hanna/fabrica

feat(web): optional self-registration with a disable toggle

be214ee · hanna committed on 2026-07-25

Add instance.allow_registration (off by default). When enabled, /register
offers a sign-up form that creates the account directly and signs in;
Sign-up links appear on the login page and in the drawer. When disabled, the
routes 404. (Captcha is deferred: it needs an outbound HTTP verifier and
loads external JS on the page, which conflicts with the no-network-requests
principle — a documented opt-in for later.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

assets/base.css +5 −0

crates/config/src/types.rs +5 −0

crates/web/src/layout.rs +5 −0

crates/web/src/lib.rs +4 −0

crates/web/src/pages.rs +163 −3

crates/web/src/tests.rs +61 −0

fabrica.example.toml +1 −0

   justify-content: center;
   margin-top: 1.25rem;
+}
+.auth-alt {
+  margin: 1rem 0 0;
+  text-align: center;
+  font-size: 0.9em;
+}
 /* ---- Flash / notices ---- */
 .notice {

@@ -106,6 +106,10 @@ pub struct Instance {
106	/// Default visibility for newly created repositories.	106	/// Default visibility for newly created repositories.
107	#[serde(default)]	107	#[serde(default)]
108	pub default_visibility: DefaultVisibility,	108	pub default_visibility: DefaultVisibility,
		109	/// Allow web self-registration (sign-up). Off by default; admin invites work
		110	/// regardless.
		111	#[serde(default)]
		112	pub allow_registration: bool,
109	}	113	}
110		114
111	impl Default for Instance {	115	impl Default for Instance {
@@ -117,6 +121,7 @@ impl Default for Instance {
117	default_branch: "main".to_string(),	121	default_branch: "main".to_string(),
118	allow_anonymous: true,	122	allow_anonymous: true,
119	default_visibility: DefaultVisibility::Private,	123	default_visibility: DefaultVisibility::Private,
		124	allow_registration: false,
120	}	125	}
121	}	126	}
122	}	127	}

@@ -29,6 +29,8 @@ pub struct Chrome {
29	pub themes: Vec<ThemeInfo>,	29	pub themes: Vec<ThemeInfo>,
30	/// Whether the theme picker is shown.	30	/// Whether the theme picker is shown.
31	pub allow_theme_choice: bool,	31	pub allow_theme_choice: bool,
		32	/// Whether web self-registration is enabled (drives the Sign-up links).
		33	pub allow_registration: bool,
32	/// The current request path, for the theme form's return and nav highlighting.	34	/// The current request path, for the theme form's return and nav highlighting.
33	pub path: String,	35	pub path: String,
34	/// The CSRF token for this session, injected into htmx and forms.	36	/// The CSRF token for this session, injected into htmx and forms.
@@ -113,6 +115,9 @@ fn drawer(chrome: &Chrome) -> Markup {
113	}	115	}
114	} @else {	116	} @else {
115	a href="/login" { (icon(Icon::User)) span { "Sign in" } }	117	a href="/login" { (icon(Icon::User)) span { "Sign in" } }
		118	@if chrome.allow_registration {
		119	a href="/register" { (icon(Icon::Plus)) span { "Sign up" } }
		120	}
116	}	121	}
117	}	122	}
118	}	123	}

         .route("/explore", get(pages::explore))
         .route("/explore/users", get(pages::explore_users))
         .route("/login", get(pages::login_form).post(pages::login_submit))
+        .route(
+            "/register",
+            get(pages::register_form).post(pages::register_submit),
+        )
         .route("/logout", post(pages::logout))
         .route(
             "/invite/{token}",

