The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Mar 17, 2026 10:03pm

You have used all Bugbot PR reviews included in your free trial for your GitHub account on this workspace.

To continue using Bugbot reviews, enable Bugbot for your team in the Cursor dashboard.

Greptile Summary

This PR migrates super-user management from a custom boolean column to better-auth's native admin plugin, replacing the old is_super_user field with role, banned, ban_reason, and ban_expires columns, and consolidating all admin controls into a new unified Admin settings tab that replaces the old Debug tab.

Key changes:

• DB schema and migration: new columns added with a backfill step that promotes existing super-users to role = 'admin' before the old column is dropped — no data loss
• Auth config: admin() server plugin and adminClient() browser plugin registered; customSession pass-through exposes user.role in the session
• New Admin settings tab with React Query hooks for listing users, setting roles, banning/unbanning; session-loading guard prevents a redirect flash for admin users navigating directly to the admin URL
• Redundant /api/user/super-user route and useSuperUserStatus hook removed; superUserModeEnabled defaults unified to false across all call sites

Issues found:

• The new BLOCKED_SIGNUP_DOMAINS feature in auth.ts only guards the email/password /sign-up path. OAuth-based account creation (social providers) uses different paths and bypasses this check entirely, so users from blocked domains can still register via social login
• The admin and access-control navigation items share the same ShieldCheck icon, making them visually indistinguishable when both are visible
• requiresSuperUser on NavigationItem and its corresponding sidebar check are now dead code — no navigation items use this field after the Debug tab was removed

Confidence Score: 3/5

• Mostly safe to merge, but the new BLOCKED_SIGNUP_DOMAINS feature has a meaningful security gap that should be addressed before relying on it in production.
• The core migration (schema, admin plugin, session wiring) is clean, the backfill is correct, and the previously-reported issues have all been fixed in follow-up commits. The score is lowered because the new BLOCKED_SIGNUP_DOMAINS env var silently fails to block OAuth sign-ups — if the operator deploys with this setting expecting it to enforce domain restrictions, blocked users can trivially bypass it via social login.
• apps/sim/lib/auth/auth.ts — the BLOCKED_SIGNUP_DOMAINS middleware does not cover OAuth/social sign-up paths.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Browser
    participant AdminUI as Admin Settings Tab
    participant AuthAPI as better-auth admin endpoints
    participant DB as PostgreSQL

    Browser->>AdminUI: Navigate to settings/admin
    AdminUI->>AdminUI: Check session user role
    alt role is not admin
        AdminUI->>Browser: Redirect to settings/general
    end

    Browser->>AdminUI: Click Load Users
    AdminUI->>AuthAPI: listUsers with limit and offset
    AuthAPI->>DB: Query user table
    DB-->>AuthAPI: Return paginated rows
    AuthAPI-->>AdminUI: Users array with total count
    AdminUI-->>Browser: Render user management table

    Browser->>AdminUI: Click Promote or Demote button
    AdminUI->>AuthAPI: setRole with userId and target role
    AuthAPI->>DB: Update role column
    AuthAPI-->>AdminUI: Success
    AdminUI->>AdminUI: Invalidate adminUsers cache

    Browser->>AdminUI: Click Ban then enter reason then Confirm
    AdminUI->>AuthAPI: banUser with userId and optional reason
    AuthAPI->>DB: Set banned true and store reason
    AuthAPI-->>AdminUI: Success
    AdminUI->>AdminUI: Invalidate adminUsers cache

_{Last reviewed commit: 02ac5da}

@greptile

@greptile

You have used all Bugbot PR reviews included in your free trial for your GitHub account on this workspace.

To continue using Bugbot reviews, enable Bugbot for your team in the Cursor dashboard.

@greptile

@greptile

You have used all Bugbot PR reviews included in your free trial for your GitHub account on this workspace.

To continue using Bugbot reviews, enable Bugbot for your team in the Cursor dashboard.

@greptile

@greptile