONE)).toEqual({ rawCallbackUrl: '', isInviteFlow: false })
+  })
+
+  it('treats an invitation destination as an invite flow without the flag', () => {
+    expect(resolveAuthRedirect({ ...NONE, callbackUrl: '/invite/abc' }).isInviteFlow).toBe(true)
+  })
+
+  it('honors the explicit flag when the destination is unrelated', () => {
+    expect(
+      resolveAuthRedirect({ ...NONE, callbackUrl: '/workspace', inviteFlow: 'true' }).isInviteFlow
+    ).toBe(true)
+  })
 })

apps/sim/app/(auth)/auth-redirect.ts

@@ -43,10 +43,43 @@ export function resolvePostSignupDestination({
   return redirectUrl ? { kind: 'redirect', url: redirectUrl } : { kind: 'workspace' }
 }
 
+/** The raw redirect-carrying params, as read from a URL on client or server. */
+interface AuthRedirectParams {
+  redirect: string | null
+  callbackUrl: string | null
+  inviteFlow: string | null
+}
+
+/**
+ * The post-auth destination a visitor arrived with, and whether they are mid
+ * invitation.
+ *
+ * `redirect` wins over `callbackUrl` — both spellings are in circulation. The
+ * invite flow is inferred from the destination as well as the explicit flag, so
+ * a link that lost `invite_flow` still reads as an invitation.
+ *
+ * Shared so the signup form and the registration-disabled page cannot drift on
+ * which param wins; both feed the result to {@link buildAuthCrossLink}. The
+ * caller validates — this function does not, so that a client can log the
+ * rejection it already reports.
+ */
+export function resolveAuthRedirect({ redirect, callbackUrl, inviteFlow }: AuthRedirectParams): {
+  rawCallbackUrl: string
+  isInviteFlow: boolean
+} {
+  const rawCallbackUrl = redirect || callbackUrl || ''
+  return {
+    rawCallbackUrl,
+    isInviteFlow: inviteFlow === 'true' || rawCallbackUrl.startsWith('/invite/'),
+  }
+}
+
 interface AuthCrossLinkParams {
   /** Validated post-auth destination to carry over, or null to drop it. */
   callbackUrl: string | null
   isInviteFlow: boolean
+  /** Marks the visitor as new so the invite page leads with account creation. */
+  isNewUser?: boolean
 }
 
 /**
@@ -57,11 +90,12 @@ interface AuthCrossLinkParams {
  */
 export function buildAuthCrossLink(
   path: '/login' | '/signup',
-  { callbackUrl, isInviteFlow }: AuthCrossLinkParams
+  { callbackUrl, isInviteFlow, isNewUser = false }: AuthCrossLinkParams
 ): string {
   const params = new URLSearchParams()
   if (isInviteFlow) params.set('invite_flow', 'true')
   if (callbackUrl) params.set('callbackUrl', callbackUrl)
+  if (isNewUser) params.set('new', 'true')
 
   const query = params.toString()
   return query ? `${path}?${query}` : path

apps/sim/app/(auth)/login/login-form.tsx

@@ -88,11 +88,14 @@ export default function LoginPage({
   googleAvailable,
   microsoftAvailable,
   isProduction,
+  registrationDisabled,
 }: {
   githubAvailable: boolean
   googleAvailable: boolean
   microsoftAvailable: boolean
   isProduction: boolean
+  /** DISABLE_REGISTRATION. Hides the signup cross-link, which `/signup` blocks. */
+  registrationDisabled: boolean
 }) {
   const router = useRouter()
   const searchParams = useSearchParams()
@@ -436,7 +439,7 @@ export default function LoginPage({
           </SocialLoginButtons>
         )}
 
-        {emailEnabled && (
+        {emailEnabled && !registrationDisabled && (
           <AuthNavPrompt prompt="Don't have an account?" href={signupHref} linkLabel='Sign up' />
         )}
 

apps/sim/app/(auth)/login/page.tsx

@@ -1,6 +1,8 @@
 import { Suspense } from 'react'
 import type { Metadata } from 'next'
+import { isRegistrationDisabled } from '@/lib/core/config/env-flags'
 import { getOAuthProviderStatus } from '@/app/(auth)/components/oauth-provider-checker'
+import LoginLoading from '@/app/(auth)/login/loading'
 import LoginForm from '@/app/(auth)/login/login-form'
 
 export const metadata: Metadata = {
@@ -14,12 +16,13 @@ export default async function LoginPage() {
     await getOAuthProviderStatus()
 
