chore(auth): rename disposable list script to generate:, read SSO callback paths from the plugin

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/lib/auth/disposable-email-gate.test.ts

@@ -4,6 +4,7 @@ import { admin } from 'better-auth/plugins'
 import { describe, expect, it } from 'vitest'
 import { DISPOSABLE_EMAIL_ERROR_CODE } from '@/lib/auth/constants'
 import { refuseDisposableAccountEmail } from '@/lib/auth/disposable-email-gate'
+import { configuredSsoPlugin } from '@/lib/auth/sso/plugin'
 
 /**
  * A real Better Auth instance wired the way `auth.ts` wires the gate, so the endpoint path each
@@ -56,14 +57,20 @@ describe('refuseDisposableAccountEmail', () => {
     expect(result.user.email).toBe('jane@mailinator.com')
   })
 
-  it.each([
-    '/sso/callback/:providerId',
-    '/sso/callback',
-    '/sso/saml2/callback/:providerId',
-    '/sso/saml2/sp/acs/:providerId',
-  ])('admits an SSO just-in-time account created at %s', async (path) => {
-    await expect(refuseDisposableAccountEmail('jane@mailinator.com', path)).resolves.toBeUndefined()
-  })
+  /**
+   * Better Auth dispatches with an endpoint's declared path, so the SSO plugin's own callback
+   * endpoints name the paths a just-in-time creation reports. No IdP is driven here.
+   */
+  const { callbackSSO, callbackSSOShared, callbackSSOSAML, acsEndpoint } =
+    configuredSsoPlugin.endpoints
+  it.each([callbackSSO.path, callbackSSOShared.path, callbackSSOSAML.path, acsEndpoint.path])(
+    'admits any domain at the SSO plugin callback path %s',
+    async (path) => {
+      await expect(
+        refuseDisposableAccountEmail('jane@mailinator.com', path)
+      ).resolves.toBeUndefined()
+    }
+  )
 
   it.each([undefined, '/sign-up/email', '/callback/:id', '/oauth2/callback/:providerId'])(
     'refuses a disposable domain created at %s',

apps/sim/lib/messaging/email/disposable.ts

@@ -40,7 +40,7 @@ export function emailDomain(email: string): string {
  * Fails open: if the list cannot load, the check logs and allows the signup, because refusing
  * every legitimate signup is worse than admitting a few throwaway ones.
  *
- * `disposable-email-domains.json` is generated by `scripts/vendor-disposable-email-domains.ts`
+ * `disposable-email-domains.json` is generated by `scripts/generate-disposable-email-domains.ts`
  * from the curated CC0 blocklist at
  * https://github.com/disposable-email-domains/disposable-email-domains (the list PyPI uses), minus
  * every public suffix and the script's reviewed exemptions (forwarding relays, real providers).

apps/sim/package.json

@@ -42,7 +42,7 @@
     "format": "biome format --write .",
     "format:check": "biome format .",
     "generate:pi-model-catalog": "bun run scripts/generate-pi-model-catalog.ts",
-    "vendor:disposable-email-domains": "bun run scripts/vendor-disposable-email-domains.ts",
+    "generate:disposable-email-domains": "bun run scripts/generate-disposable-email-domains.ts",
     "generate-docs": "bun run ../../scripts/generate-docs.ts",
     "org:consolidate-users": "bun run scripts/consolidate-users-into-organization.ts",
     "verify:oracledb": "node scripts/oracledb-patch-self-test.cjs --worker lib/internal/oracledb/oracle-worker.cjs",

…ripts/vendor-disposable-email-domains.ts …pts/generate-disposable-email-domains.tsapps/sim/scripts/vendor-disposable-email-domains.ts renamed to apps/sim/scripts/generate-disposable-email-domains.ts apps/sim/scripts/vendor-disposable-email-domains.ts renamed to apps/sim/scripts/generate-disposable-email-domains.ts

@@ -14,7 +14,7 @@
  * - forwarding relays, whose aliases deliver to a real, permanent inbox;
  * - the reviewed real providers in `LEGITIMATE_DOMAINS`.
  *
- * Usage, from apps/sim: `bun run vendor:disposable-email-domains [path-to-blocklist.conf]`. With
+ * Usage, from apps/sim: `bun run generate:disposable-email-domains [path-to-blocklist.conf]`. With
  * no path it downloads the pinned commit. To refresh, bump `UPSTREAM_COMMIT`, run it, and review
  * the diff against the Tranco top list for mainstream providers and companies.
  */