Authentication Email Handling#

Overview#

Email input is processed through two consistent layers across all Langfuse auth flows: Zod schema validation (format check only, no transformation) on the server boundary, and .toLowerCase() normalization applied server-side before every database read or write. No flow relies on the client to normalize case.

Zod Schemas by Flow#

All four schemas use z.string().email() with no .transform() — meaning schemas validate format but do not lowercase. Normalization is deferred to server-side code.

Server-Side Normalization Points#

Sign-up (signupApiHandler)#

signupApiHandler receives the validated form body and:

1. Calls signupSchema.safeParse(req.body) — rejects malformed input with 422 1.
2. Lowercases the domain portion for SSO domain blocking checks: body.email.split("@")[1]?.toLowerCase() 2.
3. Passes the raw (non-lowercased) email to createUserEmailPassword, which lowercases it for both the duplicate check and the prisma.user.create call 3.

Sign-in (Credentials Provider)#

Inside the NextAuth CredentialsProvider.authorize:

• Domain is extracted and lowercased for SSO enforcement: credentials.email.split("@")[1]?.toLowerCase() 4.
• The Prisma lookup always uses email: credentials.email.toLowerCase() 5.

signIn Callback (all providers)#

The signIn callback runs on every authentication attempt:

1. Lowercases user.email immediately: const email = user.email?.toLowerCase() 6.
2. Validates the lowercased result with z.string().email().safeParse(email) — throws if invalid 7.
3. Extracts the domain from the already-lowercased email for multi-tenant SSO enforcement 8.
4. For the email provider (OTP / password reset), queries Prisma with the lowercased email to gate the flow to existing users only 9.

Session Callback#

The session callback fetches the user record using token.email!.toLowerCase() 10, ensuring case-insensitive session hydration.

SSO Domain Enforcement and Email#

Domain-blocking logic in multiple places all derive the domain the same way — email.split("@")[1]?.toLowerCase():

• Static SSO block list (AUTH_DOMAINS_WITH_SSO_ENFORCEMENT env var): parsed in getSSOBlockedDomains(), applied in both sign-in 11 and sign-up 12.
• Multi-tenant SSO (EE): getSsoAuthProviderIdForDomain(domain) is called with the lowercased domain in sign-in, sign-up, and the enterprise SSO page. When a domain match is found the sign-in callback redirects to /auth/enterprise-sso-required with the lowercased email in the query string 13.
• Enterprise SSO page: re-validates the email with z.string().email(), then lowercases the domain before calling /api/auth/check-sso 14.

Key Files#