Fix: JWT callback allows client-controlled email spoofing via session.update()

[Copilot]

The jwt callback was applying session.update() payloads directly to token.email, letting any authenticated client overwrite their JWT email — bypassing any downstream authorization or DB lookups that trust session.user.email.

Changes

• Drop client-provided email from session.update() handler — only name updates are accepted; email is never taken from client-supplied session payloads.
• Re-hydrate token.email from DB for regular users — on every JWT refresh, email is sourced from the DB via the trusted token.id, matching the existing pattern for admin/advisor accounts.

// Before — client controls token.email
if (trigger === "update" && session) {
  if (typeof session.name === "string") token.name = session.name;
  if (typeof session.email === "string") token.email = session.email; // ❌
}

// After — email always sourced from DB
if (trigger === "update" && session) {
  if (typeof session.name === "string") token.name = session.name;
  // email intentionally omitted
}
// ...
} else if (token.userType === "user" && token.id) {
  const user = await prisma.user.findUnique({ where: { id: token.id }, select: { email: true } });
  if (user) token.email = user.email; // ✅ authoritative source
}

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• checkpoint.prisma.io
  • Triggering command: /opt/hostedtoolcache/node/24.14.0/x64/bin/node /opt/hostedtoolcache/node/24.14.0/x64/bin/node /home/REDACTED/work/Smart-Auto-Hub/Smart-Auto-Hub/node_modules/prisma/build/child {"product":"prisma","version":"6.19.2","cli_install_type":"local","information":"","local_timestamp":"2026-03-20T06:12:36Z","project_hash":"56f9ffc6","cli_path":"/home/REDACTED/work/Smart-Auto-Hub/Smart-Auto-Hub/node_modules/.bin/prisma","cli_path_hash":"8c (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)