From ddde6a7bcb60c66605060909fa560b84fe93449e Mon Sep 17 00:00:00 2001
From: Mauricio Siu <siumauricio@icloud.com>
Date: Sun, 5 Apr 2026 12:42:09 -0600
Subject: [PATCH] =?UTF-8?q?fix:=20address=20PR=20review=20=E2=80=94=20case?=
 =?UTF-8?q?-insensitive=20email=20check=20and=20proper=20error=20handling?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Normalize emails with toLowerCase().trim() before comparing
- Wrap getUserByToken in try/catch since it throws TRPCError on miss,
  rethrow as APIError for consistent error responses
---
 packages/server/src/lib/auth.ts | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/packages/server/src/lib/auth.ts b/packages/server/src/lib/auth.ts
index 88ccfe231..49a131671 100644
--- a/packages/server/src/lib/auth.ts
+++ b/packages/server/src/lib/auth.ts
@@ -148,10 +148,12 @@ const { handler, api } = betterAuth({
 						const xDokployToken =
 							context?.request?.headers?.get("x-dokploy-token");
 						if (xDokployToken) {
-							const invitation = await getUserByToken(xDokployToken);
-							if (!invitation) {
+							let invitation: Awaited<ReturnType<typeof getUserByToken>>;
+							try {
+								invitation = await getUserByToken(xDokployToken);
+							} catch {
 								throw new APIError("BAD_REQUEST", {
-									message: "User not found",
+									message: "Invalid invitation token",
 								});
 							}
 							if (invitation.isExpired) {
@@ -164,7 +166,7 @@ const { handler, api } = betterAuth({
 									message: "Invitation has already been used",
 								});
 							}
-							if (_user.email !== invitation.email) {
+							if (_user.email.toLowerCase().trim() !== invitation.email.toLowerCase().trim()) {
 								throw new APIError("BAD_REQUEST", {
 									message: "Email does not match invitation",
 								});