   return (
-    <Suspense fallback={null}>
+    <Suspense fallback={<LoginLoading />}>
       <LoginForm
         githubAvailable={githubAvailable}
         googleAvailable={googleAvailable}
         microsoftAvailable={microsoftAvailable}
         isProduction={isProduction}
+        registrationDisabled={isRegistrationDisabled}
       />
     </Suspense>
   )

apps/sim/app/(auth)/signup/page.tsx

@@ -1,7 +1,12 @@
 import type { Metadata } from 'next'
+import type { SearchParams } from 'nuqs/server'
 import { isEmailSignupDisabled, isRegistrationDisabled } from '@/lib/core/config/env-flags'
+import { validateCallbackUrl } from '@/lib/core/security/input-validation'
 import { isEmailVerificationEffectivelyEnabled } from '@/lib/messaging/email/verification'
+import { resolveAuthRedirect } from '@/app/(auth)/auth-redirect'
 import { getOAuthProviderStatus } from '@/app/(auth)/components/oauth-provider-checker'
+import { RegistrationDisabled } from '@/app/(auth)/signup/registration-disabled'
+import { signupSearchParamsCache } from '@/app/(auth)/signup/search-params'
 import SignupForm from '@/app/(auth)/signup/signup-form'
 
 export const metadata: Metadata = {
@@ -10,9 +15,25 @@ export const metadata: Metadata = {
 
 export const dynamic = 'force-dynamic'
 
-export default async function SignupPage() {
+export default async function SignupPage({
+  searchParams,
+}: {
+  searchParams: Promise<SearchParams>
+}) {
   if (isRegistrationDisabled) {
-    return <div>Registration is disabled, please contact your admin.</div>
+    const { redirect, callbackUrl, inviteFlow } = await signupSearchParamsCache.parse(searchParams)
+    const { rawCallbackUrl, isInviteFlow } = resolveAuthRedirect({
+      redirect,
+      callbackUrl,
+      inviteFlow,
+    })
+
+    return (
+      <RegistrationDisabled
+        callbackUrl={validateCallbackUrl(rawCallbackUrl) ? rawCallbackUrl : null}
+        isInviteFlow={isInviteFlow}
+      />
+    )
   }
 
   const { githubAvailable, googleAvailable, microsoftAvailable, isProduction } =

apps/sim/app/(auth)/signup/registration-disabled.tsx

@@ -0,0 +1,31 @@
+import { buildAuthCrossLink } from '@/app/(auth)/auth-redirect'
+import { AuthHeader, AuthNavPrompt } from '@/app/(auth)/components'
+
+interface RegistrationDisabledProps {
+  /** Post-auth destination the visitor arrived with, already validated. */
+  callbackUrl: string | null
+  isInviteFlow: boolean
+}
+
+/**
+ * The signup page under DISABLE_REGISTRATION. Visitors reach it from a stale
+ * link, a bookmark, or an invitation, so it wears the same shell as the form it
+ * replaces and carries the post-auth destination over to login — an invited
+ * visitor who lands here can still sign in and end up back on their invitation
+ * rather than losing it.
+ */
+export function RegistrationDisabled({ callbackUrl, isInviteFlow }: RegistrationDisabledProps) {
+  return (
+    <div className='space-y-6'>
+      <AuthHeader
+        title='Account creation is disabled'
+        description='Ask your admin to create an account for you.'
+      />
+      <AuthNavPrompt
+        prompt='Already have an account?'
+        href={buildAuthCrossLink('/login', { callbackUrl, isInviteFlow })}
+        linkLabel='Sign in'
+      />
+    </div>
+  )
+}

apps/sim/app/(auth)/signup/search-params.ts

@@ -0,0 +1,23 @@
+import { createSearchParamsCache, parseAsString } from 'nuqs/server'
+
+/**
+ * The redirect signals the signup page carries. Read once to decide where a
+ * visitor goes after authenticating, never written, so every parser is nullable
+ * with no default — absent means "no destination", which is a real state rather
+ * than something to fall back from.
+ */
+const signupParsers = {
+  redirect: parseAsString,
+  callbackUrl: parseAsString,
+  inviteFlow: parseAsString,
+} as const
+
+/** `invite_flow` on the wire; camelCase for destructuring. */
+const signupUrlKeys = { urlKeys: { inviteFlow: 'invite_flow' } } as const
+
+/**
+ * Server-side reader for the signup page. The client form reads these same keys
+ * through `useSearchParams` (the read-once auth-signal carve-out), so the wire
+ * keys here and in `signup-form.tsx` must stay in step.
+ */
+export const signupSearchParamsCache = createSearchParamsCache(signupParsers, signupUrlKeys)