fix(auth): stop offering account creation when registration is disabled by waleedlatif1 · Pull Request #6484 · simstudioai/sim

waleedlatif1 · 2026-08-10T03:09:19Z

Summary

Fixes #6473. DISABLE_REGISTRATION blocks /signup server-side, but every surface kept routing people there — an invited user clicked "Create an account" and landed on an unstyled dead end. The flag also never covered OAuth account creation.

Invite page offers only "Sign in" when the flag is set, and says why
Same gate on the login form and SSO form signup cross-links
CLI pairing (/cli/auth) bounced every signed-out visitor to /signup, so CLI login was broken for existing users on a registration-disabled instance — now goes to /login
/signup renders a proper auth-shell page that carries the callback over to login, instead of a bare <div>
Security: social OAuth still created accounts under the flag. applyRegistrationGate stamps disableSignUp + disableIdTokenSignIn on every social provider — both are needed, since Better Auth's redirect callback reads provider.options.disableSignUp while the id-token branch of /sign-in/social reads a top-level provider.disableSignUp it never hoists from config
/oauth-error explains a blocked signup instead of "please try again", which could never succeed
Extracted resolveAuthRedirect so the signup form and the disabled page can't drift on which redirect param wins
Docs: the callout under the table claimed these controls don't apply to social sign-in, which this change makes false

Breaking changes

Only when DISABLE_REGISTRATION=true; no behavior change otherwise (the gate returns the provider map by reference when off):

Social OAuth signup is blocked for new identities. Existing users signing in with Google/GitHub/Microsoft are unaffected — the gate only rejects when no account matches the verified identity
CLI pairing sends signed-out visitors to /login rather than /signup
Signup cross-links are hidden on the login and SSO pages

SSO is deliberately exempt: it runs on /sign-in/sso against admin-configured, domain-verified providers, which is its own allowlist.

Type of Change

Bug fix

Testing

bun run type-check, bun run lint:check, check:api-validation, and check:client-boundary all clean. Full suite green (1144 files / 15479 tests). New tests: 5 for the registration gate, 2 for the CLI redirect, 5 for resolveAuthRedirect/buildAuthCrossLink, 3 for the invite branch, 2 for the SSO cross-link — each verified to fail when the fix is reverted. Not exercised against a live registration-disabled deployment.

Not covered

~20 hardcoded /signup CTAs on landing pages — self-hosted prod redirects / → /login, so they're unreachable where the flag matters, and they now terminate on the explanatory page
The five non-English copies of the env-var table still carry the older, narrower wording
Inviting an address with no account is still allowed from team settings; the invitee is told they need an existing account

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

DISABLE_REGISTRATION blocks /signup server-side, but the invite flow, the login form, the SSO form, and the CLI handoff all kept routing people there, stranding invited users on a dead end. The flag also never covered OAuth account creation, so social sign-in still minted accounts for unknown identities.

vercel · 2026-08-10T03:09:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 10, 2026 3:14am

cursor · 2026-08-10T03:09:30Z

PR Summary

High Risk
Changes authentication and account-creation behavior when DISABLE_REGISTRATION=true, including OAuth provider gating and multiple auth entry redirects; incorrect gating could lock out legitimate signups or leave social signup open.

Overview
DISABLE_REGISTRATION now blocks new social OAuth accounts and the product stops steering people to /signup when the flag is on.

Auth backend: applyRegistrationGate stamps disableSignUp and disableIdTokenSignIn on Google/GitHub/Microsoft configs so first-time social sign-in cannot mint users (existing identities can still sign in). SSO stays outside this gate.

Auth surfaces: Login and SSO hide the signup cross-link; /signup shows a proper account creation disabled page that forwards callbackUrl / invite flow to login; invite flows offer sign in only with matching copy; CLI pairing redirects signed-out users to login instead of signup; /oauth-error explains signup_disabled instead of “try again.”

Shared redirect logic: resolveAuthRedirect and extended buildAuthCrossLink keep invite/login/signup/CLI links consistent (redirect vs callbackUrl, invite_flow, optional new=true).

