Documentation
¶
Overview ¶
Package signupgate implements RIVOLT_SIGNUP_DISABLED: an install-wide switch that closes every path that can create a new account on its own (the /signup page and API, access requests, OIDC and Kratos first sign-in). Accounts that already exist, and accounts an admin creates, are unaffected. Default off, so hosted behaviour is unchanged.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Allow ¶
func Allow(ctx context.Context, d *sql.DB, username, email string, emailVerified bool, displayName string) (bool, error)
Allow reports whether a sign-in by (username, email) may proceed while signups are disabled. The rules, in order:
- the account already exists (username is lower-cased and trimmed, the same way db.UserIDFor keys users): allowed;
- RIVOLT_BOOTSTRAP_ADMIN_EMAIL is set: allowed only if the email equals it (trimmed, lower-cased) AND the IdP says the email is verified. An unverified address never matches, and while the variable is set nobody else may create the first account;
- the variable is unset and the users table is empty: allowed. The check and the insert run in one transaction under an advisory lock, so two concurrent first logins can't both pass. The row is the same minimal row db.EnsureUserFull writes; it adds no admin logic (a first-ever row's role comes from the migration 0015 trigger, as before);
- otherwise refused.
func NewCapGuard ¶
func NewCapGuard(d *sql.DB, limit func() int) func(ctx context.Context, username, email string, emailVerified bool) error
NewCapGuard builds oidc.Config.CapGuard. With signups open (the default) it is exactly the guard the server always had: an existing user passes, otherwise the signup_cap flag decides (limit <= 0 blocks, otherwise the user count must be under it). With RIVOLT_SIGNUP_DISABLED an unknown identity must also pass Allow. limit reads the current signup_cap limit.
Types ¶
This section is empty.
Source Files