From 4c699b86ef6ef62741777d91573bda8fa81daa0b Mon Sep 17 00:00:00 2001
From: Daniel <danitex@danvics.com>
Date: Tue, 15 Sep 2026 03:18:57 +0200
Subject: [PATCH] feat: local registration is closed for good, and its on/off
 switch is gone

Every account comes through One Sign In; an administrator sends an
invitation link from there. The register route answers 410, the
registration-status route and the admin toggle are removed, and the
setting no longer exists in defaults, lockdown lists or seeds.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fZGJNyDvERbMgS2Uc2msP
---
 e2e/seed.js                    |  4 +-
 e2e/tests/auth-screen.spec.js  | 11 ----
 public/components/admin.html   | 10 ----
 public/js/admin.js             | 35 +------------
 public/js/auth.js              | 11 +---
 public/js/authFetch.js         |  2 +-
 src/db/database.js             |  2 -
 src/routes/admin.js            | 21 +-------
 src/routes/adminConfig.js      |  3 +-
 src/routes/auth.js             | 94 ++--------------------------------
 src/utils/adminLockdown.js     |  1 -
 src/utils/openapiRoutes.js     |  9 +---
 test/backend-hardening.test.js |  2 +-
 test/openapi.test.js           |  6 +--
 test/policy-flows.test.js      | 11 ++--
 15 files changed, 21 insertions(+), 201 deletions(-)

diff --git a/e2e/seed.js b/e2e/seed.js
index 9361ceab..ecd32f4a 100644
--- a/e2e/seed.js
+++ b/e2e/seed.js
@@ -69,9 +69,7 @@ var SETTINGS = {
   'models.disabled': '[]',
   'stt.model': 'e2e-stt',
   'tts.model': 'e2e-tts',
-  'tts.voice': 'e2e-voice',
-  // Registration open, so the auth-screen spec can see the register link.
-  'registration_enabled': 'true'
+  'tts.voice': 'e2e-voice'
 };
 
 async function seedSettings() {
diff --git a/e2e/tests/auth-screen.spec.js b/e2e/tests/auth-screen.spec.js
index dc395082..18b7fa0e 100644
--- a/e2e/tests/auth-screen.spec.js
+++ b/e2e/tests/auth-screen.spec.js
@@ -41,17 +41,6 @@ test.describe('Unauthenticated auth screen', () => {
     await expect(page.locator('#btn-local-login')).toBeVisible();
   });
 
-  test('the register link follows the registration setting', async ({ page }) => {
-    // Hidden by default and shown only when registration is enabled, which the
-    // seed turns on. No invitation field: invitations are the SSO's.
-    await page.goto(E2E_BASE + '/');
-    await page.waitForSelector('#auth-screen', { timeout: 10000 });
-    await expect(page.locator('#show-register')).toBeVisible();
-    await expect(page.locator('#register-form')).toHaveCount(1);
-    await page.click('#show-register');
-    await expect(page.locator('#reg-invite')).toHaveCount(0);
-  });
-
   test('register form DOM is wired correctly if manually unhidden', async ({ page }) => {
     await page.goto(E2E_BASE + '/');
     await page.waitForSelector('#auth-screen', { timeout: 10000 });
diff --git a/public/components/admin.html b/public/components/admin.html
index d87360e6..6f55f744 100644
--- a/public/components/admin.html
+++ b/public/components/admin.html
@@ -22,16 +22,6 @@
         <!-- Registration. Accounts are made at the SSO (sso.pedshub.com) from an
              invitation link; the switch below only governs the local password
              form, which is refused anyway while sign-in is SSO-only. -->
-        <details class="card" open>
-          <summary class="card-header"><h3><i class="fas fa-door-open"></i> Registration</h3></summary>
-          <div class="admin-card-body" style="gap:14px;">
-            <div style="display:flex;align-items:center;gap:16px;flex-wrap:wrap;">
-              <span id="reg-status-text" style="font-size:13px;color:var(--g600);">Loading...</span>
-              <button id="btn-toggle-reg" class="btn-sm btn-primary" type="button">Toggle</button>
-            </div>
-
-          </div>
-        </details>
 
