feat: disable signups by default (#233)

Author: hugodutka

internal/api/src/routes/auth/auth.server.test.ts

@@ -788,7 +788,11 @@ test("POST /signup with redirect returns custom redirect URL", async () => {
 });
 
 test("POST /signup rejects duplicate email", async () => {
-  const { url, helpers } = await serve();
+  const { url, helpers } = await serve({
+    bindings: {
+      enableSignups: true,
+    },
+  });
   const email = "existing@example.com";
 
   await helpers.createUser({ email });
@@ -871,6 +875,31 @@ test("POST /signup without email verification creates session and redirects to c
   expect(cookieString).toContain("last_login_provider=credentials");
 });
 
+test("POST /signup rejects when signups are disabled and not first user", async () => {
+  const { url, helpers } = await serve({
+    bindings: {
+      enableSignups: false,
+    },
+  });
+
+  await helpers.createUser({ email: "existing@example.com" });
+
+  const res = await fetch(`${url}/api/auth/signup`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      email: "blocked@example.com",
+      password: "password123",
+    }),
+  });
+
+  expect(res.status).toBe(403);
+  const data = await res.json();
+  expect(data.error).toBe("Signups are disabled");
+});
+
 test("POST /resend-email-verification regenerates token", async () => {
   const { url, helpers, bindings } = await serve();
   const { user } = await helpers.createUser({
@@ -1105,6 +1134,7 @@ test("POST /signup second user with autoJoinOrganizations gets site_role member"
     bindings: {
       sendEmail: undefined,
       autoJoinOrganizations: true,
+      enableSignups: true,
     },
   });
 
@@ -1197,6 +1227,7 @@ test("GET /callback/github second user with autoJoinOrganizations gets site_role
       GITHUB_CLIENT_ID: "test-client-id",
       GITHUB_CLIENT_SECRET: "test-client-secret",
       autoJoinOrganizations: true,
+      enableSignups: true,
     },
   });
 
@@ -1252,6 +1283,65 @@ test("GET /callback/github second user with autoJoinOrganizations gets site_role
   expect(secondUser?.site_role).toBe("member");
 });
 
+test("GET /callback/github blocks new user when signups are disabled", async () => {
+  const { url, bindings, helpers } = await serve({
+    bindings: {
+      GITHUB_CLIENT_ID: "test-client-id",
+      GITHUB_CLIENT_SECRET: "test-client-secret",
+      autoJoinOrganizations: true,
+      enableSignups: false,
+    },
+  });
+
+  const { user: firstUser } = await helpers.createUser({
+    email: "admin@example.com",
+    site_role: "admin",
+  });
+  const db = await bindings.database();
+  await db.insertOrganizationWithMembership({
+    name: "default",
+    kind: "organization",
+    created_by: firstUser.id,
+  });
+
+  mswServer.use(
+    http.post("https://github.com/login/oauth/access_token", () => {
+      return HttpResponse.json(mockOAuthTokenResponse);
+    }),
+    http.get("https://api.github.com/user", () => {
+      return HttpResponse.json({
+        ...mockGitHubProfile,
+        id: 999998,
+        email: "blockedoauth@example.com",
+      });
+    })
+  );
+
+  const { encode } = await import("next-auth/jwt");
+  const state = await encode({
+    secret: bindings.AUTH_SECRET,
+    salt: "oauth-state",
+    token: {
+      provider: "github",
+      nonce: "test-nonce",
+      callbackUrl: `${url}/api/auth/callback/github`,
+    },
+  });
+
+  const res = await fetch(
+    `${url}/api/auth/callback/github?code=test-code&state=${state}`,
+    {
+      redirect: "manual",
+    }
+  );
+
+  expect(res.status).toBe(302);
+  expect(res.headers.get("location")).toBe("/login?error=signups_disabled");
+
+  const blockedUser = await db.selectUserByEmail("blockedoauth@example.com");
+  expect(blockedUser).toBeUndefined();
+});
+
 // Suspended user tests
 
 const oauthProviderConfigs = [

internal/api/src/routes/auth/auth.server.ts

@@ -56,6 +56,24 @@ const providers = {
 // ============================================================================
 
 const INVITE_COOKIE = "blink_invite_verified";
+type Database = Awaited<ReturnType<Bindings["database"]>>;
+
+const isPublicSignupAllowed = async (
+  c: Context<{ Bindings: Bindings }>,
+  db: Database
+) => {
+  if (c.env.enableSignups) {
+    return true;
+  }
+
+  const teamOrgs = await db.selectTeamOrganizations();
+  if (teamOrgs.length > 0) {
+    return false;
+  }
+
+  const users = await db.selectAllUsers({ page: 1, per_page: 1 });
+  return users.items.length === 0;
+};
 
 // ============================================================================
 // OAuth
@@ -279,6 +297,11 @@ async function handleOAuthCallback(
         );
       }
     }
+
+    if (!(await isPublicSignupAllowed(c, db))) {
+      return c.redirect("/login?error=signups_disabled");
+    }
+
     // Create new user
     let usedInviteId: string | null = null;
 
@@ -925,6 +948,10 @@ export default function mountAuth(server: APIServer) {
       const { email, password, redirect: redirectTarget } = c.req.valid("json");
       const db = await c.env.database();
 
+      if (!(await isPublicSignupAllowed(c, db))) {
+        return c.json({ error: "Signups are disabled" }, 403);
+      }
+
       // Check if user exists
       const existingUser = await db.selectUserByEmail(email);
       if (existingUser) {

internal/api/src/server.ts

@@ -240,6 +240,8 @@ export interface Bindings {
 
   /** When true, auto-add new users to all existing team organizations (self-hosted mode) */
   readonly autoJoinOrganizations?: boolean;
+  /** When true, allow public signups (email/password + OAuth). */
+  readonly enableSignups?: boolean;
 
