Disable user creation while in beta (#222)

backend/bracket/config.py

@@ -3,7 +3,7 @@ import os
 from enum import auto
 
 import sentry_sdk
-from pydantic import BaseSettings, PostgresDsn
+from pydantic import BaseSettings, Field, PostgresDsn
 
 from bracket.utils.types import EnumAutoStr
 
@@ -34,39 +34,34 @@ class Environment(EnumAutoStr):
 class Config(BaseSettings):
     pg_dsn: PostgresDsn = 'postgresql://user:pass@localhost:5432/db'  # type: ignore[assignment]
     jwt_secret: str
-    cors_origins: str = ''
-    cors_origin_regex: str = ''
-    admin_email: str | None = None
-    admin_password: str | None = None
-    sentry_dsn: str | None = None
-    allow_insecure_http_sso: bool = False
-    base_url: str = 'http://localhost:8400'
+    cors_origins: str = Field(default='')
+    cors_origin_regex: str = Field(default='')
+    admin_email: str | None = Field(default=None)
+    admin_password: str | None = Field(default=None)
+    sentry_dsn: str | None = Field(default=None)
+    allow_insecure_http_sso: bool = Field(default=False)
+    base_url: str = Field(default='http://localhost:8400')
+    allow_user_registration: bool = Field(default=True)
 
 
 class CIConfig(Config):
-    allow_insecure_http_sso = False
-
     class Config:
         env_file = 'ci.env'
 
 
 class DevelopmentConfig(Config):
-    allow_insecure_http_sso = True
+    allow_insecure_http_sso: bool = Field(default=True)
 
     class Config:
         env_file = 'dev.env'
 
 
 class ProductionConfig(Config):
-    allow_insecure_http_sso = False
-
     class Config:
         env_file = 'prod.env'
 
 
 class DemoConfig(Config):
-    allow_insecure_http_sso = False
-
     class Config:
         env_file = 'demo.env'
 

backend/bracket/routes/users.py

@@ -2,6 +2,7 @@ from fastapi import APIRouter, Depends, HTTPException
 from heliclockter import datetime_utc, timedelta
 from starlette import status
 
+from bracket.config import config
 from bracket.models.db.user import (
     User,
     UserPasswordToUpdate,
@@ -68,6 +69,9 @@ async def patch_user_password(
 
 @router.post("/users/register", response_model=TokenResponse)
 async def register_user(user_to_register: UserToRegister) -> TokenResponse:
+    if not config.allow_user_registration:
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED, 'Account creation is unavailable for now')
+
     user = User(
         email=user_to_register.email,
         password_hash=pwd_context.hash(user_to_register.password),

docs/docs/getting-started/configuration.md

@@ -10,6 +10,9 @@ Copy `ci.env` to `prod.env` and fill in the values:
 - `CORS_ORIGINS` and `CORS_ORIGIN_REGEX`: Specify allowed frontend domain names for CORS (see the [FastAPI docs](https://fastapi.tiangolo.com/tutorial/cors/))
 - `ADMIN_EMAIL` and `ADMIN_PASSWORD`: The credentials of the admin user, which is created when initializing the database
 - `SENTRY_DSN`: The [Sentry](https://sentry.io) DSN  for monitoring and error tracking
+- `BASE_URL`: The base url of the API used for SSO
+- `ALLOW_USER_REGISTRATION`: Can be used to disallow user registration in the web app, currently used for production while bracket is still in beta
+- `ALLOW_INSECURE_HTTP_SSO`: Should not be used in production. Allows use of INSECURE requests for SSO auth.
 
 ## Example configuration file
 This is an example of how the config file should look like:
@@ -21,4 +24,6 @@ CORS_ORIGIN_REGEX='https://.*\.vercel\.app'
 ADMIN_EMAIL='admin@example.com'
 ADMIN_PASSWORD='some unused password'
 SENTRY_DSN='my sentry dsn'
+ALLOW_USER_REGISTRATION=false
+ALLOW_INSECURE_HTTP_SSO=false
 ```

frontend/src/pages/create_account.tsx

@@ -1,4 +1,5 @@
 import {
+  Alert,
   Anchor,
   Box,
   Button,
@@ -11,7 +12,7 @@ import {
   createStyles,
 } from '@mantine/core';
 import { useForm } from '@mantine/form';
-import { IconArrowLeft } from '@tabler/icons-react';
+import { IconAlertCircle, IconArrowLeft } from '@tabler/icons-react';
 import { useRouter } from 'next/router';
 import React from 'react';
 
@@ -72,6 +73,15 @@ export default function CreateAccount() {
         Create a new account
       </Title>
       <Paper withBorder shadow="md" p={30} radius="md" mt="xl">
+        <Alert
+          icon={<IconAlertCircle size={16} />}
+          mb={16}
+          title="Unavailable"
+          color="red"
+          radius="lg"
+        >
+          Account creation is disabled on this domain for now since bracket is still in beta phase
+        </Alert>
         <form
           onSubmit={form.onSubmit(async (values) => {
             await registerAndRedirect(values);