         <!-- Users. The search and refresh sit in a toolbar under the heading
              rather than inside it: a control inside <summary> toggles the card
diff --git a/public/js/admin.js b/public/js/admin.js
index 79eeaaae..b42f4175 100644
--- a/public/js/admin.js
+++ b/public/js/admin.js
@@ -55,10 +55,6 @@ function adminTabActive() {
     if (e.target.closest('#btn-refresh-users')) {
       loadUsers();
     }
-    // Toggle registration
-    if (e.target.closest('#btn-toggle-reg')) {
-      toggleRegistration();
-    }
   });
 
   function loadAdmin() {
@@ -84,39 +80,10 @@ function adminTabActive() {
         el = document.getElementById('stat-api-today');
         if (el) el.textContent = stats.todayApiCalls !== undefined ? stats.todayApiCalls : '—';
 
-        updateRegStatus(settings.registrationEnabled !== false);
       })
       .catch(function(err) { console.error('[Admin] Settings load failed:', err); });
   }
 
-  function updateRegStatus(enabled) {
-    var text = document.getElementById('reg-status-text');
-    var btn = document.getElementById('btn-toggle-reg');
-    if (text) {
-      text.innerHTML = 'Registration is currently <strong style="color:' + (enabled ? 'var(--green)' : 'var(--red)') + '">' + (enabled ? '✅ Enabled' : '❌ Disabled') + '</strong>';
-    }
-    if (btn) btn.textContent = enabled ? 'Disable Registration' : 'Enable Registration';
-    window._adminRegEnabled = enabled;
-  }
-
-  function toggleRegistration() {
-    var newVal = !window._adminRegEnabled;
-    fetch('/api/admin/settings/registration', {
-      method: 'POST',
-      headers: getAuthHeaders(),
-      body: JSON.stringify({ enabled: newVal })
-    })
-    .then(function(r) { return r.json(); })
-    .then(function(data) {
-      if (data.success) {
-        updateRegStatus(newVal);
-        showToast('Registration ' + (newVal ? 'enabled' : 'disabled'), 'success');
-      } else {
-        showToast(data.error || 'Failed', 'error');
-      }
-    })
-    .catch(function() { showToast('Request failed', 'error'); });
-  }
 
   // ---- USERS ----
 
@@ -1919,7 +1886,7 @@ initImageSettings();
   // the buttons that only read.
   function lockdownFields(panel, state) {
     var editable = ['cms-ann', 'announcement',
-      'admin-users-search', 'registration'];
+      'admin-users-search'];
     panel.querySelectorAll('input, select, textarea, button').forEach(function(el) {
       var id = el.id || '';
       if (editable.some(function(prefix) { return id.indexOf(prefix) === 0; })) return;
diff --git a/public/js/auth.js b/public/js/auth.js
index 836f4c87..59c80a61 100644
--- a/public/js/auth.js
+++ b/public/js/auth.js
@@ -1231,16 +1231,7 @@ document.addEventListener('DOMContentLoaded', function() {
     document.body.appendChild(modal);
   }
 
-  // Check registration status — link is hidden by default, shown only when enabled
-  fetch('/api/auth/registration-status')
-    .then(function(r) { return r.json(); })
-    .then(function(data) {
-      if (data.registrationEnabled) {
-        var link = document.getElementById('show-register');
-        if (link) link.style.display = '';
-      }
-    })
-    .catch(function() {});
+  // The register link stays hidden: accounts are created through One Sign In.
 
   console.log('[Auth] ✅ Module ready');
 });
diff --git a/public/js/authFetch.js b/public/js/authFetch.js
index fed89498..b4f2482a 100644
--- a/public/js/authFetch.js
+++ b/public/js/authFetch.js
@@ -11,7 +11,7 @@ if (!window.__fetchAuthIntercepted) {
     '/api/auth/login', '/api/auth/register', '/api/auth/logout',
     '/api/auth/forgot-password', '/api/auth/reset-password',
     '/api/auth/verify-email', '/api/auth/resend-verification',
-    '/api/auth/oidc', '/api/auth/oidc-status', '/api/auth/registration-status'
+    '/api/auth/oidc', '/api/auth/oidc-status'
   ]);
   boundary.logoutRequest = function(headers) {
     return rawFetch('/api/auth/logout', {
diff --git a/src/db/database.js b/src/db/database.js
index 261d2e09..5dbb9a47 100644
--- a/src/db/database.js
+++ b/src/db/database.js
@@ -325,8 +325,6 @@ async function initDatabase() {
 
