fix: move invite code check to server action for new users
Remove client-side invite code validation to avoid RLS issues. Co-authored-by: Moheeb Zara <1184415+virgilvox@users.noreply.github.com>
This commit is contained in:
+2
-6
@@ -79,12 +79,8 @@ export default function SignupPage() {
|
|||||||
const supabase = createClient()
|
const supabase = createClient()
|
||||||
|
|
||||||
if (mode === 'join') {
|
if (mode === 'join') {
|
||||||
const { data: space, error: lookupErr } = await supabase
|
// Invite code is validated server-side in joinSpace (uses admin client, bypasses RLS).
|
||||||
.from('spaces')
|
// Do NOT pre-validate here with the regular client — RLS blocks unauthenticated lookups.
|
||||||
.select('id')
|
|
||||||
.eq('invite_code', inviteCode.trim().toUpperCase())
|
|
||||||
.single()
|
|
||||||
if (lookupErr || !space) { setError('Invalid invite code'); setLoading(false); return }
|
|
||||||
}
|
}
|
||||||
|
|
||||||
const metadata: Record<string, string> = {
|
const metadata: Record<string, string> = {
|
||||||
|
|||||||
Reference in New Issue
Block a user