chore(web): correct stale and redundant comments in auth and signup modules

apps/web/src/lib/auth/device-sessions.ts

@@ -215,7 +215,6 @@ export async function issueSessionCredentials(
 
 /**
  * Rotate a refresh token. On success, returns a new token pair.
- * On failure, returns null with an error code.
  *
  * Precondition checks (session validity, user blocked_reason, and the domain
  * policy of the account's current email) happen BEFORE the atomic consume, so a

apps/web/src/lib/auth/email-signin-eligibility.ts

@@ -113,10 +113,10 @@ export type DomainSignInEligibility =
 /**
  * Checks whether an email's domain is allowed to sign in at all: not
  * blacklisted, not a blocked TLD (new users only), and not subject to
- * mandatory SSO. This is the shared core enforced for EVERY sign-in path
- * (email code, magic link, and native Apple/Google) — mirrors the checks
- * inline in the NextAuth `signIn` callback (lib/user/server.ts) so that no
- * provider can bypass forced SSO or the domain blacklist.
+ * mandatory SSO. This is the shared core enforced for EVERY sign-in path —
+ * mirrors the checks inline in the NextAuth `signIn` callback
+ * (lib/user/next-auth-options.ts) so that no provider can bypass forced SSO or
+ * the domain blacklist.
  *
  * Does NOT rate limit and does NOT apply magic-link-specific signup email
  * rules (lowercase/no-plus) — those are the caller's concern.

apps/web/src/lib/auth/native-admission.ts

@@ -160,19 +160,12 @@ export function validateAdmissionPayload(raw: unknown): AdmissionPayload | undef
   if (typeof raw !== 'object' || raw === null) return undefined;
   const obj = raw as Record<string, unknown>;
 
-  // platform: 'ios' | 'android'
   if (obj['platform'] !== 'ios' && obj['platform'] !== 'android') return undefined;
-
-  // kind: 'attestation' | 'assertion'
   if (obj['kind'] !== 'attestation' && obj['kind'] !== 'assertion') return undefined;
-
-  // challenge: non-empty string
   if (typeof obj['challenge'] !== 'string' || !obj['challenge']) return undefined;
-
   // payload: non-empty string (base64)
   if (typeof obj['payload'] !== 'string' || !obj['payload']) return undefined;
 
-  // keyId: optional string (required for iOS assertion)
   const kind = obj['kind'] as AdmissionKind;
   const platform = obj['platform'] as AdmissionPlatform;
   const keyId = obj['keyId'];

packages/web-shared/src/lib/blacklist-domains-config.ts

@@ -16,9 +16,8 @@ import { errorExceptInTest } from '@kilocode/web-shared/lib/utils.server';
 export type { BlacklistDomainsConfig };
 
 /**
- * TLDs refused for new signups until an admin changes the stored list. `.top`
- * and `.shop` are the long-standing defaults; `.asia` is one of the cheap TLDs
- * signup farms rotate through.
+ * TLDs refused for new signups until an admin changes the stored list. `.shop`
+ * and `.top` are the long-standing defaults.
  */
 export const DEFAULT_BLOCKED_SIGNUP_TLDS = ['shop', 'top'];
 

packages/web-shared/src/lib/user/server.ts

@@ -93,7 +93,7 @@ export const sessionAuthOptions = {
       session.isAdmin = castToken.isAdmin || false; // Ensure isAdmin is always defined
       session.kiloUserId = castToken.kiloUserId;
       session.webSessionPepper = castToken.webSessionPepper ?? castToken.pepper ?? null;
-      session.isNewUser = castToken.isNewUser || false; // Pass isNewUser to the session
+      session.isNewUser = castToken.isNewUser || false;
       session.authProvider = castToken.authProvider;
       session.authenticatedAt = castToken.authenticatedAt;
       session.ssoSourceOrganizationId = castToken.ssoSourceOrganizationId;