     // Seed all default config values (ON CONFLICT DO NOTHING — never overwrites admin changes)
     var defaults = [
-      // Core
-      ['registration_enabled', 'true'],
       // Announcements
       ['announcement.enabled', 'false'],
       ['announcement.text',    ''],
diff --git a/src/routes/admin.js b/src/routes/admin.js
index c96b74c6..3814f78f 100644
--- a/src/routes/admin.js
+++ b/src/routes/admin.js
@@ -174,37 +174,18 @@ router.post('/users/:id/reset-password', require('../utils/policy').requireLocal
   } catch (err) { res.status(500).json({ error: 'Request failed' }); }
 });
 
-// ============================================================
-// TOGGLE REGISTRATION
-// ============================================================
-router.post('/settings/registration', async function(req, res) {
-  try {
-    var { enabled } = req.body;
-    var value = enabled ? 'true' : 'false';
-
-    await db.setSetting('registration_enabled', value);
-
-    logger.audit(req.user.id, 'admin_toggle_registration', 'Registration ' + (enabled ? 'enabled' : 'disabled'), req, { category: 'admin' });
-
-    res.json({ success: true, registrationEnabled: enabled, message: 'Registration ' + (enabled ? 'enabled' : 'disabled') });
-  } catch (err) { res.status(500).json({ error: 'Request failed' }); }
-});
-
 // ============================================================
 // GET APP SETTINGS
 // ============================================================
 router.get('/settings', async function(req, res) {
   try {
-    var regEnabled = await db.getSetting('registration_enabled');
     var userCount = await db.get('SELECT COUNT(*) as count FROM users', []);
     var apiCount = await db.get('SELECT COUNT(*) as count FROM api_log', []);
     var todayApiCount = await db.get("SELECT COUNT(*) as count FROM api_log WHERE timestamp > NOW() - INTERVAL '1 day'", []);
 
     res.json({
       success: true,
-      settings: {
-        registrationEnabled: regEnabled !== 'false'
-      },
+      settings: {},
       stats: {
         totalUsers: userCount ? parseInt(userCount.count) : 0,
         totalApiCalls: apiCount ? parseInt(apiCount.count) : 0,
diff --git a/src/routes/adminConfig.js b/src/routes/adminConfig.js
index e6e60236..eaf1a952 100644
--- a/src/routes/adminConfig.js
+++ b/src/routes/adminConfig.js
@@ -246,7 +246,6 @@ router.post('/config/prompts/:key/restore', function(req, res) {
 router.post('/config/reset-defaults', async function(req, res) {
   try {
     var defaults = [
-      ['registration_enabled', 'true'],
       ['announcement.enabled', 'false'],
       ['announcement.text',    ''],
       ['announcement.type',    'info'],
@@ -973,7 +972,7 @@ router.put('/config/:key(*)', async function(req, res) {
     }
 
     // Security: only allow known key prefixes
-    var allowed = ['announcement.', 'feature.', 'email.', 'prompt.', 'registration_enabled', 'site.', 'smtp.', 'models.', 'tts.', 'stt.', 'clinical_assistant.', 'my_resources.', 'nextcloud.'];
+    var allowed = ['announcement.', 'feature.', 'email.', 'prompt.', 'site.', 'smtp.', 'models.', 'tts.', 'stt.', 'clinical_assistant.', 'my_resources.', 'nextcloud.'];
     var isAllowed = allowed.some(function(p) { return key === p || key.startsWith(p); });
     if (!isAllowed) {
       return res.status(400).json({ error: 'Unknown config key' });
diff --git a/src/routes/auth.js b/src/routes/auth.js
index 57e773b9..bd9c02ac 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -173,89 +173,11 @@ async function sendEmail(to, subject, html) {
 }
 
