feat: add DISABLE_SIGNUP environment variable #518
Conversation
|
@justsml is attempting to deploy a commit to the Listinai Team on Vercel. A member of the Team first needs to authorize it. |
WalkthroughThe pull request introduces a new configuration variable Changes
Assessment against linked issues
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
apps/backend/src/services/auth/auth.service.ts (2)
37-40: Assert consistent user feedback when signup is disabled.When throwing the error
'Signup is disabled'here, ensure that the frontend properly handles and displays it. Consider returning a status code for a disabled signup scenario that is distinct from other error codes, making it easier for clients to handle this specific condition.
139-142: Avoid duplicating signup-disabled check logic.These lines replicate the logic introduced in the
routeAuthmethod. To keep the code DRY, consider abstracting the signup-disabled check into a shared helper function or a guard. That would ensure consistency & easier maintenance.- if (process.env.DISABLE_SIGNUP === 'true') { - throw new Error('Signup is disabled'); - } + this.ensureSignupEnabled(); ... // Then define a small helper function: private ensureSignupEnabled() { if (process.env.DISABLE_SIGNUP === 'true') { throw new Error('Signup is disabled'); } }.env.example (1)
10-10: Provide environment variable usage instructions.This new environment variable is critical to controlling user registration. Consider adding a clarifying comment on how strongly the system enforces the restriction, and whether it affects only the local signup or all providers.
apps/backend/src/api/routes/auth.controller.ts (1)
40-43: Return an HTTP status code that best represents the disabled signup condition.Using a
400 Bad Requestfor disabled signup is somewhat generic. Consider returning a403 Forbiddenor a503 Service Unavailablefor better semantic meaning and to accurately describe that the server is refusing signup requests due to configuration.- response.status(400).json({ error: 'Signup is disabled' }); + response.status(403).json({ error: 'Signup is disabled' });
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.env.example(1 hunks)apps/backend/src/api/routes/auth.controller.ts(1 hunks)apps/backend/src/services/auth/auth.service.ts(2 hunks)
|
I'm thinking maybe making something like this: |
|
I'm sure there's several adjacent auth features needed. My thinking was to prioritize this security related "fix" since it buys time until a more robust solution can be implemented - never mind the necessary discussion & planning. (And I'm sure it'll get removed when it is no longer needed.) As for the nginx config, I'm sure nginx users would appreciate that. There's also nginxproxymanager.com for a GUI to configure your nginx in pretty slick little container app. Users may eventually need something robust for Auth (w/ OAuth/Open ConnectID, SAML, MFA, Passkeys, etc 🙀.) I have been using Logto, however I recently started using Zitadel. These options are probably better discussed under Discussions... |
| @@ -7,6 +7,7 @@ JWT_SECRET="random string for your JWT secret, make it long" | |||
| FRONTEND_URL="http://localhost:4200" | |||
| NEXT_PUBLIC_BACKEND_URL="http://localhost:3000" | |||
| BACKEND_INTERNAL_URL="http://localhost:3000" | |||
| USER_REGISTRATION="false" # set to true to disable signups | |||
There was a problem hiding this comment.
This seems counterintuitive. USER_REGISTRATION implies the capability of registering users. If true, I'd expect it to allow registration.
Fixes #480
What kind of change does this PR introduce?
Add support for an env var to disable registration,
DISABLE_SIGNUP.Why was this change needed?
Other information:
Focused PR, shouldn't impact future enhancements.
Checklist:
Put a "X" in the boxes below to indicate you have followed the checklist;
Summary by CodeRabbit
USER_REGISTRATIONenvironment variable to control user registration