fix(email-validation): add email validation to prevent bouncing, fixed OTP validation by waleedlatif1 · Pull Request #916 · simstudioai/sim

waleedlatif1 · 2025-08-08T23:43:10Z

Summary

Add email validation to prevent bouncing, fixed OTP validation

Type of Change

Bug fix
New feature

Testing

Tested manually

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2025-08-08T23:43:16Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
sim	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 9, 2025 0:04am

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
docs	⬜️ Skipped (Inspect)			Aug 9, 2025 0:04am

greptile-apps

Greptile Summary

This PR introduces a comprehensive email validation system to prevent email bouncing and improve deliverability across the Sim platform. The changes replace basic regex-based email validation with a sophisticated validation module that includes RFC 5322 syntax checking, disposable email provider detection, suspicious pattern filtering, and optional MX record verification.

The new validation system provides two main functions: quickValidateEmail for performance-critical scenarios (skips MX record checks) and validateEmail for thorough validation with MX record verification. This dual approach allows the application to balance performance with validation thoroughness based on context.

Key integration points include:

Authentication flows: Updated login and signup forms to use the new validation before form submission
Organization management: Enhanced invitation and member management with better email filtering
Middleware protection: Added verification requirement enforcement to prevent authenticated users from bypassing email verification
OTP verification: Fixed security vulnerability by properly clearing verification cookies after successful email confirmation

The validation module maintains a hardcoded list of disposable email domains and implements timeout handling for MX record lookups. Test files were updated to use user@company.com instead of test@example.com to ensure compatibility with the new validation rules.

PR Description Notes:

The PR description is incomplete with empty summary, unchecked type of change, and missing testing details
Issue reference shows placeholder #(issue) instead of actual issue number

Confidence score: 3/5

This PR requires careful review due to the comprehensive changes to email validation across critical authentication flows
Score reflects concerns about the @types/node downgrade, incomplete test coverage, and potential breaking changes for legitimate emails
Pay close attention to the middleware changes, email validation logic, and the @types/node version downgrade in package.json

_{17 files reviewed, 8 comments}

_{Edit Code Review Bot Settings | Greptile}

greptile-apps · 2025-08-08T23:43:44Z

apps/sim/app/(auth)/login/login-form.tsx

+const validateEmailField = (emailValue: string): string[] => {
+  const errors: string[] = []
+
+  if (!emailValue || !emailValue.trim()) {
+    errors.push('Email is required.')
+    return errors
+  }
+
+  const validation = quickValidateEmail(emailValue.trim().toLowerCase())
+  if (!validation.isValid) {
+    errors.push(validation.reason || 'Please enter a valid email address.')
+  }
+
+  return errors
 }


style: Consider extracting this validation logic into the centralized validation utility to maintain consistency with other forms

Context Used: Context - When defining properties for components, use a dedicated config file (.ts) for configuration and keep rendered components in their respective component files. (link)

greptile-apps · 2025-08-08T23:43:49Z

apps/sim/lib/email/validation.test.ts

+    it('should validate quickly without MX check', () => {
+      const result = quickValidateEmail('user@example.com')
+      expect(result.isValid).toBe(true)
+      expect(result.checks.mxRecord).toBe(true) // Skipped, so assumed true


style: The comment assumes MX record is skipped and set to true, but this might be confusing. The quick validation actually sets mxRecord: true by default, not because it's skipped.

greptile-apps · 2025-08-08T23:43:51Z

apps/sim/lib/billing/validation/seat-management.ts

+    const validEmails = uniqueEmails.filter(
+      (email) => quickValidateEmail(email.trim().toLowerCase()).isValid
+    )


logic: Email normalization with .trim().toLowerCase() should happen before deduplication on line 211 to ensure duplicate detection works correctly with emails that differ only in case or whitespace.

