[Auth] Update perm logic for extra fields

client/packages/create-instant-app/template/rules/AGENTS.md

@@ -181,6 +181,7 @@ data.ref(someVar + '.members.id')
 - Can override `view`, `update`, and `create`
 - Cannot override `delete`
 - The `create` rule runs during auth signup flows (not via `transact`). Use it to restrict signups or validate `extraFields`.
+- `extraFields` require an explicit `create` rule. Without one, signup is blocked to prevent unvalidated writes.
 
 ## $files Permissions
 

client/packages/create-instant-app/template/rules/cursor-rules.md

@@ -187,6 +187,7 @@ data.ref(someVar + '.members.id')
 - Can override `view`, `update`, and `create`
 - Cannot override `delete`
 - The `create` rule runs during auth signup flows (not via `transact`). Use it to restrict signups or validate `extraFields`.
+- `extraFields` require an explicit `create` rule. Without one, signup is blocked to prevent unvalidated writes.
 
 ## $files Permissions
 

client/packages/create-instant-app/template/rules/windsurf-rules.md

@@ -187,6 +187,7 @@ data.ref(someVar + '.members.id')
 - Can override `view`, `update`, and `create`
 - Cannot override `delete`
 - The `create` rule runs during auth signup flows (not via `transact`). Use it to restrict signups or validate `extraFields`.
+- `extraFields` require an explicit `create` rule. Without one, signup is blocked to prevent unvalidated writes.
 
 ## $files Permissions
 

client/www/lib/intern/instant-rules.md

@@ -181,6 +181,7 @@ data.ref(someVar + '.members.id')
 - Can override `view`, `update`, and `create`
 - Cannot override `delete`
 - The `create` rule runs during auth signup flows (not via `transact`). Use it to restrict signups or validate `extraFields`.
+- `extraFields` require an explicit `create` rule. Without one, signup is blocked to prevent unvalidated writes.
 
 ## $files Permissions
 

client/www/pages/docs/users.md

@@ -244,6 +244,8 @@ if (created) {
 }
 ```
 
+When using `extraFields`, a `create` rule on `$users` is required. Signup will fail if no rule is defined. This ensures you explicitly opt in to accepting custom fields. A rule of `"true"` allows any values through. See [Signup rules](#signup-rules) for more examples.
+
 ## Signup rules
 
 You can write a `create` rule on `$users` to control who can sign up and what fields they can set. This rule runs during the auth signup flow (magic codes, OAuth, guest sign-in) but does not apply to `transact`.

server/src/instant/model/app_user.clj

@@ -43,10 +43,14 @@
                               extra-fields))))
 
 (defn- assert-create-permission!
-  [app-id user-data]
+  [app-id user-data has-extra-fields?]
   (let [rules (rule-model/get-by-app-id {:app-id app-id})
-        program (rule-model/get-program! rules "$users" "create")]
-    (when program
+        program (rule-model/get-program! rules
+                  {:etype "$users"
+                   :action "create"
+                   :paths [["$users" "allow" "create"]]})]
+    (cond
+      program
       (let [ctx {:db {:conn-pool (aurora/conn-pool :read)}
                  :app-id app-id
                  :attrs (attr-model/get-by-app-id app-id)
@@ -56,7 +60,13 @@
          :perms-pass?
          ["$users" "create"]
          (cel/eval-program! ctx program {:data user-data
-                                         :new-data user-data}))))))
+                                         :new-data user-data})))
+
+      has-extra-fields?
+      (ex/assert-permitted!
+       :perms-pass?
+       ["$users" "create"]
+       false))))
 
 (defn assert-signup!
   "Validates extra-fields and checks the $users create permission rule.
@@ -66,7 +76,7 @@
   (when-not skip-perm-check?
     (let [id (or (:id params) (random-uuid))
           user-data (build-user-data (assoc params :id id))]
-      (assert-create-permission! app-id user-data))))
+      (assert-create-permission! app-id user-data (seq extra-fields)))))
 
 (defn create!
   ([params]

server/test/instant/runtime/routes_test.clj

@@ -409,6 +409,8 @@
        (test-util/make-attrs app-id
                              [[:$users/username :unique? :index?]
                               [:$users/displayName]])
+       (rule-model/put! {:app-id app-id
+                          :code {"$users" {"allow" {"create" "true"}}}})
 
        (testing "new user with extra-fields"
          (let [code (send-code app {:email "new@test.com"})
@@ -478,6 +480,8 @@
      (fn [{app-id :id :as app}]
        (test-util/make-attrs app-id
                              [[:$users/username]])
+       (rule-model/put! {:app-id app-id
+                          :code {"$users" {"allow" {"create" "true"}}}})
 
        (let [guest (sign-in-guest app)
              _     (is (= "guest" (:type guest)))
@@ -498,6 +502,8 @@
       (test-util/make-attrs app-id
                             [[:$users/username]
                              [:$users/displayName]])
+      (rule-model/put! {:app-id app-id
+                         :code {"$users" {"allow" {"create" "true"}}}})
 
       (let [provider (provider-model/create! {:app-id app-id
                                               :provider-name "clerk"})]
@@ -632,6 +638,14 @@
                                       :code code})]
            (is (true? (:created body)))))
 
+       (testing "extra-fields without create rule blocks signup"
+         (let [code (send-code app {:email "norule@test.com"})]
+           (is (thrown-with-msg?
+                ExceptionInfo #"status 400"
+                (verify-body app {:email "norule@test.com"
+                                  :code code
+                                  :extra-fields {"username" "sneaky"}})))))
+
        (testing "create rule does not run for existing users"
          (rule-model/put! {:app-id app-id
                            :code {"$users" {"allow" {"create" "false"}}}})
@@ -693,6 +707,12 @@
       (testing "create rule allows guest signup when passing"
         (rule-model/put! {:app-id app-id
                           :code {"$users" {"allow" {"create" "true"}}}})
+        (let [guest (sign-in-guest-runtime app)]
+          (is (= "guest" (:type guest)))))
+
+      (testing "$default rules do not affect guest signup"
+        (rule-model/put! {:app-id app-id
+                          :code {"$default" {"allow" {"$default" "false"}}}})
         (let [guest (sign-in-guest-runtime app)]
           (is (= "guest" (:type guest))))))))