feat: add DISABLE_SIGNUP environment variable #518
Conversation
|
@justsml is attempting to deploy a commit to the Listinai Team on Vercel. A member of the Team first needs to authorize it. |
WalkthroughThe pull request introduces a new configuration variable Changes
Assessment against linked issues
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
apps/backend/src/services/auth/auth.service.ts (2)
37-40: Assert consistent user feedback when signup is disabled.When throwing the error
'Signup is disabled'here, ensure that the frontend properly handles and displays it. Consider returning a status code for a disabled signup scenario that is distinct from other error codes, making it easier for clients to handle this specific condition.
139-142: Avoid duplicating signup-disabled check logic.These lines replicate the logic introduced in the
routeAuthmethod. To keep the code DRY, consider abstracting the signup-disabled check into a shared helper function or a guard. That would ensure consistency & easier maintenance.- if (process.env.DISABLE_SIGNUP === 'true') { - throw new Error('Signup is disabled'); - } + this.ensureSignupEnabled(); ... // Then define a small helper function: private ensureSignupEnabled() { if (process.env.DISABLE_SIGNUP === 'true') { throw new Error('Signup is disabled'); } }.env.example (1)
10-10: Provide environment variable usage instructions.This new environment variable is critical to controlling user registration. Consider adding a clarifying comment on how strongly the system enforces the restriction, and whether it affects only the local signup or all providers.
apps/backend/src/api/routes/auth.controller.ts (1)
40-43: Return an HTTP status code that best represents the disabled signup condition.Using a
400 Bad Requestfor disabled signup is somewhat generic. Consider returning a403 Forbiddenor a503 Service Unavailablefor better semantic meaning and to accurately describe that the server is refusing signup requests due to configuration.- response.status(400).json({ error: 'Signup is disabled' }); + response.status(403).json({ error: 'Signup is disabled' });
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.env.example(1 hunks)apps/backend/src/api/routes/auth.controller.ts(1 hunks)apps/backend/src/services/auth/auth.service.ts(2 hunks)
|
I'm thinking maybe making something like this: |
|
I'm sure there's several adjacent auth features needed. My thinking was to prioritize this security related "fix" since it buys time until a more robust solution can be implemented - never mind the necessary discussion & planning. (And I'm sure it'll get removed when it is no longer needed.) As for the nginx config, I'm sure nginx users would appreciate that. There's also nginxproxymanager.com for a GUI to configure your nginx in pretty slick little container app. Users may eventually need something robust for Auth (w/ OAuth/Open ConnectID, SAML, MFA, Passkeys, etc 🙀.) I have been using Logto and Authentik however I recently started using Zitadel. These options are probably better discussed under Discussions... |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
libraries/helpers/src/configuration/configuration.checker.ts (1)
29-29: LGTM! Consider adding boolean value validation.The addition of the
DISABLE_REGISTRATIONenvironment variable check is good. However, since this is meant to be a boolean flag, consider adding validation to ensure the value is either "true" or "false".Here's a suggested implementation:
+ checkIsBoolean(key: string, description?: string): boolean { + if (!this.checkNonEmpty(key, description)) { + return false; + } + const value = this.get(key)?.toLowerCase(); + if (value !== 'true' && value !== 'false') { + this.issues.push(`${key} must be either "true" or "false". ${description || ''}`); + return false; + } + return true; + } check() { this.checkDatabaseServers() this.checkNonEmpty('JWT_SECRET') - this.checkNonEmpty('DISABLE_REGISTRATION', 'Set to true to disable signup') + this.checkIsBoolean('DISABLE_REGISTRATION', 'Set to true to disable signup') this.checkIsValidUrl('MAIN_URL')
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.env.example(1 hunks)apps/backend/src/api/routes/auth.controller.ts(1 hunks)apps/backend/src/services/auth/auth.service.ts(2 hunks)libraries/helpers/src/configuration/configuration.checker.ts(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (3)
- .env.example
- apps/backend/src/api/routes/auth.controller.ts
- apps/backend/src/services/auth/auth.service.ts
🔇 Additional comments (1)
libraries/helpers/src/configuration/configuration.checker.ts (1)
29-29: Variable name inconsistency with PR objectives.The PR objectives mention
DISABLE_SIGNUP, but the code usesDISABLE_REGISTRATION. This inconsistency should be resolved to maintain clarity and prevent confusion.Let's check for any other occurrences of these variables in the codebase:
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
libraries/helpers/src/configuration/configuration.checker.ts (1)
37-50: Enhance boolean validation robustness and consistency.While the implementation works, consider these improvements:
- Handle undefined values explicitly
- Support case-insensitive comparison
- Simplify description handling
- Maintain consistent error message formatting
Here's a suggested implementation:
checkIsBoolean (key: string, description?: string): boolean { const v = this.get(key) - - if (!description) { - description = '' - } - - if (v !== 'true' && v !== 'false') { - this.issues.push(key + ' is not a boolean. ' + description) + description = description || '' + + if (!v) { + this.issues.push(`${key} not set. ${description}`) + return false + } + + const normalized = v.toLowerCase() + if (normalized !== 'true' && normalized !== 'false') { + this.issues.push(`${key} is not a boolean. ${description}`) return false } return true }This implementation:
- Handles undefined values consistently with other methods
- Supports case-insensitive comparison ('TRUE', 'True', etc.)
- Uses template literals for consistent string formatting
- Simplifies the description handling
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
libraries/helpers/src/configuration/configuration.checker.ts(1 hunks)
🔇 Additional comments (2)
libraries/helpers/src/configuration/configuration.checker.ts (2)
29-29: LGTM! Clear and well-placed validation check.The addition of the
DISABLE_REGISTRATIONcheck with a descriptive message aligns well with the PR's objective to control user registration.
29-29: Verify the security implications of this feature.Since this is a security-related feature for disabling user registration, let's verify its usage across the codebase.
Also applies to: 37-50
✅ Verification successful
Security implementation for DISABLE_REGISTRATION is robust and complete
The feature is properly implemented with multiple layers of protection:
- Configuration validation in environment variables
- Service-layer enforcement for both direct and provider-based registration
- API-level protection with proper error responses
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the usage and implementation of DISABLE_REGISTRATION # across the codebase to ensure proper security controls. echo "Checking for DISABLE_REGISTRATION usage:" rg -l "DISABLE_REGISTRATION" echo -e "\nChecking for registration-related endpoints and their security controls:" ast-grep --pattern 'router.$_( "/register", $$$ )' echo -e "\nChecking for potential security bypass attempts:" rg -i "register|signup" --type tsLength of output: 12670
Fixes #480
What kind of change does this PR introduce?
Add support for an env var to disable registration,
DISABLE_SIGNUP.Why was this change needed?
Other information:
Focused PR, shouldn't impact future enhancements.
Checklist:
Put a "X" in the boxes below to indicate you have followed the checklist;
Summary by CodeRabbit
DISABLE_REGISTRATIONvariable.DISABLE_REGISTRATIONenvironment variable, including checks for boolean values.