greptile-apps · 2025-08-08T23:43:55Z

apps/sim/app/api/organizations/[id]/invitations/route.ts

+        const normalized = email.trim().toLowerCase()
+        const validation = quickValidateEmail(normalized)
+        return validation.isValid ? normalized : null
      })
      .filter(Boolean) as string[]


style: Email normalization is now done inline instead of using a centralized utility. Consider extracting this normalization logic to maintain consistency across the codebase.

greptile-apps · 2025-08-08T23:43:55Z

apps/sim/app/api/organizations/[id]/invitations/route.ts

+          (email: string) => !quickValidateEmail(email.trim().toLowerCase()).isValid
        ),


logic: Duplicate normalization logic - email is processed twice with trim().toLowerCase(). This creates inconsistency and potential performance impact.

greptile-apps · 2025-08-08T23:44:10Z

apps/sim/lib/email/validation.ts

+  const checks = {
+    syntax: false,
+    domain: false,
+    mxRecord: true, // Skip MX check for performance


style: Setting mxRecord to true when skipping the check could be misleading - consider setting to null or adding a 'skipped' field to indicate this check wasn't performed

greptile-apps · 2025-08-08T23:44:10Z

apps/sim/lib/email/validation.ts

+    try {
+      const mxCheckPromise = checkMXRecord(domain)
+      const timeoutPromise = new Promise<boolean>((_, reject) =>
+        setTimeout(() => reject(new Error('MX check timeout')), 5000)


logic: The timeout promise creates a timer that isn't cleaned up if MX check completes first, which could cause memory leaks in high-volume scenarios

greptile-apps · 2025-08-08T23:44:11Z

apps/sim/lib/email/validation.ts

+  'spam4.me',
+  'tempail.com',
+  'tempr.email',
+  'dispostable.com',


syntax: Typo in domain name - should be 'disposable.com' not 'dispostable.com'

