{"record":{"id":"8c1e78bd9105d225","repo":"toeverything/AFFiNE","slug":"sign-up-forbidden-8c1e78","errorCode":"sign_up_forbidden","errorMessage":"sign up helper is forbidden for non-test environment","messagePattern":"sign up helper is forbidden for non-test environment","errorType":"exception","errorClass":"SignUpForbidden","httpStatus":403,"severity":"critical","filePath":"packages/backend/server/src/core/auth/service.ts","lineNumber":84,"sourceCode":"  async onApplicationBootstrap() {\n    if (env.dev) {\n      await createDevUsers(this.models, this.entitlement);\n    }\n  }\n\n  async canSignIn(_email: string) {\n    // may add more sign-in check later\n    return true;\n  }\n\n  /**\n   * @deprecated\n   *\n   * This is a test only helper to quickly signup a user, do not use in production\n   */\n  async signUp(email: string, password: string): Promise<CurrentUser> {\n    if (!env.testing) {\n      throw new SignUpForbidden(\n        'sign up helper is forbidden for non-test environment'\n      );\n    }\n\n    return this.models.user\n      .create({\n        email,\n        password,\n      })\n      .then(sessionUser);\n  }\n\n  async signIn(email: string, password: string): Promise<CurrentUser> {\n    return this.models.user.signIn(email, password).then(sessionUser);\n  }\n\n  async verifyPassword(\n    email: string,","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/26c515e050211269e911f7d9cfe162a26c83ed98/packages/backend/server/src/core/auth/service.ts#L66-L102","documentation":"Thrown by AuthService.signUp, an explicitly @deprecated test-only helper, when invoked outside the test environment (env.testing is false). Category 'action_forbidden', code 'sign_up_forbidden'. The check exists so this shortcut (which bypasses invitations, verification, and rate limiting) can never leak into production.","triggerScenarios":"Calling AuthService.signUp(email, password) (service.ts:78-86) in any process where env.testing !== true. The guard is the very first statement, so any non-test caller fails immediately.","commonSituations":"A developer copied test seed logic into a script/migration/seeder that runs against a non-test database; a feature flag or env mislabel that left signUp referenced in production code paths; an e2e harness pointed at a staging env that does not set NODE_ENV=test.","solutions":["Replace the signUp call with the real registration path (invitation accept / sign-up mutation) appropriate to the environment.","If this is genuinely test scaffolding, ensure the process runs with env.testing=true (e.g. NODE_ENV=test) and the config loader exposes it.","Remove the reference entirely; the method is @deprecated."],"exampleFix":"// before (in a seed script run against staging)\nawait auth.signUp(user.email, user.password);\n\n// after (use the real resolver or restrict to test)\nif (process.env.NODE_ENV === 'test') {\n  await auth.signUp(user.email, user.password);\n} else {\n  throw new Error('Use the invite/sign-up mutation in non-test envs');\n}","handlingStrategy":"validation","validationCode":"import { env } from '../../base/env';\nfunction assertTestEnvForSignUp(): void {\n  if (!env.testing) {\n    throw new Error('auth.signUp is a test-only helper; use the real sign-up/invitation flow.');\n  }\n}\nassertTestEnvForSignUp();\nawait auth.signUp(email, password);","typeGuard":"function isTestEnv(): boolean {\n  return Boolean(env.testing);\n}","tryCatchPattern":null,"preventionTips":["Treat auth.signUp as test-only; grep the codebase for references before any non-test deploy.","Gate seed/migration scripts on NODE_ENV === 'test'.","Prefer the invitation or public sign-up mutation for any non-test registration."],"tags":["auth","security","environment","deprecated","configuration"],"backgroundTag":null,"analyzedSha":"26c515e050211269e911f7d9cfe162a26c83ed98","analyzedAt":"2026-08-12T13:15:16.447Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}