   // Optional AWS credentials used by platform logging to CloudWatch
   readonly AWS_ACCESS_KEY_ID?: string;

internal/api/src/test.ts

@@ -118,6 +118,7 @@ export const serve = async (options?: ServeOptions) => {
     serverVersion: "test",
     ONBOARDING_AGENT_BUNDLE_URL:
       options?.bindings?.ONBOARDING_AGENT_BUNDLE_URL ?? "override-me-in-test",
+    enableSignups: options?.bindings?.enableSignups ?? true,
     ...options?.bindings,
     agentStore: (targetID) => {
       let store = agentStore.get(targetID);

internal/site/app/(public)/login/page.tsx

@@ -4,7 +4,7 @@ import Link from "next/link";
 import { redirect } from "next/navigation";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
-import { getQuerier } from "@/lib/database";
+import { getPublicSignupStatus } from "@/lib/signups";
 import { LoginForm } from "./form";
 
 export const metadata: Metadata = {
@@ -24,9 +24,8 @@ interface LoginPageProps {
 }
 
 export default async function LoginPage({ searchParams }: LoginPageProps) {
-  const db = await getQuerier();
-  const teamOrgs = await db.selectTeamOrganizations();
-  if (teamOrgs.length === 0) {
+  const { isFirstUser, enableSignups } = await getPublicSignupStatus();
+  if (isFirstUser) {
     redirect("/setup");
   }
 
@@ -173,17 +172,19 @@ export default async function LoginPage({ searchParams }: LoginPageProps) {
           </div>
 
           {/* Footer */}
-          <div className="mt-6 text-center">
-            <p className="text-sm text-neutral-600 dark:text-neutral-400">
-              Don't have an account?{" "}
-              <a
-                href={`/signup${redirectQuery}`}
-                className="text-blue-600 dark:text-blue-400 hover:underline font-medium"
-              >
-                Sign up
-              </a>
-            </p>
-          </div>
+          {enableSignups && (
+            <div className="mt-6 text-center">
+              <p className="text-sm text-neutral-600 dark:text-neutral-400">
+                Don't have an account?{" "}
+                <a
+                  href={`/signup${redirectQuery}`}
+                  className="text-blue-600 dark:text-blue-400 hover:underline font-medium"
+                >
+                  Sign up
+                </a>
+              </p>
+            </div>
+          )}
         </div>
 
         {/* Terms */}
@@ -218,6 +219,8 @@ function mapErrorToMessage(
       return "Sign-in is temporarily unavailable. Please try again later.";
     case "Verification":
       return "The verification link is invalid or has expired.";
+    case "signups_disabled":
+      return "Signups are disabled on this instance. Contact your administrator.";
     default:
       return "Sign-in failed. Please try again.";
   }

internal/site/app/(public)/signup/page.tsx

@@ -1,5 +1,5 @@
 import { Button } from "@/components/ui/button";
-import { getQuerier } from "@/lib/database";
+import { getPublicSignupStatus } from "@/lib/signups";
 import type { Metadata } from "next";
 import Link from "next/link";
 import { redirect } from "next/navigation";
@@ -26,11 +26,9 @@ export default async function SignupPage({ searchParams }: SignupPageProps) {
   const redirectQuery = redirectTarget
     ? `?redirect=${encodeURIComponent(redirectTarget)}`
     : "";
+  const loginHref = `/login${redirectQuery}`;
 
-  // Check if this is the first user (no team organizations exist yet)
-  const db = await getQuerier();
-  const teamOrgs = await db.selectTeamOrganizations();
-  const isFirstUser = teamOrgs.length === 0;
+  const { isFirstUser, enableSignups } = await getPublicSignupStatus();
 
   if (isFirstUser) {
     const setupQuery = new URLSearchParams();
@@ -40,6 +38,32 @@ export default async function SignupPage({ searchParams }: SignupPageProps) {
     redirect(`/setup${queryString ? `?${queryString}` : ""}`);
   }
 
+  if (!enableSignups) {
+    return (
+      <div className="flex items-center justify-center p-4">
+        <div className="w-full max-w-md">
+          <div className="text-center mb-8">
+            <h1 className="text-3xl font-bold text-zinc-900 dark:text-white mb-2">
+              Signups are disabled
+            </h1>
+          </div>
+
+          <div className="bg-white dark:bg-zinc-900 rounded-2xl border border-zinc-200 dark:border-zinc-700 shadow-lg p-8 text-center space-y-4">
+            <p className="text-sm text-neutral-600 dark:text-neutral-400">
+              If you already have an account, you can sign in. Otherwise, please
+              contact your administrator.
+            </p>
+            <Link href={loginHref}>
+              <Button size="lg" className="w-full h-12 text-base font-medium">
+                Go to login
+              </Button>
+            </Link>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
   return (
     <div className="flex items-center justify-center p-4">
       <div className="w-full max-w-md">

internal/site/app/(setup)/setup/page.tsx

@@ -1,6 +1,6 @@
-import { getQuerier } from "@/lib/database";
 import type { Metadata } from "next";
 import { redirect } from "next/navigation";
+import { getPublicSignupStatus } from "@/lib/signups";
 
 import { SetupForm } from "./setup-form";
 
@@ -14,12 +14,10 @@ interface SetupPageProps {
 }
 
 export default async function SetupPage({ searchParams }: SetupPageProps) {
-  // Check if this is actually the first user
-  const db = await getQuerier();
-  const teamOrgs = await db.selectTeamOrganizations();
+  const { isFirstUser } = await getPublicSignupStatus();
 
   // If not first user, redirect to normal signup
-  if (teamOrgs.length > 0) {
+  if (!isFirstUser) {
     redirect("/signup");
   }