 // ============================================================
-// REGISTER (checks if registration is enabled)
+// REGISTER — closed. Every account is created through One Sign In
+// (authentik); an administrator sends an invitation link from there.
 // ============================================================
-router.post('/register', requireLocalAuth, async (req, res) => {
-  try {
-    var regEnabled = await db.getSetting('registration_enabled');
-    if (regEnabled === 'false') {
-      return res.status(403).json({ error: 'Registration is currently disabled. Contact an administrator.' });
-    }
-
-    var { email, password, name, turnstileToken } = req.body;
-    if (!email || !password || !name) return res.status(400).json({ error: 'All fields required' });
-
-    if (password.length < 8) return res.status(400).json({ error: 'Password must be 8+ characters' });
-
-    // Cloudflare Turnstile verification
-    if (process.env.TURNSTILE_SECRET_KEY) {
-      if (!turnstileToken) return res.status(400).json({ error: 'Please complete the verification challenge' });
-      var turnstileRes = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ secret: process.env.TURNSTILE_SECRET_KEY, response: turnstileToken, remoteip: req.ip })
-      });
-      var turnstileData = await turnstileRes.json();
-      if (!turnstileData.success) {
-        console.error('[Auth] Turnstile verification failed:', turnstileData['error-codes']);
-        return res.status(400).json({ error: 'Bot verification failed. Please try again.' });
-      }
-    }
-
-    var existing = await db.get('SELECT id FROM users WHERE email = ?', [email.toLowerCase()]);
-    if (existing) return res.status(400).json({ error: 'Email already registered' });
-
-    var hash = await passwords.hash(password);
-    var verifyToken = crypto.randomBytes(32).toString('hex');
-    var verifyExpires = Date.now() + 24 * 60 * 60 * 1000;
-
-    var userCount = await db.get('SELECT COUNT(*) as count FROM users', []);
-    var role = (userCount && parseInt(userCount.count) === 0) ? 'admin' : 'user';
-
-    var result = await db.run(
-      'INSERT INTO users (email, password, name, role, verify_token, verify_expires, email_verified) VALUES (?, ?, ?, ?, ?, ?, false)',
-      [email.toLowerCase(), hash, name, role, verifyToken, verifyExpires]
-    );
-
-    var userId = result.lastInsertRowid;
-
-    var verifyUrl = safeAppUrl() + '/api/auth/verify-email?token=' + verifyToken;
-    var verifySubject = await db.getSetting('email.verify.subject') || 'Verify your Pediatric AI Scribe account';
-    var verifyBody    = await db.getSetting('email.verify.body')    || 'Great to have you on Pediatric AI Scribe. Please verify your email address by clicking the button below.';
-
-    await sendEmail(email, verifySubject, emailWrapper(
-      `<p style="margin:0 0 8px;font-size:20px;font-weight:600;">Welcome aboard, ${escHtml(name)}!</p>
-       <p style="color:#4b5563;margin:12px 0 20px;line-height:1.6;font-size:14px;">${escHtml(verifyBody).replace(/\n/g, '<br>')}</p>
-       ${btnHtml(verifyUrl, 'Verify My Email')}
-       ${linkFallback(verifyUrl)}
-       <p style="color:#9ca3af;font-size:11px;margin:16px 0 0;">This link expires in 24 hours.</p>`
-    ));
-
-    await db.run('INSERT INTO audit_log (user_id, action, ip_address, details) VALUES (?, ?, ?, ?)',
-      [userId, 'register', req.ip, role === 'admin' ? 'First user — auto admin' : 'standard user']);
-    logger.audit(userId, 'register', role === 'admin' ? 'First user — auto admin' : 'standard user', req, { category: 'auth' });
-    notifyNewRegistration(email, name);
-
-    var smtpHost = await db.getSetting('smtp.host').catch(function() { return null; }) || process.env.SMTP_HOST;
-    if (!smtpHost) {
-      await db.run('UPDATE users SET email_verified = true, verify_token = NULL WHERE id = ?', [userId]);
-      var token = signAuthToken(userId, req);
-      var regSessionId = generateSessionId();
-      await db.run('INSERT INTO user_sessions (id, user_id, token_hash, ip_address, user_agent, device_label) VALUES (?, ?, ?, ?, ?, ?)',
-        [regSessionId, userId, hashToken(token), req.ip, req.headers['user-agent'] || '', parseUserAgent(req.headers['user-agent'])]);
-      setAuthCookie(res, token);
-      return res.json({
-        success: true, token: token, sessionId: regSessionId,
-        user: { id: userId, email: email.toLowerCase(), name: name, role: role, email_verified: true },
-        message: role === 'admin' ? 'Account created as ADMIN (first user). Auto-verified.' : 'Account created (auto-verified).'
-      });
-    }
-
-    res.json({ success: true, needsVerification: true, message: 'Check your email for verification link.' + (role === 'admin' ? ' You are the first user and have admin privileges.' : '') });
-  } catch (err) {
-    console.error('[Auth] Register error:', err.message);
-    res.status(500).json({ error: 'Registration failed. Please try again.' });
-  }
+router.post('/register', function(req, res) {
+  res.status(410).json({ error: 'Accounts are created through One Sign In. Ask an administrator for an invitation link.' });
 });
 
