fix: make email whitelist comparison case-insensitive

[xingyaoww]

GitHub OAuth may return emails with different casing than what is configured in allowed-emails.json (e.g. 'User@gmail.com' vs 'user@gmail.com'). The previous list.includes() check is case-sensitive, causing legitimate users to be denied access.

Use case-insensitive comparison instead.

---

Note

Low Risk
Low risk, small change limited to the GitHub sign-in whitelist comparison logic. Main risk is unintentionally allowing emails that differ only by case from the configured list (typically desired).

Overview
Updates the NextAuth signIn callback to perform a case-insensitive comparison when checking GitHub-authenticated users against allowed-emails.json, replacing list.includes(user.email) with a lowercased some() match.

^{Written by Cursor Bugbot for commit 24b6226. This will update automatically on new commits. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes a case-sensitivity bug in the GitHub OAuth email whitelist check in frontend/lib/auth.ts. The previous list.includes(user.email) was a strict case-sensitive comparison, causing users to be denied access if their GitHub-returned email casing differed from the casing used in allowed-emails.json (e.g. User@gmail.com vs user@gmail.com).

• Replaces list.includes(user.email) with list.some((e) => e.toLowerCase() === emailLower) for case-insensitive matching
• Pre-computes emailLower once outside the callback for minor efficiency
• The fix is minimal, correct, and scoped exactly to the affected code path

Confidence Score: 5/5

• This PR is safe to merge — the change is a minimal, correct two-line fix with no risk of regressions.
• The change replaces a case-sensitive string match with a case-insensitive equivalent, which is the correct and standard approach for email comparison. The logic is simple, the scope is contained, no new dependencies are introduced, and the fix directly addresses the stated bug without side effects.
• No files require special attention.

Important Files Changed

Filename	Overview
frontend/lib/auth.ts	Changes the GitHub email whitelist check from case-sensitive list.includes() to case-insensitive .some() comparison using .toLowerCase() — a minimal and correct fix.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User initiates sign-in] --> B{provider === 'github'?}
    B -- No --> C[Return true - allow sign-in]
    B -- Yes --> D{user.email present AND list exists?}
    D -- No --> C
    D -- Yes --> E["emailLower = user.email.toLowerCase()"]
    E --> F["list.some(e => e.toLowerCase() === emailLower)"]
    F -- Match found --> G[Return true - allow sign-in]
    F -- No match --> H[Return false - deny sign-in]

Loading

_{Reviews (1): Last reviewed commit: "fix: make email whitelist comparison cas..." | Re-trigger Greptile}