chore: sync upstream dubinc/dub to 2026-07-16

[VinneyJ]

Summary

• Syncs upstream dubinc/dub at commit 1dfc9fe373 (2026-07-16)
• Applies all upstream changes in a single clean commit
• Carries forward existing CFA customizations from develop

CFA-specific changes included

• Hostnames: Added app.fyi.codeforafrica.org and dub.dev.codeforafrica.org to APP_HOSTNAMES so middleware routes them correctly
• Cookie domain: Made session cookie domain configurable via NEXTAUTH_COOKIE_DOMAIN env var (CFA uses .codeforafrica.org)
• Resend config: RESEND_FROM and RESEND_REPLY_TO remain env-configurable
• Signups: Registration disabled, /register redirects to /login
• Self-hosting docs: CFA self-hosting and upgrade guides preserved

Replaces

Replaces PR #66 which had the same changes but with a noisy commit history.

Test plan

• Auth flow works (login, session cookie uses correct domain)
• /register redirects to /login
• App loads on app.fyi.codeforafrica.org
• Vercel preview deployment passes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dub	Ready	Preview	Aug 10, 2026 12:45pm

[kilemensi]

The right approach @VinneyJ is:

1. 1st PR pulls in changes from upstream without any changes. This makes it an almost automatic merge.
2. 2nd PR, built on top of 1st PR, fixes any issues raised or that would be raised by merging the 1st PR (if any). This requires manual human review and in those cases where there are no breaking changes, the 2nd PR is usually not needed.

This approach ensures 2nd PR is small enough to be human-reviewable. It's impossible for someone to review a 3000+ files PR hunting down for a few changes that were made by hand.

Having said that, we're almost at the end of 2/3rd Sprint working on this so lets merge it (if all our tests, automated and manual, pass).

[VinneyJ]

Hey @kilemensi, thank you for the feedback. That makes a lot of sense. I'll make sure the next sync follows that PR approach you've recommended so it's easy to isolate and review.

For now, the Vercel preview is failing because the database credentials changed (I created a new PlanetScale DB branch). I'm updating the env vars now once the db branch finishes to initialize and will retrigger the build. Once that's green, I'll ping you for a final check.

[VinneyJ]

Sync PR is up!

Had to fix a few build issues along the way: stale DB credentials on the preview environment, a routing conflict from files upstream had restructured away but were still in our branch, and new marketplace tables from upstream that weren't in our PlanetScale dev schema yet. All resolved.

Ready to promote to prod.

[VinneyJ]

The E2E failure on the sync PR is not something we introduced. Upstream removed the /register route and redirected it to /login, which broke the Playwright auth setup test that was written against the old flow.

Needs a separate PR to update auth.setup.ts to match the current login flow. Not a blocker for the sync merge.

[VinneyJ]

I am merging now @kilemensi

[kilemensi]

..a routing conflict from files upstream had restructured away but were still in our branch...

If upstream has moved or deleted some files, those same files should also move/be deleted in our repo/branch, no? At least there should have been a merge conflict if both repos modified the same files.

Anyways, the longer this PR stays open, the more questions I have. May be have a small demo (how everything is pulled/merged/setup with @nkasozi) and then lets merge and move on.

[VinneyJ]

Tested the full sync on staging at dub.dev.codeforafrica.org, and everything was good. Pushed the schema changes to the main DB to prepare for the merge, but that left production in a broken state. The currently deployed code still references columns that were dropped as part of the upstream sync (dublink, ssoEnabled, subscribed), so the build is now failing.

PR #69 is the only code compatible with the current main DB schema. Merging it is the fix: #69.

I will merge for now, then address the recommendation a bit later.