 // ============================================================
@@ -701,14 +623,6 @@ router.get('/me', authMiddleware, async (req, res) => {
   } catch (err) { console.error('[Auth] Me error:', err.message); res.status(500).json({ error: 'Failed to load user' }); }
 });
 
-// Check if registration is enabled (public endpoint)
-router.get('/registration-status', async (req, res) => {
-  try {
-    var enabled = await db.getSetting('registration_enabled');
-    res.json({ registrationEnabled: enabled !== 'false' && !await isSSOOnly() });
-  } catch (err) { res.json({ registrationEnabled: false }); }
-});
-
 // Expose helpers for adminConfig test-email and email template loading
 module.exports = router;
 module.exports.__sendEmail    = sendEmail;
diff --git a/src/utils/adminLockdown.js b/src/utils/adminLockdown.js
index ba5d4bcd..f4ed6a56 100644
--- a/src/utils/adminLockdown.js
+++ b/src/utils/adminLockdown.js
@@ -28,7 +28,6 @@ var LOCKED_PREFIXES = Object.freeze([
 // Day-to-day operation stays with ordinary admins.
 var EDITABLE_WHEN_LOCKED = Object.freeze([
   'announcement.',
-  'registration_enabled',
   'feature.',
   'site.'
 ]);
diff --git a/src/utils/openapiRoutes.js b/src/utils/openapiRoutes.js
index 74fc9b6d..2a981b0a 100644
--- a/src/utils/openapiRoutes.js
+++ b/src/utils/openapiRoutes.js
@@ -56,13 +56,8 @@ var operations = {
     public: true
   },
   'POST /api/auth/register': {
-    summary: 'Create a local password account',
-    description: 'Refused while sign-in is SSO-only; accounts are then created at the SSO from an invitation link.',
-    public: true
-  },
-  'GET /api/auth/registration-status': {
-    summary: 'Whether local registration is open',
-    description: 'Read by the sign-in screen to decide whether to offer the register link.',
+    summary: 'Closed',
+    description: 'Always 410. Accounts are created through One Sign In from an invitation link an administrator sends.',
     public: true
   },
   'POST /api/auth/logout': { summary: 'End this session' },
diff --git a/test/backend-hardening.test.js b/test/backend-hardening.test.js
index 21f4b73a..7441e471 100644
--- a/test/backend-hardening.test.js
+++ b/test/backend-hardening.test.js
@@ -166,7 +166,7 @@ test('admin lockdown refuses configuration writes at the server', () => {
     'tts.voice', 'stt.model', 'smtp.host', 'email.verify.subject']) {
     assert.equal(lockdown.isLocked(key, on), true, key + ' is locked');
   }
-  for (const key of ['announcement.text', 'registration_enabled', 'feature.memories', 'site.name']) {
+  for (const key of ['announcement.text', 'feature.memories', 'site.name']) {
     assert.equal(lockdown.isLocked(key, on), false, key + ' stays editable');
   }
 
diff --git a/test/openapi.test.js b/test/openapi.test.js
index dd729381..e4632004 100644
--- a/test/openapi.test.js
+++ b/test/openapi.test.js
@@ -106,10 +106,10 @@ test('metadata is keyed exactly as routes are mounted', () => {
 