     assert!(html.contains("API tokens"), "tokens section");
+}
+/// An app with self-registration enabled (and no seeded user).
+async fn app_with_registration() -> Router {
+    let store = Store::connect("sqlite::memory:", 1).await.unwrap();
+    store.migrate().await.unwrap();
+    let mut config = Config::default();
+    config.instance.name = "Forge".to_string();
+    config.instance.allow_registration = true;
+    config.auth.cookie_secure = false;
+    let state = AppState::build(Arc::new(config), store, "test-secret".to_string()).unwrap();
+    crate::build_router(state)
+}
+#[tokio::test]
+async fn registration_is_404_when_disabled() {
+    let (_state, app) = app().await;
+    let res = app.oneshot(get("/register")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::NOT_FOUND);
+}
+#[tokio::test]
+async fn registration_creates_an_account_and_signs_in() {
+    let app = app_with_registration().await;
+    let form = app.clone().oneshot(get("/register")).await.unwrap();
+    assert_eq!(form.status(), StatusCode::OK);
+    let cookie = form
+        .headers()
+        .get(header::SET_COOKIE)
+        .unwrap()
+        .to_str()
+        .unwrap()
+        .to_string();
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    assert!(body_string(form).await.contains("Create account"));
+    let req = Request::builder()
+        .method("POST")
+        .uri("/register")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, format!("fabrica_csrf={token}"))
+        .body(Body::from(format!(
+            "username=newbie&email=new@example.com&password=secret12&confirm=secret12&_csrf={token}"
+        )))
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::SEE_OTHER, "redirect on success");
+    let set = res
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .filter_map(|v| v.to_str().ok())
+        .collect::<Vec<_>>()
+        .join("\n");
+    assert!(set.contains("fabrica_session="), "signed in: {set:?}");
+}
 #[tokio::test]
 async fn settings_requires_authentication() {
     let (_state, app) = app().await;

