From cebb84143071568ac40a589b420f418e65fa3174 Mon Sep 17 00:00:00 2001
From: forehalo <forehalo@gmail.com>
Date: Tue, 30 Apr 2024 15:19:30 +0000
Subject: [PATCH] feat(server): add flag to disable new sign ups (#6752)

---
 packages/backend/server/src/config/affine.ts              | 3 +++
 packages/backend/server/src/core/auth/controller.ts       | 8 +++++++-
 packages/backend/server/src/core/auth/resolver.ts         | 4 ++++
 packages/backend/server/src/fundamentals/config/def.ts    | 2 ++
 .../backend/server/src/fundamentals/config/default.ts     | 1 +
 5 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/packages/backend/server/src/config/affine.ts b/packages/backend/server/src/config/affine.ts
index 0dcec63c4..d3b21c8d0 100644
--- a/packages/backend/server/src/config/affine.ts
+++ b/packages/backend/server/src/config/affine.ts
@@ -53,6 +53,9 @@ AFFiNE.port = 3010;
 // AFFiNE.metrics.enabled = true;
 //
 // /* Authentication Settings */
+// /* Whether allow anyone signup */
+// AFFiNE.auth.allowSignup = true;
+//
 // /* User Signup password limitation */
 // AFFiNE.auth.password = {
 //   minLength: 8,
diff --git a/packages/backend/server/src/core/auth/controller.ts b/packages/backend/server/src/core/auth/controller.ts
index 038c79873..26a24da87 100644
--- a/packages/backend/server/src/core/auth/controller.ts
+++ b/packages/backend/server/src/core/auth/controller.ts
@@ -15,6 +15,7 @@ import {
 import type { Request, Response } from 'express';
 
 import {
+  Config,
   PaymentRequiredException,
   Throttle,
   URLHelper,
@@ -43,7 +44,8 @@ export class AuthController {
     private readonly url: URLHelper,
     private readonly auth: AuthService,
     private readonly user: UserService,
-    private readonly token: TokenService
+    private readonly token: TokenService,
+    private readonly config: Config
   ) {}
 
   @Public()
@@ -74,6 +76,10 @@ export class AuthController {
     } else {
       // send email magic link
       const user = await this.user.findUserByEmail(credential.email);
+      if (!user && !this.config.auth.allowSignup) {
+        throw new BadRequestException('You are not allows to sign up.');
+      }
+
       const result = await this.sendSignInEmail(
         { email: credential.email, signUp: !user },
         redirectUri
diff --git a/packages/backend/server/src/core/auth/resolver.ts b/packages/backend/server/src/core/auth/resolver.ts
index baa32a7de..3231a1d08 100644
--- a/packages/backend/server/src/core/auth/resolver.ts
+++ b/packages/backend/server/src/core/auth/resolver.ts
@@ -87,6 +87,10 @@ export class AuthResolver {
     @Args('email') email: string,
     @Args('password') password: string
   ) {
+    if (!this.config.auth.allowSignup) {
+      throw new ForbiddenException('You are not allowed to sign up.');
+    }
+
     validators.assertValidCredential({ email, password });
     const user = await this.auth.signUp(name, email, password);
     await this.auth.setCookie(ctx.req, ctx.res, user);
diff --git a/packages/backend/server/src/fundamentals/config/def.ts b/packages/backend/server/src/fundamentals/config/def.ts
index c93e314d5..e3a28c4be 100644
--- a/packages/backend/server/src/fundamentals/config/def.ts
+++ b/packages/backend/server/src/fundamentals/config/def.ts
@@ -214,6 +214,8 @@ export interface AFFiNEConfig {
    * authentication config
    */
   auth: {
+    allowSignup: boolean;
+
     /**
      * The minimum and maximum length of the password when registering new users
      *
diff --git a/packages/backend/server/src/fundamentals/config/default.ts b/packages/backend/server/src/fundamentals/config/default.ts
index 6b7816265..06cd8880a 100644
--- a/packages/backend/server/src/fundamentals/config/default.ts
+++ b/packages/backend/server/src/fundamentals/config/default.ts
@@ -147,6 +147,7 @@ export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => {
       playground: true,
     },
     auth: {
+      allowSignup: true,
       password: {
         minLength: node.prod ? 8 : 1,
         maxLength: 32,