Workos User Registration Action

Handle a WorkOS AuthKit User Registration Action.

WorkOS POSTs a signed payload at sign-up time; we verify the signature, then return a signed Allow/Deny verdict. Signature verification always runs and always fails closed (bad signature -> 401, missing secret -> 500) regardless of environment. The domain restriction itself is only enforced when the running environment is in signup_restricted_environments and an allowlist is configured; otherwise the action is a pass-through (always Allow).