From 1ec5c538023c9fff1b5b53e3b3a76fc6f7c78430 Mon Sep 17 00:00:00 2001
From: yusufipk <mail@yusufipek.me>
Date: Tue, 18 Aug 2026 09:48:00 +0300
Subject: [PATCH] fix(auth): start the cardless trial for social signups too

The trial is granted in the credentials signup route and on the
verification link, and an account created by Google or GitHub goes
through neither: the Prisma adapter writes it directly. Since checkout
no longer offers a trial either, such an account reached a locked
product and an immediate bill, which is the opposite of what the signup
page promised it.

The address is already proven at this point, because the signIn callback
turns away an OAuth profile that reports its email as unverified, and
the grant is idempotent, so nothing here can hand out a second trial.
---
 lib/auth.ts | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/auth.ts b/lib/auth.ts
index 5d8dad5..c43a679 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -6,7 +6,7 @@ import { PrismaAdapter } from '@auth/prisma-adapter';
 import bcrypt from 'bcryptjs';
 import { db } from '@/lib/db';
 import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
-import { hasBillingAccess } from '@/lib/billing';
+import { hasBillingAccess, startCardlessTrial } from '@/lib/billing';
 import { isInviteCodeRequired } from '@/lib/feature-flags';
 import { isEmailVerificationEnabled } from '@/lib/email-verification';
 
@@ -163,6 +163,15 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
         userId: user.id,
         visitor: await readVisitorContextFromHeaders(),
       });
+
+      // And the trial with it, for the same reason: the two places that grant it
+      // are the credentials signup route and the verification link, and a social
+      // signup goes through neither. Without this a Google account reaches a
+      // locked product and a checkout that no longer offers a trial, which is the
+      // opposite of what the signup page promised it. The address is already
+      // proven here: the signIn callback above turns away an OAuth profile that
+      // reports its email as unverified.
+      await startCardlessTrial(user.id);
     },
   },
 });