feat: Disable public user registration via environment flag #421
Conversation
|
@AnishSarkar22 is attempting to deploy a commit to the Rohan Verma's projects Team on Vercel. A member of the Team first needs to authorize it. |
WalkthroughThis pull request implements a feature to disable user registration via a configuration flag. A new Changes
Sequence DiagramsequenceDiagram
actor User
participant Frontend as Frontend<br/>(register page)
participant Backend as Backend<br/>(API routes)
participant Config as Config<br/>(REGISTRATION_ENABLED)
User->>Frontend: Submit registration
Frontend->>Backend: POST /auth/register
Backend->>Config: Check REGISTRATION_ENABLED
alt Registration Disabled
Config-->>Backend: false
Backend-->>Frontend: 403 Forbidden
Frontend->>Frontend: Display "Registration is disabled"
Frontend->>User: Show error message
else Registration Enabled
Config-->>Backend: true
Backend->>Backend: Process registration
Backend-->>Frontend: 200 OK / success response
Frontend->>User: Navigate to dashboard
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes The changes follow a consistent, repetitive pattern (adding a boolean check across configuration, dependency, and error handling). Logic is straightforward with no complex branching or state management. File spread is moderate with homogeneous edits across well-established patterns. Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
surfsense_backend/app/app.py (1)
68-77: Fix OAuth router to allow existing users to log in when registration is disabled.The fastapi-users OAuth router's
/callbackendpoint handles both user creation and login. Applyingregistration_allowedat the router level (line 75) blocks the entire/auth/googleprefix whenREGISTRATION_ENABLED=False, which prevents existing users from completing their OAuth login flow—contradicting issue #266's requirement to "allow the deployed instance to use OAuth for existing users."To meet the requirement, implement a more granular approach:
- Option 1: Custom OAuth user creation callback that allows the
/callbackflow but skips user creation when registration is disabled- Option 2: Custom OAuth router that applies dependency checks only at user creation time, not at the endpoint level
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
surfsense_backend/.env.example(1 hunks)surfsense_backend/app/app.py(4 hunks)surfsense_backend/app/config/__init__.py(1 hunks)surfsense_web/app/(home)/register/page.tsx(1 hunks)
🧰 Additional context used
📓 Path-based instructions (3)
**/.env.*
📄 CodeRabbit inference engine (.rules/no_env_files_in_repo.mdc)
Do not commit variant environment files like .env.* (e.g., .env.local, .env.production)
Files:
surfsense_backend/.env.example
**/.env.example
📄 CodeRabbit inference engine (.rules/no_env_files_in_repo.mdc)
Provide a .env.example file with placeholder values instead of real secrets
Files:
surfsense_backend/.env.example
**/*.{jsx,tsx}
📄 CodeRabbit inference engine (.rules/require_unique_id_props.mdc)
**/*.{jsx,tsx}: When mapping arrays to React elements in JSX/TSX, each rendered element must include a unique key prop
Keys used for React list items should be stable, predictable, and unique among siblings
Files:
surfsense_web/app/(home)/register/page.tsx
🪛 dotenv-linter (3.3.0)
surfsense_backend/.env.example
[warning] 12-12: [SpaceCharacter] The line has spaces around equal sign
(SpaceCharacter)
[warning] 12-12: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Python Backend Quality
🔇 Additional comments (4)
surfsense_backend/app/config/__init__.py (1)
46-46: LGTM!The implementation correctly handles case-insensitive boolean parsing with a sensible default that maintains backwards compatibility (registration enabled by default).
surfsense_web/app/(home)/register/page.tsx (1)
67-79: LGTM!The 403 handling is well-implemented with a user-friendly error message, proper toast management (reusing the loading toast ID), and an early return to prevent duplicate error handling.
surfsense_backend/app/app.py (2)
21-27: LGTM!The dependency function correctly raises a 403 HTTPException when registration is disabled and follows FastAPI best practices.
44-48: LGTM!Correctly applies the registration gate to the local registration router, blocking POST requests to
/auth/registerwhenREGISTRATION_ENABLEDis false.
|
|
||
| # Auth | ||
| AUTH_TYPE=GOOGLE or LOCAL | ||
| REGISTRATION_ENABLED= TRUE or FALSE |
There was a problem hiding this comment.
Fix formatting for consistency.
The line has a space after the equals sign, which is inconsistent with other environment variable declarations in this file. Additionally, consider quoting the value for better consistency with shell conventions.
Apply this diff to fix the formatting:
-REGISTRATION_ENABLED= TRUE or FALSE
+REGISTRATION_ENABLED="TRUE or FALSE"Or more clearly document both options:
-REGISTRATION_ENABLED= TRUE or FALSE
+REGISTRATION_ENABLED="TRUE" # Set to "FALSE" to disable registration📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| REGISTRATION_ENABLED= TRUE or FALSE | |
| REGISTRATION_ENABLED="TRUE or FALSE" |
| REGISTRATION_ENABLED= TRUE or FALSE | |
| REGISTRATION_ENABLED="TRUE" # Set to "FALSE" to disable registration |
🧰 Tools
🪛 dotenv-linter (3.3.0)
[warning] 12-12: [SpaceCharacter] The line has spaces around equal sign
(SpaceCharacter)
[warning] 12-12: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
🤖 Prompt for AI Agents
In surfsense_backend/.env.example around line 12, the environment variable
declaration contains a space after the equals sign and ambiguous wording; remove
the space so the assignment follows the same no-space convention as other lines,
replace the "or" phrasing with a single recommended example value (TRUE or
FALSE) and optionally show the alternate in a separate commented example or
explicitly state both possible values, and consider recommending quoting (e.g.,
"TRUE" or "FALSE") for consistency with shell conventions.
|
@AnishSarkar22 Thanks |
2 participants
Description
Add support to disable user registration via environment variable and surface a clear message in the frontend when registration is disabled.
Motivation and Context
Prevent unwanted public signups on deployed instances. Project owner requested a simple server-side switch (REGISTRATION_ENABLED) and keeping the register UI intact while showing a clear error message when registrations are blocked.
FIX #266
Screenshots
API Changes
Change Type
Testing Performed
Checklist
High-level PR Summary
This PR adds the ability to disable public user registration through a
REGISTRATION_ENABLEDenvironment variable. When registration is disabled, the backend blocks both local and OAuth registration endpoints with a 403 error, and the frontend displays a user-friendly message informing users that registrations are currently closed and to contact their administrator.⏱️ Estimated Review Time: 5-15 minutes
💡 Review Order Suggestion
surfsense_backend/.env.examplesurfsense_backend/app/config/__init__.pysurfsense_backend/app/app.pysurfsense_web/app/(home)/register/page.tsxSummary by CodeRabbit