Cannot login to auth as an already authorise organiser

[joshyhud]

Description of the issue 📄

I am trying to login to the codebar.io website as an organiser which i have done previously.

When loading the site the sign in link takes me to a page to complete profile with a dummy user id.

When i try this in incognito window the site will ask me to send a magic link which i usually see and then follow the magic link emailed to my registered email and i get a logged in page but i can only access the auth profile view and not the main site or admin area

Screenshots 📷

Steps to fix 🛠

To do 📋

• Claim this issue (comment below, or assign yourself if you are part of the codebar org)
• Fork and clone the repository
• Update the relevant files. Follow the steps to fix section in this issue.
• Commit your changes as one commit. Use the title of this issue as your commit message
• Submit a pull request
• Mention this issue in the PR description by including it's number
• Have your pull request reviewed & merged by a codebar team member

[mroderick]

This was the id_token email-claim incident: since better-auth 1.7, sign-in keyed new members on the better-auth user id (the "dummy user id" in the profile page) instead of the email address, so organiser sign-ins landed on empty accounts without roles.

Fixed and deployed:

• Sign-in now resolves the member email from the OIDC UserInfo endpoint (fix(auth): take the member email from the UserInfo endpoint #2992), with a fail-closed guard so a member is never keyed on the user id (fix(auth): fail the codebar callback when the id_token has no email claim #2986).
• The accounts created by the bug are deactivated (feat(members): deactivate sub-keyed members from the id_token sub fallback #2987). Their original values are preserved in member notes if anything needs reconciling.
• GitHub and magic-link sign-ins were verified in production against existing accounts after the deploy.

Please sign in again: you should land on your existing organiser account with admin access. If not, reopen this issue.