feat(auth): add email-first sign-in

[pandemicsyn]

Summary

• Changes normal web sign-in from provider-first to email-first while preserving returning-user, invite, explicit signup, and get-started behavior.
• Discovers required SSO or linked authentication methods for the submitted email, automatically continues single-method flows, and shows filtered Google-first choices for multi-provider accounts.
• Shows the complete eligible account-creation methods for unknown emails and hardens discovery with Turnstile, fail-closed IP/email limits, normalized identity ambiguity handling, and an indexed case-insensitive provider-email lookup.
• Adds cancellation-safe Turnstile and magic-link transitions, accessible form/error states, and focused coverage across the route, hook, components, navigation, eligibility, and user lookup.

Verification

• Exercised the initial email-first sign-in screen on the local Next.js app at desktop width.
• Confirmed a valid email enables Continue.
• Exercised an unknown email against the real local discovery endpoint and confirmed the complete signup method list with Google first.
• Exercised the existing multi-provider selection state in the local app using a deterministic mocked discovery response.

Visual Changes

Before	After

First sign in

Returning (with github and gmail linked)

Reviewer Notes

• Adds Drizzle migration 0224_medical_george_stacy, concurrently creating IDX_user_auth_provider_lower_email on lower(user_auth_provider.email).
• Discovery intentionally fails closed if either infrastructure-managed Vercel Firewall policy is unavailable.
• Callback-side SSO enforcement and provider identity checks remain authoritative; the submitted email is routing input, not authentication.
• Cancellation suppresses stale client transitions but cannot revoke an already-started magic-link request or external redirect.
• Independent static review/remediation completed with no remaining findings.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Re-reviewed current HEAD 6cf012a after the rebase onto main (migration 0225_tiny_reavers → 0226_aromatic_paper_doll); discovery, sign-in flow, and concurrent-index DDL look correct.

Files Reviewed (31 files)

• apps/storybook/stories/SignInForm.stories.tsx
• apps/web/src/app/api/sso/organizations/route.test.ts
• apps/web/src/app/api/sso/organizations/route.ts
• apps/web/src/app/users/sign_in/page.test.ts
• apps/web/src/app/users/sign_in/page.tsx
• apps/web/src/components/auth/AuthErrorNotification.test.ts
• apps/web/src/components/auth/AuthErrorNotification.tsx
• apps/web/src/components/auth/SignInForm.test.ts
• apps/web/src/components/auth/SignInForm.tsx
• apps/web/src/components/auth/sign-in/EmailInputForm.test.ts
• apps/web/src/components/auth/sign-in/EmailInputForm.tsx
• apps/web/src/components/auth/sign-in/ProviderSelectView.test.ts
• apps/web/src/components/auth/sign-in/ProviderSelectView.tsx
• apps/web/src/components/auth/sign-in/TurnstileView.test.ts
• apps/web/src/components/auth/sign-in/TurnstileView.tsx
• apps/web/src/hooks/useSignInFlow.test.ts
• apps/web/src/hooks/useSignInFlow.ts
• apps/web/src/lib/auth/email-signin-eligibility.test.ts
• apps/web/src/lib/auth/email-signin-eligibility.ts
• apps/web/src/lib/auth/sign-in-methods.test.ts
• apps/web/src/lib/auth/sign-in-methods.ts
• apps/web/src/lib/auth/sign-in-navigation.test.ts
• apps/web/src/lib/auth/sign-in-navigation.ts
• apps/web/src/lib/schemas/sso-organizations.ts
• apps/web/src/lib/user/index.test.ts
• apps/web/src/lib/user/index.ts
• packages/db/AGENTS.md
• packages/db/src/migrations/0226_aromatic_paper_doll.sql
• packages/db/src/migrations/meta/0226_snapshot.json
• packages/db/src/migrations/meta/_journal.json
• packages/db/src/schema.ts

Previous Review Summaries (4 snapshots, latest commit e3e7aa3)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit e3e7aa3)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (30 files)

