Repository navigation
personal-email-domains list is missing private.icloud.com (new Sign in with Apple relay domain) #9504
Description
Context
Reported by Ottó Misák via GitHub issue #9504, found with a scanner that checks public repos against upcoming platform deadlines.
Apple announced on 2026-08-24 that "starting later this year, new Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com" (Apple Developer news). Existing @privaterelay.appleid.com addresses keep working; only newly issued ones move. Apple has published no exact switch date, so this is time-bound but not yet live.
The reporter offered to open a PR instead — reply on the GitHub issue if we'd prefer that.
Problem
PERSONAL_EMAIL_DOMAINS lists privaterelay.appleid.com but not private.icloud.com. Matching is an exact lookup in a Set, not a suffix match, so once Apple switches, new Sign in with Apple relay addresses will no longer be classified as personal and will pass the Cloud sign-up gate that the old relay domain is blocked by.
iCloud+ Hide My Email stays on icloud.com (already listed), so only Sign in with Apple relay addresses are affected.
Root cause / where to look
apps/web/modules/auth/lib/personal-email-domains.ts:37— the curated list;"privaterelay.appleid.com"sits under the// Applegroup,"private.icloud.com"is missing.apps/web/modules/auth/lib/signup-email-domain.ts:18-21—blockedEmailDomainsis aSetbuilt fromPERSONAL_EMAIL_DOMAINS∪disposable-email-domains;isBlockedEmailDomaindoesblockedEmailDomains.has(domain)on the exact domain (after lowercasing and stripping trailing FQDN dots). No subdomain or suffix matching, which is whyicloud.combeing present does not coverprivate.icloud.com.- Consumers of the gate:
isSignupEmailDomainBlocked→modules/auth/signup/actions.ts,modules/auth/lib/credential-signup-backstop.ts,modules/ee/sso/lib/sso-provisioning.ts. Cloud-only (IS_FORMBRICKS_CLOUD), so self-hosted is unaffected either way.
Done when
-
"private.icloud.com"is inPERSONAL_EMAIL_DOMAINSunder the Apple group, next toprivaterelay.appleid.com. -
isBlockedEmailDomain("test@private.icloud.com")returnstrue— add the address to the existing "returns true for known free / personal providers" case inapps/web/modules/auth/lib/signup-email-domain.test.ts:30-60, besidetest@privaterelay.appleid.com. -
privaterelay.appleid.comstays listed — existing relay addresses keep working, so both domains must be blocked, not one swapped for the other. -
pnpm test --filter=@formbricks/webpasses (signup-email-domain.test.ts).
Activity
PalakshiVerma commentedon Oct 8, 2026
Hi! I'd like to work on this issue .
I noticed there is currently no assignee or linked PR, and I'd be happy to implement the proposed fix and add the regression test.
If that's okay, I'll work on it and open a PR. Thanks!
otisz22 commentedon Oct 8, 2026
Thanks @PalakshiVerma, that would be great! From my side as the reporter, please go ahead (the maintainers have the final say on assignment, of course). Happy to test the fix against a Sign in with Apple relay address once the PR is up.
PalakshiVerma commentedon Oct 8, 2026
Hi! I’ve completed the fix for #9504.
I added
private.icloud.comto the personal email domain blocklist and added a corresponding test. The focused test suite passes: 15/15 tests.My branch is ready:
PalakshiVerma:fix-private-icloud-domain-9504GitHub is currently preventing me from opening the PR because PR creation is restricted to repository collaborators. Please let me know if you’d like me to proceed another way.
Rakshaad-Kolhe commentedon Oct 16, 2026
Hi! I also prepared and tested a fix for this issue before #9570 was closed as a duplicate.
dc44ff017df74d4fb804e38b52c010349c68d392I noticed another contributor has also prepared a fix. I’m sharing mine for reference so the maintainers can use whichever implementation best fits the project. I understand PR creation is currently restricted, and I’m happy to follow the approved contribution process.
Thanks!
hardikkaurani commentedon Oct 19, 2026
Hi @Dhruwang @pandeymangg,
I have prepared the fix and test coverage for #9504:
Changes:
"private.icloud.com"toPERSONAL_EMAIL_DOMAINSinapps/web/modules/auth/lib/personal-email-domains.tsunder the Apple relay group next toprivaterelay.appleid.com.isBlockedEmailDomain("test@private.icloud.com")returnstrueinapps/web/modules/auth/lib/signup-email-domain.test.ts.Branch:
hardikkaurani:fix/apple-private-icloud-domain-9504Commit:
6442f49As repository settings currently restrict PR creation from forks to collaborators, please feel free to invite me as a contributor so I can submit the PR directly, or cherry-pick this commit into a PR. Thank you!