fix: use instance-specific emails for service accounts (#2502)

2026-08-25 15:52:29 +10:00 · 2026-02-16 11:52:19 +11:00
parent d66c330d46
commit 2e3d22c856
8 changed files with 143 additions and 3 deletions
@@ -0,0 +1,34 @@
+import { prisma } from '@documenso/prisma';
+
+const LEGACY_SERVICE_ACCOUNT_EMAIL = 'serviceaccount@documenso.com';
+
+export const legacyServiceAccountEmail = () => {
+  try {
+    // eslint-disable-next-line turbo/no-undeclared-env-vars
+    if (process.env.NEXT_PRIVATE_LEGACY_SERVICE_ACCOUNT_EMAIL) {
+      // eslint-disable-next-line turbo/no-undeclared-env-vars
+      return process.env.NEXT_PRIVATE_LEGACY_SERVICE_ACCOUNT_EMAIL;
+    }
+
+    const { hostname } = new URL(process.env.NEXT_PUBLIC_WEBAPP_URL || 'http://localhost:3000');
+
+    return `serviceaccount@${hostname}`;
+  } catch (error) {
+    return LEGACY_SERVICE_ACCOUNT_EMAIL;
+  }
+};
+
+export const migrateLegacyServiceAccount = async () => {
+  if (legacyServiceAccountEmail() !== LEGACY_SERVICE_ACCOUNT_EMAIL) {
+    console.log(`Migrating legacy service account to new email: ${legacyServiceAccountEmail()}`);
+
+    await prisma.user.updateMany({
+      where: {
+        email: LEGACY_SERVICE_ACCOUNT_EMAIL,
+      },
+      data: {
+        email: legacyServiceAccountEmail(),
+      },
+    });
+  }
+};