Disabling registration not actually working?

[jrucker2004]

I'm using docker compose, and have included the environment variable GRAMPSWEB_REGISTRATION_DISABLED: True
All of the other environment variables are working fine, but this one doesn't seem to be doing anything. The registration button and page still show up on the login page.

I'm not seeing any errors in any of the logs. Is this functionality that was working, and is no longer working, or am I doing something wrong?

[MLuc24]

The setting is working — it just doesn't hide the button. Try actually submitting the registration form and you should get a 405.

The backend enforces it in gramps-web-api, api/resources/user.py:

def _is_disabled(self, tree: Optional[str]) -> bool:
    """Check if the registration is disabled."""
    if current_app.config["REGISTRATION_DISABLED"]:
        return True

if self._is_disabled(tree=args.get("tree")):
    abort_with_message(405, "Registration is disabled")

so GRAMPSWEB_REGISTRATION_DISABLED is doing its job. No accounts can be created.

The reason the UI doesn't reflect it is that the frontend has no way to find out. The only place the server advertises its configuration is the server block of the metadata endpoint, and registration isn't in it:

"server": {
    "multi_tree": is_multi_tree,
    "task_queue": has_task_queue,
    "ocr": has_ocr,
    "ocr_languages": ocr_languages,
    "semantic_search": has_semantic_search,
    "chat": has_chat,
},

And even if it were listed there, that endpoint needs authentication — the login page is exactly where you don't have a token yet, so it couldn't consult it anyway.

So this is a real gap, just a cosmetic one rather than a security one: the door is locked, the sign on it still says "come in". Worth filing against the API rather than the frontend, since hiding the button needs the flag exposed somewhere reachable before login before the frontend can act on it.

[jrucker2004]

Thanks for the clarification!

It might be a good idea to update the documentation.

Googling how to disable registration sent me to the frontend customization page: https://www.grampsweb.org/install_setup/frontend-config/
It mentions a setting that actually hides the registration link on the login page. Since I'm using docker compose, I looked for a flag that would do the same thing from the compose file, and found the environment variable I mentioned above on the server configuration page. It's pretty easy to see how someone would assume it did the same thing.

[MLuc24]

That's a fair assumption to have made, and checking it out — there are two settings, each doing exactly one half of the job, and neither doing both.

The frontend one is what that page describes, and it really is only cosmetic (src/components/GrampsjsLogin.js):

${window.grampsjsConfig.hideRegisterLink
  ? ''
  : html`
      <md-outlined-button
        @click="${() => this._handleNav('register')}"
      >
        ${this._('Register new account')}

so hideRegisterLink: true removes the button and nothing else — the API endpoint stays open. And GRAMPSWEB_REGISTRATION_DISABLED is the reverse: the endpoint refuses with a 405 while the button stays visible.

For what you actually want, set both:

environment:
  GRAMPSWEB_REGISTRATION_DISABLED: "True"

window.grampsjsConfig = {
  hideRegisterLink: true
}

Order of importance is the env var — that's the one enforcing anything. hideRegisterLink just stops people finding a door that's already locked.

Your docs point stands, and it's sharper than "update the documentation": the two settings live on two different pages, are named as if they're unrelated, and each page reads as if its setting is the answer. A cross-reference on both — "this hides the link but does not disable registration; see the server config for that", and the inverse — would have saved you the whole investigation. Worth filing against the docs repo, and this thread is most of the writeup already.

[jrucker2004]

Thanks for digging into that. I'll file an issue in the docs repo.
I'd also argue that from a user perspective, doing one and not the other doesn't make much sense. There should be a simple way to toggle both with a single setting change. I'll file a feature request issue in this repo for that as well.

[jrucker2004]

gramps-project/gramps-web-docs#85
#1341