• apps/storybook/stories/SignInForm.stories.tsx
• apps/web/src/app/api/sso/organizations/route.test.ts
• apps/web/src/app/api/sso/organizations/route.ts
• apps/web/src/app/users/sign_in/page.test.ts
• apps/web/src/app/users/sign_in/page.tsx
• apps/web/src/components/auth/AuthErrorNotification.test.ts
• apps/web/src/components/auth/AuthErrorNotification.tsx
• apps/web/src/components/auth/SignInForm.test.ts
• apps/web/src/components/auth/SignInForm.tsx
• apps/web/src/components/auth/sign-in/EmailInputForm.test.ts
• apps/web/src/components/auth/sign-in/EmailInputForm.tsx
• apps/web/src/components/auth/sign-in/ProviderSelectView.test.ts
• apps/web/src/components/auth/sign-in/ProviderSelectView.tsx
• apps/web/src/components/auth/sign-in/TurnstileView.test.ts
• apps/web/src/components/auth/sign-in/TurnstileView.tsx
• apps/web/src/hooks/useSignInFlow.test.ts
• apps/web/src/hooks/useSignInFlow.ts
• apps/web/src/lib/auth/email-signin-eligibility.test.ts
• apps/web/src/lib/auth/email-signin-eligibility.ts
• apps/web/src/lib/auth/sign-in-methods.test.ts
• apps/web/src/lib/auth/sign-in-methods.ts
• apps/web/src/lib/auth/sign-in-navigation.test.ts
• apps/web/src/lib/auth/sign-in-navigation.ts
• apps/web/src/lib/schemas/sso-organizations.ts
• apps/web/src/lib/user/index.test.ts
• apps/web/src/lib/user/index.ts
• packages/db/AGENTS.md
• packages/db/src/migrations/0225_tiny_reavers.sql
• packages/db/src/migrations/meta/_journal.json
• packages/db/src/schema.ts

Previous review (commit e4d88c8)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/hooks/useSignInFlow.test.ts
• apps/web/src/hooks/useSignInFlow.ts

Previous review (commit ca3f3a3)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

Adding flowState to the query-email Turnstile effect re-opens verification when the user goes Back from a completed ?email= discovery.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/hooks/useSignInFlow.ts	381	flowState in the prefill effect re-opens Turnstile after Back from a completed ?email= discovery

Files Reviewed (4 files)

• apps/web/src/components/auth/SignInForm.test.ts
• apps/web/src/components/auth/SignInForm.tsx
• apps/web/src/hooks/useSignInFlow.test.ts
• apps/web/src/hooks/useSignInFlow.ts - 1 issue

Fix these issues in Kilo Cloud

Previous review (commit 95d44cf)

Status: 3 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/components/auth/SignInForm.tsx	68	Auth error codes become field errors when email is empty/invalid, hiding BlockedNotification
apps/web/src/hooks/useSignInFlow.ts	379	tier dependency re-opens Turnstile after successful ?email= discovery
apps/web/src/hooks/useSignInFlow.ts	833	Invite “Use a different account” restores params.email via the prefill effect

Files Reviewed (27 files)

• apps/storybook/stories/SignInForm.stories.tsx
• apps/web/src/app/api/sso/organizations/route.test.ts
• apps/web/src/app/api/sso/organizations/route.ts
• apps/web/src/app/users/sign_in/page.test.ts
• apps/web/src/app/users/sign_in/page.tsx
• apps/web/src/components/auth/AuthErrorNotification.test.ts
• apps/web/src/components/auth/AuthErrorNotification.tsx
• apps/web/src/components/auth/SignInForm.test.ts
• apps/web/src/components/auth/SignInForm.tsx - 1 issue
• apps/web/src/components/auth/sign-in/EmailInputForm.tsx
• apps/web/src/components/auth/sign-in/ProviderSelectView.test.ts
• apps/web/src/components/auth/sign-in/ProviderSelectView.tsx
• apps/web/src/components/auth/sign-in/TurnstileView.test.ts
• apps/web/src/components/auth/sign-in/TurnstileView.tsx
• apps/web/src/hooks/useSignInFlow.test.ts
• apps/web/src/hooks/useSignInFlow.ts - 2 issues
• apps/web/src/lib/auth/email-signin-eligibility.test.ts
• apps/web/src/lib/auth/email-signin-eligibility.ts
• apps/web/src/lib/auth/sign-in-methods.test.ts
• apps/web/src/lib/auth/sign-in-methods.ts
• apps/web/src/lib/auth/sign-in-navigation.test.ts
• apps/web/src/lib/auth/sign-in-navigation.ts
• apps/web/src/lib/schemas/sso-organizations.ts
• apps/web/src/lib/user/index.test.ts
• apps/web/src/lib/user/index.ts
• packages/db/src/migrations/0224_medical_george_stacy.sql
• packages/db/src/schema.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by grok-4.6 · Input: 92K · Output: 16K · Cached: 677.6K}

_{Review guidance: REVIEW.md from base branch main}

[iscekic]

Approved, bot comments below