Enable password self-registration; keep SSO off #80

New Issue

2026-10-20T04:36:18-07:00

westfarn commented

2026-10-20 04:36:18 -07:00

Password self-registration is off (ENABLE_ACCOUNT_REGISTRATION defaults to false). The web sign-up page already posts /user/create/ and then starts Stripe Checkout when needs_checkout is true.

Stripe path reviewed and covered by tests:

Checkout creates a subscription session (Founders, $10/month, or STRIPE_PRICE_ID) and a draft invoice.
checkout.session.completed and invoice.paid verify the webhook signature, then grant the Founders plan.
Cancel and portal paths exist. Local tests for checkout, webhooks, portal, and user create passed.

Live /api/public/settings/ currently returns enable_account_registration: false with oauth.google and oauth.microsoft already true (Drive client credentials). Turning on the registration flag alone would also show Google and Microsoft sign-up.

Do this:

Enable password self-registration by default.
Keep browser SSO off. OAuth client ids may stay set for Drive linking. Public settings must not advertise Google or Microsoft until a separate SSO flag is on, and login/signup OAuth intents must stay rejected.

Out of scope: single sign-on, native store billing.

Note: if chat_backend_prod.env / chat_backend_beta.env on the control node still set ENABLE_ACCOUNT_REGISTRATION=false, that override wins until the secret is updated.

Password self-registration is off (`ENABLE_ACCOUNT_REGISTRATION` defaults to false). The web sign-up page already posts `/user/create/` and then starts Stripe Checkout when `needs_checkout` is true. Stripe path reviewed and covered by tests: - Checkout creates a subscription session (Founders, $10/month, or `STRIPE_PRICE_ID`) and a draft invoice. - `checkout.session.completed` and `invoice.paid` verify the webhook signature, then grant the Founders plan. - Cancel and portal paths exist. Local tests for checkout, webhooks, portal, and user create passed. Live `/api/public/settings/` currently returns `enable_account_registration: false` with `oauth.google` and `oauth.microsoft` already true (Drive client credentials). Turning on the registration flag alone would also show Google and Microsoft sign-up. Do this: - Enable password self-registration by default. - Keep browser SSO off. OAuth client ids may stay set for Drive linking. Public settings must not advertise Google or Microsoft until a separate SSO flag is on, and login/signup OAuth intents must stay rejected. Out of scope: single sign-on, native store billing. Note: if `chat_backend_prod.env` / `chat_backend_beta.env` on the control node still set `ENABLE_ACCOUNT_REGISTRATION=false`, that override wins until the secret is updated.

westfarn referenced a pull request that will close this issue

2026-10-20 04:40:08 -07:00

Enable password self-registration and keep SSO off #81

westfarn closed this issue

2026-10-20 04:44:48 -07:00

westfarn referenced this issue from a commit

2026-10-20 04:44:48 -07:00

Enable password self-registration and keep SSO off (#81)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ai_ml_operations/chat_backend#80