Hey! @maxdorninger, could you please take a look on the other one ;) ?
Closes#145 ; seems like a must have thing
- Add `auth.registration_enabled` flag (default `false` — sounds safer
default in current setup)
- Password registration: `/auth/register` route will return 403 if
disabled
- OIDC registration: `UserManager.oauth_callback` is overridden to
reject user without match; so no auto-provision
- `/auth/metadata` exposes the flag to the frontend
- Frontend: signup link hidden on the login card; direct navigation to
`/login/signup` redirects to `/login` via a `+page.ts` load guard
<img width="463" height="461" alt="Screenshot 2026-05-16 at 20 52 11"
src="https://github.com/user-attachments/assets/1def5142-e930-4aa6-8771-cbff54250c1f"
/>
<img width="450" height="391" alt="Screenshot 2026-05-16 at 20 52 22"
src="https://github.com/user-attachments/assets/b4013964-cace-4aeb-a848-48ced86fcc5f"
/>
Also this means uses need to be created somehow -- so..
- Add POST `/users` - admin-protected endpoint to create a new users
(created user can be used with OIDC)
- Fronted: Add new user button and modal dialog
<img width="800" height="379" alt="Screenshot 2026-05-17 at 11 32 06"
src="https://github.com/user-attachments/assets/048e6c43-a1c1-42ce-a19c-fd9d916a47d9"
/>
<img width="537" height="439" alt="Screenshot 2026-05-17 at 11 32 12"
src="https://github.com/user-attachments/assets/3f83c2c1-027b-4279-b6a1-bbc8da77efed"
/>
---
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Add config toggle to enable/disable user registration; when disabled
sign-up endpoints return 403 and OIDC won’t auto-create unknown users.
Added admin API to create users.
* **Frontend**
* Login UI hides signup link when registration is disabled; signup page
redirects to login. Admin users list gains “Add User” modal to create
users.
* **Documentation**
* Authentication docs and config examples updated to document the new
option.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/maxdorninger/MediaManager/pull/543?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
this mostly either removes unused parameters, prefixes them with an
underscore or uses the @override decorator to tell the linter, that that
method comes from a superclass and can't be changed
this mostly adds a timeout=60 to all requests
this does mainly wants a timeout to all requests functions, since when
left out they hang infinitly.
I added a timeout of 60s, which is probably way too high, but since
before this there was none, I guess it's an improvement?
