feat(auth): add optional ALLOWED_EMAILS sign-in allowlist

[paularro]

A self-hosted instance on a public domain is open to signup. The email provider creates an account for whoever asks for a magic link, and events.createUser gives that account its own workspace. So anyone who finds the URL of an instance can register on it.

That is the right default for a hosted product, but most people following docs/setup.md are running this for their own accounts, where it is just an open door. There is currently no way to close it short of putting the whole app behind basic auth, which breaks the webhook and the OAuth callback.

Change

ALLOWED_EMAILS, a comma-separated, case-insensitive allowlist:

ALLOWED_EMAILS=you@example.com,teammate@example.com

Checked in the signIn callback, which NextAuth runs before the magic link is sent, so a blocked address never receives one and no User row is created.

Left unset, nothing changes. The helper returns true when the list is empty, so existing deployments are unaffected and the variable is purely opt-in.

The helper lives in lib/env.ts next to the other env accessors and reads process.env per call, matching getMetaGraphApiVersion rather than caching at module load. That is what makes it testable with vi.stubEnv.

Also documents it in .env.example and in the environment table in docs/setup.md.

Tests

Five cases added to __tests__/env.test.ts: unset list, list of only separators, listed vs unlisted address, case and whitespace on both sides, and a null/undefined/empty address while the list is set.

Test Files  14 passed (14)
     Tests  150 passed (150)

tsc --noEmit and eslint clean.

Behaviour when blocked

Verified against a live instance. A non-listed address redirects to /api/auth/error?error=AccessDenied and creates no user row; a listed address passes the callback and proceeds to the mail provider as normal.

[vercel]

@paularro is attempting to deploy a commit to the diwenne's projects Team on Vercel.

A member of the Team first needs to authorize it.