#239 address review feedback

Call authServer.admin.createUser before creating the app row so the Neon Auth
account is pre-provisioned and the user can sign in via OTP immediately; revert
resolveRealUser to the original atomic upsert (race-safe, no nullable neonAuthId
needed); remove the make-neon-auth-id-nullable migration.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: b-at-neu

lib/auth/server.ts

@@ -7,45 +7,23 @@ import { prisma } from '@/lib/prisma';
 
 export const authServer = createAuthServer();
 
-// Provision-on-first-auth: creates or links the app User row when a real Neon
-// session has no matching row yet, then returns it.
-// Pre-invited users (created by an admin before they sign up) are matched by
-// email and linked to the session's neonAuthId on first login.
-// Deactivated users (#153) are blocked by the post-lookup guard below.
+// Provision-on-first-auth: create the app User row when a real Neon session
+// has no matching row yet, then return it. Create-only (empty update {}) so an
+// existing row is returned without any write.
+// Keyed on the unique neonAuthId → race-safe via the DB unique constraint + upsert.
+// name omitted when falsy (OTP identities often supply an empty string → store null).
+// Deactivated users (#153) are blocked by the post-upsert guard below.
 async function resolveRealUser() {
   const { data: session } = await authServer.getSession();
   if (!session?.user) return null;
 
   const { id: neonAuthId, email, name } = session.user;
 
-  // 1. Existing user already linked by neonAuthId
-  let row = await prisma.user.findUnique({ where: { neonAuthId } });
-
-  // 2. Pre-invited user — match by email, link neonAuthId on first sign-in
-  if (!row) {
-    const pending = await prisma.user.findFirst({
-      where: { email, neonAuthId: null },
-    });
-    if (pending) {
-      row = await prisma.user.update({
-        where: { id: pending.id },
-        data: { neonAuthId, ...(name?.trim() ? { name: name.trim() } : {}) },
-      });
-    }
-  }
-
-  // 3. Brand-new user — create app row
-  if (!row) {
-    row = await prisma.user.create({
-      data: {
-        neonAuthId,
-        email,
-        ...(name?.trim() ? { name: name.trim() } : {}),
-        isAdmin: false,
-      },
-    });
-  }
-
+  const row = await prisma.user.upsert({
+    where: { neonAuthId },
+    update: {},
+    create: { neonAuthId, email, ...(name ? { name } : {}), isAdmin: false },
+  });
   if (row.deletedAt) return null;
   return row;
 }

prisma/actions/users.ts

@@ -4,7 +4,7 @@ import { revalidatePath } from 'next/cache';
 
 import { z } from 'zod/v4';
 
-import { getCurrentUser } from '@/lib/auth/server';
+import { authServer, getCurrentUser } from '@/lib/auth/server';
 import { createUserSchema } from '@/lib/constants';
 import { prisma } from '@/lib/prisma';
 
@@ -71,6 +71,16 @@ export async function deactivateUser(
   revalidatePath('/users');
 }
 
+// Type guard for Better Auth error responses — avoids unsafe `as` casts.
+function hasCode(e: unknown): e is { code: string } {
+  return (
+    typeof e === 'object' &&
+    e !== null &&
+    'code' in e &&
+    typeof (e as Record<string, unknown>).code === 'string'
+  );
+}
+
 export async function createUser(input: unknown): Promise<ActionError | void> {
   const admin = await getCurrentUser();
   if (!admin.isAdmin) return { error: 'Unauthorized' };
@@ -80,11 +90,32 @@ export async function createUser(input: unknown): Promise<ActionError | void> {
 
   const { email, name, isAdmin } = parsed.data;
 
-  const existing = await prisma.user.findFirst({ where: { email } });
-  if (existing) return { error: 'A user with this email already exists.' };
+  // Pre-create the Neon Auth account so the user can sign in via OTP immediately.
+  // A random password satisfies the required field; OTP is the actual sign-in method.
+  const authResult = await authServer.admin.createUser({
+    email,
+    name: name?.trim() ?? '',
+    password: crypto.randomUUID() + crypto.randomUUID(),
+  });
+
+  if (authResult.error) {
+    if (
+      hasCode(authResult.error) &&
+      (authResult.error.code === 'USER_ALREADY_EXISTS' ||
+        authResult.error.code === 'USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL')
+    )
+      return { error: 'A user with this email already exists.' };
+    throw new Error(`Neon Auth createUser failed: ${String(authResult.error)}`);
+  }
+
+  if (!authResult.data?.user.id)
+    throw new Error('Neon Auth createUser returned no user id');
+
+  const neonAuthId = authResult.data.user.id;
 
   await prisma.user.create({
     data: {
+      neonAuthId,
       email,
       ...(name?.trim() ? { name: name.trim() } : {}),
       isAdmin: isAdmin ?? false,

prisma/migrations/20260627000000_make-neon-auth-id-nullable/migration.sql

@@ -33,7 +33,7 @@ enum QuestionType {
 
 model User {
   id          String    @id @default(uuid(7))
-  neonAuthId  String?   @unique
+  neonAuthId  String    @unique
   email       String    @unique
   name        String?
   isAdmin     Boolean   @default(false)