fix: open registration by default and handle slug collision gracefully

This commit is contained in:
DmitrL-dev 2026-03-27 18:13:17 +10:00
parent 5ddfa74771
commit 9abdd86540

View file

@ -23,7 +23,7 @@ type EmailSendFunc func(toEmail, userName, code string) error
func HandleRegister(userStore *UserStore, tenantStore *TenantStore, jwtSecret []byte, emailFn EmailSendFunc) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
// SEC-M4: Server-side registration gate
if os.Getenv("SOC_REGISTRATION_OPEN") != "true" {
if os.Getenv("SOC_REGISTRATION_OPEN") == "false" {
http.Error(w, `{"error":"registration is closed — contact admin for an invitation"}`, http.StatusForbidden)
return
}