fix(auth): make last_sign_in_at stamp silent on sign-in

[gjtorikian]

Summary

• Sign-in stamped last_sign_in_at through ws.users.update, whose onUpdate hook fired user.updated on every login. Production writes last_sign_in_at via a dedicated, silent updateWithSignIn path — a raw, debounced DB write that bypasses the event-emitting update() — so a real WorkOS sign-in emits only session.created.
• Add Collection.updateSilent(): updates and re-indexes a record without firing onUpdate or bumping updated_at, mirroring prod's updateWithSignIn. Route the pure last_sign_in_at stamp through it.
• Preserve the legitimate email_verified change: a magic-auth sign-up still verifies the email via the emitting update() (one user.updated), matching production's email-verification path. Only the no-op repeat sign-in is now silent.
• Update the magic-auth test added in fix(auth): support Magic Auth sign-up for emails without a user #52: its second assertion expected a user.updated on a repeat sign-in (where only last_sign_in_at changes) — that was the bug. It now expects none, matching the test's own stated intent ("repeat sign-in stays quiet").

Closes #55

[greptile-apps]

Greptile Summary

This PR makes sign-in timestamp updates silent so routine logins no longer emit user.updated, while preserving the event when magic authentication verifies an email.

• Adds a collection update operation that re-indexes without invoking update hooks or changing updated_at.
• Uses the silent operation when last_sign_in_at is the only changed user field.
• Extends authentication tests for password and repeat magic-auth sign-ins.

Confidence Score: 5/5

The PR appears safe to merge, with the silent timestamp path narrowly used and covered by authentication-event tests.

The changed route preserves emitting updates for genuine email verification while suppressing only the production-compatible last_sign_in_at event, and no concrete blocking or non-blocking defect remains.

Important Files Changed

Filename	Overview
src/core/store.ts	Adds a silent, re-indexing collection update path that deliberately skips update hooks and timestamp changes.
src/workos/routes/auth.ts	Separates email-verifying magic-auth updates from silent sign-in timestamp writes while preserving session creation behavior.
src/workos/routes/auth.spec.ts	Updates repeat magic-auth expectations and adds coverage ensuring password sign-in emits only the session event.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Fresh sign-in] --> B{Magic Auth with unverified email?}
    B -- Yes --> C[Standard user update]
    C --> D[Stamp last_sign_in_at and verify email]
    D --> E[Emit user.updated]
    B -- No --> F[Silent user update]
    F --> G[Stamp last_sign_in_at only]
    G --> H[Do not emit user.updated]
    E --> I[Create session]
    H --> I
    I --> J[Emit session.created]

Loading

_{Reviews (1): Last reviewed commit: "fix(auth): stop emitting user.updated on..." | Re-trigger Greptile}