mirror of
https://github.com/element-hq/matrix-authentication-service.git
synced 2026-10-13 15:37:30 +00:00
Quentin Gliech
815cc9c1e5
The registration form only ever used the invite code to attach it to the registration: an invalid or revoked code was silently ignored, and the username and email address a code was issued for were only enforced by the `readOnly` attribute on the client side. Resolve the code up front instead, so that: - an unknown, revoked, expired or exhausted code is rejected with an error on the field, and re-rendering the form keeps the code - a code which imposes a username or an email address only lets that identity register - a `passwordless` code skips the password entirely, and requires an email address to verify even when the server otherwise does not The code is also consumed whenever one was used, not only when the server requires one.