feat(auth): ALLOW_SELF_REGISTER toggle + public /auth/config endpoint (0.42.0)

Lets operators run a closed-membership deployment by setting
ALLOW_SELF_REGISTER=false (default true, so existing deploys are
unaffected). When off, POST /auth/register returns 403 forbidden. The
rate-limit token is consumed BEFORE the disabled check so the timing
doesn't distinguish enabled-but-rejected from disabled — closes the
toggle-state probe channel.

New public GET /auth/config returns { self_register_enabled: bool }
so the frontend can render its register affordances correctly
without conflating "disabled" with "rate-limited" (which a probe
attempt would).

Frontend: a lightweight reactive `authConfig` store loads the flag
once on root-layout mount (and again on /register direct navigation,
which bypasses the layout's onMount). Header hides the Register link
when the toggle is off; /register renders a "self-registration is
disabled — ask an administrator" notice instead of the form.

Admin-create endpoint that pairs with this toggle is intentionally
not in this PR — it lands as the next branch (feat/admin-user-create).
The toggle alone is independently useful for deployments that want
to lock down enrollment without yet wiring an admin UI.

This commit is contained in:

MechaCat02

2026-05-31 13:56:18 +02:00

parent 6dd21451a8

commit 2f47faa11c

12 changed files with 182 additions and 5 deletions

									
										2

backend/Cargo.toml
									
												View File
												
				@@ -1,6 +1,6 @@

				[package]

				name = "mangalord"

				version = "0.41.2"

				version = "0.42.0"

				edition = "2021"

				default-run = "mangalord"

feat(auth): ALLOW_SELF_REGISTER toggle + public /auth/config endpoint (0.42.0)

2 backend/Cargo.toml Unescape Escape View File

2

backend/Cargo.toml

View File