         active_scheme: scheme,
         themes,
         allow_theme_choice: state.config.ui.allow_theme_choice,
+        allow_registration: state.config.instance.allow_registration,
         path,
         csrf,
     };
         return Redirect::to("/").into_response();
+    }
     let (jar, chrome) = build_chrome(&state, jar, None, uri.path().to_string());
-    let body = login_body(&chrome.csrf, None);
+    let body = login_body(&chrome.csrf, None, chrome.allow_registration);
     (jar, page(&chrome, "Sign in", body)).into_response()
+}
 /// Render the login form with an optional error notice.
-fn login_body(csrf: &str, error: Option<&str>) -> Markup {
+fn login_body(csrf: &str, error: Option<&str>, allow_registration: bool) -> Markup {
     html! {
         div class="auth-wrap" {
             div class="auth-card" {
                           autocomplete="current-password" required;
                     button class="btn btn-primary" type="submit" { "Sign in" }
+                }
+                @if allow_registration {
+                    p class="muted auth-alt" { "New here? " a href="/register" { "Create an account" } }
+                }
+            }
+        }
+    }
     let Some(user) = user.filter(|_| ok) else {
         // Re-render the form with a generic error (no username enumeration).
         let (jar, chrome) = build_chrome(&state, jar, None, "/login".to_string());
-        let body = login_body(&chrome.csrf, Some("Incorrect username or password."));
+        let body = login_body(
+            &chrome.csrf,
+            Some("Incorrect username or password."),
+            chrome.allow_registration,
+        );
         return (
             axum::http::StatusCode::UNAUTHORIZED,
             jar,
     Ok(jar.clone().add(cookie))
+}
+/// Sign-up form fields.
+#[derive(Debug, Deserialize)]
+pub struct RegisterForm {
+    /// Desired username.
+    #[serde(default)]
+    username: String,
+    /// Email address.
+    #[serde(default)]
+    email: String,
+    /// Password.
+    #[serde(default)]
+    password: String,
+    /// Confirmation.
+    #[serde(default)]
+    confirm: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `GET /register` — the sign-up form, or `404` when registration is disabled.
+pub async fn register_form(
+    State(state): State<AppState>,
+    MaybeUser(user): MaybeUser,
+    jar: CookieJar,
+    uri: Uri,
+) -> Response {
+    if !state.config.instance.allow_registration {
+        return AppError::NotFound.into_response();
+    }
+    if user.is_some() {
+        return Redirect::to("/").into_response();
+    }
+    let (jar, chrome) = build_chrome(&state, jar, None, uri.path().to_string());
+    let body = register_body(&chrome.csrf, None, "", "");
+    (jar, page(&chrome, "Sign up", body)).into_response()
+}
+/// Render the sign-up form with an optional error and prefilled fields.
+fn register_body(csrf: &str, error: Option<&str>, username: &str, email: &str) -> Markup {
+    html! {
+        div class="auth-wrap" {
+            div class="auth-card" {
+                h1 { "Sign up" }
+                @if let Some(err) = error {
+                    div class="notice notice-error" { (err) }
+                }
+                form method="post" action="/register" {
+                    input type="hidden" name="_csrf" value=(csrf);
+                    label for="username" { "Username" }
+                    input type="text" id="username" name="username" value=(username)
+                          autocomplete="username" required;
+                    label for="email" { "Email" }
+                    input type="email" id="email" name="email" value=(email)
+                          autocomplete="email" required;
+                    label for="password" { "Password" }
+                    input type="password" id="password" name="password"
+                          autocomplete="new-password" required minlength="8";
+                    label for="confirm" { "Confirm password" }
+                    input type="password" id="confirm" name="confirm"
+                          autocomplete="new-password" required;
+                    button class="btn btn-primary" type="submit" { "Create account" }
+                }
+                p class="muted auth-alt" { "Already have an account? " a href="/login" { "Sign in" } }
+            }
+        }
+    }
+}
+/// `POST /register` — create an account and sign in.
+pub async fn register_submit(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<RegisterForm>,
+) -> Response {
+    if !state.config.instance.allow_registration {
+        return AppError::NotFound.into_response();
+    }
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let username = form.username.trim().to_string();
+    let email = form.email.trim().to_string();
+    let reject = |msg: &str, username: &str, email: &str| {
+        let (jar, chrome) = build_chrome(&state, jar.clone(), None, "/register".to_string());
+        let body = register_body(&chrome.csrf, Some(msg), username, email);
+        (
+            axum::http::StatusCode::BAD_REQUEST,
+            jar,
+            page(&chrome, "Sign up", body),
+        )
+            .into_response()
+    };
+    if !email.contains('@') {
+        return reject("Enter a valid email address.", &username, &email);
+    }
+    if form.password != form.confirm {
+        return reject("Passwords do not match.", &username, &email);
+    }
+    if form.password.len() < 8 {
+        return reject("Password must be at least 8 characters.", &username, &email);
+    }
+    let params = auth::HashParams {
+        m_cost: state.config.auth.argon2_m_cost,
+        t_cost: state.config.auth.argon2_t_cost,
+        p_cost: state.config.auth.argon2_p_cost,
+    };
+    let Ok(hash) = auth::hash_password(&form.password, params) else {
+        return AppError::internal("password hashing failed").into_response();
+    };
+    let created = state
+        .store
+        .create_user(store::NewUser {
+            username: username.clone(),
+            email: email.clone(),
+            display_name: None,
+            password_hash: Some(hash),
+            is_admin: false,
+            must_change_password: false,
+        })
+        .await;
+    let user = match created {
+        Ok(u) => u,
+        Err(store::StoreError::Conflict { field, .. }) => {
+            let msg = if field == "email" {
+                "That email is already in use."
+            } else {
+                "That username is already taken."
+            };
+            return reject(msg, &username, &email);
+        }
+        Err(store::StoreError::Name(_)) => {
+            return reject(
+                "Invalid username: use letters, digits, '-', and '_'.",
+                &username,
+                &email,
+            );
+        }
+        Err(err) => return AppError::from(err).into_response(),
+    };
+    match open_session(&state, &jar, &user, &headers).await {
+        Ok(jar) => (jar, Redirect::to("/")).into_response(),
+        Err(err) => err.into_response(),
+    }
+}
 /// Logout form field.
 #[derive(Debug, Deserialize)]
 pub struct CsrfForm {

 default_branch  = "main"                    # default branch for new repositories
 allow_anonymous = true                      # anonymous browse + clone of public repos
 default_visibility = "private"              # new repos: public | internal | private
+allow_registration = false                  # allow web self-registration (sign-up)
 [server]
 address                = "0.0.0.0"