fix(config-service): make /config/user-system anonymous so INACTIVE users can read inviteOnly#5572
Open
aicam wants to merge 2 commits into
Open
fix(config-service): make /config/user-system anonymous so INACTIVE users can read inviteOnly#5572aicam wants to merge 2 commits into
aicam wants to merge 2 commits into
Conversation
…sers can read inviteOnly A freshly-registered user is INACTIVE until an admin approves them and therefore cannot reach the @RolesAllowed("REGULAR", "ADMIN") config endpoints. The frontend reads the `inviteOnly` flag at exactly that point to decide whether to show the registration-request form (and notify admins). Since apache#5305 moved /config/user-system behind a role check, the flag became unreachable for the very users it targets, so the form never appeared and no admin notification was sent. Restore @permitAll on /config/user-system. It only exposes the boolean inviteOnly flag, which is non-sensitive and already needed pre-activation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
aicam
force-pushed
the
fix/user-system-config-permitall
branch
from
8d3763f to
8e6a1b4
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5572 +/- ##
=========================================
Coverage 52.17% 52.17%
Complexity 2482 2482
=========================================
Files 1068 1068
Lines 41311 41311
Branches 4439 4439
=========================================
Hits 21556 21556
Misses 18490 18490
Partials 1265 1265
*This pull request uses carry forward flags. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
…nfig/user-system The spec pinned /config/user-system as @RolesAllowed (401 without a token). Now that the endpoint is @permitAll, assert it answers anonymous callers with 200 and exposes exactly the inviteOnly flag, while still serving authenticated callers. Mirrors the existing /config/pre-login guard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
|
The PR description is not following the PR template. Please fix the PR description. Also, please create an issue and resolve that issue in this PR. Since it is related to user experience, please include screenshots of BEFORE & AFTER. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A freshly-registered user is
INACTIVEuntil an admin approves them, so they cannot reach the@RolesAllowed("REGULAR", "ADMIN")config endpoints. The frontend reads theinviteOnlyflag at exactly that point (right after registration) to decide whether to show the registration-request form — which collects the user's affiliation/reason and triggers the admin notification email.#5305 moved
/config/user-systemfrom@PermitAllto@RolesAllowed("REGULAR", "ADMIN"). As a result, an INACTIVE user's request forinviteOnlyreturns 403, the flag is left undefined on the frontend, and:So in invite-only deployments, new sign-ups are silently dropped.
Fix
Restore
@PermitAllon/config/user-system. The endpoint only exposes the booleaninviteOnlyflag, which is non-sensitive and is specifically needed before activation.Testing
Verified on an invite-only deployment: a fresh registration now receives
inviteOnly: truewhile INACTIVE, the registration-request form appears, and the admin notification email is sent.🤖 Generated with Claude Code