From 3f57a9c8c730d61b41b3b3daafca8e0404869f5c Mon Sep 17 00:00:00 2001 From: defaultdino Date: Wed, 13 May 2026 13:17:51 +0200 Subject: [PATCH] resolve comments related to deprecation and transitioning --- crates/cli/src/util.rs | 9 +++++ crates/config/src/sections/account.rs | 34 +++++++++++-------- crates/data-model/src/site_config.rs | 4 +++ crates/handlers/src/admin/v1/site_config.rs | 11 +++++- .../src/views/register/steps/finish.rs | 16 ++------- ..._providers_registration_token_required.sql | 5 +++ 6 files changed, 50 insertions(+), 29 deletions(-) diff --git a/crates/cli/src/util.rs b/crates/cli/src/util.rs index 6d3d0ba52..fd8f358d1 100644 --- a/crates/cli/src/util.rs +++ b/crates/cli/src/util.rs @@ -212,6 +212,14 @@ pub fn site_config_from_config( user_session_inactivity_ttl: c.expire_user_sessions.then_some(c.ttl), }); + if account_config.registration_token_required { + tracing::warn!( + "`account.registration_token_required` is deprecated. use \ + `account.password_registration_token_required` and per-provider \ + `registration_token_required` instead" + ) + } + Ok(SiteConfig { access_token_ttl: experimental_config.access_token_ttl, compat_token_ttl: experimental_config.compat_token_ttl, @@ -224,6 +232,7 @@ pub fn site_config_from_config( && account_config.password_registration_enabled, password_registration_email_required: account_config.password_registration_email_required, password_registration_token_required: account_config.password_registration_token_required, + registration_token_required: account_config.registration_token_required, email_change_allowed: account_config.email_change_allowed, displayname_change_allowed: account_config.displayname_change_allowed, password_change_allowed: password_config.enabled() diff --git a/crates/config/src/sections/account.rs b/crates/config/src/sections/account.rs index a861e713d..dae74c583 100644 --- a/crates/config/src/sections/account.rs +++ b/crates/config/src/sections/account.rs @@ -68,7 +68,16 @@ pub struct AccountConfig { /// This has no effect if password login is disabled. #[serde(default = "default_false", skip_serializing_if = "is_default_false")] pub password_recovery_enabled: bool, - + + /// Whether registration tokens are required for password registrations. + /// Defaults to `false`. + /// + /// When enabled, users must provide a valid registration token during + /// password registration. This has no effect if password registration + /// is disabled. + #[serde(default = "default_false", skip_serializing_if = "is_default_false")] + pub password_registration_token_required: bool, + /// Whether users are allowed to delete their own account. Defaults to /// `true`. #[serde(default = "default_true", skip_serializing_if = "is_default_true")] @@ -80,18 +89,11 @@ pub struct AccountConfig { #[serde(default = "default_false", skip_serializing_if = "is_default_false")] pub login_with_email_allowed: bool, - /// Whether registration tokens are required for password registrations. - /// Defaults to `false`. - /// - /// When enabled, users must provide a valid registration token during - /// password registration. This has no effect if password registration - /// is disabled. - #[serde( - default = "default_false", - skip_serializing_if = "is_default_false", - alias = "registration_token_required" - )] - pub password_registration_token_required: bool, + /// Whether registration tokens are required for password registrations + /// This is deprecated in favor of `password_registration_token_required` + #[serde(default = "default_false", skip_serializing_if = "is_default_false")] + pub registration_token_required: bool, + } impl Default for AccountConfig { @@ -103,9 +105,10 @@ impl Default for AccountConfig { password_registration_email_required: default_true(), password_change_allowed: default_true(), password_recovery_enabled: default_false(), + password_registration_token_required: default_false(), + registration_token_required: default_false(), account_deactivation_allowed: default_true(), login_with_email_allowed: default_false(), - password_registration_token_required: default_false(), } } } @@ -118,9 +121,10 @@ impl AccountConfig { && is_default_true(&self.displayname_change_allowed) && is_default_true(&self.password_change_allowed) && is_default_false(&self.password_recovery_enabled) + && is_default_false(&self.password_registration_token_required) + && is_default_false(&self.registration_token_required) && is_default_true(&self.account_deactivation_allowed) && is_default_false(&self.login_with_email_allowed) - && is_default_false(&self.password_registration_token_required) } } diff --git a/crates/data-model/src/site_config.rs b/crates/data-model/src/site_config.rs index 7adb683ed..ab4e85c51 100644 --- a/crates/data-model/src/site_config.rs +++ b/crates/data-model/src/site_config.rs @@ -79,6 +79,10 @@ pub struct SiteConfig { /// Whether registration tokens are required for password registrations. pub password_registration_token_required: bool, + /// Whether registration tokens are required globally for password registrations + /// Deprecated in favor of `password_registration_token_required` + pub registration_token_required: bool, + /// Whether users can change their email. pub email_change_allowed: bool, diff --git a/crates/handlers/src/admin/v1/site_config.rs b/crates/handlers/src/admin/v1/site_config.rs index 17e95e5c5..51766116d 100644 --- a/crates/handlers/src/admin/v1/site_config.rs +++ b/crates/handlers/src/admin/v1/site_config.rs @@ -25,9 +25,14 @@ pub struct SiteConfig { /// Whether a valid email address is required for password registrations. pub password_registration_email_required: bool, - /// Whether registration tokens are required for password registrations. pub password_registration_token_required: bool, + /// Whether registration tokens are required for password registrations. + /// Deprecated in favor of `password_registration_token_required` + #[deprecated = "use `password_registration_token_required` instead"] + #[allow(deprecated)] + pub registration_token_required: bool, + /// Whether users can change their email. pub email_change_allowed: bool, @@ -52,6 +57,7 @@ pub struct SiteConfig { pub minimum_password_complexity: u8, } +#[allow(deprecated)] pub fn doc(operation: TransformOperation) -> TransformOperation { operation .id("siteConfig") @@ -64,6 +70,7 @@ pub fn doc(operation: TransformOperation) -> TransformOperation { password_registration_enabled: true, password_registration_email_required: true, password_registration_token_required: true, + registration_token_required: true, email_change_allowed: true, displayname_change_allowed: true, password_change_allowed: true, @@ -76,6 +83,7 @@ pub fn doc(operation: TransformOperation) -> TransformOperation { } #[tracing::instrument(name = "handler.admin.v1.site_config", skip_all)] +#[allow(deprecated)] pub async fn handler( _: CallContext, State(site_config): State, @@ -86,6 +94,7 @@ pub async fn handler( password_registration_enabled: site_config.password_registration_enabled, password_registration_email_required: site_config.password_registration_email_required, password_registration_token_required: site_config.password_registration_token_required, + registration_token_required: site_config.password_registration_token_required, email_change_allowed: site_config.email_change_allowed, displayname_change_allowed: site_config.displayname_change_allowed, password_change_allowed: site_config.password_change_allowed, diff --git a/crates/handlers/src/views/register/steps/finish.rs b/crates/handlers/src/views/register/steps/finish.rs index 697891a49..792ad478e 100644 --- a/crates/handlers/src/views/register/steps/finish.rs +++ b/crates/handlers/src/views/register/steps/finish.rs @@ -120,17 +120,7 @@ pub(crate) async fn get( ))); } - let token_required = if registration - .upstream_oauth_authorization_session_id - .is_some() - { - // load provider to let OAuth registrations check its - // per provider `registration_token_required` flag - let session_id = registration - .upstream_oauth_authorization_session_id - .context("Missing upstream OAuth session ID") - .map_err(InternalError::from_anyhow)?; - + let token_required = if let Some(session_id) = registration.upstream_oauth_authorization_session_id { let session = repo .upstream_oauth_session() .lookup(session_id) @@ -145,9 +135,9 @@ pub(crate) async fn get( .context("Could not load the upstream OAuth provider") .map_err(InternalError::from_anyhow)?; - provider.registration_token_required + provider.registration_token_required || site_config.registration_token_required } else { - site_config.password_registration_token_required + site_config.password_registration_token_required || site_config.registration_token_required }; let registration_token = if token_required { diff --git a/crates/storage-pg/migrations/20260403144138_upstream_oauth2_providers_registration_token_required.sql b/crates/storage-pg/migrations/20260403144138_upstream_oauth2_providers_registration_token_required.sql index d1c35003b..7570b5c7d 100644 --- a/crates/storage-pg/migrations/20260403144138_upstream_oauth2_providers_registration_token_required.sql +++ b/crates/storage-pg/migrations/20260403144138_upstream_oauth2_providers_registration_token_required.sql @@ -1,3 +1,8 @@ +-- Copyright 2026 Element Creations Ltd. +-- +-- SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial +-- Please see LICENSE files in the repository root for full details. + -- Adds a `registration_token_required` column to the UpstreamOauthProvider table ALTER TABLE upstream_oauth_providers