fix: use instance-specific emails for service accounts (#2502)

packages/auth/server/lib/utils/handle-oauth-callback-url.ts

@@ -5,6 +5,8 @@ import { deleteCookie } from 'hono/cookie';
 
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { onCreateUserHook } from '@documenso/lib/server-only/user/create-user';
+import { deletedServiceAccountEmail } from '@documenso/lib/server-only/user/service-accounts/deleted-account';
+import { legacyServiceAccountEmail } from '@documenso/lib/server-only/user/service-accounts/legacy-service-account';
 import { isValidReturnTo, normalizeReturnTo } from '@documenso/lib/utils/is-valid-return-to';
 import { prisma } from '@documenso/prisma';
 
@@ -26,6 +28,13 @@ export const handleOAuthCallbackUrl = async (options: HandleOAuthCallbackUrlOpti
   const { email, name, sub, accessToken, accessTokenExpiresAt, idToken, redirectPath } =
     await validateOauth({ c, clientOptions });
 
+  if (
+    email.toLowerCase() === legacyServiceAccountEmail() ||
+    email.toLowerCase() === deletedServiceAccountEmail()
+  ) {
+    return c.text('FORBIDDEN', 403);
+  }
+
   // Find the account if possible.
   const existingAccount = await prisma.account.findFirst({
     where: {