From ab39c8f58191500501156bc41d961e204ddcef6f Mon Sep 17 00:00:00 2001 From: Somay Chauhan Date: Fri, 15 Sep 2023 18:27:41 +0530 Subject: [PATCH] fix: a new email can signin with any password once it's invited to a team (#11359) Co-authored-by: Shivam Kalra --- packages/features/auth/lib/next-auth-options.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/features/auth/lib/next-auth-options.ts b/packages/features/auth/lib/next-auth-options.ts index ace33145df..40d240b95f 100644 --- a/packages/features/auth/lib/next-auth-options.ts +++ b/packages/features/auth/lib/next-auth-options.ts @@ -143,7 +143,9 @@ const providers: Provider[] = [ if (user.identityProvider !== IdentityProvider.CAL && !credentials.totpCode) { throw new Error(ErrorCode.ThirdPartyIdentityProviderEnabled); } - + if (!user.password && user.identityProvider == IdentityProvider.CAL) { + throw new Error(ErrorCode.IncorrectEmailPassword); + } if (!user.password && user.identityProvider !== IdentityProvider.CAL && !credentials.totpCode) { throw new Error(ErrorCode.IncorrectEmailPassword); }