…ypes (#919) * feat(execution-filesystem): system to pass files between blocks (#866) * feat(files): pass files between blocks * presigned URL for downloads * Remove latest migration before merge * starter block file upload wasn't getting logged * checkpoint in human readable form * checkpoint files / file type outputs * file downloads working for block outputs * checkpoint file download * fix type issues * remove filereference interface with simpler user file interface * show files in the tag dropdown for start block * more migration to simple url object, reduce presigned time to 5 min * Remove migration 0065_parallel_nightmare and related files - Deleted apps/sim/db/migrations/0065_parallel_nightmare.sql - Deleted apps/sim/db/migrations/meta/0065_snapshot.json - Removed 0065 entry from apps/sim/db/migrations/meta/_journal.json Preparing for merge with origin/staging and migration regeneration * add migration files * fix tests * Update apps/sim/lib/uploads/setup.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update apps/sim/lib/workflows/execution-file-storage.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update apps/sim/lib/workflows/execution-file-storage.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * cleanup types * fix lint * fix logs typing for file refs * open download in new tab * fixed * Update apps/sim/tools/index.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * fix file block * cleanup unused code * fix bugs * remove hacky file id logic * fix drag and drop * fix tests --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * feat(trigger-mode): added trigger-mode to workflow_blocks table (#902) * fix(schedules-perms): use regular perm system to view/edit schedule info (#901) * fix(schedules-perms): use regular perm system to view schedule info * fix perms * improve logging * feat(webhooks): deprecate singular webhook block + add trigger mode to blocks (#903) * feat(triggers): added new trigger mode for blocks, added socket event, ran migrations * Rename old trigger/ directory to background/ * cleaned up, ensured that we display active webhook at the block-level * fix submenu in tag dropdown * keyboard nav on tag dropdown submenu * feat(triggers): add outlook to new triggers system * cleanup * add types to tag dropdown, type all outputs for tools and use that over block outputs * update doc generator to truly reflect outputs * fix docs * add trigger handler * fix active webhook tag * tag dropdown fix for triggers * remove trigger mode schema change * feat(execution-filesystem): system to pass files between blocks (#866) * feat(files): pass files between blocks * presigned URL for downloads * Remove latest migration before merge * starter block file upload wasn't getting logged * checkpoint in human readable form * checkpoint files / file type outputs * file downloads working for block outputs * checkpoint file download * fix type issues * remove filereference interface with simpler user file interface * show files in the tag dropdown for start block * more migration to simple url object, reduce presigned time to 5 min * Remove migration 0065_parallel_nightmare and related files - Deleted apps/sim/db/migrations/0065_parallel_nightmare.sql - Deleted apps/sim/db/migrations/meta/0065_snapshot.json - Removed 0065 entry from apps/sim/db/migrations/meta/_journal.json Preparing for merge with origin/staging and migration regeneration * add migration files * fix tests * Update apps/sim/lib/uploads/setup.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update apps/sim/lib/workflows/execution-file-storage.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update apps/sim/lib/workflows/execution-file-storage.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * cleanup types * fix lint * fix logs typing for file refs * open download in new tab * fixed * Update apps/sim/tools/index.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * fix file block * cleanup unused code * fix bugs * remove hacky file id logic * fix drag and drop * fix tests --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * feat(trigger-mode): added trigger-mode to workflow_blocks table (#902) * fix(schedules-perms): use regular perm system to view/edit schedule info (#901) * fix(schedules-perms): use regular perm system to view schedule info * fix perms * improve logging * cleanup * prevent tooltip showing up on modal open * updated trigger config * fix type issues --------- Co-authored-by: Vikhyath Mondreti <vikhyathvikku@gmail.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai> * fix(helm): fix helm charts migrations using wrong image (#907) * fix(helm): fix helm charts migrations using wrong image * fixed migrations * feat(whitelist): add email & domain-based whitelisting for signups (#908) * improvement(helm): fix duplicate SOCKET_SERVER_URL and add additional envvars to template (#909) * improvement(helm): fix duplicate SOCKET_SERVER_URL and add additional envvars to template * rm serper & freestyle * improvement(tag-dropdown): typed tag dropdown values (#910) * fix(min-chunk): remove minsize for chunk (#911) * fix(min-chunk): remove minsize for chunk * fix tests * improvement(chunk-config): migrate unused default for consistency (#913) * fix(mailer): update mailer to use the EMAIL_DOMAIN (#914) * fix(mailer): update mailer to use the EMAIL_DOMAIn * add more * Improvement(cc): added cc to gmail and outlook (#900) * changed just gmail * bun run lint * fixed bcc * updated docs --------- Co-authored-by: Adam Gough <adamgough@Mac.attlocal.net> Co-authored-by: waleedlatif1 <walif6@gmail.com> * fix(email-validation): add email validation to prevent bouncing, fixed OTP validation (#916) * feat(email-validation): add email validation to prevent bouncing * removed suspicious patterns * fix(verification): fixed OTP verification * fix failing tests, cleanup * fix(otp): fix email not sending (#917) * fix(email): manual OTP instead of better-auth (#921) * fix(email): manual OTP instead of better-auth * lint --------- Co-authored-by: Vikhyath Mondreti <vikhyathvikku@gmail.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai> Co-authored-by: Adam Gough <77861281+aadamgough@users.noreply.github.com> Co-authored-by: Adam Gough <adamgough@Mac.attlocal.net>

…d OTP validation (simstudioai#916) * feat(email-validation): add email validation to prevent bouncing * removed suspicious patterns * fix(verification): fixed OTP verification * fix failing tests, cleanup

