mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 15:51:26 +00:00
Tomas DvorakandDevin
e127c62b0f
Sign-ups through the Better Auth proxy write to auth_users, but the bootstrap gate counted users — which only mirrors on the first authenticated call. In that window a second public registration was accepted on both the proxied sign-up and the native register endpoint. countLocalUsers now unions users with auth_users (guarded by to_regclass so backend-only installs still work), and handleRegister uses it instead of its own inline count. e2e-verified on a live stack: users=0/auth_users=1 already reports mode=login and 403s both public paths; internal-token bypass works, wrong token refused, authed POST /users creates users (201), and the users mirror still populates on first authenticated call. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>