feat(web): Google sign-in and company onboarding - #30
Merged
Conversation
Merges the Better Auth identity stack and connects it to the workspace that already existed. The auth schema was already migrated into Neon; this wires it to the product. Two changes were needed beyond the merge. The auth instance was constructed at module scope, so next build — which imports every route module while collecting page data — required production secrets to compile. CI has none, so this would have gone red on merge and would have forced real credentials into the build environment for nothing. getAuth() now builds on first use and memoises; the pg pool still lives on globalThis so it survives across invocations. Verified by building with all four auth variables unset. Organisation scoping now has exactly one decision point. resolveOrganizationId reads the session and returns the active organisation, falling back to the demo organisation only for visitors. The direction matters: an unauthenticated visitor can reach only the demo, and a signed-in user is never silently handed it. The seed agents are inserted into the demo organisation and nowhere else — pre-populating a real company with approvers it never added would be inventing authority. sign-in and onboarding move into the (marketing) group so they render without the workspace chrome. Their test imports carry the .js extensions node16 resolution requires; pnpm check typechecks a config that turbo run typecheck does not. Google and Better Auth organization roles remain application identity only. They never grant payment authority: that still requires a distinct human resolved through AgentBook plus a role issued by the company.
Lyons800
force-pushed
the
feat/auth-onboarding
branch
from
July 26, 2026 06:20
dd859c6 to
ed3c604
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges the Better Auth identity stack and connects it to the workspace that already existed. The auth schema was already migrated into Neon.
Two changes beyond the merge
The auth instance was built at module scope.
next buildimports every route module while collecting page data, so compiling required production secrets — CI has none, so this would have gone red on merge and forced real credentials into the build environment for nothing.getAuth()now builds on first use and memoises; the pg pool still lives onglobalThisso it survives across invocations. Verified by building with all four auth variables unset.Organisation scoping now has exactly one decision point.
resolveOrganizationId()reads the session and returns the active organisation, falling back to the demo only for visitors. The direction matters: an unauthenticated visitor can reach only the demo, and a signed-in user is never silently handed it. Seed agents go into the demo organisation and nowhere else — pre-populating a real company with approvers it never added would be inventing authority.sign-inandonboardingmove into(marketing)so they render without workspace chrome.Boundary preserved
Google and Better Auth organization roles are application identity only. They never grant payment authority — that still requires a distinct human resolved through AgentBook plus a role issued by the company.
lint·typecheck(19 tasks) · 369 tests ·build(with and without secrets) all green.