…ypes (simstudioai#919) * feat(execution-filesystem): system to pass files between blocks (simstudioai#866) * feat(files): pass files between blocks * presigned URL for downloads * Remove latest migration before merge * starter block file upload wasn't getting logged * checkpoint in human readable form * checkpoint files / file type outputs * file downloads working for block outputs * checkpoint file download * fix type issues * remove filereference interface with simpler user file interface * show files in the tag dropdown for start block * more migration to simple url object, reduce presigned time to 5 min * Remove migration 0065_parallel_nightmare and related files - Deleted apps/sim/db/migrations/0065_parallel_nightmare.sql - Deleted apps/sim/db/migrations/meta/0065_snapshot.json - Removed 0065 entry from apps/sim/db/migrations/meta/_journal.json Preparing for merge with origin/staging and migration regeneration * add migration files * fix tests * Update apps/sim/lib/uploads/setup.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update apps/sim/lib/workflows/execution-file-storage.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update apps/sim/lib/workflows/execution-file-storage.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * cleanup types * fix lint * fix logs typing for file refs * open download in new tab * fixed * Update apps/sim/tools/index.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * fix file block * cleanup unused code * fix bugs * remove hacky file id logic * fix drag and drop * fix tests --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * feat(trigger-mode): added trigger-mode to workflow_blocks table (simstudioai#902) * fix(schedules-perms): use regular perm system to view/edit schedule info (simstudioai#901) * fix(schedules-perms): use regular perm system to view schedule info * fix perms * improve logging * feat(webhooks): deprecate singular webhook block + add trigger mode to blocks (simstudioai#903) * feat(triggers): added new trigger mode for blocks, added socket event, ran migrations * Rename old trigger/ directory to background/ * cleaned up, ensured that we display active webhook at the block-level * fix submenu in tag dropdown * keyboard nav on tag dropdown submenu * feat(triggers): add outlook to new triggers system * cleanup * add types to tag dropdown, type all outputs for tools and use that over block outputs * update doc generator to truly reflect outputs * fix docs * add trigger handler * fix active webhook tag * tag dropdown fix for triggers * remove trigger mode schema change * feat(execution-filesystem): system to pass files between blocks (simstudioai#866) * feat(files): pass files between blocks * presigned URL for downloads * Remove latest migration before merge * starter block file upload wasn't getting logged * checkpoint in human readable form * checkpoint files / file type outputs * file downloads working for block outputs * checkpoint file download * fix type issues * remove filereference interface with simpler user file interface * show files in the tag dropdown for start block * more migration to simple url object, reduce presigned time to 5 min * Remove migration 0065_parallel_nightmare and related files - Deleted apps/sim/db/migrations/0065_parallel_nightmare.sql - Deleted apps/sim/db/migrations/meta/0065_snapshot.json - Removed 0065 entry from apps/sim/db/migrations/meta/_journal.json Preparing for merge with origin/staging and migration regeneration * add migration files * fix tests * Update apps/sim/lib/uploads/setup.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update apps/sim/lib/workflows/execution-file-storage.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update apps/sim/lib/workflows/execution-file-storage.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * cleanup types * fix lint * fix logs typing for file refs * open download in new tab * fixed * Update apps/sim/tools/index.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * fix file block * cleanup unused code * fix bugs * remove hacky file id logic * fix drag and drop * fix tests --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * feat(trigger-mode): added trigger-mode to workflow_blocks table (simstudioai#902) * fix(schedules-perms): use regular perm system to view/edit schedule info (simstudioai#901) * fix(schedules-perms): use regular perm system to view schedule info * fix perms * improve logging * cleanup * prevent tooltip showing up on modal open * updated trigger config * fix type issues --------- Co-authored-by: Vikhyath Mondreti <vikhyathvikku@gmail.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai> * fix(helm): fix helm charts migrations using wrong image (simstudioai#907) * fix(helm): fix helm charts migrations using wrong image * fixed migrations * feat(whitelist): add email & domain-based whitelisting for signups (simstudioai#908) * improvement(helm): fix duplicate SOCKET_SERVER_URL and add additional envvars to template (simstudioai#909) * improvement(helm): fix duplicate SOCKET_SERVER_URL and add additional envvars to template * rm serper & freestyle * improvement(tag-dropdown): typed tag dropdown values (simstudioai#910) * fix(min-chunk): remove minsize for chunk (simstudioai#911) * fix(min-chunk): remove minsize for chunk * fix tests * improvement(chunk-config): migrate unused default for consistency (simstudioai#913) * fix(mailer): update mailer to use the EMAIL_DOMAIN (simstudioai#914) * fix(mailer): update mailer to use the EMAIL_DOMAIn * add more * Improvement(cc): added cc to gmail and outlook (simstudioai#900) * changed just gmail * bun run lint * fixed bcc * updated docs --------- Co-authored-by: Adam Gough <adamgough@Mac.attlocal.net> Co-authored-by: waleedlatif1 <walif6@gmail.com> * fix(email-validation): add email validation to prevent bouncing, fixed OTP validation (simstudioai#916) * feat(email-validation): add email validation to prevent bouncing * removed suspicious patterns * fix(verification): fixed OTP verification * fix failing tests, cleanup * fix(otp): fix email not sending (simstudioai#917) * fix(email): manual OTP instead of better-auth (simstudioai#921) * fix(email): manual OTP instead of better-auth * lint --------- Co-authored-by: Vikhyath Mondreti <vikhyathvikku@gmail.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai> Co-authored-by: Adam Gough <77861281+aadamgough@users.noreply.github.com> Co-authored-by: Adam Gough <adamgough@Mac.attlocal.net>

