PRO

Better Auth Provisioning Gate

A tenant admission gate built on Better Auth 1.7's user.validateUserInfo hook, which runs across every authentication method at create-user, link-account, and OAuth or SSO sign-in. Enforces an email domain allowlist, narrows each SSO provider to the domains it is authoritative for, rejects anonymous sessions, and refuses to admit a new identity whose provider does not assert a verified address. Re-checks the fresh provider email on sign-in, so an account whose IdP identity moved out of the tenant is caught rather than grandfathered.

Install
npx shadcn@latest add https://ui.aryank.space/r/better-auth-provisioning-gate.json

Installs from ui.aryank.space. To add it by hand, copy the files in Files below, or register the @compronents namespace via the docs.

Visualization
sign-in
sign-in
unknown
admit
unknown
if (!allowed.has(domain)) return { error: DENY.domain }

validateUserInfo runs on every sign-in path; an allowlisted domain is admitted and the tenant membership is provisioned.

Files

Dependencies