Docs: English self-hosting docs clarify that DISABLE_REGISTRATION covers all signup paths (including social) while domain/email MX rules remain email-only.

^{Reviewed by Cursor Bugbot for commit 23bec77. Configure here.}

greptile-apps · 2026-08-10T03:11:59Z

Greptile Summary

The PR consistently applies DISABLE_REGISTRATION across authentication navigation and social OAuth account creation while preserving sign-in paths for existing users.

Hides or replaces signup links on login, SSO, invitation, and CLI authentication surfaces.
Adds a registration-disabled signup page that preserves validated post-auth destinations.
Gates social providers against new-account creation and improves blocked-signup messaging and documentation.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/auth/constants.ts	Adds a centralized social-provider registration gate that preserves provider configuration while disabling both supported new-account entrances.
apps/sim/lib/auth/auth.ts	Applies the registration gate to all configured first-party social providers while deliberately leaving allowlisted SSO behavior unchanged.
apps/sim/app/(auth)/auth-redirect.ts	Centralizes redirect precedence, invitation inference, and auth cross-link generation without introducing a distinct redirect outcome.
apps/sim/app/(auth)/signup/page.tsx	Replaces the bare disabled-registration response with an auth-shell flow that validates and preserves the callback to login.
apps/sim/app/invite/[id]/invite.tsx	Derives signed-out invitation actions from the registration flag and preserves invitation callbacks through shared link generation.
apps/sim/app/cli/auth/page.tsx	Routes signed-out CLI pairing through login when account creation is unavailable while retaining the pairing callback.
apps/sim/ee/sso/components/sso-form.tsx	Removes the dead signup cross-link under disabled registration without changing the configured SSO sign-in path.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Visitor[Signed-out visitor] --> Flag{DISABLE_REGISTRATION}
  Flag -->|false| Signup[Signup page]
  Flag -->|true| Login[Login path]
  Signup --> ExistingOrNew[Existing or new account flow]
  Login --> Existing[Existing accounts only]
  Social[Social OAuth] --> SocialGate{Registration disabled?}
  SocialGate -->|No| SocialAccount[Sign in or create account]
  SocialGate -->|Yes, known identity| Existing
  SocialGate -->|Yes, unknown identity| Blocked[Blocked-signup explanation]
  Invite[Invitation or CLI callback] --> Flag
  Login --> Callback[Return to validated callback]

_{Reviews (2): Last reviewed commit: "fix(auth): stop offering account creatio..." | Re-trigger Greptile}

waleedlatif1 · 2026-08-10T03:13:17Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 23bec77. Configure here.}

waleedlatif1 · 2026-08-10T03:34:21Z

@greptile

greptile-apps Bot reviewed Aug 10, 2026

View reviewed changes

Comment thread apps/sim/app/(auth)/signup/signup-form.tsx

vercel Bot deployed to Preview August 10, 2026 03:14 View deployment

cursor Bot reviewed Aug 10, 2026

View reviewed changes

Navigation Menu

Uh oh!

fix(auth): stop offering account creation when registration is disabled - #6484

fix(auth): stop offering account creation when registration is disabled#6484
waleedlatif1 wants to merge 1 commit into
stagingfrom
worktree-invite-disable-registration

waleedlatif1 commented Aug 10, 2026

Uh oh!

vercel Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Aug 10, 2026 •

edited

Loading

Important Files Changed

Flowchart

Uh oh!

Uh oh!

waleedlatif1 commented Aug 10, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

waleedlatif1 commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

waleedlatif1 commented Aug 10, 2026

Summary

Breaking changes

Type of Change

Testing

Not covered

Checklist

Uh oh!

vercel Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

waleedlatif1 commented Aug 10, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Aug 10, 2026 •

edited

Loading

cursor Bot commented Aug 10, 2026 •

edited

Loading

greptile-apps Bot commented Aug 10, 2026 •

edited

Loading