Dealing with invalid user registration

As we had to generally re-enable signups for the intuitive OAuth login, there’s a possibility that someone creates user accounts solely in auth.users. It can happen for two reasons at this point:

1. Someone uses our OAuth sign-in process but is not legitimated to access the tenant. Still, a Supabase user will be created as this action takes place before we can check it.
2. Someone uses the Anonymous Key exposed in the frontend and triggers the public signUp method on their own, hoping to breach the application security and gain access beyond our registration methods.

In both cases, the user won’t get far. They will be an orphaned Supabase user with no access to our application whatsoever. However, it’s not nice to have orphan users. So, how can we deal with it?

What you’ll ideally want is to delete such orphan users as soon as possible. As this is not a definitive necessity, we won’t go into implementation...