waleedlatif1 added 3 commits August 8, 2025 14:49

feat(email-validation): add email validation to prevent bouncing

51d3ba6

removed suspicious patterns

c345945

fix(verification): fixed OTP verification

9afca3e

greptile-apps bot reviewed Aug 8, 2025

View reviewed changes

vercel bot deployed to Preview – docs August 8, 2025 23:44 View deployment

vercel bot deployed to Preview – sim August 8, 2025 23:48 View deployment

vercel bot temporarily deployed to Preview – docs August 8, 2025 23:55 Inactive

waleedlatif1 changed the title ~~fix/email validation~~ fix(email-validation): add email validation to prevent bouncing, fixed OTP validation Aug 8, 2025

fix failing tests, cleanup

75fd0b8

waleedlatif1 force-pushed the fix/email-validation branch from 0200861 to 75fd0b8 Compare August 8, 2025 23:58

vercel bot temporarily deployed to Preview – docs August 8, 2025 23:58 Inactive

waleedlatif1 merged commit 43a3416 into staging Aug 9, 2025
3 of 4 checks passed

waleedlatif1 deleted the fix/email-validation branch August 9, 2025 00:01

vercel bot deployed to Preview – sim August 9, 2025 00:04 View deployment

waleedlatif1 mentioned this pull request Aug 9, 2025

v0.3.22: handle files, trigger mode, email validation, tag dropdown types #919

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(email-validation): add email validation to prevent bouncing, fixed OTP validation#916

fix(email-validation): add email validation to prevent bouncing, fixed OTP validation#916
waleedlatif1 merged 4 commits intostagingfrom
fix/email-validation

waleedlatif1 commented Aug 8, 2025 •

edited

Loading

Uh oh!

vercel bot commented Aug 8, 2025 •

edited

Loading

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Aug 8, 2025

Uh oh!

greptile-apps bot Aug 8, 2025

Uh oh!

greptile-apps bot Aug 8, 2025

Uh oh!

greptile-apps bot Aug 8, 2025

Uh oh!

greptile-apps bot Aug 8, 2025

Uh oh!

greptile-apps bot Aug 8, 2025

Uh oh!

greptile-apps bot Aug 8, 2025

Uh oh!

greptile-apps bot Aug 8, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		(email: string) => !quickValidateEmail(email.trim().toLowerCase()).isValid
		),

Conversation

waleedlatif1 commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel bot commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Greptile Summary

Confidence score: 3/5

Uh oh!

greptile-apps bot Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Aug 8, 2025 •

edited

Loading

vercel bot commented Aug 8, 2025 •

edited

Loading