From 1d843af3cdbe4aa81b9f47adf2ae94e02b8e6d4b Mon Sep 17 00:00:00 2001
From: Adrian Winterstein <adrian@winterstein.biz>
Date: Sat, 28 Sep 2024 16:23:04 +0200
Subject: [PATCH] Configurable registration only by invite.

---
 config.json.example               |  1 +
 website/server/libs/auth/index.js | 10 +++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/config.json.example b/config.json.example
index d81f1b9ad9..3057a663fa 100644
--- a/config.json.example
+++ b/config.json.example
@@ -28,6 +28,7 @@
   "GOOGLE_CLIENT_SECRET": "aaaabbbbccccddddeeeeffff00001111",
   "IAP_GOOGLE_KEYDIR": "/path/to/google/public/key/dir/",
   "IGNORE_REDIRECT": "true",
+  "INVITE_ONLY": "true",
   "ITUNES_SHARED_SECRET": "aaaabbbbccccddddeeeeffff00001111",
   "LOGGLY_CLIENT_TOKEN": "token",
   "LOGGLY_SUBDOMAIN": "example-subdomain",
diff --git a/website/server/libs/auth/index.js b/website/server/libs/auth/index.js
index 76d37c1a47..5582d7bb21 100644
--- a/website/server/libs/auth/index.js
+++ b/website/server/libs/auth/index.js
@@ -18,7 +18,9 @@ import {
 } from './social';
 import { loginRes } from './utils';
 import { verifyUsername } from '../user/validation';
+import nconf from 'nconf';
 
+const INVITE_ONLY = nconf.get('INVITE_ONLY') === 'true';
 const USERNAME_LENGTH_MIN = 1;
 const USERNAME_LENGTH_MAX = 20;
 
@@ -60,7 +62,9 @@ async function _handleGroupInvitation (user, invite) {
     }
   } catch (err) {
     logger.error(err);
+    return false;
   }
+  return true;
 }
 
 function hasLocalAuth (user) {
@@ -191,7 +195,11 @@ async function registerLocal (req, res, { isV3 = false }) {
 
   // we check for partyInvite for backward compatibility
   if (req.query.groupInvite || req.query.partyInvite) {
-    await _handleGroupInvitation(newUser, req.query.groupInvite || req.query.partyInvite);
+    const success = await _handleGroupInvitation(newUser, req.query.groupInvite || req.query.partyInvite);
+    if (INVITE_ONLY && !success)
+      throw new NotAuthorized(res.t('inviteOnly'));
+  } else if (INVITE_ONLY) {
+    throw new NotAuthorized(res.t('inviteOnly'));
   }
 
   const savedUser = await newUser.save();