fix(auth): reject Entra guest accounts

README.md

@@ -89,7 +89,7 @@ Register these callback URLs, replacing the origin with your deployment:
 | PoliNetwork Entra | `https://auth.polinetwork.org/api/auth/callback/pn-entra` |
 | Telegram          | `https://auth.polinetwork.org/api/auth/callback/telegram` |
 
-PoliNetwork Entra uses a tenant-specific registration, not the `common` tenant. Google and PoliNetwork Entra are login providers. Telegram uses the official OIDC authorization-code flow with PKCE and RS256 ID tokens, but the server only permits it through the account-linking flow. Configure its allowed origin and callback in BotFather. Its bot user ID comes from the signed `id` claim, separately from its OIDC `sub`.
+PoliNetwork Entra uses a tenant-specific registration, not the `common` tenant. Only members of the tenant can use it: B2B guests (for example someone invited with a `@mail.polimi.it` address) get tokens from our tenant too, so the app registration must add the `acct` optional claim to the ID token, and sign-ins whose token lacks `acct: 0` are refused. Add the claim before deploying, or every PoliNetwork Entra sign-in fails. Google and PoliNetwork Entra are login providers. Telegram uses the official OIDC authorization-code flow with PKCE and RS256 ID tokens, but the server only permits it through the account-linking flow. Configure its allowed origin and callback in BotFather. Its bot user ID comes from the signed `id` claim, separately from its OIDC `sub`.
 
 Polimi verification accepts only the exact `mail.polimi.it` domain. Codes contain six digits, expire after 10 minutes, allow five attempts, and cannot be resent for 60 seconds. The cooldown applies to both the user and recipient and survives failed guesses, consumption, and failed delivery. The database stores only an HMAC of each code. Successful verification creates a `polimi-email` account link and grants student status for `STUDENT_VERIFICATION_TTL_DAYS`.
 

src/auth/policy.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vite-plus/test";
 import {
   hasAppRole,
   hasPolimiStudentDomain,
+  isEntraMember,
   identityStates,
   isLinkOnlyProvider,
   isLoginProvider,
@@ -91,6 +92,12 @@ describe("identity states", () => {
     expect(hasPolimiStudentDomain("name@polimi.it")).toBe(false);
     expect(hasPolimiStudentDomain("name@mail.polimi.it.example.org")).toBe(false);
   });
+  it("accepts only Entra tenant members, never guests or tokens without acct", () => {
+    expect(isEntraMember(0)).toBe(true);
+    expect(isEntraMember(1)).toBe(false);
+    expect(isEntraMember("0")).toBe(false);
+    expect(isEntraMember(undefined)).toBe(false);
+  });
   it("keeps verifier providers out of the login set", () => {
     expect(isLoginProvider("google")).toBe(true);
     expect(isLoginProvider("pn-entra")).toBe(true);

src/auth/policy.ts

@@ -83,6 +83,16 @@ export function hasPolimiStudentDomain(email: string) {
   return email.split("@").at(-1) === "mail.polimi.it";
 }
 
+/**
+ * Whether an Entra ID token belongs to a member of the tenant rather than a B2B guest.
+ * Guests sign in with their home address but get tokens from our tenant, so the issuer and
+ * `tid` checks pass for them. Needs the `acct` optional claim (0 member, 1 guest) on the app
+ * registration; a token without it is refused.
+ */
+export function isEntraMember(acct: unknown) {
+  return acct === 0;
+}
+
 export function isLoginProvider(providerId: string) {
   return providerId === "google" || providerId === "pn-entra";
 }

src/auth/providers.ts

@@ -8,6 +8,7 @@ import { authorizationMutationLock } from "../db/security-lock";
 import { env } from "../env";
 import { claimEmail } from "./contact-email";
 import { checkPnGroupStates, membershipEvidence } from "./membership";
+import { isEntraMember } from "./policy";
 
 type ProviderSettings = {
   clientId: string;
@@ -95,6 +96,8 @@ function makeProvider(id: string, settings: ProviderSettings): GenericOAuthConfi
       if (!payload.sub || !payload.exp) throw new Error("Missing identity claims");
       if (!telegram && payload.tid !== settings.tenantId)
         throw new Error("Unexpected Entra tenant");
+      if (!telegram && !isEntraMember(payload.acct))
+        throw new Error("Entra guest accounts cannot sign in");
       const telegramId =
         telegram &&
         (typeof payload.id === "string" ||