 test('a public operation says so, and is the only kind that does', () => {
   // Guessing this from middleware gets it wrong in the direction that hides a
-  // hole, so it is stated per route. Registration status must be public — the
-  // sign-in screen reads it before anyone has a session.
+  // hole, so it is stated per route. Sign-in must be public — the sign-in
+  // screen calls it before anyone has a session.
   const meta = require('../src/utils/openapiRoutes');
-  assert.equal(meta.operations['GET /api/auth/registration-status'].public, true);
+  assert.equal(meta.operations['POST /api/auth/login'].public, true);
   assert.equal(meta.operations['GET /api/health'].public, true);
   assert.equal(meta.operations['POST /api/auth/logout'].public, undefined);
 });
diff --git a/test/policy-flows.test.js b/test/policy-flows.test.js
index 31fe2cf3..c8f7e49f 100644
--- a/test/policy-flows.test.js
+++ b/test/policy-flows.test.js
@@ -244,13 +244,12 @@ test('OIDC refuses unsafe linking, disabled/mismatched identities, and session f
 test('active SSO-only policy denies local login/registration/credential creation, but disabled OIDC cannot lock out local auth', async t => {
   const f = fixture(); const request = await f.serve(t, true);
   f.state.settings['oidc.disable_local_auth'] = 'true';
-  for (const route of ['/api/auth/login', '/api/auth/register', '/api/auth/forgot-password', '/api/auth/reset-password', '/api/auth/change-password', '/api/auth/setup-2fa', '/api/auth/verify-2fa', '/api/auth/2fa/backup-codes', '/api/admin/users/7/reset-password']) {
+  for (const route of ['/api/auth/login', '/api/auth/forgot-password', '/api/auth/reset-password', '/api/auth/change-password', '/api/auth/setup-2fa', '/api/auth/verify-2fa', '/api/auth/2fa/backup-codes', '/api/admin/users/7/reset-password']) {
     const response = await request(route, { method: 'POST', body: {}, authenticated: true });
     assert.equal(response.status, 403, route); assert.equal(response.data.code, 'sso_only'); assert.equal(authCookies(response).length, 0);
   }
   assert.equal(f.state.writes.length, 0);
   assert.equal((await request('/api/auth/oidc-status')).data.disableLocalAuth, true);
-  assert.equal((await request('/api/auth/registration-status')).data.registrationEnabled, false);
   assert.equal((await request('/api/auth/me', { authenticated: true })).data.user.canLocalAuth, false);
   f.state.settings['oidc.enabled'] = 'false';
   assert.equal((await request('/api/auth/oidc-status')).data.disableLocalAuth, false);
@@ -261,14 +260,14 @@ test('active SSO-only policy denies local login/registration/credential creation
   assert.equal(unavailable.status, 503); assert.equal(authCookies(unavailable).length, 0);
 });
 
-test('local login and auto-verified registration never issue success/cookie on session insert failure', async t => {
+test('local login never issues success/cookie on session insert failure, and registration is closed', async t => {
   const f = fixture(); const request = await f.serve(t); f.state.sessionError = true;
   const login = await request('/api/auth/login', { method: 'POST', body: { email: f.state.user.email, password: 'synthetic-password' } });
   assert.equal(login.status, 500); assert.equal(authCookies(login).length, 0); assert.equal(login.data.success, undefined);
-  f.state.user = null;
+  assert.equal(f.state.writes.filter(w => w.sql.includes('INSERT INTO user_sessions')).length, 1);
+  // Local registration is closed for good: it answers 410 before touching anything.
   const registration = await request('/api/auth/register', { method: 'POST', body: { email: 'new@example.test', password: 'synthetic-password', name: 'Synthetic' } });
-  assert.equal(registration.status, 500); assert.equal(authCookies(registration).length, 0); assert.equal(registration.data.success, undefined);
-  assert.equal(f.state.writes.filter(w => w.sql.includes('INSERT INTO user_sessions')).length, 2);
+  assert.equal(registration.status, 410); assert.equal(authCookies(registration).length, 0);
 });
 
 test('final model allowlist is enforced for streaming/nonstream, invalid settings/outage, defaults and fallback', async () => {