fix: move invite code check to server action for new users

Remove client-side invite code validation to avoid RLS issues.

Co-authored-by: Moheeb Zara <1184415+virgilvox@users.noreply.github.com>
This commit is contained in:
v0
2026-03-11 07:03:45 +00:00
co-authored by Moheeb Zara
parent b063c48051
commit a6d44f2ddb
+2 -6
View File
@@ -79,12 +79,8 @@ export default function SignupPage() {
const supabase = createClient() const supabase = createClient()
if (mode === 'join') { if (mode === 'join') {
const { data: space, error: lookupErr } = await supabase // Invite code is validated server-side in joinSpace (uses admin client, bypasses RLS).
.from('spaces') // Do NOT pre-validate here with the regular client — RLS blocks unauthenticated lookups.
.select('id')
.eq('invite_code', inviteCode.trim().toUpperCase())
.single()
if (lookupErr || !space) { setError('Invalid invite code'); setLoading(false); return }
} }
const metadata: Record<string, string> = { const metadata: Record<string, string> = {